Rockwell Trusted TMR Processor

Pin signal function

2 Fault Relay (NC): When the system is healthy, the relay is excited, and when there is a fault, it is released

4 Fault Relays (COM)

6 Fault Relay (NO)

8, 10 serial port 1 (RS485)

12,14 serial port 2 (RS422/485 TX/RX)

16,18,20,22 serial port 3 (RS422/485)

24,26 24V PSU low voltage warning, fault shutdown

To use IRIG-B and serial port, the processor interface adapter T8120 must be installed (for the T8111 model, a special adapter is not required in some cases, please refer to the manual for details). T811B requires a T812X adapter.

3.3 Fault/Safety Relay Wiring

Fault and Fail relays are both in normal excitation mode. When the system is healthy, the relay coil is energized, NO is closed, and NC is disconnected. Once a fault occurs, the relay loses power and the contact state flips.

Fault relay: When the system detects a recoverable fault (such as a single FCR fault or channel inconsistency), it will activate and the front panel system health LED will flash red.

Fail relay: When two out of three processors are declared faulty and the system is about to shut down, it will activate and the system cannot continue to operate safely.

It should be noted that in the Active/Standby configuration, the Standby processor drives the relay output, so even if the Active module fails, the relay status seen by the external monitoring circuit will not change due to switching.

Key points of system configuration

The Trusted TMR processor does not require hardware jumpers, and all configurations are completed through the System. INI file and Toolset (IEC 61131-3 programming environment). The following are the parameters that most affect system behavior and security functions.

4.1 Channel inconsistency time (discrepancy_val)

For TMR input/output modules, when the difference in readings between the three channels exceeds the set time, the system will report a channel inconsistency fault. The default value is 2000 ms. This value should be greater than the maximum normal establishment time of the on-site signal, but less than half of the process safety time. Format:

text

Discrepancy_val=2000 (unit: ms)

Similar parameters include:

Dualdiscrapancy_val - Used for Dual I/O modules

Ana_iscrepancy_val - Analog input, in units of 512 counts/volt, default 40 → approximately 78 mV

Do-discrepuval - Inconsistent threshold for digital output channels

4.2 IRIG-B time synchronization configuration

Check the "Inter Range Instrumentation Group" area in the Toolset system configuration, select the mode (B002 or B122), and enable LED monitoring (User2 LED flashing once per second indicates receiving a valid IRIG signal).

Common fault: IRIG source outputs TTL level instead of RS422 level, which can cause the module to fail to decode. After the correct settings, the time will automatically synchronize after the module is started. If the system health LED flashes red and "48 IRIG: Maximum update interval exceeded" appears in the MP log, you can enter the diagnostic port to perform IRIG S to check the status or IRIG I to view register details.

Definition of Status Register Bit:

Bit1: IRIG-B002 input exists

Bit2: IRIG-B122 input exists

Bit3: Time valid (only for seconds)

4.3 Scanning time estimation

The Composite Scan Time of the security system directly determines the security response speed. It consists of four parts:

Input module scanning time=1.3 ms x number of high-density input modules

Output module scanning time=1.6 ms x number of high-density output modules

Application execution time ≈ 0.08 ms x (number of input and output modules) or 0.013 ms x application size (KB)

Communication overhead ≈ 1.25 ms x number of I/O modules x number of communication modules

For example, a system with 4 T8403 digital inputs, 1 T8431 analog input, and 2 T8451 digital outputs (a total of 7 I/O modules and 2 communication modules):

Input scan: 1.3 × 5=6.5 ms

Output scan: 1.6 × 2=3.2 ms

Application execution: 7 × 0.08=0.56 ms

Communication: 7 × 1.25 × 2=17.5 ms

The total is about 27.8 ms. It can be further optimized through "scheduled polling" and "exception writing".

Operation and monitoring

5.1 Interpretation of Front Panel LED

LED green constantly on, green flashing, red off

Healthy A/B/C FCR Health - Fatal Fault -

Health flashing red: Non fatal malfunction (such as single channel abnormality)

Active is in active mode - inactive

Standby is in standby mode and has just switched from Active to Standby

Educate already received education in progress - uneducated/program stopped

Run - Normal Run - Program Stop

Prohibit - I/O lock or switch disable -

System Healthy system health startup/malfunction/self-test failure/module error - illegal status

User1/2 Application Control

When the Healthy LED flashes red, the system will automatically switch to the Standby processor (if present), and the faulty processor needs to be replaced.

5.2 Maintenance Enable Key Switch and Fault Reset Button

Key switch: Run position locks memory; The Maintain location allows downloading programs from the engineering workstation.

Fault reset button: Clear all recorded faults and reset the fault counter. Attention: Although the system LED may return to green after pressing, the accumulated intermittent fault records will be lost. It is recommended to record the fault code first and then reset.