Tricon Triple-Modular Redundant Controller: TMR Architecture for Critical Process Safety

TMR DI module: with 100% triple critical signal path. Each signal is independently regulated and provides optocoupler isolation. Of particular note is its' self-test 'feature. Given that most safety systems use a 'power outage trip' logic, it is crucial to detect the 'stuck on' state. The TMR module of the DC model reads zero input (OFF) by closing a switch in the circuit to verify the integrity of the circuit.

Single channel DI module: designed for cost sensitive but highly secure applications. Although only the critical signal path has been tripled, a special self-test circuit can detect all stuck ON or stuck OFF faults within 0.5 seconds.

2. Digital Output Module (DO)

The digital output module is the key to executing safety interlocks in the system, and is divided into various specifications such as dual channel, monitoring type, DC voltage type, and AC voltage type.

Monitoring type digital output (SDO): designed specifically for outputs that are in a single state for a long time, such as emergency stop valves. In addition to conventional output voting, SDO also has voltage and current read back circuits that can diagnose faults such as open circuits, short circuits, or load loss in on-site circuits. Through the "monitoring" function, the system can detect whether the load is erroneously energized or if there is a short circuit in the demagnetization state.

Dual channel digital output (DDO): strikes a balance between security and cost. It applies 2/3 voting logic to each switch, although not as redundant as TMR modules, it is sufficient to ensure safe operation.

3. Analog quantity and thermocouple module

The analog input module also uses three independent channels and processes data using the median selection algorithm to ensure that drift or faults in a single channel do not affect control accuracy. The thermocouple module integrates cold junction compensation and linearization functions, and supports multiple thermocouple types such as J, K, T, E, etc. The high-precision analog output module (AO) is used to drive 4-20mA field devices and has circuit detection function to ensure the accuracy of output current.

System configuration and expansion architecture

The flexibility of the Tricon system is reflected in its diverse rack configuration options, which consist of one main rack and up to 14 expansion or remote expansion (RXM) racks, supporting up to 118 I/O modules.

1. Rack layout and power supply

Each rack is equipped with two redundant power modules on the left side, using a dual power rail design. Each power module can independently provide full load power to all modules in the rack. The rated output power of the power module is 175 watts at an ambient temperature of 140 ° F (60 ° C). The main processor is located on the right side of the mainframe, and the rest is divided into logical slots.

In the mainframe, there are 6 logical slots for I/O and communication modules, as well as 1 COM slot. The expansion rack provides 8 logical slots.

2. I/O bus and remote expansion

The racks are connected through triple I/O bus cables. The standard local extension distance is usually 100 feet (30 meters), but can be extended to 1000 feet (300 meters) in specific applications.

For applications located more than 30 meters away from the main control room, such as different areas of offshore drilling platforms or large refineries, Tricon offers a Remote Expansion (RXM) solution. The RXM rack uses fiber optic cables to place I/O modules 7.5 miles (12 kilometers) away from the main rack, while also having excellent anti-static and electromagnetic interference capabilities. Each RXM module group serves as a repeater and extender, providing ground isolation to ensure that remote signals are not distorted.

3. Online module maintenance

Tricon's logic slot design supports two online repair methods: hot standby and online replacement.

Hot standby method: Install two identical I/O modules in the slot. One is in an active state, while the other is charged but not working. The system automatically rotates control every hour to ensure that both modules receive complete diagnosis. Once a fault is detected, the system instantly switches to the hot standby module.

Online replacement: Even if there is only one module in the slot, if a fault occurs, the engineer can directly insert the replacement module. Tricon will smoothly transition control from the old module to the new module after self diagnosis, without interference during the process.

Communication capability and integration with third-party systems

Effective integration of Safety Instrumented Systems (SIS) and Distributed Control Systems (DCS) is crucial in modern factories. Tricon offers a wide range of communication module options, breaking down information silos.

1. Overview of Communication Module

Tricon Communication Module (TCM): Supports 10/100BaseT Ethernet and RS-232/485 serial ports. It allows Tricon to communicate peer-to-peer with Modbus TCP/RTU devices, OPC clients, and other Tricon controllers, and supports GPS time synchronization.

Enhanced Intelligent Communication Module (EICM): Focusing on serial communication, supporting Modbus and TriStation protocols, with optical isolation ports, suitable for serial networks with high anti-interference requirements.