ICS Triplex T8850 Trusted 40 Channel Analogue or Digital Output FTA

user-configurable module providing overall system control and monitoring facilities and processes

input and output data received from a variety of analogue and digital Input / Output (I/O) modules

across a Trusted TMR Inter-Module Communications Bus.

The range of applications for the Trusted TMR Processor vary in integrity level and include fire and

gas control, emergency shutdown, monitoring and control, and turbine control.

Hardware

The module has a Power PC Processor. Bootstrap software is stored on Erasable

Programmable Read Only Memory (EPROM). Operational firmware is stored in flash memory

and may be upgraded via the Front Panel Port.

The Trusted Operating System is used on both the TMR Processor and CI. The real time

kernel is a high speed, high functionality kernel made for fault tolerant distributed systems.

The kernel provides basic services (such as memory management) and interference free

software environments.

A module watchdog monitors processor operation and the power supply unit (PSU) output

voltages.

The module is supplied with a dual redundant +24 Vdc power feed from the chassis

backplane. An on-board power supply unit provides voltage conversion, supply conditioning

and protection.

The Trusted CI communicates with the Trusted TMR Processor via the triplicated Inter

Module Bus. When polled by the Trusted TMR Processor, the module’s bus interface votes

the data 2 out of 3 (2oo3) from the Inter-Module Bus and transmits back its reply via all

three Inter-Module Bus channels. The remainder of the Communications Interface is

simplex.

All communications transceivers are electrically isolated from each other and the module

and have additional transient protection measures.

The module internal supplies are isolated from the dual 24 Vdc feeds.

Communications

Data is transferred between the TMR Processor and the Communications Interfaces using a

common interface called the Network Variable Manager. When data is read from a Trusted

System, the data is obtained from the local copy maintained on the Communications

Interface, providing a fast response.

Data writes are more complicated. If a data write simply updated the local copy and was

then relayed to the processor, the other Communications Interfaces in the system would

carry different data. This may cause problems for redundant links.

To overcome this problem, when data is written to a Communications Interface, it is first

passed to the TMR Processor and the write is acknowledged immediately by the

Communications Interface (to avoid communications delays). The processor updates its own

database and then sends the data back to all Communications Interfaces so that they all

have the same data. This can take one or two application scans. This means that subsequent

reads will receive the old data immediately after the write, until the new data has been

distributed.

All changes to CI parameters (.ini changes) loaded online do not require a power cycle, and

will take effect immediately. The Communications Interface disconnects all communications

and restarts. Communications is also restarted on an application online update and is shut

down when the application is stopped.