Rockwell Automation Trusted TMR 120 User manual

ICSTT-RM283H-EN-E (PD-T8472) Trusted
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15
Trusted TMR 120 Vac Digital Output Module – 16
Channel
Product Overview
The Trusted® 120 Vac Digital Output Module interfaces to 16 field devices. Triplicated diagnostic
tests are performed throughout the Module including measurements for current and voltage on
each portion of the voted output channel. Tests are also performed for stuck on and stuck off
failures. Fault tolerance is achieved through a Triple Modular Redundant (TMR) architecture within
the System Side and Quad Element redundancy for each of the 16 output channel circuits.
The Module provides on-board Sequence of Events (SOE) reporting with a resolution of 1 ms. An
output change of state triggers an SOE entry. Output states are automatically determined by
multiple voltage and current measurements for each of the 16 channels of the Module.
Features:
•Triplicated TMR system architecture, with fault tolerant output switching.
•16 Output Channels: 120 Vac, 0.5 A per channel, field powered as two groups of 8.
•Comprehensive, automatic diagnostics and self-test.
•Short circuit monitoring per channel when energized (requires regular proof testing for
safety related normally de-energized outputs, e.g. F&G).
•Open circuit monitoring when energized or de-energized
•2500 V impulse withstand opto/galvanic isolation barrier.
•Automatic channel over-current protection, no fuses required.
•On-board Sequence of Events (SOE) reporting with 1 ms resolution.
•Module can be hot-replaced on-line using dedicated ‘Companion Slot’ (adjacent slot) or
SmartSlot (one spare slot for many Modules) configurations.
•Front Panel output status Light Emitting Diodes (LEDs) for each channel indicate output
status and field wiring faults.

Trusted ICSTT-RM283H-EN-E
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15
•Front Panel Module status LEDs indicate Module health and operational mode (Active,
Standby, Educated).
•TϋV Certified IEC 61508, SIL 3.

Trusted TMR 120 Vac Digital Output Module – 16 Channel PREFACE
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 i
PREFACE
In no event will Rockwell Automation be responsible or liable for indirect or consequential damages
resulting from the use or application of this equipment. The examples given in this manual are
included solely for illustrative purposes. Because of the many variables and requirements related to
any particular installation, Rockwell Automation does not assume responsibility or reliability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, with respect to use of information, circuits,
equipment, or software described in this manual.
Allen‐Bradley, LISTEN. THINK. SOLVE., Rockwell Automation, TechConnect, and Trusted are
trademarks of Rockwell Automation, Inc.
All trademarks are acknowledged.
DISCLAIMER
It is not intended that the information in this publication covers every possible detail about the
construction, operation, or maintenance of a control system installation. You should also refer to
your own local (or supplied) system safety manual, installation and operator/maintenance manuals.
REVISION AND UPDATING POLICY
This document is based on information available at the time of its publication. The document
contents are subject to change from time to time. The latest versions of the manuals are available at
the Rockwell Automation Literature Library under "Product Information" information "Critical
Process Control & Safety Systems".
TRUSTED RELEASE
This technical manual was updated for Trusted Release 4.0.
LATEST PRODUCT INFORMATION
For the latest information about this product review the Product Notifications and Technical Notes
issued by technical support. Product Notifications and product support are available at the Rockwell
Automation Support Centre at
http://rockwellautomation.custhelp.com
At the Search Knowledgebase tab select the option "By Product" then scroll down and select the
Trusted product.
Some of the Answer ID’s in the Knowledge Base require a TechConnect℠Support Contract. For more
information about TechConnect Support Contract Access Level and Features, click on the following
link:
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/50871
This will get you to the login page where you must enter your login details.

PREFACE Trusted TMR 120 Vac Digital Output Module – 16 Channel
ii Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
IMPORTANT A login is required to access the link. If you do not have an account then you can create one
using the "Sign Up" link at the top right of the web page.
DOCUMENTATION FEEDBACK
Your comments will help us serve your documentation needs better. If you have any suggestions on
how to improve this document, complete the How Are We Doing? form at
http://literature.rockwellautomation.com/idc/groups/literature/documents/du/ra-du002_-en-e.pdf.

Trusted TMR 120 Vac Digital Output Module – 16 Channel PREFACE
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 iii
SCOPE
This manual specifies the maintenance requirements and describes the procedures to assist
troubleshooting and maintenance of a Trusted system.
WHO SHOULD USE THIS MANUAL
This manual is for plant maintenance personnel who are experienced in the operation and
maintenance of electronic equipment and are trained to work with safety systems.
SYMBOLS
In this manual we will use these notices to tell you about safety considerations.
SHOCK HAZARD: Identifies an electrical shock hazard. If a warning label is fitted, it
can be on or inside the equipment.
WARNING: Identifies information about practices or circumstances that can cause
an explosion in a hazardous environment, which can cause injury or death,
property damage or economic loss.
ATTENTION: Identifies information about practices or circumstances that can cause
injury or death.
CAUTION: Identifies information about practices or circumstances that can cause
property damage or economic loss.
BURN HAZARD: Identifies where a surface can reach dangerous temperatures. If a
warning label is fitted, it can be on or inside the equipment.
This symbol identifies items which must be thought about and put in place when
designing and assembling a Trusted controller for use in a Safety Instrumented
Function (SIF). It appears extensively in the Trusted Safety Manual.
IMPORTANT Identifies information that is critical for successful application and understanding of
the product.
NOTE Provides key information about the product or service.
TIP Tips give helpful information about using or setting up the equipment.

PREFACE Trusted TMR 120 Vac Digital Output Module – 16 Channel
iv Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
WARNINGS AND CAUTIONS
WARNING: EXPLOSION RISK
Do not connect or disconnect equipment while the circuit is live or unless the area is
known to be free of ignitable concentrations or equivalent
AVERTISSEMENT - RISQUE D’EXPLOSION
Ne pas connecter ou déconnecter l’équipement alors qu’il est sous tension, sauf si
l’environnement est exempt de concentrations inflammables ou équivalente
MAINTENANCE
Maintenance must be carried out only by qualified personnel. Failure to follow these
instructions may result in personal injury.
CAUTION: RADIO FREQUENCY INTERFERENCE
Most electronic equipment is influenced by Radio Frequency Interference. Caution
should be exercised with regard to the use of portable communications equipment
around such equipment. Signs should be posted in the vicinity of the equipment
cautioning against the use of portable communications equipment.
CAUTION:
The module PCBs contains static sensitive components. Static handling precautions
must be observed. DO NOT touch exposed connector pins or attempt to dismantle a
module.

Trusted TMR 120 Vac Digital Output Module – 16 Channel PREFACE
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 v
ISSUE RECORD
Issue Date Comments
No issue record in source
14 Aug 15 Rebranded and reformatted with correction to Relative Humidity Range
and Operating Temperature statements in the Specification Sections,
also correction to any typographical errors
15 Mar 20 Added trademarks statement.
Updated Documentation Feedback section.
Updated Figure 4 Module Front Panel.
Changed Minimum On State Load Current in Specifications table.
Changed Channel Test Interval to Self-Test Interval in Specifications
table.
Changed Weight in Specifications table.
Added Output Field Loop Voltage Reporting Accuracy and Minimum
No-Load Threshold (NLTHRESH) configuration to Specifications table.
Updated to display Rockwell Automation publication numbers.

PREFACE Trusted TMR 120 Vac Digital Output Module – 16 Channel
vi Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
Page intentionally left blank

Trusted TMR 120 Vac Digital Output Module – 16 Channel Table of Contents
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 1
Table of Contents
1. Description .............................................................................................................3
1.1. Field Termination Unit (FTU)....................................................................................................... 4
1.2. Field Interface Unit (FIU).............................................................................................................5
1.3. Host Interface Unit (HIU) ............................................................................................................6
1.4. Front Panel Unit (FPU) ................................................................................................................ 6
1.5. Line Monitoring and Output States ............................................................................................ 7
1.6. Housekeeping.............................................................................................................................. 7
1.7. Fault Detection / Testing.............................................................................................................7
1.8. Sequence of Events Characteristics ............................................................................................ 8
1.9. Output Switch Structure ............................................................................................................. 8
2. Installation...........................................................................................................11
2.1. Module Insertion and Removal.................................................................................................11
2.2. Field Power Connection ............................................................................................................11
2.2.1. Cable Impedance............................................................................................................... 12
2.3. Termination............................................................................................................................... 12
2.4. Module Pin-out Connections ....................................................................................................12
2.5. Trusted Module Polarisation / Keying.......................................................................................13
3. Application ...........................................................................................................15
3.1. Module Configuration...............................................................................................................15
3.2. T8472 Complex Equipment Definition ...................................................................................... 15
3.2.1. Rack 1: DO .........................................................................................................................16
3.2.2. Rack 2: STATE ....................................................................................................................17
3.2.3. Rack 3: AI - Channel Field Voltage.....................................................................................18
3.2.4. Rack 4: CI – Channel Field Current ....................................................................................18
3.2.5. Rack 5: LINE_FLT................................................................................................................19
3.2.6. Rack 6: DISCREP.................................................................................................................19
3.2.7. Rack 7: Housekeeping .......................................................................................................19
3.2.8. Rack 8: INFO ......................................................................................................................22
3.3. Sequence of Events Configuration............................................................................................23
3.4. System.INI File Configuration....................................................................................................24
4. Operation .............................................................................................................25
4.1. Front Panel Indications .............................................................................................................25
4.2. Module Status LEDs...................................................................................................................26
4.3. I/O Status LEDs..........................................................................................................................27

Table of Contents Trusted TMR 120 Vac Digital Output Module – 16 Channel
2 Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
5. Fault Finding and Maintenance..............................................................................29
5.1. Fault Reporting..........................................................................................................................29
5.2. Field Wiring Faults.....................................................................................................................29
5.3. Module Faults ...........................................................................................................................29
5.4. Companion Slot.........................................................................................................................30
5.5. SmartSlot...................................................................................................................................30
5.6. Cold Start...................................................................................................................................30
5.7. Active and Standby Transfers....................................................................................................31
6. Specifications........................................................................................................33

Trusted TMR 120 Vac Digital Output Module – 16 Channel 1. Description
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 3
1. Description
The TMR 120 Vac Digital Output Module is a member of the Trusted range of Input/Output
(I/O) Modules. All Trusted I/O Modules share common functionality and form. At the most
general level, all I/O Modules interface to the Inter-Module Bus (IMB) which provides power
and allows communication with the TMR Processor. In addition, all Modules have a field
interface that is used to connect to module specific signals in the field. All Module system
circuits are Triple Modular Redundant (TMR). The AC Output Module has 16 quad fully
isolated and monitored channel AC output switches, configured as two groups of 8, each
group having its own field supply input and field supply monitoring.

1. Description Trusted TMR 120 Vac Digital Output Module – 16 Channel
4 Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
Figure 1 Module Architecture
This High Integrity I/O Module comprises 4 printed circuit boards (PCBs): Host Interface Unit
(HIU), the Field Interface Unit (FIU), the Field Termination Unit (FTU), and the Front Panel
Unit (or FPU).
1.1. Field Termination Unit (FTU)
The Field Termination Unit (FTU) contains the circuitry for the Quad Element Channel
Switches Ch 9 to Ch 16. (Circuitry for Switches Ch 1 to Ch 8 are located on the FIU.)
The FTU contains the Field Output Connector, therefore all field connections come from or
route via the FTU.

Trusted TMR 120 Vac Digital Output Module – 16 Channel 1. Description
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 5
When installed in a Chassis, the FTU Field Connector accepts the Field I/O Cable Assembly
attached at the rear of the Chassis.
1.2. Field Interface Unit (FIU)
The Field Interface Unit (FIU) is the section of the Module that contains the specific circuits
necessary to interface to the particular types of field I/O signals. Unlike other Trusted I/O
Modules, the T8472 has four FIUs. References to OFIU refer to specifically OUTPUT Module
functions. Each FIU slice operates one switch element (QA, QB, QC or QD) in each of the 16
output channels, as shown in the figure below:
Figure 2 FIU Architecture
The switch commands from each HIU slice are voted by each FIU switch interface circuit and
conversely, each FIU slice relays diagnostic information back to the three HIU slices for
further processing. The overall functions of the FIU are summarised below:
Control function – The FIU receives and decodes ON/OFF commands from the HIU for each
of the switch elements and forwards the commands to the appropriate switches.
Monitoring function – The FIU receives and processes measurement data from each of the
switch elements and forwards the results to the HIU.

1. Description Trusted TMR 120 Vac Digital Output Module – 16 Channel
6 Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
Isolation – The FIU provides galvanic isolation between logic and field.
The majority voting carried out in the FIU verifies that any single slice failure in the HIU does
not degrade the output switch operation. Under those circumstances, all output switches
would continue to function correctly so long as two out of the three control circuits were
operational. A second slice failure would therefore verify that the quad output switches
degraded to a known (‘OFF’ or ‘Normally Open’) state.
1.3. Host Interface Unit (HIU)
The HIU is the point of access to the Inter-Module Bus (IMB) for the Module. It is the only
section of the I/O Module to directly connect to the IMB Backplane. The HIU also provides
power distribution and local programmable processing power. The HIU is common to most
high integrity I/O types and has type dependent and product range common functions. Each
HIU contains three independent sections, known as ‘slices’, commonly referred to as A, B,
and C. All interconnections between the three slices incorporate isolation to help prevent
any fault interaction between the slices. Each slice is considered a Fault Containment Region
(FCR), as a fault on one slice has no effect on the operation of the other slices.
The HIU provides the following services common to the Modules in the family:
•High Speed Fault Tolerant Communications with the TMR Processor via the IMB
interface.
•FCR Interconnect Bus between slices to vote incoming IMB data and distribute
outgoing I/O Module data to IMB.
•Optically isolated serial data interface to the FIU slices.
•Redundant power sharing of dual 24 Vdc chassis supply voltage and power
regulation for logic power to HIU circuitry.
•Serial data interface to the FPU for Module status LEDs.
•Digital Signal Processing to perform local data reduction and self-diagnostics.
•Local memory resources for storing Module operation, configuration, and field I/O
data.
•On-board housekeeping, which monitors reference voltages, current consumption
and board temperature.
1.4. Front Panel Unit (FPU)
The Front Panel Unit (FPU) contains the necessary connectors, switches, logic, and LED
indicators for the Front Panel. For every Module, the FPU contains the Slice Healthy,
Active/Standby, the Educated LED indicators, and the module removal switches. Additional

Trusted TMR 120 Vac Digital Output Module – 16 Channel 1. Description
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 7
bi-colour LEDs provide status indication for the individual I/O signals. Serial data interfaces
connect the FPU to each of the HIU slices to control the LED status indicators and monitor
the module removal switches
1.5. Line Monitoring and Output States
The Module automatically monitors the output channel current and voltage (indirectly) to
determine the state of the output channel. The numerical output state and line fault status
are reported back to the application and are represented below.
Description Numerical
Output State
Line Fault
Status
Field Short Circuit 15 1
Output Energized (On) 4 0
No Load, Field Open Circuit 31
Output De-energized (Off) 2 0
No Field Supply Voltage 1 1
Table 1 Line Monitoring Fault Status
Note 1: Short circuits are not detected when the output is de-energized.
1.6. Housekeeping
The Output Module automatically performs local measurements of on-board signals that
can be used for troubleshooting and verification of Module operating characteristics.
Measurements are made within each slice’s HIU and FIU.
1.7. Fault Detection / Testing
Extensive diagnostics provide the automatic detection of Module faults. The TMR
architecture of the Output Module and the diagnostics performed verify the validity of all
critical circuits. Using the TMR architecture provides a fault tolerant method to withstand
the first fault occurrence on the Module and continue normal output controls without
interruption in the system or process. Faults are reported to the user through the Healthy
status indicators on the Front Panel of the Module and through the information reported to
the TMR Processor. Under normal operations all three Healthy indicators are green. When a
fault occurs, one of the Healthy indicators will be flashing red. It is recommended that this
condition is investigated and if the cause is within the Module, it should be replaced.

1. Description Trusted TMR 120 Vac Digital Output Module – 16 Channel
8 Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
Module replacement activities depend on the type of spare Module configuration chosen
when the system was configured and installed. The Module may be configured with a
dedicated Companion Slot or may use a separate SmartSlot. The I/O Module contains
extensive fault detection and integrity testing. As an output device, all testing is performed
in a non-interfering mode. Data input from the IMB is stored in redundant error-correcting
Random Access Memory (RAM) on each slice portion of the HIU. Received data is voted on
by each slice. All data transmissions include a confirmation response from the receiver.
Periodically, the TMR Processor commands the on-board Digital Signal Processors (DSPs) to
perform a Safety Layer Test (SLT). The SLT results in the DSP verifying with the TMR
Processor its ability to process data with integrity. In addition, the DSP uses Cyclical
Redundancy Checks (CRC) to verify the variables and configuration stored in Flash memory.
Between the FIU and the Field Output switch element circuits are a series of magnetically
isolated links for data and power. The data link is synchronized and monitored for variance.
The HIU has on-board temperature sensors to characterize temperature-related problems.
The power supply for the HIU board is redundant, fully monitored and testable.
1.8. Sequence of Events Characteristics
The Module automatically measures the field voltage and current to determine the state of
each output channel. An event occurs when the output transitions from one state to
another. When a channel changes state, the on-board timer value is recorded. When the
TMR Processor next reads data from the Output Module, the channel state and real-time
clock value are retrieved. The TMR Processor uses this data to log the state change into the
system Sequence of Events (SOE) log. The user may configure each output to be included in
the system SOE log.
Full details of SOE are contained in Trusted Sequence of Events and Process Historian
Package, publication ICSTT-RM243 (PD-T8013).
1.9. Output Switch Structure
The Digital Output Module provides a Quad Element switch topology where each load is
driven by a total of four fully monitored, fail safe (4 element) ‘high-side’ switches configured
as a dual redundant series / parallel combination. With this configuration a failed switch
element (either failed open or failed short circuited) can be isolated and switch channel
functionality maintained.
The 16 output channels are configured as two groups of 8 each and each group has its own
field supply connections.
Group 1 Output Channels (Ch1 to Ch8) are physically resident on the FIU board.
Group 2 Output Channels (Ch9 to Ch16) are physically resident on the FTU board.

Trusted TMR 120 Vac Digital Output Module – 16 Channel 1. Description
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 9
Due to the majority voting scheme incorporated on FIU-QA, QB, QC and QD voters, any
single HIU main slice A, B or C, failure will not result in the loss of any switch element
operation.

1. Description Trusted TMR 120 Vac Digital Output Module – 16 Channel
10 Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
Page intentionally left blank

Trusted TMR 120 Vac Digital Output Module – 16 Channel 2. Installation
Rockwell Automation Publication ICSTT-RM283H-EN-E Issue 15 11
2. Installation
2.1. Module Insertion and Removal
CAUTION:
The Module contains static sensitive parts. Static handling precautions must be
observed. Specifically ensure that exposed connector pins are not touched. Under no
circumstances should the Module housing be removed.
Before installation, visually inspect the module for damage. Ensure that the module housing
appears undamaged and inspect the I/O connector at the back of the module for bent pins.
If the module appears damaged or any pins are bent, do not install the module. Do not try
to straighten bent pins. Return the module for replacement.
Ensure that the module is of the correct type.
Record the module type, revision and serial number of the module before installation.
To install the module:
1. Ensure that the field cable assembly is installed and correctly located.
2. If I/O module keys are used, verify that all keys are installed in the correct positions
and properly seated in their slots.
3. Release the ejector tabs on the module using the release key. Ensure that the ejector
tabs are fully open.
4. Holding the ejectors, carefully insert the module into the intended slot.
5. Push the module fully home by pressing on the top and bottom of the module fascia.
6. Close the module ejectors, ensuring that they click into their locked position.
The module should mount into the chassis with a minimum of resistance. If the module does
not mount easily, do not force it. Remove the module and check it for bent or damaged
pins. If the pins have not been damaged, try reinstalling the module.
2.2. Field Power Connection
May be connected at the T8871 Field Termination Adapter. However Field Power may be
connected anywhere along the cable by pulling the Field Power Cables (Grey & White) out
of the outer sheath and connecting onto suitable junction boxes.

2. Installation Trusted TMR 120 Vac Digital Output Module – 16 Channel
12 Issue 15 Rockwell Automation Publication ICSTT-RM283H-EN-E
2.2.1. Cable Impedance
Custom length multi-core FTA cables are 0.5 mm2with a resistance of 40 Ω/km. eg a 50 m
cable will have 4 Ω loop impedance at 0.5 A, this equates to a 2 Vdc volt drop.
2.3. Termination
Unused channels should be commanded OFF and may be fitted with a 33k 2 W resistor to
help prevent no-load detection.
2.4. Module Pin-out Connections
Field connections are made to the Modules DIN41612 type D Field Connector:
Pin No. Row a Row c
2 (SMART_SLOT_A) (SMART_SLOT_B)
4 (SMART_SLOT_C) spare
6 V_RET_CH9_16 V_RET_CH1_8
8 V_FIELD_CH9_16 V_FIELD_CH1_8
10 V_FIELD_CH9_16 V_FIELD_CH1_8
12 V_FIELD_CH9_16 V_FIELD_CH1_8
14 V_FIELD_CH9_16 V_FIELD_CH1_8
16 V_FIELD_CH9_16 V_FIELD_CH1_8
18 LOAD_CH9 LOAD_CH1
20 LOAD_CH10 LOAD_CH2
22 LOAD_CH11 LOAD_CH3
24 LOAD_CH12 LOAD_CH4
26 LOAD_CH13 LOAD_CH5
28 LOAD_CH14 LOAD_CH6
30 LOAD_CH15 LOAD_CH7
32 LOAD_CH16 LOAD_CH8