Rockwell Automation Trusted TMR User manual

ICSTT-RM278P-EN-P (PD-T8448) Trusted
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16
Trusted TMR 24 Vdc Zone Interface Module 40
Channel
Product Overview
The Trusted® TMR Zone Interface Module has been designed to provide a configurable interface
specifically for use in Fire and Gas protection systems. The Module interfaces to up to 40 Fire and
Gas field device inputs or actuators. Each of the 40 I/O Channels can be individually configured as
Analogue Input, Digital Input or Digital Output to provide all of the interfaces needed to protect one
or more Fire and Gas Zones. Interfacing to the field devices is through a Versatile Field Termination
Assembly type 8842, which provides the field loop conditioning for each of the types of signal, and
enables the connection of reset signals for latching type detectors without the need for external
hardware. The Module is separated into 5 power groups each with 8 channels. Power groups can be
combined together to provide a configurable number of channels for each Fire/Gas Zone. All of
these functions provide data to the Trusted TMR System which acts as the logic solver. This Module
is not approved for direct connection to hazardous areas and should be used in conjunction with
Intrinsic Safety Barrier devices.
Triplicated diagnostic tests are performed throughout the Module, including measurements for
current and voltage on each portion of voted input or output channels. Tests are also performed for
stuck on and stuck off failures. All inputs are treated as analogue and are fully tested. Fault
tolerance is achieved through a Triple Modular Redundant (TMR) architecture within the Module
for each of the 40 channels.
Features:
•40 Triple Modular Redundant selectable input/output points per Module.
•Inputs interface to 4-20 mA gas detectors, Fire and Heat detectors, Break Glass units etc.
•Programmable Field Device Reset signals (up to 5 individual resets).
•Two or Three Wire Field devices through 8842.
•Fuse Protection of Inputs and Outputs through 8842, external to the Module.
•High Power Digital Outputs to interface to Dampers, Extinguishant Release, Fire pumps etc.
•5 Isolated Power Groups to allow flexible and efficient field configurations.

Trusted ICSTT-RM278P-EN-P
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16
•Comprehensive automatic diagnostics and self-test.
•Automatic line monitoring per point to detect faults in field wiring and loads.
•2500 V impulse withstand opto/galvanic isolation barrier.
•Automatic over-current protection (per channel), no external fuses required.
•On-board Sequence of Events (SOE) reporting with 1 ms resolution.
•Module can be hot-replaced on-line using dedicated Companion (adjacent) Slot or SmartSlot
(one spare slot for many Modules) configurations.
•Front Panel output status Light Emitting Diodes (LEDs) for each channel indicate status and
field wiring faults.
•Front Panel Module status LEDs indicate Module health and operational mode (Active,
Standby, Educated).
•TϋV Certified IEC 61508 SIL 3.

Trusted TMR 24Vdc Zone Interface Module 40 Channel PREFACE
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 i
PREFACE
In no event will Rockwell Automation be responsible or liable for indirect or consequential damages
resulting from the use or application of this equipment. The examples given in this manual are
included solely for illustrative purposes. Because of the many variables and requirements related to
any particular installation, Rockwell Automation does not assume responsibility or reliability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, with respect to use of information, circuits,
equipment, or software described in this manual.
Allen-Bradley, LISTEN. THINK. SOLVE., Rockwell Automation, TechConnect, and Trusted are
trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
All trademarks are acknowledged.
DISCLAIMER
It is not intended that the information in this publication covers every possible detail about the
construction, operation, or maintenance of a control system installation. You should also refer to
your own local (or supplied) system safety manual, installation and operator/maintenance manuals.
REVISION AND UPDATING POLICY
This document is based on information available at the time of its publication. The document
contents are subject to change from time to time. The latest versions of the manuals are available at
the Rockwell Automation Literature Library under "Product Information" information "Critical
Process Control & Safety Systems".
TRUSTED RELEASE
This technical manual was updated for Trusted Release 4.0.
LATEST PRODUCT INFORMATION
For the latest information about this product review the Product Notifications and Technical Notes
issued by technical support. Product Notifications and product support are available at the Rockwell
Automation Support Centre at
http://rockwellautomation.custhelp.com
At the Search Knowledgebase tab select the option "By Product" then scroll down and select the
Trusted product.
Some of the Answer ID’s in the Knowledge Base require a TechConnect℠Support Contract. For more
information about TechConnect Support Contract Access Level and Features please click on the
following link:
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/50871

PREFACE Trusted TMR 24Vdc Zone Interface Module 40 Channel
ii Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
This will get you to the login page where you must enter your login details.
IMPORTANT A login is required to access the link. If you do not have an account then you can create one
using the "Sign Up" link at the top right of the web page.
DOCUMENTATION FEEDBACK
Your comments help us to write better user documentation. If you discover an error, or have a
suggestion on how to make this publication better, send your comment to our technical support
group at http://rockwellautomation.custhelp.com

Trusted TMR 24Vdc Zone Interface Module 40 Channel PREFACE
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 iii
SCOPE
This manual specifies the maintenance requirements and describes the procedures to assist
troubleshooting and maintenance of a Trusted system.
WHO SHOULD USE THIS MANUAL
This manual is for plant maintenance personnel who are experienced in the operation and
maintenance of electronic equipment and are trained to work with safety systems.
SYMBOLS
In this manual we will use these notices to tell you about safety considerations.
SHOCK HAZARD: Identifies an electrical shock hazard. If a warning label is fitted, it
can be on or inside the equipment.
WARNING: Identifies information about practices or circumstances that can cause
an explosion in a hazardous environment, which can cause injury or death,
property damage or economic loss.
ATTENTION: Identifies information about practices or circumstances that can cause
injury or death.
CAUTION: Identifies information about practices or circumstances that can cause
property damage or economic loss.
BURN HAZARD: Identifies where a surface can reach dangerous temperatures. If a
warning label is fitted, it can be on or inside the equipment.
This symbol identifies items which must be thought about and put in place when
designing and assembling a Trusted controller for use in a Safety Instrumented
Function (SIF). It appears extensively in the Trusted Safety Manual.
IMPORTANT Identifies information that is critical for successful application and understanding of
the product.
NOTE Provides key information about the product or service.
TIP Tips give helpful information about using or setting up the equipment.

PREFACE Trusted TMR 24Vdc Zone Interface Module 40 Channel
iv Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
WARNINGS AND CAUTIONS
WARNING: EXPLOSION RISK
Do not connect or disconnect equipment while the circuit is live or unless the area is
known to be free of ignitable concentrations or equivalent
AVERTISSEMENT - RISQUE D’EXPLOSION
Ne pas connecter ou déconnecter l’équipement alors qu’il est sous tension, sauf si
l’environnement est exempt de concentrations inflammables ou équivalente
MAINTENANCE
Maintenance must be carried out only by qualified personnel. Failure to follow these
instructions may result in personal injury.
CAUTION: RADIO FREQUENCY INTERFERENCE
Most electronic equipment is influenced by Radio Frequency Interference. Caution
should be exercised with regard to the use of portable communications equipment
around such equipment. Signs should be posted in the vicinity of the equipment
cautioning against the use of portable communications equipment.
CAUTION:
The module PCBs contain static sensitive components. Static handling precautions
must be observed. DO NOT touch exposed connector pins or attempt to dismantle a
module.

Trusted TMR 24Vdc Zone Interface Module 40 Channel PREFACE
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 v
ISSUE RECORD
Issue Date Comments
7 July 05 Reformat
Sect 3 Application Resistor
Sect 1.5 Default Thresholds added
8 Feb 06 Format correction
9 Aug 06 Input power
10 Dec 06 Weights & Dims
11 Mar 07 Accuracy
12 Nov 07 STATE descriptions
13 Aug 08 Accuracy
14 Apr 10 Rack 7 changes
15 Jun 16 Rebranded and reformatted with correction to Relative Humidity Range
and Operating Temperature statements in the Specification Section, also
correcting any typographical errors. This Product Description has also
been updated incorporating IEEE standards.
16 Apr 19 Updated Specifications section and main text to a more consistent
format.
Updated Front Panel section to updated product design.
Updated content for the following sections:
•1.2 Field Interface Unit (FIU)
•1.3 Host Interface Unit (HIU)
•1.4 Front Panel Unit (FPU)
•1.7 Fault Detection and Testing
•3.4 System.INI File Configuration
Updated Output Turn-on/off Delay specification.
Updated document to display Rockwell Automation publication
numbers.
Added trademarks statement.

PREFACE Trusted TMR 24Vdc Zone Interface Module 40 Channel
vi Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
Page intentionally left blank

Trusted TMR 24Vdc Zone Interface Module 40 Channel Table of Contents
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 1
Table of Contents
1. Description ............................................................................................................3
1.1. Field Termination Unit (FTU)...................................................................................................... 4
1.2. Field Interface Unit (FIU)............................................................................................................ 4
1.3. Host Interface Unit (HIU) ........................................................................................................... 5
1.4. Front Panel Unit (FPU) ............................................................................................................... 6
1.5. Input Line Monitoring Thresholds.............................................................................................. 6
1.6. Housekeeping............................................................................................................................. 6
1.7. Fault Detection and Testing ....................................................................................................... 6
1.8. Sequence of Events Characteristics ........................................................................................... 7
1.9. Output Switch Structure ............................................................................................................ 8
1.9.1. Switch Diagnostics.............................................................................................................. 9
1.9.2. Short Circuit Protection.................................................................................................... 10
1.9.3. Group Fail Safe Switches .................................................................................................. 10
1.10. Output Line Monitoring States ................................................................................................ 11
1.11. Input Interfaces ........................................................................................................................ 11
1.12. Field Interface Selection........................................................................................................... 11
2. Installation.......................................................................................................... 13
2.1. Module Insertion and Removal................................................................................................ 13
2.2. Field Cable Selection ................................................................................................................ 14
2.3. Termination.............................................................................................................................. 14
2.4. Module Pin-out Connections ................................................................................................... 14
2.5. Trusted Module Polarisation/Keying ....................................................................................... 16
3. Application .......................................................................................................... 17
3.1. Module Configuration.............................................................................................................. 18
3.2. T8448 Complex Equipment Definition ..................................................................................... 18
3.2.1. Rack 1: DO ........................................................................................................................ 19
3.2.2. Rack 2: STATE ................................................................................................................... 20
3.2.3. Rack 3: AI .......................................................................................................................... 21
3.2.4. Rack 4: CI .......................................................................................................................... 22
3.2.5. Rack 5: LINE_FLT............................................................................................................... 22
3.2.6. Rack 6: DISCREP................................................................................................................ 23
3.2.7. Rack 7: HKEEPING............................................................................................................. 23
3.2.8. Rack 8: INFO ..................................................................................................................... 25
3.2.9. Rack 9: THRSHIN ............................................................................................................... 27
3.2.10. Rack 10: THRSHOUT ......................................................................................................... 28
3.3. Sequence of Events Configuration ........................................................................................... 29
3.4. System.INI File Configuration................................................................................................... 29

Table of Contents Trusted TMR 24Vdc Zone Interface Module 40 Channel
2 Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
4. Operation ............................................................................................................ 31
4.1. Front Panel ............................................................................................................................... 31
4.2. Module Status LEDs ................................................................................................................. 32
4.3. I/O Status Indicators ................................................................................................................ 33
5. Fault Finding and Maintenance............................................................................. 35
5.1. Fault Reporting......................................................................................................................... 35
5.2. Field Wiring Faults.................................................................................................................... 35
5.3. Module Faults .......................................................................................................................... 35
5.4. Companion Slot........................................................................................................................ 36
5.5. SmartSlot.................................................................................................................................. 36
5.6. Cold Start.................................................................................................................................. 36
5.7. Transfer between Active and Standby Modules...................................................................... 37
6. Specifications....................................................................................................... 39

Trusted TMR 24Vdc Zone Interface Module 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 3
1. Description
The TMR Zone Interface Module is a member of the Trusted range of Input/Output (I/O)
Modules. All Trusted I/O Modules share common functionality and form. At the most
general level, all I/O Modules interface to the Inter-Module Bus (IMB) which provides power
and allows communication with the TMR Processor. In addition, all Modules have a field
interface that is used to connect to Module specific signals in the field. All Modules are
Triple Modular Redundant (TMR).
Figure 1 Module Architecture
All High Integrity I/O Modules are made up of 4 sections: Host Interface Unit (HIU), the Field
Interface Unit (FIU), the Field Termination Unit (FTU), and the Front Panel Unit (or FPU).

1. Description Trusted TMR 24Vdc Zone Interface Module 40 Channel
4 Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
Figure 2 shows a simplified block diagram of the Trusted Zone Interface Module.
Figure 2 Function Block Diagram
1.1. Field Termination Unit (FTU)
The Field Termination Unit (FTU) is the section of the I/O Module that connects all three
FIUs to a single field interface. The FTU provides the Group Fail Safe switches and passive
components necessary for signal conditioning, over-voltage protection, and EMI/RFI
filtering. When installed in a Trusted Controller or Expander Chassis, the FTU field connector
interconnects to the Field I/O Cable Assembly attached at the rear of the Chassis.
The SmartSlot link is passed from the HIU to the field connections via the FTU. These signals
go directly to the field connector and maintain isolation from the I/O signals on the FTU. The
SmartSlot link is the intelligent connection between Active and Standby Modules for co-
ordination during Module replacement.
1.2. Field Interface Unit (FIU)
The Field Interface Unit (FIU) is the section of the Module that contains the specific circuits
necessary to interface to the particular types of field I/O signals. Each Module has three
FIUs, one per slice. For the TMR Zone Interface Module, the FIU contains one stage of the
output switch structure, and analogue to digital (ADC) monitoring circuits for each of the
channels Two additional ADC circuits provide optional monitoring of the external field I/O
supply voltage.
Slice Power
Supply Housekeeping
Failsafe Bias Control
A
Back Plane
Power Bus
1
Front Panel
TMR Intermodule Bus
Opto Isolation Boundary
Serial Display Latches
Voted Status Display LEDs
Internal Voting Bus
Housekeeping
Module Temp
Supply Diag
DSP reference
Health
Indicators
Back Plane Power Bus 1
Back Plane Power Bus 2
Slice A
OFIU
HIU
FPDU
FPIU
Field Logic
Control
Redundant Supply
N.C.
N.O.
Diagnostic
Monitor
Bus
Interface
Bus
Interface
Slice Power
Supply Housekeeping
Failsafe Bias Control
B
Field Logic
Control
N.C.
N.O.
Diagnostic
Monitor
Slice Power
Supply Housekeeping
Failsafe Bias Control
C
Field Logic
Control
N.C.
N.O.
Diagnostic
Monitor
Bus
Interface
Front Panel
Voting Logic
Slice
Control
B
Ti me Stamp
Slice
Control
B
Ti me Stamp
Slice
Control
A
Ti me Stamp
OFTU
+V
Slice B
Slice C
ABC
Group
Fail-Safe
Switch
-
V
Field Interface
Protection Circuit

Trusted TMR 24Vdc Zone Interface Module 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 5
The FIU receives isolated power from the HIU for logic. The FIU provides additional power
conditioning for the operational voltages required by the FIU circuitry. An isolated 6.25
Mbit/sec serial link connects each FIU to one of the HIU slices.
The FIU also measures a range of on-board “housekeeping” signals that assist in monitoring
the performance and operating conditions of the Module. These signals include power
supply voltages, current consumption, on-board reference voltages and board temperature.
1.3. Host Interface Unit (HIU)
The HIU is the point of access to the Inter-Module Bus (IMB) for the Module. It also provides
power distribution and local programmable processing power. The HIU is the only section of
the I/O Module to directly connect to the IMB backplane. The HIU is common to most high
integrity I/O types and has type dependent and product range common functions. Each HIU
contains three independent slices, commonly referred to as A, B, and C.
All interconnections between the three slices incorporate isolation to prevent any fault
interaction between the slices. Each slice is considered a Fault Containment Region (FCR), as
a fault on one slice has no effect on the operation of the other slices.
The HIU provides the following services common to the Modules in the family:
•High Speed Fault Tolerant Communications with the TMR Processor via the IMB
interface.
•FCR Interconnect Bus between slices to vote incoming IMB data and distribute
outgoing I/O Module data to the IMB.
•Galvanically isolated serial data interface to the FIU slices.
•Redundant power sharing of dual 24 Vdc Chassis supply voltage and power
regulation for logic power to HIU circuitry.
•Magnetically isolated power to the FIU slices.
•Serial data interface to the FPU for Module status LEDs.
•SmartSlot link between Active and Standby Modules for co-ordination during
Module replacement.
•Digital Signal Processing to perform local data reduction and self-diagnostics.
•Local memory resources for storing Module operation, configuration, and field I/O
data.
•On-board housekeeping, which monitors reference voltages, current consumption
and board temperature.

1. Description Trusted TMR 24Vdc Zone Interface Module 40 Channel
6 Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
1.4. Front Panel Unit (FPU)
The Front Panel Unit (FPU) contains the necessary connectors, switches, logic, and LED
indicators for the Front Panel. For every type of Trusted I/O Module, the FPU contains the
Slice Healthy, Active/Standby, and Educated indicators (LEDs), also the Module removal
switches. Additional bi-colour LEDs provide status indication for the individual I/O signals.
Serial data interfaces connect the FPU to each of the HIU slices to control the LED status
indicators and monitor the Module removal switches.
1.5. Input Line Monitoring Thresholds
Whether selected as a digital or an analogue input, the Module measures the voltage
applied to each input and compares this with four user programmed thresholds and two
fixed (minimum and maximum) thresholds. These may be used within the application to
signal a field device state. Hysteresis is provided on the thresholds by upscale and
downscale values, corresponding to the thresholds for increasing and decreasing values
respectively. The analogue voltage reading is also provided to the application for conversion
to engineering units and/or direct trip derivation.
Default threshold values used for non line monitored inputs are as follows (in raw units):
Default = -5000, -5000, 5000, 5000, 7500, 7500, 11750, 11750
1.6. Housekeeping
The Zone Interface Module automatically performs local measurements of several on-board
signals that can be used for detailed troubleshooting and verification of Module operating
characteristics. Measurements are made within each slice’s HIU and FIU.
1.7. Fault Detection and Testing
Extensive diagnostics provide the automatic detection of Module faults. The TMR
architecture of the Output Module and the diagnostics performed verify the validity of all
critical circuits. Using the TMR architecture provides a Fault Tolerant method to withstand
the first fault occurrence on the Module and continue normal output controls without
interruption in the system or process. Faults are reported to the user through the Healthy
status indicators on the Front Panel of the Module and through the information reported to
the TMR Processor. Under normal operations all three Healthy indicators are green. When a
fault occurs, one of the Healthy indicators will be flashing red. It is recommended that this
condition be investigated and if the cause is within the Module, it should be replaced.

Trusted TMR 24Vdc Zone Interface Module 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 7
Module replacement activities depend on the type of spare Module configuration chosen
when the system was configured and installed. The Module may be configured with a
dedicated Companion Slot or with a SmartSlot for a spare replacement Module.
From the IMB to the field connector, the I/O Module contains extensive fault detection and
integrity testing. Most testing is performed in a non-interfering mode. Data input from the
IMB is stored in redundant error-correcting RAM on each slice portion of the HIU. Received
data is voted on by each slice. All data transmissions include a confirmation response from
the receiver.
Periodically, the TMR Processor commands the on-board Digital Signal Processors (DSPs) to
perform a Safety Layer Test (SLT). The SLT results in the DSP verifying with the TMR
Processor its ability to process data with integrity. In addition, the DSP uses Cyclical
Redundancy Checks (CRC) to verify the variables and configuration stored in Flash memory.
Between the HIU and FIU are a series of galvanically isolated links for data and power. The
data link is synchronized and monitored for variance. Both FIU and HIU have on-board
temperature sensors to characterize temperature-related problems.
The power supplies for both the HIU and FIU boards are redundant, fully instrumented and
testable. Together these assemblies form a Power Integrity Sub-system.
1.8. Sequence of Events Characteristics
The Module automatically measures the field voltage and current to determine the state of
each channel. An event occurs when the channel transitions from one state to another.
When a channel changes state, the on-board timer value is recorded. When the TMR
Processor next reads data from the Module, the channel state and real-time clock value are
retrieved. The TMR Processor uses this data to log the state change into the system
Sequence of Events (SOE) log.
The user may configure each channel to be included in the system SOE log. Full details of
SOE are contained in Trusted Sequence of Events and Process Historian Package, publication
ICSTT-RM243 (PD-T8013).

1. Description Trusted TMR 24Vdc Zone Interface Module 40 Channel
8 Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
1.9. Output Switch Structure
The Zone Interface Module provides a TMR switch topology where the load is driven by a
total of three fully monitored, fail safe (6 element) switch channels, one physically resident
on each OFIU in the Module. Any single switch or entire slice failure is designed to leave two
of the three fail safe switch channels operational to power the load.
Figure 3 Output Switch Structure
The upper switches as shown in Figure 3are denoted as N.O. (Normally Open), and are
controlled by the FIU on which they are physically resident.1The lower switches are
depicted as N.C. (Normally Closed), and are controlled by the “upstream” neighbouring FIU.2
Note: In this context, N.O. is defined as being in the off state in the absence of control signal power, and
similarly, N.C. is the on state in the absence of control signal power. These switches are constructed from
enhancement mode MOSFETs and are both guaranteed to be off in the absence of Module power to create
gate voltage signals to bias them on3(unlike electromechanical relays for example).
The reason that the lower switches are specified to be on in the absence of control signal
power is to allow two channels to power the load should an entire slice fail. Even if an entire
slice fails, the surviving output circuits will carry the necessary control. The structure of each
FIU output is shown below:
1 Their “home” FIU.
2 The home FIU, supplies an independent control signal for the “downstream” FIU FSS.
3For an un-faulted transistor.

Trusted TMR 24Vdc Zone Interface Module 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 9
Figure 4 Simplified Switch Circuit Diagram
A resistor provides a means of continuously monitoring the switch current. A signal
transistor is used to drive the gate of Switch 2. It provides Switch 2 with a negative gate
voltage, to minimize it’s on resistance, and serves to hold Switch 2 on in the event that the
secondary gate control loses power.
The Zener diode between the gate of Switch 2 and source is only required to protect the
gate from large voltage spikes on the drain that might capacitively couple through when
Switch 1 and Switch 2 are in the off state.
The resistors in series with the gate of Switch 1 and the signal transistor serve to protect the
drive logic in the event of a malicious switch failure. The pull-up resistors define the gate
voltages in the absence of power.
1.9.1. Switch Diagnostics
During normal operation, Switch 1 and Switch 2 are maintained on. In this state, Switch 1
and Switch 2 exhibit a low resistance.
To determine the ability of the system to control the load via Switch 1 and Switch 2, their
gate voltages are modulated, one at a time. As the gate voltages are modulated, the
monitoring signals synchronously change in a predictable fashion. The local DSP analyses the
relative amplitude and phase of these small AC signals, to determine the on resistance and
threshold voltages of each switch.
The current to the load does not need to be completely interrupted in order to obtain a
level of confidence in the ability of the transistors to turn off. For the TMR switch
configuration in the on state, only one fail safe switch at a time needs to be modulated,
while the other two bear the load current.

1. Description Trusted TMR 24Vdc Zone Interface Module 40 Channel
10 Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
1.9.2. Short Circuit Protection
Output channels are classified as protected under IEC 61131-2, specifically ‘Protected
Outputs Requirements’.
In a fuse-free design such as in the Trusted System, the Module is required to respond
rapidly in the event of an over-current or over-power situation. In fact, this protection
scheme offers advantages to fuses in both automatic recovery and speed of action.
The topology of the channel provides a natural limit to the instantaneous current flow,
giving the Module time to respond. Furthermore, the over-current protection circuitry is
inherently self-testable, since the threshold can be set to a programmable value.
The P-channel architecture of Switch 1 and Switch 2 has an open-drain output structure.
Under short-circuit conditions the maximum instantaneous current with a 24 V field voltage
is naturally limited to less than 5 A per channel. This is because high output currents cause
the gate-source voltages of the two transistors to be reduced, tending to turn them off.
The output current is monitored by the DSP. Sustained over current conditions cause the
DSP to de-energise the associated output. Once the fault has been corrected, the latched
de-energised state can be cleared by operating the system Fault Reset button or by
transitioning the commanded channel state.
The output also includes a non-replaceable fusible link for absolute protection.
1.9.3. Group Fail Safe Switches
To support safe operation, the Zone Interface Module is equipped with a series of switches
that provide source power to a group of 8 channels. The Module Group Fail Safe Switch
(GFSS) is intended as a final control switch which can de-energise any outputs that cannot
be de-energised in the normal way. For safety, the presence of two or more faults within
the Module will cause the Group Fail Safe Switches to de-energise. This de-energises all of
the outputs in its group.
The GFSS has three switches in parallel, each controlled by one 'slice' of the group. This
means that if one slice determines from the states that an output is not de-energised when
it should be, then it can command its own GFSS and those of the other slices’ GFSS to de-
energise. This results in two of the three elements of the GFSS structure to de-energise,
leaving only one GFSS element energised. If two slices do the same thing then the last GFSS
will de-energise. For example, this would occur if two or more switch elements fail in a
'stuck-on' state such that the output cannot de-energise.
The GFSS control signal is generated by a charge pump driven from the comms clock to the
slice power group. If the clock fails then the GFSS bias collapses. This means that even if the
ability of the slice to communicate with a power group is lost, the GFSS can still be de-
energised by stopping the comms clock. If a slice fails, the watchdog on the HIU will time out

Trusted TMR 24Vdc Zone Interface Module 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM278P-EN-P Issue 16 11
and reset the slice. This will shutdown the FIU power supply and the associated GFSS control
signal will also de-energise.
1.10. Output Line Monitoring States
When a channel is selected as an output, the Module automatically monitors channel
current and voltage to determine the state. The numerical output state and line fault status
are reported back to the application and are represented below.
Description Numerical
Output State
Line Fault
Status
Field Short Circuit 5 1
Output Energised (On) 4 0
No Load, Field Open Circuit 31
Output De-energised (Off) 2 0
No Field Supply Voltage 1 1
Table 1 Line Monitoring Fault Status
1.11. Input Interfaces
Each channel selected as an input is provided with three ADC converters which monitor the
voltage at the input connection. These are the same ADC converters which are used to
determine channel state in the output configuration. Each input is a high impedance
channel and measures from 0 to 30V. If current is to be measured, the input must be
conditioned with an external resistor. This resistor is mounted on the T8842 Versatile Field
Termination Assembly. The Module uses its TMR architecture to provide fault tolerance in
the event of a hardware failure. Dynamic testing of the input path is provided to support
safe operation within the TMR structure.
Note that 24 V field power is required for a Zone Interface Module even if all channels are
configured as volt-free inputs. This may be connected via the plug at the Chassis end of the
cable to a T8290 or T8297 Distribution Unit (for cables without power wires) or at the
Versatile Field Termination Assembly (VFTA) (for integral power cables).
1.12. Field Interface Selection
For details of the recommended field interface circuit configurations, please refer to the
product description for the T8842 Versatile Termination Assembly.

1. Description Trusted TMR 24Vdc Zone Interface Module 40 Channel
12 Issue 16 Rockwell Automation Publication ICSTT-RM278P-EN-P
Page intentionally left blank