Rockwell Automation Trusted TMR User manual

ICSTT-RM046A-EN-E (PD-T8425) Trusted
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1
Trusted TMR 35 to 120 Vdc Digital Input Module –
40 Channel
Product Overview
The Trusted®TMR 120 Vdc Digital Input Module interfaces to 40 field input devices. Fault tolerance
is achieved through a Triple Modular Redundant (TMR) architecture within the Module for each of
the 40 input channels.
Each field input is triplicated and the input voltage is measured using a sigma-delta input circuit.
The resulting field voltage measurement is compared to user configurable threshold voltages to
determine the reported field input state. When a line-monitoring device is installed at the field
switch, the Module can detect open and short circuit field cables. Line monitoring functions are
independently configured for each input channel. The triplicated voltage measurement, coupled
with on-board diagnostic testing, provides comprehensive fault detection and tolerance.
The Module provides on-board Sequence of Events (SOE) reporting with a resolution of 1 ms. A
change of state triggers an SOE entry. States are determined by voltage thresholds that can be
configured on a per channel basis.
Features:
•40 Triple Modular Redundant (TMR) input channels per Module.
•Comprehensive, automatic diagnostics and self-test.
•Selectable line monitoring per channel to detect open circuit and short circuit field wiring
faults.
•2500 V impulse withstand opto/galvanic isolation barrier.
•On-board Sequence of Events (SOE) reporting with 1 ms resolution.
•Module can be hot-replaced on-line using dedicated Companion (adjacent) Slot or SmartSlot
(one spare slot for many modules) configurations.
•Front Panel input status LEDs for each channel indicate input status and field wiring faults.

Trusted ICSTT-RM046A-EN-E (PD-T8425)
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1
•Front panel module status LEDs indicate module health and operational mode (Active,
Standby, Educated).
•TϋV Certified IEC 61508 SIL 3.

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel PREFACE
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 i
PREFACE
In no event will Rockwell Automation be responsible or liable for indirect or consequential damages
resulting from the use or application of this equipment. The examples given in this manual are
included solely for illustrative purposes. Because of the many variables and requirements related to
any particular installation, Rockwell Automation does not assume responsibility or reliability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, with respect to use of information, circuits,
equipment, or software described in this manual.
Allen-Bradley, LISTEN. THINK. SOLVE., Rockwell Automation, TechConnect, and Trusted are
trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
All trademarks are acknowledged.
DISCLAIMER
It is not intended that the information in this publication covers every possible detail about the
construction, operation, or maintenance of a control system installation. You should also refer to
your own local (or supplied) system safety manual, installation and operator/maintenance manuals.
REVISION AND UPDATING POLICY
This document is based on information available at the time of its publication. The document
contents are subject to change from time to time. The latest versions of the manuals are available at
the Rockwell Automation Literature Library under "Product Information" information "Critical
Process Control & Safety Systems".
TRUSTED RELEASE
This technical manual was updated for Trusted Release 4.0.
LATEST PRODUCT INFORMATION
For the latest information about this product review the Product Notifications and Technical Notes
issued by technical support. Product Notifications and product support are available at the Rockwell
Automation Support Centre at
http://rockwellautomation.custhelp.com
At the Search Knowledgebase tab select the option "By Product" then scroll down and select the
Trusted product.
Some of the Answer ID’s in the Knowledge Base require a TechConnect℠Support Contract. For more
information about TechConnect Support Contract Access Level and Features, click on the following
link:
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/50871

PREFACE Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel
ii Issue 1 Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425)
This will get you to the login page where you must enter your login details.
IMPORTANT A login is required to access the link. If you do not have an account then you can create one
using the "Sign Up" link at the top right of the web page.
DOCUMENTATION FEEDBACK
Your comments will help us serve your documentation needs better. If you have any suggestions on
how to improve this document, complete the How Are We Doing? form at
https://literature.rockwellautomation.com/idc/groups/literature/documents/du/ra-du002_-en-e.pd
f.

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel PREFACE
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 iii
SCOPE
This manual specifies the maintenance requirements and describes the procedures to assist
troubleshooting and maintenance of a Trusted system.
WHO SHOULD USE THIS MANUAL
This manual is for plant maintenance personnel who are experienced in the operation and
maintenance of electronic equipment and are trained to work with safety systems.
SYMBOLS
In this manual we will use these notices to tell you about safety considerations.
SHOCK HAZARD: Identifies an electrical shock hazard. If a warning label is fitted, it
can be on or inside the equipment.
WARNING: Identifies information about practices or circumstances that can cause
an explosion in a hazardous environment, which can cause injury or death,
property damage or economic loss.
ATTENTION: Identifies information about practices or circumstances that can cause
injury or death.
CAUTION: Identifies information about practices or circumstances that can cause
property damage or economic loss.
BURN HAZARD: Identifies where a surface can reach dangerous temperatures. If a
warning label is fitted, it can be on or inside the equipment.
This symbol identifies items which must be thought about and put in place when
designing and assembling a Trusted controller for use in a Safety Instrumented
Function (SIF). It appears extensively in the Trusted Safety Manual.
IMPORTANT Identifies information that is critical for successful application and understanding of
the product.
NOTE Provides key information about the product or service.
TIP Tips give helpful information about using or setting up the equipment.

PREFACE Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel
iv Issue 1 Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425)
WARNINGS AND CAUTIONS
WARNING: EXPLOSION RISK
Do not connect or disconnect equipment while the circuit is live or unless the area is
known to be free of ignitable concentrations or equivalent
AVERTISSEMENT - RISQUE D’EXPLOSION
Ne pas connecter ou déconnecter l’équipement alors qu’il est sous tension, sauf si
l’environnement est exempt de concentrations inflammables ou équivalente
MAINTENANCE
Maintenance must be carried out only by qualified personnel. Failure to follow these
instructions may result in personal injury.
CAUTION: RADIO FREQUENCY INTERFERENCE
Most electronic equipment is influenced by Radio Frequency Interference. Caution
should be exercised with regard to the use of portable communications equipment
around such equipment. Signs should be posted in the vicinity of the equipment
cautioning against the use of portable communications equipment.
CAUTION:
The module PCBs contains static sensitive components. Static handling precautions
must be observed. DO NOT touch exposed connector pins or attempt to dismantle a
module.

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel PREFACE
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 v
ISSUE RECORD
Issue Date Comments
1 Jul 19 First issue

PREFACE Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel
vi Issue 1 Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425)
Page intentionally left blank

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel Table of Contents
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 1
Table of Contents
1. Description .............................................................................................................3
1.1. Field Termination Unit (FTU)....................................................................................................... 4
1.2. Field Interface Unit (FIU).............................................................................................................5
1.3. Host Interface Unit (HIU) ............................................................................................................ 5
1.4. Front Panel Unit (FPU) ................................................................................................................ 6
1.5. Line Monitoring Thresholds ........................................................................................................ 6
1.6. Housekeeping.............................................................................................................................. 9
1.7. Fault Detection and Testing ........................................................................................................9
1.8. Sequence of Events Characteristics .......................................................................................... 10
2. Installation...........................................................................................................12
2.1. Module Insertion/Removal .......................................................................................................12
2.2. Field Cable Selection .................................................................................................................12
2.3. Module Pin-out Connections ....................................................................................................13
2.4. Trusted Module Polarisation/Keying. .......................................................................................14
3. Application ...........................................................................................................16
3.1. Module Configuration...............................................................................................................16
3.2. T8425 Complex Equipment Definition ...................................................................................... 16
3.2.1. Rack 1: DI...........................................................................................................................18
3.2.2. Rack 2: STATE ....................................................................................................................
18
3.2.3. Rack 3: AI ...........................................................................................................................19
3.2.4. Rack 4: SPARE ....................................................................................................................20
3.2.5. Rack 5: LINE_FLT................................................................................................................20
3.2.6. Rack 6: DISCREP.................................................................................................................20
3.2.7. Rack 7: HKEEPING..............................................................................................................21
3.2.8. Rack 8: Information ........................................................................................................... 23
3.3. Sequence of Events Configuration............................................................................................25
3.4. System.INI File Configuration....................................................................................................25
4. Operation .............................................................................................................28
4.1. Front Panel ................................................................................................................................28
4.2. Module Status LEDs...................................................................................................................29
4.3. I/O Status LEDs..........................................................................................................................30
5. Fault Finding and Maintenance..............................................................................32
5.1. Fault Reporting..........................................................................................................................32
5.2. Field Wiring Faults.....................................................................................................................32

Table of Contents Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel
2 Issue 1 Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425)
5.3. Module Faults ...........................................................................................................................32
5.4. Companion Slot.........................................................................................................................33
5.5. SmartSlot...................................................................................................................................33
5.6. Cold Start...................................................................................................................................33
5.7. Transfer between Active and Standby Modules.......................................................................34
6. Specifications........................................................................................................36

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 3
1. Description
The Trusted TMR 35-120 Vdc Digital Input Module is a member of the Trusted range of
Input/Output (I/O) Modules. All Trusted I/O Modules share common functionality and form.
At the most general level, all I/O Modules interface to the Inter-Module Bus (IMB) which
provides power and allows communication with the Trusted TMR Processor. In addition, all
Modules have a field interface that is used to connect to module specific signals in the field.
All Modules are Triple Modular Redundant (TMR).
The T8425 replaces the T8423 module, but it is not a direct replacement. When using the
T8425 module, replace the Field Termination Assembly (FTA) with the T8825 FTA and alter
the cable keying.
Figure 1 Module Architecture

1. Description Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel
4 Issue 1 Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425)
All Trusted I/O Modules comprise four sections: Host Interface Unit (HIU), the Field Interface
Unit (FIU), the Field Termination Unit (FTU) and the Front Panel Unit (or FPU). The Field
Termination Assembly (FTA) is shown with its onboard attenuation because of its
importance to the operation of the T8425 module.
Figure 2 shows a simplified functional block diagram of the Trusted 120 Vdc Digital input
module.
Figure 2 Functional Block Diagram
1.1. Field Termination Unit (FTU)
The Field Termination Unit (FTU) is the section of the I/O Module that connects all three
FIUs to a single field interface. The FTU primarily contains passive components necessary for
front-end signal conditioning, field signal over-voltage protection, and EMI/RFI filtering.
When installed in a Trusted Controller or Expander Chassis, the FTU field connector
interconnects to the I/O cable assembly attached at the rear of the Chassis.
The SmartSlot link is passed from the HIU to the field connections via the FTU. These signals
go directly to the I/O cable assembly and maintain isolation from the I/O signals on the FTU.
The SmartSlot link is the intelligent connection between Active and Standby Modules for
co-ordination during Module replacement.

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 5
1.2. Field Interface Unit (FIU)
The Field Interface Unit (FIU) is the section of the Module that contains the specific circuits
necessary to interface to the particular types of field I/O signals. Each Module has three
FIUs, one per slice. For the TMR 120 Vdc Digital Input Module, the FIU contains an individual
analogue to digital converter (ADC) for each of the 40 field inputs.
The FIU receives isolated power from the HIU for logic. The FIU provides additional power
conditioning for the operational voltages required by the FIU circuitry. An isolated serial link
connects each FIU to one of the HIU slices.
The FIU also measures a range of on-board “housekeeping” signals that assist in monitoring
the performance and operating conditions of the Module. These signals include power
supply voltages, current consumption, on-board reference voltages, board temperature, and
condensation.
1.3. Host Interface Unit (HIU)
The HIU is the point of access to the Inter-Module Bus (IMB) for the Module. It also provides
power distribution and local programmable processing power. The HIU is the only section of
the I/O Module to directly connect to the IMB Backplane. The HIU is common to most
Trusted I/O types and has type dependent and product range common functions. Each HIU
contains three independent slices, commonly referred to as A, B, and C.
All interconnections between the three slices incorporate isolation to help prevent any fault
interaction between the slices. Each slice is considered a Fault Containment Region (FCR), as
a fault on one slice has no effect on the operation of the other slices.
The HIU provides the following services common to the modules in the family:
•High Speed Fault Tolerant Communications with the TMR Processor via the IMB
interface.
•FCR Interconnect Bus between slices to vote incoming IMB data and distribute
outgoing I/O Module data to the IMB.
•Optically isolated serial data interface to the FIU slices.
•Redundant power sharing of dual 24 Vdc chassis supply voltage and power
regulation for logic power to HIU circuitry.
•Magnetically isolated power to the FIU slices.
•Serial data interface to the FPU for Module status LEDs.
•SmartSlot link between Active and Standby Modules for co-ordination during
Module replacement.
•Digital Signal Processing to perform local data reduction and self-diagnostics.

1. Description Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel
6 Issue 1 Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425)
•Local memory resources for storing module operation, configuration, and field I/O
data.
•On-board housekeeping, which monitors reference voltages, current consumption
and board temperature.
1.4. Front Panel Unit (FPU)
The Front Panel Unit (FPU) comprises a Front Panel Termination Unit (FPTU) and a Front
Panel Display Unit (FPDU). The overall FPU contains the necessary connectors, switches,
logic, and LED indicators for the Front Panel. For every type of Trusted I/O Module, the FPU
contains the Slice Healthy, Active/Standby and Educated indicators (LEDs), and the module
removal switches. Additional bi-color LEDs provide status indication for the individual I/O
signals. Serial data interfaces connect the FPU to each of the HIU slices to control the LED
status indicators and monitor the module removal switches.
1.5. Line Monitoring Thresholds
The Module determines the contact state and line fault status by comparing the input
voltage level to four user programmed thresholds and two fixed (minimum and maximum)
thresholds. A “Contact Indeterminate” region is defined between the contact Closed and
Open states to account for marginal faults in the external wiring or in the FIU. Hysteresis is
provided on the thresholds by up-scale and downscale values, corresponding to the
thresholds for increasing and decreasing values respectively.
The tables below show example threshold data for both 120 Vdc input contacts and 48 Vdc
input contacts both with line monitoring respectively.

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 7
Typical voltage
threshold values Input Channel
State
DI Status
Line Fault
Status
Over-range 6 0 1
Tmax 160.0
Short Circuit 5
T8 111.0
4 or 5
(see Note) 0/1 0/1
T7 110.0
Contact Closed 4 ‘1’ 0
T6 91.0
3 or 4 0/1 0/1
T5 90.0
Contact Indeterminate 3 0 1
T4 41.0
2 or 3 0
T3 40.0
Contact Open 2
T2 11.0
1 or 2 0/1
T1 10.0
Open Circuit 1 1
Tmin -10.0
Under-range 0
Table 1 Example Threshold Data (120 Vdc)

1. Description Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel
8 Issue 1 Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425)
Note: The channel state value returned is dependent on the previous state value. If the input level is increasing
then the lower state value will be returned. If the input level is decreasing the higher state value will be
returned.
Typical voltage
threshold values
Input
Channel
State
DI
Status
Line Fault
Status
Over-range 6 0 1
Tmax 160.0
Short Circuit 5
T8 44.4
4 or 5
(see Note) 0/1 0/1
T7 44.0
Contact Closed 4 ‘1’ 0
T6 36.4
3 or 4 0/1 0/1
T5 36.0
Contact Indeterminate 3 0 1
T4 16.4
2 or 3 0
T3 16.0
Contact Open 2
T2 4.4
1 or 2 0/1
T1 4.0
Open Circuit 1 1
Tmin -10.0
Under-range 0
Table 2 Example Threshold Data (48 Vdc)

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 9
Note: The channel state value returned is dependent on the previous state value. If the input level is increasing
then the lower state value will be returned. If the input level is decreasing the higher state value will be
returned.
When a Module is inserted into the standby slot in a line-monitored application, then the
field terminations for all the input channels are paralleled, resulting in a drop in the input
voltages for the Active Module.
The Module biases each input channel by means of a 60 kΩ (typical for 120 Vdc digital
inputs) termination resistor to the 0 V reference of the module input circuitry. In the
absence of any line fault, the resistors used for line monitoring purposes form a voltage
divider with the termination resistor in the Module. Typically, the values are chosen so that
the open contact voltage at the input terminal is about 1/3of the field supply; with the user
contact closed the voltage is about 2/3of the field supply.
Default threshold values used for non-line monitored inputs are as follows (in raw units):
Default = -640, -256, 2432, 3712, 11136, 12416, 18560, 19840
1.6. Housekeeping
The Input Module automatically performs local measurements of several on-board signals
that can be used for detailed troubleshooting and verification of module operating
characteristics. Measurements are made within each slice’s HIU and FIU.
1.7. Fault Detection and Testing
Extensive diagnostics provide the automatic detection of Module faults. The TMR
architecture of the Output Module and the diagnostics performed verify the validity of all
critical circuits. Using the TMR architecture provides a Fault Tolerant method to withstand
the first fault occurrence on the Module and continue normal output controls without
interruption in the system or process. Faults are reported to the user through the Healthy
status indicators on the Front Panel of the Module and through the information reported to
the TMR Processor. Under normal operations all three Healthy indicators are green. When a
fault occurs, one of the Healthy indicators will be flashing red. It is recommended that this
condition is investigated and if the cause is within the Module, it should be replaced.
Module replacement activities depend on the type of spare module configuration chosen
when the system was configured and installed. The Module may be configured with a
dedicated Companion Slot or with a SmartSlot for a spare replacement module.
From the IMB to the field connector, the Input Module contains extensive fault detection
and integrity testing. As an input device, all testing is performed in a non-interfering mode.
Data input from the IMB is stored in redundant error-correcting RAM on each slice portion
of the HIU. Received data is voted on by each slice. All data transmissions include a
confirmation response from the receiver.

1. Description Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel
10 Issue 1 Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425)
Between the HIU and FIU, there are a series of optically isolated links for data and power.
The data link is synchronised and monitored for variance. Both the FIU and HIU have
on-board temperature sensors to characterise temperature-related problems. Each FIU is
also fitted with a condensation sensor.
The power supplies for both the HIU and FIU boards are redundant, fully instrumented and
testable. Together, these assemblies form a Power Integrity Sub-system.
The Module field input is connected to a single bit ADC known as the Σ∆ input circuit. These
circuits, one per channel on each slice, produce a digital output which naturally transitions
between on and off. Any failure in the circuit causes the output to saturate to stuck-on or
stuck-off which is automatically detected. As the conversion process is dynamic and not
gated like traditional ADCs, failures are rapidly diagnosed and located.
By using the Σ∆ circuit, the analogue path in the Module is short and does not involve many
components. This results in analogue failures being contained to a single channel on a single
slice instead of causing a group of eight or more inputs to fail.
1.8. Sequence of Events Characteristics
The Input Module automatically measures the field input voltage, compares the value to the
configurable thresholds, and determines the state of the field input. An event occurs when
the input transitions from one state to another. When an input changes state, the on-board
real-time clock value is recorded. When the TMR Processor next reads data from the Input
Module, the input state and real-time clock values are retrieved. The TMR Processor uses
this data to log the input state change into the system Sequence of Events (SOE) log. The
user may configure each input to be included in the system SOE log. Full details of SOE are
contained in Trusted Sequence of Events and Process Historian Package, publication
ICSTT-RM243 (PD-T8013).

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel 1. Description
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 11
Page intentionally left blank

Trusted TMR 35 to 120 Vdc Digital Input Module – 40 Channel 2. Installation
Rockwell Automation Publication ICSTT-RM046A-EN-E (PD-T8425) Issue 1 12
2. Installation
2.1. Module Insertion/Removal
CAUTION:
The Module contains static sensitive parts. Static handling precautions must be
observed. Specifically ensure that exposed connector pins are not touched. Under no
circumstances should the module housing be removed.
Before installation, visually inspect the module for damage. Ensure that the module housing
appears undamaged and inspect the I/O connector at the back of the module for bent pins.
If the module appears damaged or any pins are bent, do not install the module. Do not try
to straighten bent pins. Return the module for replacement.
Ensure that the module is of the correct type.
Record the module type, revision and serial number of the module before installation.
To install the module:
1. Ensure that the field cable assembly is installed and correctly located.
2. Release the ejector tabs on the module using the release key. Ensure that the ejector
tabs are fully open.
3. Holding the ejectors, carefully insert the module into the intended slot.
4. Push the module fully home by pressing on the top and bottom of the module fascia.
5. Close the module ejectors, ensuring that they click into their locked position.
The module should mount into the chassis with a minimum of resistance. If the module does
not mount easily, do not force it. Remove the module and check it for bent or damaged
pins. If the pins have not been damaged, try reinstalling the module.
2.2. Field Cable Selection
I/O cables suitable for use with the Trusted TMR 120 Vdc Digital Input Module are detailed
in the following Product Descriptions.
•Trusted I/O Companion Slot Cables, publication ICSTT-RM311 (PD-TC200)
•Trusted I/O SmartSlot Cables, publication ICSTT-RM313 (PD-TC500)
The Product Descriptions detailed above also detail the types of Field Termination Assembly
(FTA) which may be used with this type of Module.