Safety Considerations Guide for Triconex General ... - ICEWeb

40 Chapter 3 Fault Management
Input/Output Processing
The I/O processor is protected by an independent watchdog that verifies the timely execution
of the I/O processor firmware and I/O module diagnostics. In addition, the I/O processor
reports its sequence of process execution to the MP. If an I/O processor fails to execute correctly,
the MP and the I/O processors enter the fail-safe state and the I/O bus for the faulting channel
is disabled, leaving all outputs under control of the remaining healthy channels.
The integrity of the I/O bus is continuously monitored and verified independently by each
channel of the system. A catastrophic bus fault results in affected I/O module channels
reverting to the fail-safe state in less than 500 milliseconds (0.5 seconds), worst case, or less than
10 milliseconds, typically.
I/O Module Alarms
Loss of communication with an I/O module is reported to the control application and can be
used to increase availability during specific multiple-fault conditions.
Main Processor and TriBus
Each Main Processor (MP) module uses memory data comparison between itself and the other
MPs to ensure that the control application executes correctly on each scan. Each MP transfers its
input data to the other two MPs via the TriBus during each scan. Each MP then votes the input
data and provides voted data to the control application. The results of the control application
(outputs), including all internal variables, are transferred by the TriBus. If a mis-compare is
detected, special algorithms are used to isolate the faulting MP. The faulting MP enters the failsafe
state and is ignored by the remaining MPs. Background diagnostics test MP memory and
compare control application instructions and internal status.
The integrity of the TriBus is continuously monitored and verified independently by each MP.
All TriBus faults are detected within the scan associated with the TriBus transfer. Fault isolation
hardware and firmware causes the MP with the faulting TriBus to enter the fail-safe state.
An independent watchdog ensures that the control application and diagnostics execute within
0.5 seconds. If an MP fails to execute the scan, the watchdog forces the MP to the fail-safe state.
The I/O processor adds a sequential element to the MP watchdog. If an MP fails to report the
proper sequence of execution, the I/O processor causes the MP to enter the fail-safe state.
Safety Considerations Guide for Triconex General Purpose v2 Systems