Safety Considerations Guide for Trident v2 Systems - TUV ...

34 Chapter 3 Fault Management
Overview
The Trident controller has been designed from its inception with self-diagnostics as a primary
feature. Triple-Modular Redundant (TMR) architecture (shown in Figure 9) ensures fault
tolerance and provides error-free, uninterrupted control in the event of hard failures of
components or transient faults from internal or external sources.
As described in IEC 61508, the hardware fault tolerance of the Triconex controller is one.
Each I/O module houses the circuitry for three independent channels. Each channel on the
input modules reads the process data and passes that information to its respective main
processor. The three Main Processor (MP) modules communicate with each other using a
proprietary, high-speed bus system called the TriBus.
Extensive diagnostics on each channel, module, and functional circuit quickly detect and report
operational faults by means of indicators or alarms. This fault information is available to an
application. It is critical that an application properly manage fault information to avoid an
unnecessary shutdown of a process or plant.
This section discusses the methods for properly handling faults.
Field
Input
Input Module
Hot Spare
Input
Channel A
Input
Channel B
Input
Channel C
Channel A I/O Bus
Channel B IO/ Bus
MP B IOP B
(SX) (IOX)
Channel C I/O Bus
Figure 9 Typical Triconex Controller
Safety Considerations Guide for Trident v2 Systems
MP A IOP A
(SX)
MP C
(SX)
TriBus & TriTime
(IOX)
IOP C
Diagnostic Channel
(IOX)
Output
Channel A
Output
Channel B
Output
Channel C
Output Module
Hot Spare
Output Voter
Field
Output