Rockwell Automation T8094 8000 Series TMR System Safety Manual - Manual (Page 103)

SAFETY MANUAL
D oc N umber T8094
I ssue 27 – June 2013
Page 82 of 103
The Trusted processor constantly monitors the analogue data input from the CS300
slices. When a discrepancy greater than 1% is detected between two slices a fault is
declared.
9.6.5 PI-626/PI-726 Digital Output Board
The PI-626/PI-726 voted digital output board receives inputs from each of the T8162
CS300 bridge modules, votes on the inputs, and produces one voted output per
channel.
When the digital output board is used for safety-related applications, it must be
arranged as shown in Figure 12.
9.6.6 PI-627/727 Digital Output Board
The PI-627/727 voted digital output board provides 32 voted output lines.
When the digital output board is used for safety-related applications, it must be
configured for 3-2-0 degradation and arranged as shown in Figure 12. The output
board 3-2-1 function is not validated.
9.6.7 TM118-TWD Watchdog Module
The migrated system must use the TM118-TWD watchdog module to put digital
outputs into a known safe state if the application stops, for example if more than one
T8162 CS300 bridge module fails.
The migrated system must pulse the outputs to the TM118-TWD watchdog module at
intervals of no more than five seconds. An interval of one second is recommended.
The five second period between system failure and the watchdog module trip must be
accounted for in the overall process safety time. Refer to the information in section
1.3.3 for details about PST.
The watchdog may be patted as fast as the application scan rate will allow an output to
be toggled; i.e. two application scan periods.
Note: The use of three separate digital output modules for the three signals is
recommended. Refer to Figure 12.
The state of the watchdog must be monitored and, if the watchdog goes to the tripped
state, all outputs associated with the watchdog must be latched to the tripped condition
until a manual reset is applied.