Rockwell Automation T8094 8000 Series TMR System Safety Manual - Manual (Page 44)

SAFETY MANUAL
D oc N umber T8094
I ssue 27 – June 2013
Page 23 of 103
3.2.2 High-Density I/O
The High-Density I/O modules are either inherently triplicated or dual redundant with
comprehensive self-test and diagnosis facilities. The self-tests are co-ordinated to
ensure that a majority can be established even in case of a demand during the
execution of the tests. Discrepancy and deviation monitoring further enhance the
verification and fault detection. The TMR Processor tests internal interfaces to the
controller. The culmination of these measures results in high levels of fault detection
and tolerance, ultimately leading to fail-safe operation in the event of multiple fault
conditions. The maximum fault detection time for each module type is specified within
its associated Product Description. In all cases, even in the presence of a fault during
this period, the system will continue to be able to respond. Under multiple fault
conditions the second fault detection period within the repair time may need to be
considered where the system is used in high or continuous demand safety
applications.
All High Density I/O modules include line-monitoring facilities; it is recommended that
these facilities be enabled for safety-related I/O. For normally de-energised I/O these
facilities shall be enabled, see 3.2.4.
Ch. A
Ch. B
Ch. C
Figure 3 - Single High Density TMR I/O Module Architecture
The system supports single module, where it is acceptable to either stop the system or
allow the signals corresponding to that module to change to their default state, and two
active-standby configurations. The first active-standby configuration is to
accommodate the active and spare modules in adjacent slot positions, the second is
use the SmartSlot configuration where a single module position may be used as the
spare for a number of active modules. All configurations may be used for safety-
related applications; the choice between the configurations supporting live on-line
repair is dependent on the end-user’s preference and the number of faulty modules to
be repaired simultaneously.