Rockwell Automation T8444 Trusted TMR Pulse Generator and Monitoring Module - Manual (Page 37)

Trusted
TM
Module T8444
Issue 09 Apr 10 PD-T8444 37
6.3. Fail Safe actions
This is not a safety system. Other equipment must be supplied for removing the power from the motor
drive circuits in an emergency. Fail safe action in this case is to maintain control of the rods whenever
possible even if a fault is detected in the control Module. For example a slice fault will be logged and
annunciated to the Trusted
TM controller but it will not result in the module entering the “Fatal” state.
This is not a safety critical design and has been classified as Sil0 however it can reside in a system
which is capable of maintaining AK6 on some of its signals.
6.4. Internal testing and Monitoring
Maintaining control of the Damper Rods/Stepper Motors is the primary aim of this system. Fail danger
faults detected by any diagnostics do not lead to the module releasing the Damper rods except in the
manner specified in Framatome Spec 08-5011407-00.
Monitoring which detects faults provides alarm indication but unless totally unavoidable does not
release control of the damper rods.
6.5. Thyristor Driver interfaces/Stepper Motor Drives
6.5.1. Module Start up
When a module is powered up it will maintain all outputs Off. Gate signals will be off and Output
Drives will be off.
The education process is automatic and follows the Trusted
TM standard procedure.
Once the boot and education sequence is complete the module will turn on Outputs A and B for each
Motor. The fault detection will operate and the fault bits will be determined depending upon the field
state.
The Gate drives will remain latched until commanded to reset by the application program.
Should the motor poll pieces not be aligned with A&B it is assumed that a recovery procedure will be
initiated by the application to engage the threaded rod.
After a successful start the Position counters will be set to Zero. This value can be amended using the
INI file if required.
Should a module detect a problem with booting and education the start up will be aborted and the
module will not energise any of its outputs. Restart will be by removal and re insertion of the module.
6.5.2. Minimum output Load
The Pulse Generator and Monitoring Module requires a minimum current to be drawn from each
energised output. If the load to which it is connected is not sufficient. It is suggested that the
termination resistor of 500Ohms should be fitted
6.5.3. Input Termination Resistance
Input circuits accept 0 to 10V analogue values. Circuits which are interfacing to 4 to 20mA signals
should be conditioned with a 500 Ohm resistor.