Rockwell Automation T8448 Trusted TMR Zone Interface Module - 40 Channel - Manual (Page 14)

Trusted
TM
Module T8448
Issue 14 Apr 10 PD-T8448 14
Figure 4 Simplified Switch Circuit Diagram
A resistor provides a means of continuously monitoring the switch current. A signal transistor is used
to drive the gate of Switch 2. It provides Switch 2 with a negative gate voltage, to minimize it’s on
resistance, and serves to hold Switch 2 on in the event that the secondary gate control loses power.
The zener diode between the gate of Switch 2 and source is only required to protect the gate from
large voltage spikes on the drain that might capacitively couple through when Switch 1 and Switch 2
are in the off state.
The resistors in series with the gate of Switch 1 and the signal transistor serve to protect the drive logic
in the event of a malicious switch failure. The pull-up resistors define the gate voltages in the absence
of power.
1.9.1. Switch Diagnostics
During normal operation, Switch 1 and Switch 2 are maintained on. In this state, Switch 1 and Switch 2
exhibit a low resistance.
To determine the ability of the system to control the load via Switch 1 and Switch 2, their gate voltages
are modulated, one at a time. As the gate voltages are modulated, the monitoring signals
synchronously change in a predictable fashion. The local DSP analyses the relative amplitude and
phase of these small AC signals, to determine the on resistance and threshold voltages of each switch.
The current to the load does not need to be completely interrupted in order to obtain a level of
confidence in the ability of the transistors to turn off. For the TMR switch configuration in the on state,
only one fail-safe switch at a time needs to be modulated, while the other two bear the load current.
1.9.2. Short Circuit Protection Issues
In a fuse-free design such as in the Trusted TM System, the module is required to respond rapidly in the
event of an over-current or over-power situation. In fact, this protection scheme offers advantages to
fuses in both automatic recovery and speed of action.
The topology of the channel provides a natural limit to the instantaneous current flow, giving the
module time to respond. Furthermore, the over-current protection circuitry is inherently self-testable,
since the threshold can be a programmable value.
The P-channel architecture of Switch 1 and Switch 2 has an open-drain output structure. Under short-
circuit conditions the maximum instantaneous current with a 24V field voltage is naturally limited to less
than 5A per channel. This is because high output currents cause the gate-source voltages of the two
transistors to be reduced, tending to turn them off.