Rockwell Automation MPP Processor Moduile - Manual (Page 12)

12 MPP October 2005 – Issue 6
Triguard SC300E
Commanded output states are received by an output module’s microcontrollers which, using
2-oo-3 hardware voters, set the outputs to the field. Any discrepancy between a commanded
output state and the field output is detected by the microcontrollers and reported to the
appropriate MPP
OFFLINE/STARTUP DIAGNOSTICS
When a SC300E’s MPPs are first powered up, the following diagnostic routines are executed:
• Initialisation of all SRAM
• Memory configuration and size checks
• RTTS and application logic copied to SRAM
• All program checksums recalculated and checked
• Configuration and checksums of neighbouring MPPs read and confirmed
• Initialisation of synchronisation registers
• Synchronisation registers of neighbouring processors read
A processor will then pause, waiting for the other two MPPs to complete their startup
diagnostics.
At powerup a SC300E system must have three healthy MPPs, otherwise the startup
diagnostics will prevent execution of the system application logic.
In the event of a processor failing a replacement MPP can be brought online using a warm start
command. Warm start commands can be issued from a TriBuild workstation or by use of an
application logic assigned input. A newly installed MPP will execute its startup diagnostics,
monitor the running MPP’s synchronisation registers and await a warm start command. At this
point checksums will be confirmed and the new MPP acquires I/O data tables from its
neighbours and commences execution of its application logic.
Online/continuous diagnostics
All memory reads and writes are automatically checked for errors by the MPPs' error checking
and correcting circuitry. Single memory errors are detected and corrected, all multiple errors
are flagged.
Software Implemented Fault Tolerant (SIFT) votes the data tables between the MPPs using a
majority vote algorithm, any errors being logged and corrected by the processors during their
'read neighbour's data' cycle.
Corrected memory errors are logged in diagnostic history tables. These tables can be
accessed by application logic functions and be used to generate system alarms. If multiple
errors are detected an MPP will be halted. An MPP’s I/O hot repair task regularly scans all