Rockwell Automation T7480 ICS Regent+Plus Guarded Analog Output Modules - Manual (Page 3)

Guarded Analog Output Modules (T7480)
P D - 7 0 2 6 M a r - 0 6
3
The combination of redundant interface circuits, D/A
converters, and comparison of drive and reference signals
produces a fail-safe signal to the load.
For fault tolerant operation, two Guarded analog output
modules can be used in parallel. In this configuration, the
STATUS OUT and STATUS IN signals are cross-strapped
between the two redundant modules. This connection causes
only one of the analog output modules to control the field
devices, while the redundant module is in a standby mode. In
the standby mode the module has its D/A converter output
signals shunted to AGND. This allows the module to
completely test and validate its analog drive circuits while the
other module controls the load devices. If the controlling
module fails, it turns off and the standby module becomes the
controlling module. This switch over occurs in less than 5
msec and is effectively bumpless for most field devices.
Testing and Diagnostics
The voter and I/O bus interface logic of the Guarded analog
output module are automatically tested by the processor
modules. Discrepant data are sent through one of three legs
of the I/O Safetybus to determine whether the module’s voters
are able to outvote the incorrect data. A failure to return the
correct majority-voted result to the processors produces an I/O
module error indication at the processor modules and a
module fault indication at the I/O module.
Each type of module has a unique identification code that is
read by the controller. This code lets the controller know
which type of module is installed in each I/O chassis slot and
how to address that module and its points specifically. If a
module is removed, or is replaced with a module of a different
type, the processor modules will indicate an I/O module error.
Loopback logic tests periodically write data to the module and
then read it back to determine whether the module’s I/O bus
interface logic is functioning correctly.
To detect a failure in the redundant analog drive circuits,
each channel’s redundant D/A converter output signals are
compared. If they are not the same, a fault signal is sent to
the fault summary circuits to disable the module’s outputs —