ICS Triplex ICS Regent+Plus Isolated Guarded Output Modules Reference Manual

ICS Regent+Plus
®
PD-7034
Isolated Guarded Output Modules
24 to 120 VAC/DC
(T7485)
Issue 1, March, 06
The Isolated Guarded output module provides Guarded
control of eight isolated user output loads. One type of module
is available to interface to outputs powered from isolated field
power supplies operating between 12 to 130 VAC or 15 to 150
VDC. This module is called Guarded because the module's
dual-redundant design ensures that no single fault within the
module will inadvertently apply power to an output. The
module is ideally suited for controlling isolated, safety critical
inductive loads such as motor starters. Other applications
include output circuits that contain additional safety interlock
contacts or switches in series with the module outputs.
Features
·
•
•
•
•
·
•
·
Eight isolated Guarded outputs.
Fault tolerant operation when connected in parallel with
another module of the same type.
Hot-replaceable.
Complete, automatic testing of all output circuits, independent
of load or field power connection.
Individual front panel indicators on each module show module
fault/active status and shutdown state; additional indicators
show output on/off status and blown fuse for each point.
Fuses accessible from front panel.
2500 minimum electrical isolation between field and logic
circuits.
TÜV certified, Risk Class 5.
The module's triplicated Safetybus interface ensures that no
Regent system failure will inadvertently apply power to an
output. Extensive fault detection and redundant critical
circuits ensure that the module operates in a fail-safe manner.
Industrial Control Services
1
Isolated Guarded Digital Output Module (T7485)
Two isolated Guarded output modules can be connected in
parallel to obtain fault tolerant control of power to loads. In
this parallel module configuration, either module can be
removed and replaced while the other Guarded module
continues to control the loads without interruption.
Module Operation
A block diagram of a typical isolated Guarded digital output
module is shown in Figure 1.
Figure 1. Block Diagram of Isolated Guarded Digital Output Module.
The processor modules send triplicated write data commands
over the I/O Safetybus to the isolated Guarded output module.
Onboard the output module the triplicated data are routed to
two independent voters which provide voted data to associated
2
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
field programmable gate arrays (FPGA). Each FPGA
independently operates one of the two output control switches.
The two output switches are connected in series with the load.
When both output switches are on, current will flow through
the output and energize a field load. If either switch is off,
current will not flow through the output and the load will be
de-energized. This combination of series output switches and
independent drive signals produces fail-safe activation of the
load. Single failures can only affect one of the output drive
signals or switches. A single failure will result in either
continued correct control or a fail-safe output as shown in
Table 1.
Table 1. Output States After Switch Failure.
Case
Commanded
Output State
Switch
Failed
State
Actual
Output
to Load
1
On
On
On
Continued correct control.
Automatic testing detects
stuck-on switch. If output is
subsequently commanded
off, output will turn off.
2
On
Off
Off
Fail-safe output. Automatic
testing detects stuck-off
switch.
3
Off
On
Off
Continued correct control.
Automatic testing detects
stuck-on switch. If output is
subsequently commanded
on, output will turn on.
4
Off
Off
Off
Fail-safe output. Automatic
testing detects stuck-off
switch. If output is subsequently commanded on,
output will remain off.
Remarks
To achieve fault tolerance, two isolated Guarded output
modules are used with their outputs connected in parallel.
This configuration provides for continued correct control even
when one output switch fails off (cases two and four in
Table 1). The module failure is automatically detected and
the module can be removed and replaced without interrupting
output control.
PD-7034
Mar-06
3
Isolated Guarded Digital Output Module (T7485)
Testing and Diagnostics
Automatic testing is performed on the isolated Guarded
output modules and its internal output circuits. The output
circuits are completely tested independent of any field load or
power connections. The module does not perform line
monitoring of the wiring connections to field loads.
Module Testing
Each voter and FPGA logic section of the isolated Guarded
output module is automatically tested by the processor
modules. Discrepant data are sent through one of three legs
of the I/O Safetybus to determine whether the module’s voters
are able to outvote the incorrect data. A failure to return the
correct majority-voted result to the processors produces an I/O
module error indication at the processor modules and a
module fault indication at the I/O module.
Each type of module has a unique identification code that is
read by the controller. This code lets the controller know
which type of module is installed in each I/O chassis slot and
how to address that module and its points specifically. If a
module is removed, or is replaced with a module of a different
type, the processor modules will indicate an I/O module error.
Loopback logic tests periodically write data to the module and
then read it back to determine whether the module’s I/O bus
interface logic is functioning correctly.
Output Circuit Testing
The output circuits of the isolated Guarded output module are
automatically tested to detect failures in the redundant
output switch circuits on-board the module. The output fuses
are also checked for blown fuse conditions.
Output Switch Testing
To detect a failure in the redundant output switch circuits,
each output switch is checked for turn-on and turn-off
capability. Periodically, each output switch circuit on the
module is tested for its ability to change its current state.
During testing, the output state is changed; outputs that are
on are turned off and outputs that are off are turned on.
Output switch testing is no-coincident and does not produce a
turn-on pulse to the load. Two output test pulses are
4
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
performed on each switch to eliminate the effects of AC phase
on the test.
When two isolated Guarded output modules are wired in
parallel for fault tolerance, the output circuit testing is noncoincident between the modules and the test pulses do not
disturb the load in either the on or off state.
When an output switch is tested, the test pulse duration is
nominally 125 msec, and is insufficient to affect the state of
most field loads. The output circuit test interval will range
from 1 to 60 seconds, depending on the quantity of I/O
configured in the system.
If an output switch doesn’t change state when tested, an
output switch fault is detected. An output switch failure is
annunciated as a module fault. An I/O module fault is
indicated by the module FAULT LED on the module, the red
I/O fault LEDs on the processor modules and the system
control relay fault bit for the module assembly and slot.
Output Fuse Monitoring
For each output, the voltage at the fuse terminal is monitored
and the optically coupled signal is sensed by the FPGAs. If a
fuse blows, the corresponding output’s blown fuse LED is
illuminated on the front of the module and a module fault is
also indicated.
Note: There are three instances when a blown fuse will not be
detected. These are described below.
PD-7034
Mar-06
1)
For DC voltage applications, the positive side of the
field power source must be connected to the “IN”
terminal and the load must be connected to the fused
“OUT” terminal for proper blown fuse detection.
2)
If dual modules are wired in parallel for fault tolerance,
when an output is on and only one of the two modules’
fuse blows, the blown fuse is not detected. This effect
will not normally occur, because if an output load short
circuit occurs, both modules’ fuse should blow.
3)
When an output is fully connected to a load and power
source, and the output is in the off state, if the field
power supply is not powered (i.e. the power source’s
5
Isolated Guarded Digital Output Module (T7485)
primary voltage is switched off) a blown fuse will not be
detected. This is illustrated in Figure 2.
Figure 2. Case 3: No Blown Fuse Detection.
Front Panel
Figure 3 shows the physical features of the isolated Guarded
output module. The front panel of the module contains a
module active and fault status indicator, a shutdown
indicator, as well as output fuses, output status indicators and
blown fuse indicators for the output circuits.
Active/Fault Status Indicators
These green and red LEDs indicate the overall health of the
module and output circuits. During normal operation, the
green ACTIVE indicator flashes at the controller's scan rate.
If a module fault is detected, the red FAULT indicator turns
on and the green ACTIVE indicator turns off.
6
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
Figure 3. Isolated Guarded Output Module.
PD-7034
Mar-06
7
Isolated Guarded Digital Output Module (T7485)
Shutdown Indicator
Upon loss of communications with the controller, output
modules enter either a shutdown or hold fault mode. If the I/O
unit is set to shutdown, the red SHUTDOWN indicator will
turn on when communications with the controller are lost. If
the I/O unit is set to hold, the SHUTDOWN indicator will
always be off (see page 13, Fault Mode Jumper).
Note: When the module is installed in the I/O chassis or when logic
power (from the I/O power supply modules) is first applied to
the module, it will be in the shutdown mode until the first
output scan, regardless of the fault mode jumper settings.
Also, removing two I/O transceiver modules, two I/O power
supply modules, or two power legs will cause the module to be
in the shutdown mode.
Output Status Indicators
The output status indicators are yellow LEDs, located on the
front of the module. The FPGAs logically drive the output
status LEDs. The indicator is on when both of the FPGAs
agree that the output circuit is energized.
The blown fuse indicators are red LEDs. When a blown fuse is
detected the LED is energized. Under certain operating
conditions, a blown fuse may not be detected. For more
information see Output Fuse Monitoring, on page 5.
Application
Isolated Guarded output modules provide a suitable interface
to safety-critical output devices. These safety-critical devices
typically include motor starters, motor operated valves or
other output circuits operating from isolated power sources.
Isolated Guarded output modules can be used for fail-safe or
fault tolerant operation.
Fail-Safe Configuration
As shown in Figure 4, fail-safe configuration uses a single
isolated Guarded output module. In this configuration, the
worst case failure will cause the output to fail to the off state.
8
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
In a fail-safe configuration, removing the module disables all
outputs.
Figure 4. Fail-Safe Configuration.
Fault Tolerant Configuration
For fault tolerant operation, two isolated Guarded output
modules are connected in parallel as shown in Figure 5. In
this configuration, operation continues even if one module
fails.
In the fault tolerant configuration, a failed module can be
removed and replaced without interrupting operation of the
loads.
Figure 5. Fault Tolerant Configuration.
PD-7034
Mar-06
9
Isolated Guarded Digital Output Module (T7485)
Fault Tolerant Configuration with Redundant
Actuators
When redundant actuators are installed in the field, the level
of fault protection can be extended to include the field wiring
and actuators. Each actuator should be connected to an
individual isolated Guarded output module as shown in
Figure 6.
In this configuration continuous operation can be maintained
even if a module, field wiring or load fault occurs.
Figure 6. Fault Tolerant Configuration with Redundant
Actuators.
Output Load Considerations
Output Current Ratings
The output current ratings for the isolated Guarded output
module can be expressed in terms of individual output circuit
ratings and total module ratings.
10
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
In general, each output circuit is rated for 1.5 Amps from 0 to
40º C, derated linearly to 1.0 Amps at 60º C. All eight outputs
can simultaneously operate at these levels, producing a total
module current rating (total of all eight output circuits) of 12
Amps from 0 to 40º C, derated linearly to 8 Amps at 60º C.
Applications that require higher output current ratings are
allowable, but only if the total module current is reduced. You
may operate output circuits as high as 2.0 Amps from 0 to 40º
C, derated to 1.5 Amps at 60º C if you reduce the current on
the other remaining outputs. For example the combination of
output load ratings shown in Table 2 are allowable.
Table 2. Output Current Ratings.
0 to 40º C
at 60º C
Circuit
0 < Iout < 1.5
1.5 < Iout < 2
0 < Iout < 1.5
1.5 < Iout < 2
1
1.5
0.75
1.0
1.5
2
1.5
2.0
1.0
0.5
3
1.5
0.5
1.0
1.5
4
1.5
2.0
1.0
0.5
5
1.5
0.5
1.0
0.5
6
1.5
1.0
1.0
0.5
7
1.5
0.75
1.0
0.5
8
1.5
0.5
1.0
0.5
Total
(Imod)
12
8
8
6
(maximum @
0 - 40º C)
(maximum @
60º C)
Output Load Types
The isolated Guarded output module is ideally suited for
controlling safety critical loads including motor starters as
large as NEMA Size 5. Their are some applications that may
not be suitable for using the isolated Guarded output module
which are described below. For these applications, other
output module types available for the system should be
considered. Refer to the specific Product Descriptions of these
modules for their application and specifications.
PD-7034
Mar-06
11
Isolated Guarded Digital Output Module (T7485)
Resistive Loads
If resistive loads are applied, the isolated Guarded output
module may erroneously annunciate a module fault. This will
occur with a single, fail-safe module configuration. In dual
module configurations, no erroneous faults will be
annunciated until one of the two modules has a fault or is
removed. In either configuration, the outputs will always be
controlled on and off correctly; however, the testing of the
output module’s circuits will not be sensed correctly by the
module and it will report output circuit faults.
Other output module types should be used for safety critical
load devices that have resistive load characteristics.
DC Voltage, Low Current Applications
DC applications with low current loads (Iout < 100 mA) and
long field wiring lengths (Ltotal > 2000 feet) may also cause
erroneous fault annunciation and should be avoided. Other
output module types should be considered for these
applications.
Field Wiring
For field wiring details, refer to PD-7901 - I/O Termination
Assembly (ITA).
12
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
Fault Mode Jumper
The fault mode jumper is located behind the ID switch cover
in the lower left-hand corner of each I/O chassis. The position
of the fault mode jumper determines the module's response to
system level faults. The fault mode jumper’s position will
cause all output modules in the I/O chassis to either shutdown
(turn off all outputs) or to hold (hold the last state) after a
system level failure occurs. An example of a system level
failure is the failure of two processor modules.
Keying
The I/O chassis can be physically keyed to prevent accidental
damage caused by inserting a module into a slot wired for a
different module type. Figure 7 illustrates how the slot keys
are installed on the I/O chassis slot field wiring connectors.
The slot key positions for the isolated Guarded output module
are listed in Table 3.
Table 3. Slot Key Positions.
PD-7034
Mar-06
Module
Upper
Connector
Lower
Connector
T7485
12
3
13
Isolated Guarded Digital Output Module (T7485)
Figure 7. Installing Slot Keys.
Configuration
Each output module is configured using the WINTERPRET I/O
Configuration Editor. In the editor you will perform the three
steps described below to configure the output module.
14
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
1) Set the Module Type:
Position the cursor on the module slot you wish to define.
Choose Set Module Type from the Edit Menu and select
the isolated Guarded output module from the list.
2) Edit the Module Definition:
Choose Edit Module Definition from the Edit Menu. A
dialog box will open where you can define the output point
definitions.
Figure 8. Isolated Guarded Output Module Definition.
3) Edit each point:
Choose Edit from the Module Definition dialog box to define a
name and description for each output point. In the Digital
Output Point dialog, enter names and values for the
configuration fields as described below.
PD-7034
Mar-06
15
Isolated Guarded Digital Output Module (T7485)
Figure 9. Defining an Isolated Guarded Digital Output Point.
Name
Also called the tag name, this is the name used in the
application program to reference the output point. The name
can be up to 12 characters long.
Description
This 40-character field provides a place to describe the output
point definition. The description is used to help document
your system (it does not affect application program operation).
Comm Protect
Marking the Comm Protect check box protects the point from
changes by communications functions such as data write,
forcing, and load initial value when Comm Protect is enabled.
Initial Value
The initial value for the output is loaded to the Regent when
you load the I/O configuration and also when you load the
application program that controls the output.
Final Value
The final value for the output is loaded to the Regent when
the application program that controls the output is deleted.
Unless special circumstances exist, you should always enter
zero, so that the output is turned off when you delete the
application program that controls it.
16
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
Output Module Definition
In addition to configuring output point definitions, you can
configure the output module definition to represent the
combined state of all eight output points.
The module definition represents the eight output point
definitions as signed, 16-bit integers. In this format, the eight
outputs are the least significant bits with output point 1 as the
LSB. The eight most significant bits are always zero.
The module definition names are not normally used for
control purposes. However, they do provide convenient single
name references to all eight outputs points when reporting
status information to operator interface equipment.
Programming
Outputs are controlled by writing application programs that
solve for output values. For example, placing an output tag
name on a coil in ladder logic will cause the output to turn on
when there is power flow to the coil in the ladder logic rung.
To program fault tolerant outputs two output coils driven by
the same control logic are used as shown in Figure 10.
Figure 10. Programming Fault Tolerant Outputs.
In this illustration A, B, C, D represent various logic elements
used to drive the outputs; XV103A represents the output on
one Guarded output module; and XV103B represents the
output on the other Guarded output module.
Maintenance
No periodic maintenance or calibration is required for this
module.
Fuses can be removed and replaced without removing the
module from the I/O chassis. Turning the fuse holder one-
PD-7034
Mar-06
17
Isolated Guarded Digital Output Module (T7485)
quarter turn from its locked position releases the fuse holder,
extending the fuse and allowing it to be removed.
To prevent damage to the module, replacement fuses must be
of the same rating and type (see Specifications, below).
Safety Considerations
The Isolated Guarded output module is TÜV certified to Risk
Class 5 for safety critical outputs. The modules are approved
for de-energize to trip safety critical outputs in single or dual
module configurations.
The modules are also approved for energize to trip safety
critical outputs in dual module configuration only if the
outputs are dynamically transitioned at a period not greater
that six months (to verify the signal wiring and load device
integrity).
Specifications
Safetybus Power
1.75 load units
Number of Outputs
Eight, isolated
Voltage Range
12 to 130 VAC
15 to 150 VDC
Frequency Range (Vac)
47 to 63 Hz
Output Load Current (Iout)
(0 to 40° C)
derating (at 60° C)
2.0 amps max. (see page 10)
1.5 amps max. (see page 10)
Module Load Current (Imod)
for Iout < 1.5 amps
On State Drop
12 amps (0 to 40° C), derated
linearly to 8 amps at 60° C
8 amps (0 to 40° C), derated
linearly to 6 amps at 60° C
2.5 volts, maximum
Surge Current
20 amps, 20 msec
for Iout > 1.5 amps
18
Industrial
Control
Services
Isolated Guarded Digital Output Module (T7485)
Minimum Load
20 mA
Over Voltage Protection
Continuous:
450 VAC
Output Test Load Bump
Single module:
Dual modules:
Fusing
None for turn-on test.
2 pulses at 125 msec each for
turn-off test or if single fault.
None during turn-on or turnoff test.
2 pulses at 125msec each if
single fault.
One 3 A, 250 V fast-acting
per output (Littelfuse 3AG
series)
Output Leakage
1 mA, maximum
Turn-On Delay
1.0 ms
Turn-Off Delay
1.0 ms
Heat Dissipation
25 Watts, 85 BTUs/hour
Isolation
2500 volts minimum (field
wiring to control logic)
2500 volts minimum (output
to output)
Operating Temperature
0° to 60° C
(32° to 140° F)
Storage Temperature
-40° to 85° C
(-40° to 185° F)
Operating Humidity
0 to 95% relative humidity,
non-condensing
Vibration
10 to 55 Hz:
±0.15mm
Shock
Operating:
PD-7034
Mar-06
15 g, ½ sine wave, 11 msec
19
Isolated Guarded Digital Output Module (T7485)
Electromagnetic
Interference
•
•
•
•
•
IEC 801 Part 2 - Electrostatic
Discharges
IEC 801 Part 3 - Radiated
Electromagnetic Fields
IEC 801 Part 4 - Transients
and Bursts
IEC 801 Part 5 - Surge
Immunity
ANSI/IEEE C37.90 - Surge
Withstand Capability
Safety
Level 3: Contact discharge of
6 kV
Level 3: 10 V/M, 27 MHz 500 MHz
Level 4: 2 kV, 2.5 kHz for
t=60 sec
Level 3: 2 kV
2.5 kV damped 1 MHz sine
wave,
4 kV bi-directional impulse,
10 nsec rise time, fast
transient
Certified to DIN V VDE
0801 for Risk Class 5. Also
designed to meet UL 508 and
CSA 22.2, No. 142-M1981
Dimensions
Height:
Width:
Depth:
Weight
20
12.6" (320 mm)
1.27" (32 mm)
10.12" (257 mm)
4.2 lbs (1.8 kg)
Industrial
Control
Services
">