ICS Triplex ICS Regent Isolated Guarded Output Modules Reference Manual
ICS Triplex ICS Regent Isolated Guarded Output Modules offer reliable control of eight isolated user output loads. Designed for safety-critical applications, these modules provide fail-safe operation even in the event of a single fault. The modules are ideally suited for controlling isolated, safety-critical inductive loads such as motor starters. They feature redundant circuitry and automated testing to ensure reliable and secure operation. The module's triplicated Safetybus interface ensures that no Regent system failure will inadvertently apply power to an output.
advertisement
ICS Regent®
PD-6034
Industrial Control Services 1
Isolated Guarded Output Modules
24 to 120 VAC/DC
(T3485)
Issue 1, March, 06
The Isolated Guarded output module provides Guarded
control of eight isolated user output loads. One type of module
is available to interface to outputs powered from isolated field
power supplies operating between 12 to 130 VAC or 15 to 150
VDC. This module is called Guarded because the module's
dual-redundant design ensures that no single fault within the
module will inadvertently apply power to an output. The
module is ideally suited for controlling isolated, safety critical
inductive loads such as motor starters. Other applications
include output circuits that contain additional safety interlock
contacts or switches in series with the module outputs.
Features
· Eight isolated Guarded outputs.
• Fault tolerant operation when connected in parallel with
another module of the same type.
• Hot-replaceable.
• Complete, automatic testing of all output circuits, independent
of load or field power connection.
• Individual front panel indicators on each module show module
fault/active status and shutdown state; additional indicators
show output on/off status and blown fuse for each point.
· Fuses accessible from front panel.
• 2500 minimum electrical isolation between field and logic
circuits.
· TÜV certified, Risk Class 5.
The module's triplicated Safetybus interface ensures that no
Regent system failure will inadvertently apply power to an
output. Extensive fault detection and redundant critical
circuits ensure that the module operates in a fail-safe manner.
PD-6034
Industrial Control Services 1
Isolated Guarded Output Modules
24 to 120 VAC/DC
(T3485)
Issue 1, March, 06
The Isolated Guarded output module provides Guarded
control of eight isolated user output loads. One type of module
is available to interface to outputs powered from isolated field
power supplies operating between 12 to 130 VAC or 15 to 150
VDC. This module is called Guarded because the module's
dual-redundant design ensures that no single fault within the
module will inadvertently apply power to an output. The
module is ideally suited for controlling isolated, safety critical
inductive loads such as motor starters. Other applications
include output circuits that contain additional safety interlock
contacts or switches in series with the module outputs.
Features
· Eight isolated Guarded outputs.
• Fault tolerant operation when connected in parallel with
another module of the same type.
• Hot-replaceable.
• Complete, automatic testing of all output circuits, independent
of load or field power connection.
• Individual front panel indicators on each module show module
fault/active status and shutdown state; additional indicators
show output on/off status and blown fuse for each point.
· Fuses accessible from front panel.
• 2500 minimum electrical isolation between field and logic
circuits.
· TÜV certified, Risk Class 5.
The module's triplicated Safetybus interface ensures that no
Regent system failure will inadvertently apply power to an
output. Extensive fault detection and redundant critical
circuits ensure that the module operates in a fail-safe manner.
Isolated Guarded Digital Output Module (T3485)
2 Industrial Control Services
Two isolated Guarded output modules can be connected in
parallel to obtain fault tolerant control of power to loads. In
this parallel module configuration, either module can be
removed and replaced while the other Guarded module
continues to control the loads without interruption.
Module Operation
A block diagram of a typical isolated Guarded digital output
module is shown in Figure 1.
Figure 1. Block Diagram of Isolated Guarded Digital Output Module.
The processor modules send triplicated write data commands
over the I/O Safetybus to the isolated Guarded output module.
Onboard the output module the triplicated data are routed to
two independent voters which provide voted data to associated
2 Industrial Control Services
Two isolated Guarded output modules can be connected in
parallel to obtain fault tolerant control of power to loads. In
this parallel module configuration, either module can be
removed and replaced while the other Guarded module
continues to control the loads without interruption.
Module Operation
A block diagram of a typical isolated Guarded digital output
module is shown in Figure 1.
Figure 1. Block Diagram of Isolated Guarded Digital Output Module.
The processor modules send triplicated write data commands
over the I/O Safetybus to the isolated Guarded output module.
Onboard the output module the triplicated data are routed to
two independent voters which provide voted data to associated
Isolated Guarded Digital Output Module (T3485)
P D - 6 0 3 4 M a r - 0 6 3
field programmable gate arrays (FPGA). Each FPGA
independently operates one of the two output control switches.
The two output switches are connected in series with the load.
When both output switches are on, current will flow through
the output and energize a field load. If either switch is off,
current will not flow through the output and the load will be
de-energized. This combination of series output switches and
independent drive signals produces fail-safe activation of the
load. Single failures can only affect one of the output drive
signals or switches. A single failure will result in either
continued correct control or a fail-safe output as shown in
Table 1.
Table 1. Output States After Switch Failure.
Case
Commanded
Output State
Switch
Failed
State
Actual
Output
to Load Remarks
1 On On On Continued correct control.
Automatic testing detects
stuck-on switch. If output is
subsequently commanded
off, output will turn off.
2 On Off Off Fail-safe output. Automatic
testing detects stuck-off
switch.
3 Off On Off Continued correct control.
Automatic testing detects
stuck-on switch. If output is
subsequently commanded
on, output will turn on.
4 Off Off Off Fail-safe output. Automatic
testing detects stuck-off
switch. If output is subse-
quently commanded on,
output will remain off.
To achieve fault tolerance, two isolated Guarded output
modules are used with their outputs connected in parallel.
This configuration provides for continued correct control even
when one output switch fails off (cases two and four in
Table 1). The module failure is automatically detected and
the module can be removed and replaced without interrupting
output control.
P D - 6 0 3 4 M a r - 0 6 3
field programmable gate arrays (FPGA). Each FPGA
independently operates one of the two output control switches.
The two output switches are connected in series with the load.
When both output switches are on, current will flow through
the output and energize a field load. If either switch is off,
current will not flow through the output and the load will be
de-energized. This combination of series output switches and
independent drive signals produces fail-safe activation of the
load. Single failures can only affect one of the output drive
signals or switches. A single failure will result in either
continued correct control or a fail-safe output as shown in
Table 1.
Table 1. Output States After Switch Failure.
Case
Commanded
Output State
Switch
Failed
State
Actual
Output
to Load Remarks
1 On On On Continued correct control.
Automatic testing detects
stuck-on switch. If output is
subsequently commanded
off, output will turn off.
2 On Off Off Fail-safe output. Automatic
testing detects stuck-off
switch.
3 Off On Off Continued correct control.
Automatic testing detects
stuck-on switch. If output is
subsequently commanded
on, output will turn on.
4 Off Off Off Fail-safe output. Automatic
testing detects stuck-off
switch. If output is subse-
quently commanded on,
output will remain off.
To achieve fault tolerance, two isolated Guarded output
modules are used with their outputs connected in parallel.
This configuration provides for continued correct control even
when one output switch fails off (cases two and four in
Table 1). The module failure is automatically detected and
the module can be removed and replaced without interrupting
output control.
Isolated Guarded Digital Output Module (T3485)
4 Industrial Control Services
Testing and Diagnostics
Automatic testing is performed on the isolated Guarded
output modules and its internal output circuits. The output
circuits are completely tested independent of any field load or
power connections. The module does not perform line
monitoring of the wiring connections to field loads.
Module Testing
Each voter and FPGA logic section of the isolated Guarded
output module is automatically tested by the processor
modules. Discrepant data are sent through one of three legs
of the I/O Safetybus to determine whether the module’s voters
are able to outvote the incorrect data. A failure to return the
correct majority-voted result to the processors produces an I/O
module error indication at the processor modules and a
module fault indication at the I/O module.
Each type of module has a unique identification code that is
read by the controller. This code lets the controller know
which type of module is installed in each I/O chassis slot and
how to address that module and its points specifically. If a
module is removed, or is replaced with a module of a different
type, the processor modules will indicate an I/O module error.
Loopback logic tests periodically write data to the module and
then read it back to determine whether the module’s I/O bus
interface logic is functioning correctly.
Output Circuit Testing
The output circuits of the isolated Guarded output module are
automatically tested to detect failures in the redundant
output switch circuits on-board the module. The output fuses
are also checked for blown fuse conditions.
Output Switch Testing
To detect a failure in the redundant output switch circuits,
each output switch is checked for turn-on and turn-off
capability. Periodically, each output switch circuit on the
module is tested for its ability to change its current state.
During testing, the output state is changed; outputs that are
on are turned off and outputs that are off are turned on.
Output switch testing is no-coincident and does not produce a
turn-on pulse to the load. Two output test pulses are
4 Industrial Control Services
Testing and Diagnostics
Automatic testing is performed on the isolated Guarded
output modules and its internal output circuits. The output
circuits are completely tested independent of any field load or
power connections. The module does not perform line
monitoring of the wiring connections to field loads.
Module Testing
Each voter and FPGA logic section of the isolated Guarded
output module is automatically tested by the processor
modules. Discrepant data are sent through one of three legs
of the I/O Safetybus to determine whether the module’s voters
are able to outvote the incorrect data. A failure to return the
correct majority-voted result to the processors produces an I/O
module error indication at the processor modules and a
module fault indication at the I/O module.
Each type of module has a unique identification code that is
read by the controller. This code lets the controller know
which type of module is installed in each I/O chassis slot and
how to address that module and its points specifically. If a
module is removed, or is replaced with a module of a different
type, the processor modules will indicate an I/O module error.
Loopback logic tests periodically write data to the module and
then read it back to determine whether the module’s I/O bus
interface logic is functioning correctly.
Output Circuit Testing
The output circuits of the isolated Guarded output module are
automatically tested to detect failures in the redundant
output switch circuits on-board the module. The output fuses
are also checked for blown fuse conditions.
Output Switch Testing
To detect a failure in the redundant output switch circuits,
each output switch is checked for turn-on and turn-off
capability. Periodically, each output switch circuit on the
module is tested for its ability to change its current state.
During testing, the output state is changed; outputs that are
on are turned off and outputs that are off are turned on.
Output switch testing is no-coincident and does not produce a
turn-on pulse to the load. Two output test pulses are
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
advertisement
Key Features
- Eight isolated Guarded outputs
- Fault tolerant operation
- Hot-replaceable
- Automatic testing
- Front panel indicators
- 2500V isolation
- TÜV certified, Risk Class 5
- Fail-safe operation
Related manuals
Frequently Answers and Questions
What is the purpose of the Isolated Guarded Output Modules?
These modules provide a safe and reliable way to control output loads in safety-critical applications, such as motor starters and other devices powered from isolated power sources.
How do the modules ensure fail-safe operation?
The modules employ a dual-redundant design, ensuring that no single fault within the module can inadvertently apply power to an output. This ensures the output will either remain in its current state or safely shut down, preventing unintended activation.
What type of loads are these modules suitable for?
They are ideally suited for controlling isolated inductive loads, particularly safety-critical applications like motor starters. They can also be used for output circuits with additional safety interlock contacts or switches.
advertisement
