T8151B  Trusted TMR Processor

The Trusted® Processor is the main processing component in a Trusted System. It is a powerful, user-configurable module providing overall system control and monitoring facilities and processes input and output data received from a variety of analogue and digital Input / Output (I/O) modules across a Trusted TMR Inter-Module Communications Bus.
The range of applications for the Trusted TMR Processor vary in integrity level and include fire and gas control, emergency shutdown, monitoring and control, and turbine control. Features:
• Triple Modular Redundant (TMR), fault tolerant (3-2-0) operation.
• Hardware Implemented Fault Tolerant (HIFT) architecture.
• Dedicated hardware and software test regimes which provide very fast fault recognition and response times.
• Automatic fault handling without nuisance alarming.
• Time-stamped fault historian.
• Hot replacement (no need to re-load programs).
• Full suite of IEC 61131-3 programming languages.
• Front panel indicators that show module health and status.
• Front panel RS232 serial diagnostics port for system monitoring, configuration and programming.
• IRIG-B002 and 122 time synchronisation signals (available on T8110B only).
• Active and Standby processor fault and failure contacts.
• Two RS422 / 485 configurable 2 or 4 wire connections (available on T8110B only).
• One RS485 2 wire connection (available on T8110B only).
• TϋV Certified IEC 61508 SIL 3.

The Trusted TMR Processor is a fault tolerant design based on a Triple Modular Redundant (TMR) architecture operating in a lock-step configuration. Figure 1 shows, in simplified terms, the basic structure of the Trusted TMR Processor module.
The module contains three Processor fault containment regions (FCR), each containing a Motorola Power PC series Processor and its associated memory (EPROM, DRAM, Flash ROM, and NVRAM), memory mapped I/O, voter and glue logic circuits. Each Processor FCR has voted two-out-of-three (2oo3) read access to the other two Processor’s FCR memory systems to eliminate divergent operation.
The module’s three Processors store and execute the application program, scan and update the I/O modules and detect system faults. Each Processor executes the application program independently, but in lock-step synchronisation with the other two. Should one of the Processors diverge, additional mechanisms allow the failed Processor to re-synchronise with the other two.
Each Processor has an interface which consists of an input voter, discrepancy detector logic, memory, and an output driver bus interface to the Inter-Module Bus. The output of each Processor is connected by the module connector to a different channel of the triplicated Inter-Module Bus.

T8151B