Trusted TMR processor contains and executes the operating and application software programs in a triple redundant, fault tolerant controller system.

The fault tolerant design contains six fault containment regions. The three synchronized processor fault containment regions contain respectively a 600 series microprocessor, its memory, voter and associated circuits.

The non-volatile memory is used to store the configuration and application programs for the system.
Each processor has an independent power supply fed from the dual redundant 24Vdc power supply of the Trusted controller chassis backplane. The processor power supplies provide short circuit protection and regulated power to the module electronics.

The processor operates concurrently to achieve triple modular redundancy and fault tolerance. By providing 2-out-of-3 hardware voting on every inter-processor exchange and memory data retrieval, uncompromised fault detection and error-free operation are assured.

Trusted TMR processor communicates with other modules via a backplane mounted, triplicated inter-module bus. Additionally, the interface modules are used to support communication with I/O sub-systems and other equipment.

Module faults are automatically detected, time-stamped, and stored for historical review. Transient faults, once they are recorded, are cleared automatically without nuisance alarming. Permanent faults in a processor are annunciated on the front panel of the module, without disturbing ongoing processing in the two remaining processors.

When a failed Trusted TMR processor is replaced, it is automatically initialized without external loader or other equipment.

Application programs are developed using the full suite of IEC 1131-3 languages. The user can load, run, stop, single-step or delete the application program. A front panel maintenance enable key-switch allows the download of application programs.

Features

• Triple modular redundant, fault tolerant 3-2-0 operation.
  
• Two-out-of-three voting on internal operations.
  
• Automatic fault handling without nuisance alarming.
  
• Trusted operating system kernel (IEC 61508 SIL3).
  
• Time-stamped fault historian.
  
• Module replacement without program down-loading.
  
• Non-volatile memory for program storage.
  
• Full suite of IEC 1131-3 languages.
  
• Multiple process program execution.
  
• TÜV certified for safety, SIL3.