The Trusted TMR 24V dc digital output module interfaces to 40 field output devices. Outputs are arranged in five groups of eight outputs. All outputs in a group share a common power source and return. Fault tolerance is achieved through Triple Modular Redundancy (TMR) within the same module for each of the 40 output channels.
The module provides on-board sequence of events (SOE) reporting with a resolution of 1ms. The “event” is the actual sensing of the field device loop current.
Each triplicated section (slice) of the module, receives output data from the Trusted TMR processor and sends its data to an internal safety layer hardware voter. Each slice uses the voted data to control the outputs. Every output channel consists of a six-element voted array. The output switch array provides fault tolerant, uninterrupted control under an output switch failure condition. Output switching and fault diagnostics comply with the demanding requirements of IEC-61508 SIL-3 for First fault - Fault tolerant, and Second fault – Fail-safe outputs.

When a module fault is detected, the Trusted TMR processor will flag the unhealthy condition, indicating the need to replace the module. Control continues until a replacement (healthy) module is available. Replacement modules can be located in a standby slot next to the module or in a designated SmartSlot with a temporary connection to the same Trusted termination assembly.

Each output is user configurable to perform line monitoring of the connected field devices to detect field wiring and load failures. Automatic over-current protection is inherent in every output circuit which eliminates the need for fuses.

Modules may be placed in any I/O module slot in a Trusted processor chassis or expander chassis. Once the I/O module configuration is set, mechanical keying is available on all I/O modules to prevent inserting a module into an incorrect slot.
Configuration of the module is carried out using the Trusted Toolset running on an engineering workstation. Once configured and loaded into the Trusted controller, replacement modules are online educated by the TMR processor.

Features
40 TMR output channels per module.
Five isolated groups of eight outputs each.
Six-element voted output array.
Comprehensive diagnostics and self-test.
Guaranteed, First fault – fault tolerant, Second fault – fail-safe.
Line monitoring on a per channel basis.
Automatic over-current protection – no fuses required.
2500V dc optically isolation.
Hot replaceable.
Front panel status LEDs for each channel.
Module fault and status indicators.
IEC 61508, SIL 3 safety applications.
On-board 1 ms resolution sequence of events reporting.