ICS Triplex T9110 AADvance Processor Module Trusted TMR System
T9110 AADvance Processor Module is suitable for Emergency Shutdown Systems (ESD)
1. Product Overview
The ICS Triplex T9110 AADvance Processor Module is the core central processing unit of Rockwell Automation AADvance controller series, specifically engineered for high-reliability and high-safety control scenarios in industrial settings. It is particularly suited for process control and safety control tasks that demand compliance with functional safety requirements.
Serving as the "brain" of the entire AADvance control system, this module not only undertakes fundamental core tasks such as application logic operation, I/O data interaction and network communication coordination, but also ensures stable operation in complex industrial environments through redundant fault-tolerant design, stringent electrical isolation and periodic diagnostic mechanisms. Even in the event of partial component malfunctions or external interference, it maximizes system continuity and safety. It is widely applied in sectors with extremely high demands for control precision and system reliability, including petrochemicals, energy and intelligent manufacturing.
Download
Core Functions and Tasks
As the core of the AADvance controller, the T9110 Processor Module undertakes a variety of critical process and safety control tasks, serving as the fundamental support for the stable operation of the system:
Safety Kernel and Application Logic Execution
It runs the AADvance Safety Kernel, responsible for parsing and executing user-configured application logic—including process control algorithms and safety interlock logic. This ensures the precise implementation of control strategies and meets the real-time control requirements of industrial scenarios.
I/O Module Interaction and Data Processing
It establishes real-time communication with all types of I/O modules of the controller (e.g., Digital Input Modules T9401/2, Analog Input Modules T9431/2, Digital Output Module T9451, etc.). It reads field device status data collected by input modules (such as sensor signals and switch states), and after processing, sends control commands to output modules to drive actuator actions, realizing a closed-loop process of acquisition - processing - control.
Multi-node Communication and Collaboration
It supports communication with other processor modules in the local and control networks to enable multi-module collaborative operation. Meanwhile, it can interact with external systems such as Human-Machine Interfaces (HMI) and upper-level monitoring systems, transmitting real-time data and status information for convenient operator monitoring and intervention.
Periodic Diagnostics and Fault Monitoring
It proactively initiates periodic internal diagnostic tests and combines a Watchdog Circuit to monitor the module's internal performance in real time, including processor operation status, memory integrity, and power supply stability. If a critical fault (e.g., hardware failure, logic error) is detected, the module triggers a shutdown mechanism to prevent fault propagation and ensure system safety.
Secure Communication and Data Verification
It encapsulates and verifies communication data with other nodes (e.g., other processors, I/O modules) and establishes secure channels to prevent tampering, loss or interference during data transmission, ensuring the reliability and security of communication links.
Hardware Design and Reliability Assurance
1. Electrical Isolation and Power Supply Protection
Full-Range Isolation Design
The module adopts galvanic isolation technology for external power supply and data links, which can effectively block the conduction of field-side faults (e.g., short circuit, overvoltage) to the inside of the module, prevent module failure caused by external anomalies, and protect the safety of core control components.
Redundant Power Supply and Voltage Protection
It supports dual redundant 24V dc power input; if one power supply fails, the other can still maintain the normal operation of the module. The internal power circuit is equipped with undervoltage (below 18V dc) and overvoltage (above 32V dc) protection functions. When the voltage exceeds the safe range, a protection mechanism is triggered, and a power valid signal is sent to the module's own diagnostic microprocessor to facilitate fault location and handling.
2. Communication Interface Configuration
Ethernet Ports
Equipped with 2 functionally independent and electrically isolated Ethernet ports (Ethernet 1/2), each port can be individually configured with a variety of communication protocols, including Modbus RTU, Open Modbus/TCP and the proprietary AADvance protocol. Port data can be shared by all processors in the controller, supporting flexible network topology design to meet the communication requirements of different industrial scenarios.
Serial Communication Ports
Each processor module is provided with 2 serial communication ports for Modbus RTU slave communication, and the ports also feature functional and electrical isolation. It supports RS-485 (4-wire and 2-wire) communication modes, with asynchronous data rates configurable in the range of 1200 ~ 115200 baud, adapting to the communication needs of field devices with different rates.
3. Fault Tolerance and Redundancy Capabilities
Multi-Module Redundant Architecture
The controller can be configured with 1, 2 or 3 T9110 Processor Modules to form different fault-tolerant architectures: 2 modules enable a 1oo2D (1-out-of-2 with downgrade) architecture, and 3 modules support a 2oo3D (2-out-of-3 with downgrade) or TMR (Triple Modular Redundancy) architecture, which greatly improves the system's fault tolerance. If one module fails, the remaining modules can seamlessly take over the work without affecting the overall operation of the controller.
Online Replacement and Self-Synchronization
In dual or triple module redundant configurations, if a processor module fails, maintenance personnel can replace it with a new one while the controller remains online and in operation. After the new module is connected, it automatically executes a self-education process to synchronize the configuration data and operating status of other normal modules, eliminating the need for shutdown and ensuring production continuity.
4. Backup Battery and Data Protection
The module has a built-in backup battery that only operates when the system power supply is completely interrupted, used to protect critical data and functions, including the following specific aspects:
- Real-Time Clock (RTC) Power Supply: Powers the internal real-time clock chip to ensure the clock continues to run even in the event of a power outage. After power recovery, the time can be quickly synchronized to avoid time disorder affecting data timestamps and scheduled tasks.
- Conserved Variables Data Storage: Stores the data of Conserved Variables in the battery-backed RAM area at the end of each application scan cycle. After power recovery, the data is reloaded into the corresponding variables to ensure the continuity of application logic without the need for re-initialization.
- Diagnostic Log Preservation: The processor's diagnostic logs (e.g., fault records, status change records) are stored in battery-backed RAM and will not be lost in the event of a power outage, facilitating the tracing of fault causes and assisting in maintenance after power recovery.
Battery Life: Under continuous module power supply, the designed battery life is 10 years. If the module is powered off for a long time, the life is approximately 6 months (based on a constant temperature of 25°C and low humidity environment). High humidity, high temperature and frequent power cycling will shorten the battery life, which requires regular inspection and replacement.
Performance Parameters
1. Functional Characteristics
Degradation Mode: Supports three modes including 1oo1D (1-out-of-1 with degradation), 1oo2D (1-out-of-2 with degradation) and 2oo3D (2-out-of-3 with degradation), adapting to scenarios with different safety level requirements.Processor Clock: 400MHz, capable of rapidly processing complex application logic and real-time data to ensure fast control response speed.Safety Integrity Level (SIL): Meets different SIL level requirements based on the number of configured modules – a single module is suitable for non-safety applications and SIL1/SIL2 safety applications; two modules support SIL3 applications; three modules enable SIL3 fault tolerance and TMR applications, complying with the IEC 61508 functional safety standard.Sequence of Events: The event resolution and time-stamp accuracy reach 1ms and 5ms respectively, which can accurately record the sequence and time of event occurrence, facilitating fault tracing and process analysis.
2. Storage Configuration
Boot Flash features a capacity of 512kB, serving to store the module's boot program and firmware core to ensure proper initialization after the module is powered on. SRAM has a capacity of 512kB, used for temporary storage of running data and programs with high speed, and its data requires battery backup in case of power failure. Bulk Flash comes with a large capacity of 64MB for storing application configuration files, log data and other information, with data remaining intact even when the power is off. SDRAM has a capacity of 32MB, which supports program operation and data caching to improve the processing speed of the module.
3. Electrical and Mechanical Parameters
Supply Voltage: Dual redundant 24V dc (nominal value) with a voltage range of 18V dc ~ 32V dc, compatible with common DC power supply systems in industrial sites.Power Consumption and Heat Dissipation: Powered by a 24V dc power supply with a power consumption of approximately 6W and a heat dissipation power of 6W as well. No additional forced heat dissipation is required during operation, and a stable working temperature can be maintained only through natural heat dissipation.Temperature and Environmental Adaptability: The maximum surface temperature of the module is 43°C±2°C, and it can operate stably within the industrial temperature range (typically 0°C ~ 60°C, subject to specific on-site environmental requirements), adapting to various factory environments.Mechanical Dimensions and Weight: The dimensions are 166mm×42mm×118mm (Height × Width × Depth) with a weight of approximately 430g (15 oz.). It adopts a non-combustible plastic housing, complying with the mechanical strength and safety standards for industrial equipment.
Compatibility and Interoperability
As a core component of the AADvance controller series, the T9110 Processor Module boasts high compatibility with a wide range of supporting hardware from Rockwell Automation, forming a complete control solution:
Processor Base Unit: It must be used with the T9100 Processor Base Unit, which provides electrical connections for the T9110 (e.g., I/O bus, power input, serial/Ethernet ports) and supports the installation of 1 to 3 T9110 modules to meet the requirements of different redundant configurations.
I/O Base and Modules: It is compatible with the T9300 I/O Base Unit (3-channel I/O Base) and various I/O modules. The T9300 Base can support 3 I/O modules (such as T9401/2 digital input, T9431/2 analog input, T9451 digital output) and is connected to the T9100 Base via a command response bus to enable I/O expansion.
Communication and Expansion Components: It supports connecting multiple groups of T9300 I/O Bases through the T9310 Extension Cable Assembly for flexible expansion of I/O modules. It is also compatible with general industrial protocols such as Modbus and SNTP, and can interconnect with third-party protocol-compliant devices (e.g., sensors, actuators, monitoring systems).
Related brand series products
3005319639