The TRICONEX Trident series: a benchmark for redundant architecture in industrial safety instrumented systems

The TRICONEX Trident series: a benchmark for redundant architecture in industrial safety instrumented systems

Product core positioning and architecture design

The core positioning of the TRICONEX Trident series is to provide highly reliable and secure control solutions for low point control scenarios and distributed I/O applications. Unlike traditional industrial control systems, the Trident series adopts a Triple Modular Redundancy (TMR) architecture, which runs through the entire product ecosystem and serves as the core support for resisting single point failures and ensuring continuous system operation.

In the TMR architecture, each Trident system consists of three independent main processor (MP) modules that share a base board and run in parallel as three independent channels of the system. This three channel design is not simply a hardware overlay, but a real-time data synchronization and voting mechanism achieved through the high-speed fault-tolerant TriBus bus. After the three channels independently process input data, the main processor compares and votes on the data. In TMR mode, the intermediate value is taken as the effective output, and in dual module mode, the average value is taken to ensure the accuracy and reliability of data transmission. Even if a single channel fails, the system can still maintain normal operation through the redundant design of the remaining two channels. The diagnostic information of the faulty channel will be fed back to the front-end panel in real time, which is convenient for operation and maintenance personnel to handle in a timely manner and achieve the industrial level requirement of "no stopping for faults".

From the perspective of system composition, the Trident series follows a modular design concept and can be divided into four categories: core control modules, I/O modules, expansion components, and supporting accessories. This modular architecture not only reduces the complexity of system deployment, but also enables flexible expansion of functionality - users can flexibly combine different modules according to the point requirements, signal types, and environmental conditions of actual application scenarios, forming a complete control chain from signal acquisition, data processing to instruction output. At the same time, all modules adopt standardized mechanical size design, with I/O modules uniformly measuring 8.65 inches (height) x 1.75 inches (width) x 6.65 inches (depth). The base board is divided into two categories based on function: 9-inch wide (MP, CM, HART type base board) and 7-inch wide (standard I/O base board), ensuring compatibility and interchangeability between modules and providing great convenience for later system upgrades and maintenance.

Analysis of Core Module Technology

（1） Main Processor Module (MP): System Control Center

The main processor module, as the control core of the Trident series, is responsible for key functions such as data processing, communication coordination, and system diagnosis. Each Trident system comes standard with three MP modules (model 3101), which are installed together on the main processor substrate (model 2101) to form a three channel redundant architecture.

The hardware configuration of the MP module is designed for stable industrial operation, with a built-in 16MB DRAM memory that can simultaneously store user written control programs, sequence of events (SOE) data, I/O acquisition data, and communication cache, meeting the operational requirements of complex control logic. In terms of communication interface, each MP module is equipped with RS-232/RS-485 Modbus port and 10BaseT Ethernet port (compliant with IEEE 802.3 standard), where the Modbus port can directly establish TMR connection with distributed control system (DCS) or other external hosts without the need for additional adapter modules; The Ethernet port is used to connect to the TriStation 1131 development workstation, supporting program upload, download, and online debugging.

To ensure the visualization of the system's operating status, the front panel of the MP module integrates rich indicator lights and operation buttons. The status indicator lights include three core status indicators: "Pass" (normal operation), "Active" (flashing once every scan during program execution), and "Fault" (internal fault); The alarm indicator light covers five key alarm scenarios: field power failure, logic power failure, system integrity failure, program failure, and over temperature failure (triggered when the module temperature exceeds 84 ℃). In addition, the mode indicator lights (Remote/Run/Program/Alt) can visually display the current operating status of the system, making it easy for maintenance personnel to quickly determine the system's operating conditions.

（2） Communication Module (CM): Industrial Interconnection Bridge

The communication module (model 3201) serves as the interconnection core between the Trident system and external devices, adopting a "three to one" interface design to achieve efficient data exchange between the main processor and external systems. A single Trident controller can support up to 2 CM modules installed on the same communication substrate board (model 2201). The two modules can operate independently and can be configured as redundant communication connections or extended independent communication ports, meeting the dual requirements of communication reliability and scalability in industrial scenarios.

In terms of communication capabilities, the hardware configuration of the CM module fully covers the mainstream communication needs of the industry: equipped with three optically isolated RS-232/RS-485 serial ports, with a maximum transmission rate of 115kbps, supporting Modbus RTU (master/slave) and ASCII (slave) protocols, and can be flexibly configured for point-to-point or multi-point network connections; The network interface includes one 10 Mbps Ethernet port (supporting 10BaseT and AUI interfaces) and one 100 Mbps Ethernet port (supporting 100BaseTX and MII interfaces), supporting various protocols such as TSAA (UDP/IP), IP multicast, point-to-point (UDP/IP/DLC), Modbus TCP, SNTP time synchronization, etc. It can achieve seamless interconnection with external hosts, DCS systems, network printers, other Trident systems, and Tricon 9-10 series systems.

In terms of power supply, the logic power supply of the CM module is provided by the MP substrate board, with a nominal input voltage of 24VDC and a working voltage range of 19.2-30VDC (allowing 5% AC ripple). The maximum power consumption is 8W (excluding the media adapter unit MAU), and an additional 3.75-6W of power is required for each additional MAU. The module has a comprehensive power protection mechanism, supporting reverse voltage isolation (maximum reverse voltage -0.6VDC), short-circuit current limiting (maximum 2.4A), and surge protection, ensuring stable operation in complex industrial power supply environments.

（3） I/O module: the core carrier for signal acquisition and control execution

The Trident series offers a comprehensive product line of I/O modules, covering seven categories: Analog Input (AI), Analog Input/Digital Input Hybrid (AI/DI), Digital Input (DI), Pulse Input (PI), Analog Output (AO), Digital Output (DO), and Solid State Relay Output (SRO), which can meet the majority of signal acquisition and control execution needs in industrial scenarios. All I/O modules adopt a three channel isolation design, with each channel independently processing signals to avoid single point failures affecting the operation of the entire module. At the same time, it supports hot standby function and can replace faulty modules online without affecting the overall operation of the system.

Input module

The analog input module (model 3351) is the core module for industrial sensor signal acquisition, supporting 32 common input points. The nominal input current is 4-20mA DC, and the working range can be extended to 2-22mA DC. It has a 12 bit resolution and an absolute error of 0.15% of the full range (20mA), ensuring high accuracy of signal acquisition. The module supports use with standard AI base boards (2351), HART AI base boards (2354), and hazardous environment HART AI base boards (2354A). The HART version can communicate with HART field devices and upper computer configuration software to meet the requirements of intelligent device management.

The analog/digital input hybrid module (model 3361) integrates 16 analog input points (17-32 points) and 16 digital input points (1-16 points), suitable for scenarios where both signals need to be collected simultaneously. The analog channel supports 4-20mA current signals, and the digital channel operates within a voltage range of 15-30VDC with an input delay of less than 10ms. The two channels are independently isolated and do not interfere with each other. The data is transmitted to the control program after three channel voting to ensure data reliability.

The digital input module (model 3301) supports 32 input points, with a nominal voltage of 24VDC. The input impedance is greater than 30k Ω without a base board and about 3k Ω with a base board. It has a forced value diagnosis (FVD) function, with a diagnosis time of less than 2ms per point, and can quickly detect signal loss or line faults. The module is compatible with standard substrate boards (2301), high-voltage substrate boards (2302), and hazardous environment substrate boards (2302A), which can meet the application requirements of different voltage levels and environmental conditions.

The pulse input module (model 3381) is designed specifically for measuring the speed of rotating equipment, supporting 6 isolated input points and compatible with magnetic sensors, active sensors, and open collector sensors. The input frequency range is 0.5Hz-32kHz, and the speed measurement range can reach 0-32000RPM, with an absolute error of only ± 0.01% in the 2000-32000Hz range. It can accurately collect speed data of equipment such as turbines and compressors. The module supports gear tooth configuration (1-255 teeth) and signal conditioning functions, with precise reference testing and diagnosis, which can effectively resist measurement errors caused by signal waveform distortion.

Output module

The analog output module (model 3481) supports four DC coupled output points returned from the common terminal, with an output current range of 4-20mA (the over range can be extended to 0-2mA). The output accuracy within the working temperature range of 0-70 ℃ is less than 0.25% of the full range, and it can drive loads of 300-800 Ω (depending on the supply voltage). The module adopts forced switching diagnosis (FSD) function, which can detect output channel faults in real time. The typical fault switching time is 1ms, and the maximum value does not exceed 3ms, ensuring the timely execution of control instructions. The 3-4 channels of the high-voltage version (model 3482) can support 4-40mA output and are suitable for high-power actuator control scenarios.

The digital output module (model 3401) is equipped with 16 output points, with a nominal output voltage of 24VDC, a typical output current of 1.5A, and a maximum output current of 3.0A in degraded mode. It also has self limiting current protection function (minimum 0.7A). The module adopts a patented Quad Voter voting circuit, which drives the output through a "two out of three" logic, requiring two or more channel instructions to be consistent in order to trigger the output, ensuring the safety of control instructions. The output channel has loop feedback diagnosis (OVD) function, which can detect output point jamming (normally open/normally closed) and switch faults within 500ms, with leakage current less than 1mA, effectively avoiding misoperation.

The solid-state relay output module (model 3451) supports 32 paired common terminal output points, with a nominal input voltage of ± 24VDC, a maximum switching voltage of ± 33V peak, a maximum switching power of 15W (resistive load), a maximum nominal current of 0.5A per channel, and an overcurrent protection threshold of 0.7A. The output part of the module adopts a simplex design, suitable for control scenarios of non critical control points, such as alarm panel interfaces, etc. Each output channel is equipped with an independent loop feedback circuit, which can verify the relay switch status under no-load conditions.

（4） Extension components and supporting accessories

To meet the expansion needs of distributed I/O systems, the Trident series offers an I/O extender module kit (model 2281) for signal transmission and logic power distribution between multiple I/O columns. Each expansion kit includes 2 I/O extender modules, 3 2-foot I/O bus cables, 1 I/O interconnect component, and 2 end caps. It supports expanding the maximum number of base boards for a single I/O column from 8 to more, or deploying it in a distributed manner as multiple I/O columns. The maximum I/O bus length can reach 200 meters (650 feet), and if it exceeds 6 meters, a bus termination kit (model 2291/2292) is required.

Interconnection components are key components for connecting Trident system substrate boards, including MP interconnection components (model 2920) and I/O interconnection components (model 2921), both designed with DIN-C 96 pin male connectors, which achieve signal and power transmission between substrate boards through passive PCB boards. The MP interconnect component is suitable for connecting MP base boards, AI HART base boards, and AO HART base boards, while the I/O interconnect component is used for cascading standard I/O base boards to ensure signal transmission stability of the entire system.

In terms of supporting accessories, the Trident series provides three essential protective components: end caps, terminal caps, and slot caps, which are used to protect the base board and module from dust, liquids, and corrosive gases. The end caps are divided into two categories: MP base plate dedicated and I/O base plate dedicated, which respectively protect the top and bottom of the base plates at both ends of the column and serve as card guides; Terminal covers are used to cover unconnected base board terminals, while slot covers are used to protect unused base board slots, enhancing the system's environmental adaptability in all aspects.

Key technical characteristics and security certification

（1） Environmental adaptability and reliability design

The Trident series is designed for harsh industrial environments and has excellent anti-interference and environmental tolerance capabilities. The operating temperature range is -20 ℃ to 70 ℃ (-4 ° F to 158 ° F), and the storage temperature range is -40 ℃ to 85 ℃ (-40 ° F to 185 ° F), which can meet the temperature requirements of the vast majority of industrial scenarios; The relative humidity tolerance range is 5% -95% (no condensation), and it meets the G3 corrosion environment level of ISA S71.04 standard. It can operate stably in highly corrosive environments such as chemical and marine industries.

In terms of anti-interference performance, the module has passed the IEC 61000 series anti-interference standard certification: electrostatic discharge protection up to 4kV contact discharge and 8kV air discharge; Fast transient pulse group protection up to 2kV (power supply end) and 1kV (signal end); Surge protection up to 2kV (common mode at the AC power supply end); The radiation immunity reaches 10V/m (26-100MHz), ensuring signal stability in industrial strong electromagnetic interference environments. In addition, the module can withstand 1G (10-150Hz) sinusoidal vibration and 15G (6-11ms) impact, meeting the mechanical environment requirements during equipment transportation and on-site installation.

（2） Comprehensive security certification and standard compliance

The Trident series has passed safety certifications from multiple authoritative organizations worldwide, complying with multiple international industrial safety standards and providing compliance assurance for industrial applications worldwide. Among them, the Canadian Standards Association (CSA) certification ensures compliance with standards such as CAN/CSA-C22.2 No.0-M91 and CAN/CSA C22.2 No.1010.1-92, applicable to electrical safety requirements in North America; The EU CE certification enables it to comply with the EMC Directive (89/336/EEC) and the Low Voltage Directive (72/23/EEC), and can be freely circulated in EU member states.

In terms of functional safety, the module has passed T Ü V Rheinland certification and complies with the IEC 61508 (Parts 1-7, 2000 edition) functional safety standard, suitable for control scenarios with high Safety Integrity Level (SIL); Factory Mutual (FM) certification qualifies it for use in Class I Zone 2, Class II Zone 2, and Class III Zones 1-2 hazardous locations, with a temperature level of T4, suitable for Group A, B, C, and D hazardous gas environments. In addition, the module also complies with NFPA 85 (2007 edition) Boiler and Combustion System Safety Specification, SEMI S2-0200 Semiconductor Manufacturing Equipment Safety Guidelines, and ATEX Directive (94/9/EC), and can be widely used in various special industrial scenarios.

（3） Diagnosis and fault tolerance capability

The diagnostic function of the Trident series runs through the entire system architecture, achieving full level fault detection from module channels to the overall system. All I/O modules have channel level diagnostic function, which can detect faults such as channel short circuit, open circuit, signal loss, etc. The fault information is fed back in real time through the Fault indicator light and system alarm signal; The main processor module can detect global faults such as single channel faults, power failures, program errors, and system integrity abnormalities, and achieve isolation and redundant switching of faulty channels through the TriBus bus to ensure that the system can maintain core functional operation even in the event of a fault.

In terms of fault-tolerant design, the core advantage of TMR architecture is that "single point of failure does not affect system operation, and multi-point failures can be detected and alarmed". Whether it is the main processor module, communication module, or I/O module, a single channel failure will not cause system shutdown. The data of the faulty channel will be automatically eliminated, and the remaining channels will maintain normal output through a voting mechanism; When multiple faults are detected, the system will promptly trigger an alarm and retain critical operational data to provide support for troubleshooting. This "fault detectable, fault isolatable, and fault tolerant" design significantly improves the mean time between failures (MTBF) of the Trident series, meeting the high reliability requirements of industrial safety instrumented systems.

Software support and application scenarios

（1） Software development platform

The TriStation 1131 development workstation (version 4.5), which is compatible with the Trident series, is a core tool for system programming and configuration. It supports five programming languages that comply with the IEC 61131-3 standard, including ladder diagrams, function block diagrams, sequential function diagrams, structured text, and instruction lists, and can meet the programming needs of different control logics. The development platform provides complete project management, program editing, online debugging, fault diagnosis, and document generation functions. It supports establishing a connection with the Trident system through Ethernet ports to achieve program upload, download, and online monitoring.

In addition, the Trident series also supports various auxiliary software tools, including DDE Server 4.1.116 (for data exchange), SOE Recorder 4.1 (sequence event recording), Enhanced Diagnostic Monitor v2.2 (enhanced diagnostic monitoring), etc., providing comprehensive support for system operation and data management. All software tools provide detailed user documentation, including development guides, library reference manuals, security considerations guides, etc., to help users quickly master system configuration and debugging skills.

（2） Typical application scenarios

With high reliability, redundant design, and extensive environmental adaptability, the Trident series has been widely used in multiple key industrial fields

Petrochemical industry: used for monitoring and controlling key parameters such as temperature, pressure, and flow in refining units, chemical reactors, and storage tank areas, to achieve safety interlocking of emergency shutdown systems (ESD);

Power industry: suitable for the safety monitoring of boiler combustion systems and turbine control systems in thermal power, nuclear power and other power plants, ensuring the stable operation of generator sets;

Semiconductor manufacturing industry: compliant with SEMI S2-0200 standard, used for process parameter control and safety protection of semiconductor wafer manufacturing equipment;

Other industries, including pharmaceuticals, food processing, water treatment, and other fields that require high continuity and safety in the production process, provide reliable safety instrumented system solutions for various industrial control scenarios.

Product delivery and after-sales support

All components of the Trident series are available in flexible delivery options, including TriPak kits, module kits, and individual parts. The TriPak kit is an integrated delivery solution that includes modules and supporting base boards. For example, the main processor TriPak (model 5101) includes 3 MP modules and 1 MP base board kit, while the analog input TriPak (model 5351) includes 1 AI module and 1 AI base board kit, which can be directly used for system deployment; The module kit includes modules, base boards, and necessary interconnect components, while individual components allow users to flexibly purchase and replace according to their actual needs.

In terms of after-sales support, TRICONEX provides comprehensive technical documentation support, including planning and installation guides, communication guides, safety considerations guides, etc. Users can obtain them through hard copies or PDF formats; At the same time, TRICONEX has established a comprehensive technical support network worldwide, providing users with full lifecycle technical services such as system installation, debugging, and maintenance to ensure the stable operation of the system.