guarded analog output modules - rockwell automation

ICS Regent® PD-6026

Industrial Control Services 1

Guarded Analog Output Modules

4 to 20 mA (T3480)

Issue 1, March, 06

Guarded analog output modules provide 4 to 20 mA current outputs for a maximum of six user loads per module. These modules are called Guarded because the module's dual-redundant design ensures that no single fault within a module will inadvertently change an output's signal. The module's triplicated Safetybus interface ensures that no Regent system failure will inadvertently affect the output signal. Extensive fault detection and annunciation of critical redundant circuits ensures the modules will continue to operate in a fail-safe manner.

Features

· Six 4 to 20 mA output circuits.

· Dual, high resolution, 12-bit D/A converters per output.

· Fault tolerant operation when connected in parallel with another module of the same type.

· Hot-replaceable.

· Comprehensive self-testing of all critical circuits.

· Front panel indicators on each module show active/fault, shutdown, and on status.

· 2500 volt minimum electrical isolation between field and logic circuits.

· TÜV certified, Risk Class 5, non-interfering.

Two Guarded output modules can be connected in parallel to obtain fault tolerant control of current to the loads. In this parallel module configuration, either module can be removed and replaced while the other Guarded module continues to control the loads without interruption.

Guarded Analog Output Modules (T3480)

2 Industrial Control Services

Module Operation

A block diagram of the Guarded analog output module is shown in Figure 1.

The processor modules send triplicated write data commands over the I/O Safetybus to the Guarded output module. Onboard the Guarded output module the triplicated data are routed to two independent voter and I/O Safetybus logic sections. Each section independently votes the triplicated data and drives one digital-to-analog (D/A) converter for each of the six output channels.

Figure 1. Block Diagram of Guarded Analog Output Module.

For each output channel, one of the D/A converter output signals is used for the actual analog output drive signal. The other D/A converter output signal generates a redundant reference output signal. When all circuits are operating correctly each channel’s drive output and reference output should be the same. These two signals are compared on the module and must be the same in order for the module to control the field outputs.


P D - 6 0 2 6 M a r - 0 6 3

The combination of redundant interface circuits, D/A converters, and comparison of drive and reference signals produces a fail-safe signal to the load.

For fault tolerant operation, two Guarded analog output modules can be used in parallel. In this configuration, the STATUS OUT and STATUS IN signals are cross-strapped between the two redundant modules. This connection causes only one of the analog output modules to control the field devices, while the redundant module is in a standby mode. In the standby mode the module has its D/A converter output signals shunted to AGND. This allows the module to completely test and validate its analog drive circuits while the other module controls the load devices. If the controlling module fails, it turns off and the standby module becomes the controlling module. This switch over occurs in less than 5 msec and is effectively bumpless for most field devices.

Testing and Diagnostics

The voter and I/O bus interface logic of the Guarded analog output module are automatically tested by the processor modules. Discrepant data are sent through one of three legs of the I/O Safetybus to determine whether the module’s voters are able to outvote the incorrect data. A failure to return the correct majority-voted result to the processors produces an I/O module error indication at the processor modules and a module fault indication at the I/O module.

Each type of module has a unique identification code that is read by the controller. This code lets the controller know which type of module is installed in each I/O chassis slot and how to address that module and its points specifically. If a module is removed, or is replaced with a module of a different type, the processor modules will indicate an I/O module error.

Loopback logic tests periodically write data to the module and then read it back to determine whether the module’s I/O bus interface logic is functioning correctly.

To detect a failure in the redundant analog drive circuits, each channel’s redundant D/A converter output signals are compared. If they are not the same, a fault signal is sent to the fault summary circuits to disable the module’s outputs —



shunting all six output channel signal outputs to AGND via the diode matrix.

An open circuit wiring fault to a load will cause the output signal comparison for that channel to fail. In single module configurations this may produce undesirable effects. Refer to page 11, Effects of Open Circuit Field Wiring, for further details and recommendations.

Front Panel Indicators

Figure 2 shows the physical features of a Guarded analog output module. The front panel of each module contains active and fault status indicators, an on status indicator, and a shutdown indicator.

Active and Fault Status Indicators

These green and red LEDs indicate the overall health of the module and its field circuits. During normal operation the green ACTIVE indicator flashes at the controller's scan rate. If a module fault occurs the red FAULT indicator turns on and the green ACTIVE indicator turns off.

The module will indicate a FAULT if field power is not applied.

On Status Indicator

In a single module, fail-safe configuration this green LED is on when the module is operating correctly. If any output channel’s dual D to A converters fail to compare, the module shuts off and this LED turns off.

In a dual module, fault tolerant configuration only one of the two parallel modules is controlling the load current while the other is in a standby mode. Only the ON status indicator on the controlling module is turned on (the standby module's ON indicator will remain off). If the controlling module fails, its ON status indicator will turn off and the standby module's ON status indicator will turn on (as it becomes the controlling module).

Shutdown Indicator

Upon loss of communications with the controller, output modules enter either a shutdown or hold fault mode. If the I/O

Important!

Note:


P D - 6 0 2 6 M a r - 0 6 5

unit is set to shutdown, the red SHUTDOWN indicator will turn on when the communications with the controller are lost. If the I/O unit is set to hold, the SHUTDOWN indicator will always be off (see page 11, Fault Mode Jumper).

When the module is installed in the I/O chassis or when logic power (from the I/O power supply modules) is first applied to the module, it will be in the shutdown mode until the first output scan, regardless of the fault mode jumper settings. Also, removing two I/O transceiver modules, two I/O power supply modules, or two power legs will cause the module to be in the shutdown mode.

Note:



Figure 2. Guarded Analog Output Module.


P D - 6 0 2 6 M a r - 0 6 7

Application

Guarded analog output modules are suited for high integrity control of analog output devices. Guarded output modules can be used for fail-safe or fault tolerant operation.

Fail-Safe Configuration

As shown in Figure 3, fail-safe configuration uses a single Guarded module. In this configuration, the worst case failure will cause the output to fail to the off state.

In a fail-safe configuration, a module failure and subsequent removal of the module disables all of its outputs.

Figure 3. Fail-Safe Configuration.

Fault Tolerant Configuration

For fault tolerant operation, two Guarded modules are connected in parallel as shown in Figure 4. In this configuration, operation continues even if one module fails.

In the fault tolerant configuration, a failed module can be removed and replaced without interrupting operation of the loads.



Figure 4. Fault Tolerant Configuration.

Field Wiring

Field wiring terminal blocks on the I/O chassis are used to connect power sources and loads to the module. The terminal blocks are located directly above and below the slot where the module is installed. Each terminal block consists of ten #6 wire clamp screw terminals capable of holding two 12 AWG wires. Figure 5 shows the proper field wiring for a single module and Figure 6 shows the field wiring for fault tolerant modules connected in parallel.

Two terminals are provided for connecting to each output load device. All six analog output channels must be connected to a load device or else the output circuit testing will fail. For each unused spare output channel, short its two output terminals together by installing a wire across the appropriate terminals on the I/O chassis.

Each module has one-pair of terminals for connecting an external 24 VDC field power supply to power the field-side D/A circuits and output current signals. Output circuit testing requires the presence of this field power. If the field power is disconnected, output testing fails and a module fault is indicated.

When two guarded analog output modules are used in a fault tolerant configuration, the A and B terminals must be cross strapped between the two modules as shown in Figure 6.

Important!


P D - 6 0 2 6 M a r - 0 6 9

Figure 5. Fail Safe Field Wiring.


1 0 Industrial Control Services

Figure 6. Fault Tolerant Module Wiring.


P D - 6 0 2 6 M a r - 0 6 11

Effects of Open Circuit Field Wiring

When a Guarded analog output module is controlling the outputs (as opposed to the standby mode) an open circuit in the field wiring connected to a load device will be detected as a failure. This causes the controlling module to switch off, annunciate a fault and enter the standby mode. Once in the standby mode, all of its outputs are shunted to AGND internal to the module, thus eliminating the open circuit and the module’s comparators become healthy. This will have one of two effects based upon single or dual module configuration:

Single Guarded Module Configuration

In a single guarded output configuration the module will toggle back and forth between the controlling and standby modes about every one or two seconds. The ON status LED on the face of the module will turn on and off repeatedly until the open circuit field wiring is corrected. During this time the module FAULT status LED will also be on and the system will report a fault for this module.

Each time the single module enters the standby mode all six of the output channels are taken off line and the field signals become 0 mA. When the module switches back to the control mode the field signals return to their controlled values. This causes the output loads that have healthy wiring connections to experience an output signal that toggles between 0 mA and their controlled values which often produces undesirable effects. To avoid this, you should monitor the fault status system control relay for the output module in your application program and use it to set all of the analog output channels to zero. Turning all of the outputs off will often be safer than letting them toggle between 0 mA and a controlled value.

Dual Guarded Module Configuration

In a dual module configuration the two modules will switch back and forth between control and standby modes. The ON status LED will appear to “ping-pong” back and forth between the two modules about every one or two seconds. This will continue until the open circuit field wiring is corrected. During this time the module FAULT status LED will also be on for each of the modules and the system will report a fault for both modules.

Important!



While in this mode the remaining output loads that have healthy field wiring connections should continue to be controlled correctly because one of the two modules is always in the control mode.

Fault Mode Jumper

The fault mode jumper is located behind the ID switch cover in the lower left-hand corner of each I/O chassis. The position of the fault mode jumper determines the module's response to system level faults. The fault mode jumper’s position will cause all output modules in the I/O chassis to either shutdown (set all outputs to zero) or to hold (hold the last state) after a system level failure occurs. An example of a system level failure is the failure of two processor modules.

Keying

The I/O chassis can be physically keyed to prevent accidental damage caused by inserting a module into a slot wired for a different module type. Figure 7 illustrates how the slot keys are installed on the I/O chassis slot field wiring connectors. The slot key positions for the Guarded analog output module are listed in Table 1.

Table 1. Slot Key Positions.

Module Upper Connector

Lower Connector

T3480 9 10


P D - 6 0 2 6 M a r - 0 6 13

Figure 7. Installing Slot Keys.

Configuration

Each output module is configured using the WINTERPRET I/O Configuration Editor. In the editor you will perform the three steps described below to configure the output module.



1) Set the Module Type:

Position the cursor on the module slot you wish to define. Choose Set Module Type from the Edit Menu and select the Guarded analog output module from the list.

2) Edit the Module Definition:

Choose Edit Module Definition from the Edit Menu. A dialog box will open where you can define the analog output point definitions.

Figure 8. Guarded Analog Output Module Definition.

3) Edit each point:

Choose Edit from the Module Definition dialog box to define a name and description for each output point. In the Analog Output Point dialog, enter names and values for the configuration fields as described below.


P D - 6 0 2 6 M a r - 0 6 15

Figure 9. Defining an Analog Output Point.

Name

Also called the tag name, this is the name used in the application program to reference the output point. The name can be up to 12 characters long.

Description

This 40-character field provides a place to describe the output point definition. The description is used to help document your system (it does not affect application program operation).

Comm Protect

Marking the Comm Protect check box protects the point from changes by communications functions such as data write, forcing, and load initial value when Comm Protect is enabled.

Initial Value

The initial value for the output is loaded to the Regent when you load the I/O configuration and also when you load the application program that controls the output.

Final Value

The final value for the output is loaded to the Regent when the application program that controls the output is deleted. Unless special circumstances exist, you should always enter zero, so that the output is turned off when you delete the application program that controls it.



Programming

Outputs are controlled by writing application programs that solve for output values. For example, placing an output tag name in the result field of a math element in ladder logic will set the analog output to the value calculated by the math element. Note that the data range for analog outputs is 0 to 4095 corresponding to the output current rage of 4 to 20 mA.

Often you may choose to write analog control logic using an engineering unit number range other than 0 to 4095 to simplify the creation and interpretation of the control logic. If you do so you should use the analog scaling function block to “unscale” your calculated value to the 0 to 4095 range required for the analog output. An example of an analog scaling entry for analog outputs is shown in Figure 10.

Figure 10. Unscaling an Analog Output.

This example implies that some other control logic solves a value for the shared register “AO1_ENG_VAL” which ranges from 0 to 10,000 (the low and high values). The analog scaling entry shown in the example then converts the engineering unit value to the analog output range of 0 to 4095, storing the converted value in the analog output “AO1”. By using an engineering unit range of 0 to 10,000 for your


P D - 6 0 2 6 M a r - 0 6 17

control logic, you maintain the full resolution of the analog output (1 part in 4096) and have a convenient engineering range that represents 0.00 to 100.00% (the two decimal places are implied).

Programming Fault Tolerant Guarded Analog Outputs

To program guarded analog outputs in a fault tolerant configuration, you should create control logic to calculate the value for one of the guarded analog outputs and copy this calculated value to the redundant guarded analog output. If you use the unscale entry in the analog scaling function block you should place this “copy logic” after the analog scaling function block in your application program. Figure 11 illustrates how the Assign instruction in ladder logic can be used.

Figure 11. Programming Fault Tolerant Outputs.

In this example GAO1A is the name of the analog output that has been set by your control logic, and GAO1B is the redundant analog output. When power flows to the Assign element, it reads the value of GAO1A and stores that value to GAO1B, so that both of the redundant analog outputs have the same value.

Maintenance

There are no user replaceable parts inside the Guarded analog output module. Re-calibration is recommended once per year, in order to maintain the rated accuracy of the analog output signals over an extended period of time. The following procedure describes the equipment and steps necessary to calibrate the Guarded analog output module.

Calibration Procedure

Equipment Required

· A 5½-digit voltmeter.

· Six 250 ohm, 0.005%, 5 ppm/°C resistors to convert the six output signals from a current to a voltage.



· Potentiometer adjustment tool.

· Phillips screwdriver

· I/O module extender, catalog number T3322.

· PC running the WINTERPRET software, used to force the analog output channels to the specific values for calibration.

Calibration Preparation

The module must be calibrated while connected to an I/O chassis of an operational Regent system.

During calibration, the Guarded analog output module will be disconnected from the actual controlled field devices. Appropriate precautions should be taken to ensure that the disconnection of the control signals does not pose a safety risk to plant personnel or process equipment.

There are Offset and Gain potentiometers for each analog output channel. In addition there are three reference voltage potentiometers and four test points to measure the reference voltages. These potentiometers are located on a circuit board inside the module's protective clamshell housing (see Figure 12). During the calibration steps you will remove the printed circuit board from the housing in order to access these potentiometers for adjustment.

The potentiometers for each analog output channel are identified in Table 2. The potentiometers labeled R19, R17 and R22 are used to adjust the reference voltages.

Table 2. Potentiometer Identification.

Channel

Offset Potentiometer

Gain Potentiometer

1 R101 R100

2 R201 R200

3 R301 R300

4 R401 R400

5 R501 R500

6 R601 R600

Important!


P D - 6 0 2 6 M a r - 0 6 19

Figure 12. Guarded Analog Output Module Calibration Potentiometer Locations.

The I/O extender module has jumper posts that allow you to connect or disconnect the I/O slot field wiring on the I/O chassis to the printed circuit board plugged into the I/O extender. During the calibration steps you will remove any jumpers installed on these posts in order to connect the precision load resistors to the analog outputs. Figure 13 shows the jumper posts to which you should connect the precision resistors for each analog output channel.



Figure 13. I/O Extender Connections for Guarded Analog Output Calibration.

Within each pair of jumper posts, make sure that you connect the resistors to the jumper posts nearest the front of the I/O extender. Do not make any connections to the jumper posts nearest the I/O chassis backplane — these connect to the actual field wiring attached to the I/O slot terminals on the I.O chassis.

Calibration Steps

1. Remove the module to be calibrated from the I/O chassis.

2. Install the I/O extender module into the slot from which the module was removed.

3. Remove the jumpers (if installed) labeled CH1 through CH16 from the I/O extender module.

Important!


P D - 6 0 2 6 M a r - 0 6 21

4. Connect the six precision resistors to the I/O extender jumper posts as shown in Figure 13. Use test clips as required to make the connections.

5. Remove the four screws on one side of the module and remove the printed circuit board from the module clamshell housing.

6. Install the printed circuit board into the I/O extender module. Allow the board to warm up for approximately one minute.

7. Connect the voltmeter's negative probe to test point TP4. Measure the voltage at TP1. The voltage should be 10.0000 VDC (±0.0003 VDC). Use R22 to adjust the voltage.

8. Connect the voltmeter’s negative probe to TP4. Measure the voltage at TP2. The voltage should be 8.0000 VDC (±0.0002 VDC). Use R17 to adjust the voltage.

9. Connect the voltmeter negative probe to TP4. Measure the voltage at TP3. The voltage should be 2.0000 VDC (±0.0001 VDC). Use R19 to adjust the voltage.

10. Using the forcing functions of WINTERPRET, force all of the six analog outputs to zero. Refer to the Regent User’s Guide for more details about the forcing functions. Wait approximately one minute after forcing the outputs to allow them to stabilize.

11. Adjust each of the six Offset potentiometers until the voltage measured across the corresponding precision resistor is +1.0000 V (± 0.0002 V). Connect the voltmeter across the resistor leads to measure the voltage.

12. Force all six of the outputs to 4095. Wait approximately one minute after forcing the outputs to allow them to stabilize.

13. Adjust each of the six Gain potentiometers until the voltage measured across the corresponding precision resistor is +4.9990 V (± 0.0002 V).

After completing one iteration of the calibration, repeat the offset and gain adjustments (steps 10 through 13) until the readings are within specifications. It is necessary to repeat



these steps as there may be some interaction between the gain and offset adjustments.

14. As a final check, use WINTERPRET to force all six outputs to 2048. Wait one minute and verify that the voltage measured across each of the precision resistors is +3.0000 VDC (±0.0002 VDC). If the Offset and Gain adjustments are within the limits stated in steps 11 and 13 above, but this midvalue point is not, return the Guarded analog output module to the factory for repair or replacement.

15. Calibration is complete. Unplug the printed circuit board from the I/O extender module and replace it in its clamshell housing. Remove all forcing of the analog outputs from the force table using WINTERPRET. Remove the I/O extender module from the I/O chassis and reinstall the calibrated module in the I/O chassis.

The module’s red Fault indicator will be on until you perform a voted reset by pressing the Reset buttons on two of the Regent processor modules. After the voted reset is complete, the module’s green Active indicator should turn on.

Latent Fault Testing Procedure

Equipment Required

· A digital multimeter with diode test mode (2 mA current source).

· Six 250 ohm, 0.005%, 5 ppm/°C resistors to terminate the analog output channels.

· One 47K ohm, 5%, ¼ Watt resistor for fault injection tests.

· Phillips screwdriver

· I/O module extender, catalog number T3322.

· PC running the WINTERPRET software, used to force the analog output channels to the specific values for calibration.

Testing Preparation

A portion of the tests are performed on the module while it is disconnected from the rest of the system and removed from its protective clamshell housing. For the remainder of the tests


P D - 6 0 2 6 M a r - 0 6 23

the module must be connected (using the I/O extender) to an I/O chassis of an operational Regent system. It is recommended that these tests are performed each time that you calibrate the Guarded analog output module.

There are two diodes for each analog output channel that must be tested for latent faults. In addition the fault summary logic is exercised by injecting a fault. The locations of the diodes and other necessary test and measurement points for this procedure are shown in Figure 14.

The I/O extender module has jumper posts that allow you to connect the six 250 Ohm termination resistors to the printed circuit board plugged into the I/O extender. During the calibration steps you will remove any jumpers installed on these posts in order to connect the termination resistors to the analog outputs. Figure 13 shows the jumper posts to which you should connect the resistors for each analog output channel.



Figure 14. Location of Test Points for Latent Fault Testing.

Testing Steps

1. Remove the module to be tested from the I/O chassis.

2. Install the I/O extender module into the slot from which the module was removed.

3. Remove the jumpers (if installed) labeled CH1 through CH16 from the I/O extender module.


P D - 6 0 2 6 M a r - 0 6 25

4. Connect the six termination resistors to the I/O extender jumper posts as shown in Figure 13. Use test clips as required to make the connections.

5. Remove the four screws on one side of the module and remove the printed circuit board from the module clamshell housing.

6. With the printed circuit board removed from the system, check the forward voltage drop (in-circuit) on all 12 output diodes with a digital multimeter in the diode test mode (2 mA current source). Verify that the forward voltage drop is within the following tolerances:

0.6 to 0.8 volts for CR100, CR200, CR300, CR400, CR500, and CR600.

0.2 to 0.45 volts for CR101, CR201, CR301, CR401. CR501 and CR601.

7. Check the resistance (in-circuit) of the 12 output diodes reversely polarized with a digital multimeter set to 20 MOhm resistance range, by connecting the (+) lead of the meter to the cathode and the (-) lead of the meter to the anode of the diode. Verify that the resistance is within the following tolerances:

> 20 MOhm for CR100, CR200, CR300, CR400, CR500, and CR600.

> 1 MOhm for CR101, CR201, CR301, CR401. CR501 and CR601.

8. If any of the tests in steps 6 or 7 fails, the board should be returned to the factory for repair or replacement. If the tests passed continue to step 9.

9. Install the printed circuit board into the I/O extender module. Perform a voted reset (press two of the processor module Reset buttons) and verify that the module is Active (green Active LED is on and red Fault LED is off). Allow the board to warm up for approximately one minute.

10. Connect a 47K Ohm, 5% resistor between TP4 (AGND) and the top lead of the first resistor (10K Ohm) on the SIP resistor network RN101 (Figure 14 shows the exact location of this resistor). Verify that the module signals a



fault (green Activity LED turns off and the red Fault LED turns on).

11. Disconnect the one end of the 47K Ohm resistor from TP4. The other end should still be connected to the top lead of the 10K Ohm resistor on RN101. Restore the module to the Active state by performing a voted reset. Now take the end of the 47K Ohm resistor that you removed from TP4 and reconnect it to TP3 (+2VREF). Verify that the module indicates a fault.

12. Restore the module to the Active state by performing a voted reset.

13. Repeat steps 10 through 12 for output channels 2 through 6 connecting the 47K Ohm resister to the appropriate resistor network (RN201 through RN601). Use the same test points TP4 and TP3 as used for output channel 1. In each case, verify that the fault injection procedure causes a fault indication on the module.

14. If any of the fault injection tests does not produce a fault indication, the module should be returned to the factory for repair or replacement.

15. Calibration is complete. Unplug the printed circuit board from the I/O extender module and replace it in its clamshell housing. Remove the I/O extender module from the I/O chassis and reinstall the module in the I/O chassis.

The module’s red Fault indicator will be on until you perform a voted reset. After the voted reset is complete, the module’s green Active indicator should turn on.

Safety Considerations

The Guarded analog output module is TÜV certified as non-interfering, and can be used in a safety system for non-safety critical outputs.

Analog outputs are rarely used to perform safety critical interlock functions, but processes may have control applications that demand a high integrity for analog control functions. The guarded analog output module is ideally suited for these types of applications. In all applications the


P D - 6 0 2 6 M a r - 0 6 27

safety of the process should not be dependent on the operations of the guarded analog output module.

To maintain the highest level of integrity, users are advised to periodically perform the calibration and latent fault testing described in the Maintenance section of this document. Refer to page 17 for specific details on performing these procedures.

Specifications

Safetybus Power 0.8 load units

Number of Outputs Six

External Power Voltage: Current:

24 VDC ±10% 0.5 amps

Output Range 4 to 20 mA

Data Range 0 to 4095

Resolution 12-bit (1 in 4096)

Accuracy 0.05% of full scale @ 25° C

Drift ±50 ppm/°C

Load Resistance 0 to 400 ohms

Settling Time 0.1 ms (to 0.1% of full scale)

Heat Dissipation 14 Watts, 47 BTUs/hour

Isolation 2500 volts minimum (field wiring to control logic)

Operating Temperature 0° to 60° C (32° to 140° F)

Storage Temperature -40° to 85° C (-40° to 185° F)

Operating Humidity 0 to 95% relative humidity, non-condensing

Vibration 10 to 55 Hz:

±0.15mm

Shock Operating:

15 g, ½ sine wave, 11 msec



Electromagnetic Interference

• IEC 801 Part 2 - Electrostatic Discharges

• IEC 801 Part 3 - Radiated Electromagnetic Fields

Level 3: Contact discharge of 6 kV

Level 3: 10 V/M, 27 MHz - 500 MHz

Safety Certified to DIN V VDE 0801 (non-interfering) and designed to meet UL 508 and CSA 22.2, No. 142-M1981

Dimensions Height: Width: Depth:

12.6" (320 mm) 1.27" (32 mm) 10.12" (257 mm)

Weight 3.5 lbs (1.6 kg)

guarded analog output modules - rockwell automation

Documents