Trusted TMR Processor System: Building Reliable Safety Control with ICS Triplex Technology

What Is the Trusted TMR Processor System?

The Trusted TMR Processor System is the core processing platform within the ICS Triplex Trusted safety system, designed to provide dependable control, monitoring, and fault management for mission-critical industrial applications. Acting as the system's central controller, it processes input and output data exchanged with analog and digital I/O modules through the Trusted Triple Modular Redundant (TMR) Inter-Module Communications Bus.

Unlike conventional PLC processors, the Trusted TMR Processor System is specifically engineered for safety-critical environments where continuous operation and high availability are essential. Industries such as oil and gas, power generation, petrochemical production, and manufacturing rely on this platform to maintain safe operation even when hardware faults occur.

By combining redundant hardware, intelligent diagnostics, and IEC 61131-3 programming support, the system minimizes downtime while ensuring process integrity in demanding industrial environments.

Architecture of the Trusted TMR Processor System

One of the defining characteristics of the Trusted TMR Processor System is its Triple Modular Redundant architecture. The processor module contains three independent processor sections operating simultaneously in lock-step synchronization.

Each processor region includes:

Motorola PowerPC processor

EPROM

DRAM

Flash ROM

NVRAM

Memory-mapped I/O

Dedicated voter circuits

Fault detection logic

Rather than depending on a single CPU, all three processors execute identical application programs simultaneously. Their outputs are continuously compared using a two-out-of-three (2oo3) voting mechanism. If one processor produces inconsistent results due to a hardware fault or temporary disturbance, the remaining two processors maintain correct system operation while automatically isolating the faulty section.

This design significantly improves system reliability because transient, intermittent, and permanent faults can be detected without interrupting plant operation.

Communication between processor modules and remote chassis is achieved through Trusted Interface Modules or Expander Interface Modules, enabling scalable distributed safety architectures for large industrial facilities.

Key Features of the Trusted TMR Processor System

The Trusted TMR Processor System incorporates multiple technologies that improve availability, diagnostics, and operational safety.

Triple Modular Redundancy

Three synchronized processors continuously execute the same logic, allowing automatic fault masking through 2oo3 voting.

Hardware Fault Tolerance

The Hardware Implemented Fault Tolerant (HIFT) architecture enables extremely rapid fault detection without relying solely on software diagnostics.

Automatic Fault Management

The processor automatically identifies, isolates, and manages hardware failures while reducing unnecessary alarms that may distract operators.

Hot Module Replacement

Faulty processor modules can be replaced without reloading application programs, helping maintenance personnel minimize production interruptions.

IEC 61131-3 Programming Support

Engineers can develop control strategies using standard industrial programming languages, simplifying application development and long-term maintenance.

Built-in Diagnostics

Front-panel LED indicators, event history logs, and an RS232 diagnostic interface provide detailed information for troubleshooting and system monitoring.

Industrial Applications

The ICS Triplex Trusted platform has been widely adopted in industries where process safety cannot be compromised.

Typical applications include:

Emergency Shutdown Systems (ESD)

Fire and Gas Detection Systems

Turbine Protection Systems

Burner Management Systems

Process Safety Instrumented Systems (SIS)

Critical Process Monitoring

Plant-wide Safety Control

Offshore Oil and Gas Platforms

Refineries

Chemical Processing Plants

Power Generation Facilities

In these applications, even a brief controller failure may result in equipment damage, production losses, or safety hazards. The Trusted TMR Processor System provides the high availability required to maintain continuous protection.

How the Trusted TMR Processor System Operates

When power is applied, the processor performs a comprehensive initialization sequence to verify the condition of its internal resources. Memory devices, arithmetic units, timers, communication buses, and fault detection circuits are all tested before the system enters normal operation.

During runtime, data received from the Trusted Inter-Module Bus is continuously checked by dedicated voter circuits. Every data transaction undergoes two-out-of-three comparison to ensure accuracy before reaching processor memory.

All three processors execute the application program in perfect synchronization. Process variables, internal calculations, and program instructions are continually compared across processor channels, ensuring that any deviation is immediately detected.

Output data is then transmitted to output modules, where additional voting circuits verify consistency before signals are delivered to field devices.

If one processor begins producing inconsistent data, the remaining processors continue operating in 2oo3 mode while the faulty processor is isolated and, where possible, automatically resynchronized. This approach allows the system to maintain uninterrupted operation despite individual hardware failures.

Fault Detection, Diagnostics, and Maintenance

One of the greatest advantages of the Trusted TMR Processor System is its comprehensive diagnostic capability.

Continuous Self-Testing

The processor periodically performs automatic hardware tests on:

Microprocessors

Memory management units

Clock circuits

Communication buses

Error detection logic

These tests are scheduled by the real-time operating system without interrupting normal control functions.

Maintenance Mode

Maintenance mode allows engineers to update application software while retaining most operational capabilities. Engineering workstations can download new programs, modify control logic, and perform configuration changes efficiently.

Diagnostic Interface

An integrated RS232 diagnostic port operating at 19.2 kbps provides direct communication with engineering software for system configuration, fault analysis, and maintenance activities. Front-panel LEDs further simplify onsite troubleshooting by displaying processor health and operating status.

Fault Logging

Every detected fault is recorded with time stamps in the processor's fault history. This information assists maintenance teams in identifying recurring issues and improving long-term system reliability.

Fault Handling and System Recovery

The Trusted TMR Processor System is designed to respond intelligently to both minor and major hardware failures.

If a second processor failure occurs within the same module, the processor automatically isolates itself from the remaining system to prevent incorrect control actions. External interfaces return to predefined safe states while diagnostic information is preserved in non-volatile memory whenever possible.

In active/standby configurations, a failure of one processor slice automatically initiates changeover to the standby processor, ensuring uninterrupted operation if system conditions permit.

During power supply interruptions, early warning signals trigger the processor's Power Off mode. Critical operating data, fault history, user applications, and plant status information remain safely stored in non-volatile memory, allowing rapid recovery once power is restored.

Conclusion

The Trusted TMR Processor System represents one of the most reliable safety processing platforms available for modern industrial automation. For organizations implementing ICS Triplex safety systems, the Trusted TMR Processor System provides a proven foundation for emergency shutdown, fire and gas protection, turbine control, and other high-integrity applications. Its combination of redundant processing, standardized programming, and advanced maintenance features enables industrial facilities to maximize operational safety while reducing downtime and maintenance costs.

Q1: What is the Trusted TMR Processor System?

A: The Trusted TMR Processor System is the central processing unit of the ICS Triplex Trusted safety system, providing reliable control, monitoring, and communication for safety-critical industrial applications.

Q2: How does the Trusted TMR Processor System ensure fault tolerance?

A: It uses Triple Modular Redundancy (TMR) with three synchronized processors and a two-out-of-three (2oo3) voting mechanism to detect and isolate faults while maintaining continuous operation.

Q3: What industries commonly use the Trusted TMR Processor System?

A: It is widely used in oil and gas, power generation, chemical processing, petrochemical plants, and other industries requiring high-integrity safety control systems.

Q4: What are the main features of the Trusted TMR Processor System?

A: Key features include TMR fault tolerance, HIFT architecture, hot module replacement, IEC 61131-3 programming support, built-in diagnostics, and automatic fault handling.

Q5: How does the Trusted TMR Processor System support maintenance and troubleshooting?

A: It provides continuous self-testing, time-stamped fault logging, front-panel status indicators, and an RS232 diagnostics port for efficient monitoring, maintenance, and fault diagnosis.

Sources 

https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/icstt-rm251_-en-p.pdf

(If there is any copyright infringement, please contact me to delete this article.)