Rockwell Automation T8310 Trusted Expander Processor - Manual (Page 16)

Trusted
TM
Module T8310
Issue 12 Dec 06 PD-T8310 16
3. Application
3.1. Message Forwarding
The primary function of the Expander is to provide a method of extending the IMB beyond a single
processor chassis. The active TMR Expander Interface Module receives messages from the
processor chassis IMB/backplane and forwards them to the Expander Bus when its slot position is
enabled. Similarly, the active TMR Expander Processor Module forwards all messages received from
the Expander Bus to the Expander Chassis IMB.
Messages addressed to the Expander Processor module itself, i.e. those command messages with
chassis and slot address fields matching those of the module, result in the message being handled
locally and the appropriate response message being generated. For other command messages the
response message received by the active Expander Processor from the addressed module is passed
to the Expander Bus and hence to the TMR Expander Interface Module. The active TMR Expander
Interface Module then passes the message to the Processor Chassis IMB, subject to the prevailing
IMB control signals.
The messages received from the controller chassis IMB at the TMR Expander Interface Module are
re-synchronised and majority voted before being passed to the triplicated Expander Bus. Similarly,
messages received by the TMR Expander Processor Module from the Expander Chassis IMB are
re-synchronised and majority voted before onward transmission.
Messages received from the Expander Bus at both the TMR Expander Interface Module and TMR
Expander Processor Module are re-synchronised and majority voted (Byzantine voted) before being
passed to the associated IMB.
Errors in messages are corrected, and therefore masked using this method. This, however, makes it
important that discrepancies in faults in these signals are detected and the information made available
for fault reporting purposes to avoid latent fault issues.
3.2. Control Signal Forwarding
The active TMR Expander Interface Module continually monitors and transmits the state of the
following signals:
All three signals are fully triplicated. These signals are distributed to all of the attached Expander
Busses. The TMR Expander Processor Modules forward the received state of these signals to the
Expander Chassis IMB. The direction of these signals is always from TMR Processor to TMR
Expander Interface to TMR Expander Processor to interface (I/O) module.
As with the message forwarding, these signals are re-synchronised and majority voted, i.e. Byzantine
voted at the TMR Expander Interface and TMR Expander Processor Modules. The signals are
synchronous within the Expander Chassis even in the case of a fault within the Processor Chassis.
3.3. Interface Module Selection
The active TMR Expander Processor Module monitors the received command messages and decodes
chassis and slot information where the message’s chassis number matches that set by the local
switches.
• Power Failure Warning
• System Watchdog
• Command Response Control