ABB August Ltd

CS300 Safety System Training Manual

PREFACE
One of the main activities of ABB August is to develop, manufacture and produce
Specialised Control Systems. Each system manufactured is individually designed
to suit both the application and the requirement of the client.

The majority of systems developed by ABB August utilise their own ultra-reliable
fault tolerant CS300 Process Control System which provides maximum safety
and performance for a wide range of Onshore and Offshore process applications.
The unique concept and continuous development of the CS300 Series Triple
Modular Redundant (TMR) System has enabled ABB August to produce Fault
Tolerant Safety Control Systems.

By utilising the Triple Modular Redundant principles combined extensively with

the use of Software Implemented Fault Tolerant (SIFT) technology, uninterrupted
operation of critical applications can be ensured.

ABB August have now achieved an international reputation for the design and
manufacture of High Integrity and High Reliability systems in critical applications
where the ultimate requirement is always Safety, Availability and Accurate
Control of process plant together with the Protection of Personnel.

The CS300 Process Control System is Field Proven with over 600 major
systems, accumulating in excess of 10,000,000 Operational Hours, having been
installed in applications where Safety, Availability and Reliability are essential.

The Prime Objective of this training course is to introduce the delegates to the
principles of the Fault Tolerant Concept and provide them with a clear
understanding of the operating features of the CS300 Process Control System.

A Further Objective of this training course is to provide sufficient detail and

information on the way in which the CS300 Process Control System has been
utilised to suit a particular application and also the way in which it interfaces with
the surrounding environment.

The training course will therefore commence with an introduction into the
development of both the company and the fault tolerant concept before going on
to discuss and introduce both the equipment being supplied and the way in which
its configured.

Issue ** Jan 97 Page 1 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Contents
1. THE TRAINING COURSE ................................................................................................................. 7
1.1 INTRODUCTION .................................................................................................................................. 7
1.2 CONCEPT .......................................................................................................................................... 7
1.3 OPPORTUNITY ................................................................................................................................... 8
1.4 TRAINING MANUAL ............................................................................................................................ 8
1.5 PROGRAM ......................................................................................................................................... 9
1.6 TIMETABLE ........................................................................................................................................ 9
1.7 COURSE OBJECTIVES ....................................................................................................................... 9
1.8 COURSE OUTLINE ........................................................................................................................... 10
2. COMPANY INTRODUCTION ......................................................................................................... 11
2.1 THE DEVELOPMENT OF THE FAULT TOLERANT CONCEPT ............................................................ 11
2.2 THE COMPANY'S BACKGROUND ..................................................................................................... 12
2.3 THE GROUP TODAY ......................................................................................................................... 14
2.4 QUALITY .......................................................................................................................................... 15
2.5 SOFTWARE CONTROL..................................................................................................................... 16
2.6 CONTROL OF APPLICATION SOFTWARE ......................................................................................... 16
2.7 TESTING .......................................................................................................................................... 16
2.8 SYSTEM APPLICATIONS .................................................................................................................. 17
2.9 ADDITIONAL APPLICATIONS ............................................................................................................ 18
2.10 DOCUMENTATION ....................................................................................................................... 19
2.10.1 Contract Specific Documentation ..................................................................................... 19
2.10.2 Standard Documentation ................................................................................................... 19
2.11 TRAINING COURSES................................................................................................................... 20
2.12 ON-SITE ASSISTANCE................................................................................................................ 20
2.13 SERVICES PROVIDED ................................................................................................................. 20
2.14 ABB AUGUST LIMITED ............................................................................................................... 21
2.15 ABB AUGUST INC. ............................................................... ERROR! BOOKMARK NOT DEFINED.
2.16 ABB AUGUST PTE LTD ........................................................ ERROR! BOOKMARK NOT DEFINED.
3. TMR APPLIED .................................................................................................................................. 23
3.1 RELIABILITY ..................................................................................................................................... 23
3.2 SYSTEM AVAILABILITY .................................................................................................................... 24
3.3 TYPICAL APPLICATIONS .................................................................................................................. 25
3.4 THE MAIN FEATURES OF THE CS300 SYSTEM ............................................................................. 25
3.5 THE FAULT TOLERANT CONCEPT .................................................................................................. 25
3.6 FAULT TOLERANT OPERATION ....................................................................................................... 27
3.7 REAL TIME TASK SUPERVISOR (RTTS) ........................................................................................ 27
3.8 SOFTWARE IMPLEMENTED FAULT TOLERANCE (SIFT) ................................................................. 28
3.9 SOFTWARE VOTING ........................................................................................................................ 28
3.10 3-2-0, 3-2-1 CONTROLLED DEGRADATION ............................................................................... 29
3.11 HOT REPAIR I/O FACILITIES ...................................................................................................... 29
3.12 SELF DIAGNOSTIC ROUTINES .................................................................................................... 30
3.13 OFF-LINE/START DIAGNOSTICS ................................................................................................ 31
3.14 ON-LINE DIAGNOSTICS .............................................................................................................. 32
3.15 ACHIEVING FAULT TOLERANCE ................................................................................................. 33
4. CS300 SYSTEM................................................................................................................................ 35
4.1 CS300 SYSTEM ARCHITECTURE ................................................................................................... 35

Issue ** Jan 97 Page 2 of 230

 ABB August Ltd
CS300 Safety System Training Manual

4.2 CS300 RESIDENT PIM CHASSIS ................................................................................................... 36

4.3 TERMINATION MODULES................................................................................................................. 37
4.4 TRIGARD ENGINEERING W ORKSTATION ..................................................................................... 38
4.5 COMMUNICATION LINKS TO THIRD PARTY SYSTEMS .................................................................... 39
4.6 COMMUNICATIONS TO PROPRIETARY COMPUTER BASED SYSTEMS ............................................ 39
4.7 THEORY OF OPERATION ................................................................................................................. 40
4.8 CS300 MINIMUM SYSTEM .............................................................................................................. 40
4.8.1 Operating System Firmware.............................................................................................. 41
4.8.2 Application Software........................................................................................................... 42
4.8.3 Module Support ................................................................................................................... 42
4.8.4 Network Ladder Software .................................................................................................. 42
5. CS300 HARDWARE......................................................................................................................... 43
5.1 CS300 SERIES MAIN COMPONENTS ............................................................................................. 43
5.1.1 PI-317 Process Interface Module .................................................................................... 44
5.1.2 PI-331 PIM Power Supply Unit ....................................................................................... 47
5.1.3 PI-110 Triple Fan Unit ...................................................................................................... 48
5.1.4 TM117-SA Serial I/O Termination Panel ........................................................................ 49
5.1.5 CD-901 System Diagnostic Panel .................................................................................... 50
5.1.6 CD905 System Diagnostic Switch.................................................................................. 52
5.1.7 PM108-D 5 VDC Termination Panel Power Supply...................................................... 53
5.1.8 PM108-A 24VDC Termination Panel Power Supply ..................................................... 54
5.2 CS300 PROCESS INTERFACE MODULE (PIM) CARDS .................................................................. 55
5.2.1 CS386 ICCB - Industrial Control Computer Board....................................................... 56
5.2.2 PI751 PIM BUS Interface Card ....................................................................................... 58
5.2.3 PI774 4 Port Serial I/O Card............................................................................................ 59
5.2.4 PI716 Digital Input Card................................................................................................... 61
5.2.5 PI-726 Digital Output Card .............................................................................................. 63
5.2.6 PI727 Digital Output Board.............................................................................................. 65
5.2.7 PI732 Analogue Input Card ............................................................................................. 67
5.2.8 PI741 Analogue Output Card .......................................................................................... 69
5.3 TERMINATION MODULES......................................................................................................... 71
5.4 117 SERIES TERMINATION MODULES ............................................................................................ 72
5.4.1 TM117-AC 16 Channel Input or Output .......................................................................... 72
5.4.2 TM117-DC 16 Channel Input or Output.......................................................................... 74
5.4.3 TM117-DIS 16 Channel Input with Override Switch ..................................................... 76
5.4.4 TM117-DR 16 Channel Volt Free Change Over Output ............................................. 77
5.4.5 TM117-DR/5 ........................................................................................................................ 79
5.4.6 TM117-DR/30 8 Channel Volt Free Change Over Output @ 30 Amps ..................... 80
5.4.7 TM117-P16 16 Channel Pulse Input ............................................................................... 81
5.4.8 TM117-RMD 8 Channel Monitored Relay Output ......................................................... 82
5.4.9 TM117-RME 15 Channel Line Monitored Dual Relay Output...................................... 84
5.4.10 TM117-SME 15 Channel Line Monitored Dual SSR Output ........................................ 86
5.4.11 TM117-DIB 16 Channel I.S. Barrier Input....................................................................... 87
5.4.12 TM117-DOB 16 Channel I.S. Barrier Output ................................................................. 88
5.4.13 TM117-AIB 16 Channel I.S. Barrier Analogue Input ..................................................... 89
5.4.14 TM117-DLP 16 Channel Line Proved Input ................................................................... 90
5.4.15 TM117-DLP/3 16 Channel Line Proved Input ................................................................. 91
5.4.16 TM117-TMR 8 Channel Triplicated Relay Output ......................................................... 92
5.4.17 TM117-DRM 8 Channel Line Monitored Output ............................................................. 93
5.4.18 TM117-AO11 16 Channel Non-Isolated Voltage Output (0-10) .................................. 94

Issue ** Jan 97 Page 3 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.19 TM117-AO2 16 Channel Non-Isolated Current Output ................................................ 95

5.4.20 TM117-AO3 4 Channel Isolated Current Output ........................................................... 96
5.4.21 TM117-AO4 4 Channel Isolated Current Output ........................................................... 97
5.4.22 TM117-AI11 16 Channel Voltage Input........................................................................... 98
5.4.23 TM117-AI12 16 Channel Current Input - Internally Powered ...................................... 99
5.4.24 TM117-AI13 16 Channel Current Input - Externally Powered ................................... 100
5.4.25 TM117-AI2 8 Channel Isolated Current Input .............................................................. 101
5.4.26 TM117-AI22 16 Channel Isolated Current Input.......................................................... 102
5.4.27 TM117-T/C 16 Channel Thermocouple Input .............................................................. 103
5.4.28 TM117-CM ......................................................................................................................... 104
5.5 118 SERIES TERMINATION MODULES .......................................................................................... 105
5.5.1 TM118-AC 8 Channel Input or Output .......................................................................... 105
5.5.2 TM118-DC 8 Channel Input or Output .......................................................................... 107
5.5.3 TM118-DH 16 Channel Input ......................................................................................... 109
5.5.4 TM118-DH/2 16 Channel Input ...................................................................................... 111
5.5.5 TM118-AR 8 Channel Annunciator Repeater ............................................................. 113
5.6 119 SERIES TERMINATION MOULES ............................................................................................ 114
5.6.1 TM119-DH 16 Channel Rack Mounted Input............................................................... 114
5.6.2 RK119-DH 128 Channel Input Rack ............................................................................. 115
5.7 FIRE & GAS DETECTION MODULES.............................................................................................. 116
5.7.1 FM100 2 Channel Fire Detector Input........................................................................... 116
5.7.2 FM101................................................................................................................................. 117
5.7.3 EM100 2 Channel ESD Module ..................................................................................... 118
5.7.4 FT100 16 Slot Fire Module Rack.................................................................................. 119
5.7.5 GM100-C 1 Channel Combustible Gas Module .......................................................... 120
5.7.6 GM100-T 1 Channel Toxic Gas Module ....................................................................... 121
5.7.7 GM100-H 1 Channel Toxic Gas Module....................................................................... 122
5.7.8 GM101................................................................................................................................ 123
5.7.9 AM100 1 Channel Toxic Gas Module ........................................................................... 124
5.7.10 AM100-C 1 Channel Combustible Gas Module........................................................... 125
5.7.11 AM101 1 Channel Line Of Sight Gas Module .............................................................. 126
5.7.12 GT100 16 Slot Gas Module Rack.................................................................................. 127
5.7.13 TM118-DEC Fire & Gas Autotest Decoder Board....................................................... 128
5.7.14 TM118-FGAD Fire & Gas Autotest Distribution Board ................................................ 129
5.8 SPECIAL FUNCTION MODULES ..................................................................................................... 130
5.8.1 TM118-TWD Triplicated Watchdog.............................................................................. 130
5.8.2 TM118-TWD/2 Triplicated Watchdog............................................................................. 132
5.8.3 TM232 4 Port Serial Booster .......................................................................................... 134
5.8.4 TM117-DMX 64 Channel De-Multiplexed Display Driver .......................................... 135
5.8.5 FM118-FSM 16 Channel Fuse / Supply Monitor ......................................................... 137
5.8.6 FM-112 12 Channel Fuse Module ................................................................................. 139
5.8.7 TM118-R3 Triplicated Relay Module............................................................................. 140
5.8.8 RM118-D Single Relay Module...................................................................................... 141
5.8.9 DM118-AIM 1 Channel Analogue Input Display Module ............................................ 142
5.8.10 DM118-DIM 1 Channel Digital Input Display Module.................................................. 143
5.8.11 DM118-DOM 1 Channel Digital Output Display Module.............................................. 144
5.8.12 DM118-ESD 1 Channel ESD Status Display Module ................................................. 145
6. TRIGARD ENGINEERING WORKSTATION ............................................................................. 146
6.1 INTRODUCTION .............................................................................................................................. 146
6.2 HARDWARE ................................................................................................................................... 146

Issue ** Jan 97 Page 4 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.3 SOFTWARE.................................................................................................................................... 146

6.3.1 VP125 ................................................................................................................................. 147
6.3.2 COM125 ............................................................................................................................. 147
6.3.3 ANN125.............................................................................................................................. 147
6.3.4 CONF125 ........................................................................................................................... 147
6.3.5 MAKE125 ........................................................................................................................... 148
6.3.6 SIM125 ............................................................................................................................... 148
6.4 TRIGARD LADDER LOGIC ........................................................................................................... 148
6.5 TRIGARD LADDER LOGIC ELEMENT REFERENCE ......................................................................... 150
6.6 THE BASIC TRIGARD ELEMENTS ................................................................................................ 151
6.6.1 Normally Open Contact..................................................................................................... 153
6.6.2 Normally Closed Contact .................................................................................................. 154
6.6.3 Coil ...................................................................................................................................... 155
6.6.4 Horizontal Shunt................................................................................................................. 156
6.6.5 Vertical Shunt..................................................................................................................... 157
6.6.6 Up Transition...................................................................................................................... 158
6.6.7 Down Transition ................................................................................................................. 161
6.6.8 Add Element....................................................................................................................... 162
6.6.9 Subtract Element ............................................................................................................... 163
6.6.10 Multiply Element................................................................................................................. 165
6.6.11 Divide Element ................................................................................................................... 166
6.6.12 BCD In Element ................................................................................................................. 167
6.6.13 BCD Out Element .............................................................................................................. 168
6.6.14 Move Register To Register ............................................................................................... 169
6.6.15 Timer Element.................................................................................................................... 171
6.6.16 The Up Counter Element .................................................................................................. 173
6.6.17 The Down Counter Element ............................................................................................. 175
6.6.18 The Stepper Switch Element ............................................................................................ 176
6.6.19 The MID Value Element .................................................................................................... 177
6.6.20 The Dead Band Element................................................................................................... 178
6.6.21 The GOTO Element .......................................................................................................... 179
6.6.22 The Left Shift Element....................................................................................................... 180
6.6.23 The Right Shift Element .................................................................................................... 181
6.6.24 The Boolean Elements...................................................................................................... 182
6.7 THE TRIGARD CALL ELEMENTS .................................................................................................. 183
6.7.1 The TRIGARD Call Function Element ............................................................................. 184
6.7.2 ACAL (Analogue Output Calibration Assistance) ........................................................... 185
6.7.3 DFLT (Digital Filter) ........................................................................................................... 187
6.7.4 DIAG (TRIDAC diagnostic report).................................................................................... 188
6.7.5 DIPT (Digital Input Discrepancy Monitor) ........................................................................ 189
6.7.6 DUMP (Dump History) ...................................................................................................... 191
6.7.7 ERCL (Clear RTTS and PIMSS error tables).................................................................. 193
6.7.8 FALT (Get RTTS status) ................................................................................................... 194
6.7.9 GDIA (PIM I/O diagnostics) .............................................................................................. 195
6.7.10 HIST (Collect registers and discretes historically) .......................................................... 196
6.7.11 INIT (peer to peer initialisation)......................................................................................... 199
6.7.12 INPM (Cold Initialise PIMSS)............................................................................................ 200
6.7.13 LED (Set ICCB auxiliary LED's to pattern) ...................................................................... 201
6.7.14 LLDO (TRIDAC digital output processing) ...................................................................... 203
6.7.15 MDBS (Perform MODBUS I/O) ........................................................................................ 204
6.7.16 NOFM (N out of M alarm) ................................................................................................. 206

Issue ** Jan 97 Page 5 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.17 PAUS (Timed ladder executing suspension). ................................................................. 207

6.7.18 PERR (Print Errors) ........................................................................................................... 209
6.7.19 PMIO (Perform Process I/O) ............................................................................................ 210
6.7.20 PRNT (Print Message) ...................................................................................................... 211
6.7.21 RECV (peer-to-peer I/O receive)...................................................................................... 213
6.7.22 RMET (RME/SME dual output discrepancy monitor)..................................................... 214
6.7.23 SEND (peer-to-peer I/O transmit) .................................................................................... 216
6.7.24 SQRT (Integer square root function) ............................................................................... 217
6.7.25 SYNC (RTTS synchronise call)........................................................................................ 218
6.7.26 TDAC (TRIDAC processing) ............................................................................................ 220
6.7.27 THLD (THRESHOLD Subroutine) ................................................................................... 221
6.7.28 TINI (TRIDAC initialization)............................................................................................... 228
6.7.29 USR1, USR2, USR3, USR4 (User Definable Functions) .............................................. 229
6.7.30 WARM (Warmstart call). ................................................................................................... 230

Issue ** Jan 97 Page 6 of 230

 ABB August Ltd
CS300 Safety System Training Manual

1. The Training Course

1.1 Introduction
The main objective of this and any other training course is to enable the delegate
to become more familiar with the concepts, configuration and operation of the
system, the equipment and its software package.

Therefore the intention of the training course is to not only give the delegate
confidence in working with the system but also to show that further help and
assistance is available should the need ever arise.

1.2 Concept

Ideally any training course should be aimed at the specific needs and particular
requirements of the individual participants. With most training courses it is likely
that the participants will have varying levels of knowledge and experience and
come from different backgrounds.

Therefore it is important that sufficient information is provided enabling each

delegate to become more knowledgeable without any of the others losing
interest.

The approach adopted is to assume that all participants have at least a basic
knowledge of either computers and/or control systems. Essentially the delegate
should have a good general knowledge and understanding of the application the
equipment is being used in. If any participant has any difficulties with part of the
course then additional assistance is usually available should the need arise.

It is vitally important that for any training course the information should be
presented in a way which is most effective for retention by the trainees. It is
therefore important to keep the sessions both brief and flexible.

In order that the maximum attention can be both achieved and maintained the
intention of the course is provide individual training sessions each having a
duration of between 60 - 90 minutes.

Issue ** Jan 97 Page 7 of 230

 ABB August Ltd
CS300 Safety System Training Manual

1.3 Opportunity

The main objective of this and any other training course is to enable the delegate
to gain adequate 'hands on' experience.

Usually by the time that training courses are held, either access to the system is
restricted, or the system is on-line which automatically prohibits any opportunities
to demonstrate either the features of the system or its principles of operation.
Wherever possible the use of a Training Simulator and Workstation will be
provided in order to enhance the course and provide at least some of the
essential hands on experience required. Although the training simulator may
have some limitations it is however capable of demonstrating the majority of
operational features that exist on the main system.

During every training course it is always hoped that the delegate will be able to
get full use of the Training Simulator and Workstation and be able to both create
and debug (fault find) ladder networks.

1.4 Training Manual

The training manual has been designed to accompany the training course;
hopefully it will prove useful in the future as a reminder of what was learnt on the
course.

The training manual is divided into several parts, these being:

General Introduction and Aims of the Training Course,

Information and Background on the Company,
Development of the Fault Tolerance Concept,
The Main System Components,
Development of the Operating Software,
The On-site Equipment,
Glossary of Terms.

Issue ** Jan 97 Page 8 of 230

 ABB August Ltd
CS300 Safety System Training Manual

1.5 Program

The course is divided into several sections, these being:

General introduction in the company and the services it provides,

Details of the training course,
The development of the TMR principles,
An outline of the main system components,
Development of the operating software,
The on-site equipment,
Outline of some of the basic components.
Outline of the systems operator facilities.
Introduction to the software used in the system,
Software simulation of the actual system.
Hands-on operation of a training simulator and workstation,

1.6 Timetable

As each training course takes a variable amount of time to cover a particular

topic due to either the understanding of the delegate or the complexity of the
topic or system only a general outline or timetable can be given at this point in
time. As the training course progresses then the timing of certain events will be
discussed. Each session allows ample opportunity for each delegate to ask any
questions and for the instructor to either review material discussed during earlier
sessions or to answer any outstanding points.

The instructor will often invite the delegate to comment on the material or subject
under review and so by participating in a two-way discussion any problems or
misunderstandings can soon be resolved or clarified.

1.7 Course Objectives

The course, which combines both instructional material and practical experience,
has some very clear targets to meet.

The course which introduces both the theory and operation of the TRIGARD
(TRIplicated safeGuARD) system also enables the delegate to gain valuable
experience in setting up and running their own system.

Issue ** Jan 97 Page 9 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The delegate can only achieve this if the following list of objectives are realised
and fully understood.

i, The Trainee is to gain a working knowledge of not only the theory and
operation of a TMR Fault Tolerant System but also the reasoning behind
the use of a triplicated system,

ii, The trainee is able to gain some experience in understanding and

developing ladder logic networks,

iii, The trainee to gain knowledge of the systems' hardware components and
to be able to understand their operation,

iv, The trainee is able to follow start up procedures and also be able to
diagnose any minor system maintenance problems, knowing what sort of
action to take,

vi, The trainee to be able to fully understand the operational features of the
TRIGARD engineering workstation,

vii, The trainee is able to understand the operational features of both the
system, its software and any associated equipment being supplied.

1.8 Course Outline

In order that the objectives of the course can be met the various tasks have been
re-organised and broken up into separate sections or topics.

Although the list is not necessarily in the correct order and may not be complete
it never the less begins to show some of the subjects that need to be discussed
and explained during the course:

System introduction, Ladder logic,

System reliability, Engineering workstation,
Fault tolerance, Fault finding/system diagnostics,
System concept, Maintenance Requirements,
System hardware, Calibration checks,
System operation, Start up procedures,
Input/Output circuits, System overview,
Field devices, Hands on tutorial,
TRIGARD software, programming, Question and answer sessions.

Issue ** Jan 97 Page 10 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2. Company Introduction

2.1 The Development of the Fault Tolerant Concept

During the early part of the 1960's the need for Fault Tolerant systems was being
realised by many industries including not only the Petrochemical but also those
involved with both Nuclear Power and Space Exploration.

John Wensley was part of the Computer Science Group at Stanford Research
Institute, California and was involved with a research project into the feasibility of
using multiple computer systems linked together to form a control system
capable of meeting many different applications. This project was supported by
the National Aeronautics and Space Administration (NASA) who were developing
an automatic (Fly By Wire) landing system as part of the Space Shuttle Program.

The development of the NASA Space Shuttle proved to be the first time where
three separate computers could be linked together and used to carry out a single
control action.

The Stanford research team pioneered the technology which has now become
widely known as SIFT (Software Implemented Fault Tolerant).

The research proved that three computers were not only capable of supervising
each other, but were also capable of voting on all control actions to ensure safe
operation in the presence of faults by utilising a majority voting philosophy.

Issue ** Jan 97 Page 11 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2.2 The Company's Background

John Wensley was soon to realise the market potential of these concepts on a
wider scale and so in 1978 with the help of financial backing set up a company
called August Systems Inc. The initial intention of the company was to further
develop the SIFT techniques in conjunction with appropriate hardware and then
fully explore the American Industrial market.

After spending several million dollars on development the first order was finally
completed five years later.

The original TMR system produced by August Systems was called the CS306
and utilised three Intel Bus structured computers as the heart of the system
combined with a triplicated Process Interface Module (PIM) rack system
designed by August Systems.

This was shortly replaced with the CS300 series TMR system which utilised
purpose built computer boards designed by August Systems to fit into the
triplicated PIM rack system.

The company rapidly expanded and quite soon reached a turnover of about $8M.

During 1985 the company began to evaluate the market in Europe paying
particular attention to both the Petrochemical and Offshore industries. As part of
a joint venture with Low and Bonar, a British company, Bonar August Systems
Ltd, was set up to service the European industries.

However in 1986 a worldwide fall in oil prices caused the fortunes of the
company to change.

Due to the rapid fall in the market and the rising losses the original American
venture providers of August Systems Inc decided to put the company on the
market and sell off any assets.

The options to purchase the company were bought up by the British company
Low and Bonar who had been previously involved in the joint European venture.
Low and Bonar incorporated August Systems Inc into their electronics division,
the company was renamed Bonar August Systems Inc and formed a subsidiary
of Bonar August Systems Ltd.

In 1987, Low and Bonar decided to sell off their electronics division, which
included both the British company and the American subsidiary.

Issue ** Jan 97 Page 12 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The management team of August Systems Ltd were successful in self-funding a

buy out of the August Systems Group.

Since 1987 the company has continued with a steady expansion program which
has seen the current turnover of the company rise steadily.

In 1993 the American Manufacturing Corporation (AMC), a large American

privately held corporate group purchased the August Systems Group as part of
their expansion strategy. The additional funds injected by AMC enabled rapid
expansion to occur both within the USA and the Far East.

In December 1997 the August Systems group was purchased by ABB to become
a major part of their Safety business unit. At this time the company name
changed to ABB August Ltd.

ABB August have now achieved an international reputation for both the design
and manufacture of high integrity, high reliability systems in a number of
industries where the ultimate requirement is for both Reliability and Safety as well
as the accurate control of process plant and equipment which ensures the
protection of Personnel and Plant.

To date many major contracts for safety and control systems have been
successfully commissioned in many countries throughout the world, these
systems have been supplied to a diverse customer base operating in a variety of
industries both Onshore and Offshore.

Issue ** Jan 97 Page 13 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2.3 The Group Today

Today ABB August forms part of the ABB Safety business unit. The ABB Safety business
unit is the part of the ABB group that is responsible for safety related systems and
products. Within the ABB Safety group are a number of companies with the ABB August
companies being specifically responsible for the TMR systems.

The ABB August companies are:

ABB August Limited - Europe
ABB August Incorporated - USA
ABB August Pte Limited - Far East

The August Systems companies all provide sales and technical support for the CS300
range of equipment with the manufacturing facilities being based in Europe.

As well as the ABB August companies there are ABB companies based all over the
World, which can also provide support. The ABB Group is made up of over 1000
companies employing in excess of 200,000 personnel in 140 countries Worldwide.

Issue ** Jan 97 Page 14 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2.4 Quality

To enable a company in 'todays world' to be successful, and to remain so, it

must be fully aware of the requirements of its clients and the industries that it
serves.

All the ABB Safety companies that both design and manufacture safety and
control systems in order to protect both personnel and plant must have and
maintain the very highest engineering standards.

ABB August continually audits its own in-house quality and ensures that its
Project Managers and Engineers follow strict laid down procedures.

ABB August are fully aware of its responsibilities to not only maintain high
standards but to continually improve on them in all the various stages of design
or manufacture.

All Quality Assurance and Quality Control personnel report directly to the
Managing Director to ensure that the company complies with all aspects of the
appropriate standards applicable to each one of the companies within the ABB
Safety Group.

The Quality Assurance (QA) personnel regularly carry out other checks on all
members of staff to ensure that all company procedures are strictly followed and
adhered too.

During the product and system manufacturing period continuous visual

inspection and quality checks are carried out to ensure that not only are all
current standards maintained but also that the completed system conforms to
and fully meets the clients specified requirements.

All hardware and software products and systems are designed to conform to the
numerous relevant industry standards, approvals and codes of practice or, where
required, can be certified by the applicable authority.

ABB August are continuously investing in a programme of both hardware and

software research and development in order to maintain its high standards and
meet the latest industry requirements. Great care is therefore taken to ensure
that any new products are based on not only on field proven design methods but
also using tried and tested electronic components. The company is always keen
to take advantage of the latest commercially available technologies or techniques
once they have been substantially proven to be both safe and reliable.

Issue ** Jan 97 Page 15 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2.5 Software Control

Extreme care is taken during both the design and testing of all software programs
or routines to ensure that when the software is installed the highest system
integrity and reliability is maintained.

The executive software has been exhaustively tested, validated and field proven
in many critical installations within a wide range of applications.

2.6 Control of Application Software

The latest version of application software developed for each system is retained
and stored on a central computer.

Any software changes occurring after the completion of either the installation or
commissioning phase of a project and undertaken by any ABB August engineers
is automatically stored on the central computer for future reference.

By maintaining the latest version of software, if at any time a fault develops on a

system then ABB August engineers can quickly duplicate the situation and
resolve the problem. The continuous control of software is essential if ABB
August are to be able to provide any help or assistance in the future.

Should any changes occur after commissioning by the Client then these
modifications should be copied to ABB August so that their records can be
updated and the changes if required verified.

2.7 Testing

Extensive factory testing is carried out on all products and systems using our own
test procedures. These test procedures can be supplemented when required to
include any additional client tests.

As a minimum our standard tests include the following:

modules tested on computer based automatic test equipment (ATE),

module heat soak tests,

Issue ** Jan 97 Page 16 of 230

 ABB August Ltd
CS300 Safety System Training Manual

fully simulated functional system tests,

fully simulated functional software tests,
sub-assembly tests,
system 'string' tests,
elevated/cyclic temperature system heat soak tests,
continuous quality and visual checks.

2.8 System Applications

The following short list is a sample of the variety of systems currently supplied.
The list is continually growing as a wider range of industries realise the need for
fault tolerant systems.

Issue ** Jan 97 Page 17 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The current list is:

Burner management,
Emergency shutdown,
Process shutdown,
Process control,
Fire/Gas detection,
Sequence and batch control.

In addition, ABB August can manufacture control panels and peripherals using
either products or equipment purchased from outside sources.

2.9 Additional Applications

Over the past few years ABB August has been able to establish itself as a true
Safety and Control Systems Company, producing systems not only based on the
CS300 series Microprocessor technology but developing systems using various
different Programmable Controllers, Solid State Control Modules and Relays.

The main areas of the Companies activities are centred around systems for both
Fire & Gas Detection and Protection, Emergency Shutdown, Process Shutdown
and Critical Control.

The technologies applied include the use of Relay or Solid State Logic and
Programmable Controllers as well as our extensive experience of using the
CS300 Series TMR Fault Tolerant Microprocessor based system.

Display systems, Operator and Engineering Workstations and Interfaces include

technologies often based on Hardwired Matrices, Mimics, VDU/Keyboard and
DCS Display Systems (via Serial Communication links).

Continuous product and system development has resulted in a system which

offers the user the choice of many critical advantages over many of the
conventional Dual and Triple architecture systems currently available.

Issue ** Jan 97 Page 18 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2.10 Documentation

2.10.1 Contract Specific Documentation

The contract specific documentation supplied with each system will initially
depend on the contractual requirements under which the equipment or system is
being supplied.

Typically this would include some of the following:

General Arrangement Drawings,

Internal Layout Drawings,
Schematic Diagrams (Typical Loop Diagrams),
Input/Output Schedules,
Logic Diagrams (Ladder Logic Format),
Interconnection/Termination Diagrams,
Configuration Software Listings,
Operational, Maintenance, Installation and
Commissioning Manuals,
Factory Acceptance Test (FAT) Specification or
Site Acceptance Test (SAT) Specification.

2.10.2 Standard Documentation

In addition to any of the project or contract specific documentation supplied

August Systems can also provide fully detailed standard software user and
hardware maintenance manuals.

The standard documentation supplied with each system is also dependant on the
contractual requirements under which the equipment is being supplied.

Typically this would include at least some of the following:

TRIGARD Users Manual,

Short Form Hardware Manuals,
Maintenance Manuals/Procedures.

Issue ** Jan 97 Page 19 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2.11 Training Courses

A number of training courses are available for all disciplines of client personnel
including Process Operators, Plant Management and Maintenance Engineers to
ensure that they are fully conversant with all aspects of the system, its operation
and performance. Each course not only includes theoretical training but also
endeavours wherever possible to also provide some essential 'hands on'
experience.

Training courses can be conducted either at our offices, at the clients premises,
on-site or at a suitable venue more practically located or better suited to meet the
clients requirements.

2.12 On-Site Assistance

Fully qualified and experienced engineers are available to provide the client on-
site assistance for either Installation Supervision, Commissioning, Maintenance
or as part of a fault repair service. All our engineers participate in extensive
product training sessions to enable them to become fully proficient in carrying out
the tasks allocated to them.

ABB August are currently able to operate and provide both short or medium term
call-out and routine maintenance agreements.

2.13 Services Provided

ABB August are able to offer a total support package for each system supplied,
this support package basically consists of the following facilities and services:

Contract - specific documentation.

Standard documentation.
Training courses.
On site assistance.
Maintenance contracts including call out facilities.

Issue ** Jan 97 Page 20 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2.14 ABB August Limited

ABB August Limited heads up the TMR part of the ABB Safety Business unit and
is based in the UK. The company is located within 5 minutes of London Gatwick
International airport. This location is ideally suited to cater for both the European
market and the North Sea oil & gas industry. The current premises incorporate
25.000 square feet of office facilities and 25,000 square feet of manufacturing
workshop.

The company provides the following primary functions.

Product design, research and Software development,

development, International sales and
System engineering, marketing
System manufacture, Commissioning support,
System integration and testing, After sales support and
Modular matrix design and engineering.
manufacture, Spares and repairs facilities.

ABB August Limited is accredited to the following standards

BS EN ISO 9001,1994
This is the internationally recognised model for Quality Assurance which
covers all areas of company activity excepting accounts (subject to
independent assessment).

TUV (Technischer Uberwachungs Verin) Rheinland requirements Class AK5 & 6.

This relates to the hazard category of process as defined by DIN VDE
0116, which grades industrial process by safety and reliability
requirements.

ABB August Ltd conforms to CE (Community European) marking requirements

and our equipment has been assessed against the related EMC (Electro-
Magnetic Compatibility) and Low Voltage directives issued by the European
Economic Community (EEC).

ABB August Limited is a member of BEAMA (British Electromechanical and

Allied Manufacturers Association), Safety Critical Systems Club, EWICS TC7
(European Workshop of Industrial Control Systems) and ISA SP84
(Instrumentation Society of America safety systems working group) which
enables it to play an active role in the future development of safety control
applications throughout industry.

Issue ** Jan 97 Page 21 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Issue ** Jan 97 Page 22 of 230

 ABB August Ltd
CS300 Safety System Training Manual

3. TMR Applied

The ABB August CS300 is an ultra-reliable fault tolerant Safety and Control
System which is fully configurable for a wide range of applications where Safety,
Reliability, Availability and Performance are Essential. In addition to providing
critical control actions in safety shutdown (ESD), Fire and Gas and Process
Shutdown applications, the CS300 System is well suited to sequence and batch
process control as well as general control functions.

3.1 Reliability

John Wensley realised that Reliability was going to be related to at least two very
important factors:

mean time to failure (MTTF)

mean time to repair (MTTR)

MTTF is a statistical number which can be obtained from large numbers of

component assessments. The statistical number is normally expressed in terms
of time e.g. the average number of hours of operation before failure.

MTTR is an assessment value that varies for each specific applications and is
often dependent on the following:

the diagnostics available,

the ready availability of spare parts,
the ease of replacing faulty parts,
the level of skill available.

The best definition of Reliability, in the case of a safety system which must be
operating to function on demand, is Availability which can be measured as a
percentage of time. For example a system given a typical availability figure of
99.9% would be expected to run trouble free without failure for 999 hours in
every 1000 hours and then only have a down time of 1 hour before the repair
could be implemented and the system operational again.

MTBF (mean time between failure) = MTTF + MTTR

MTTF
Availability (%) = x 100
MTBF

Issue ** Jan 97 Page 23 of 230

 ABB August Ltd
CS300 Safety System Training Manual

3.2 System Availability

In the ongoing and continuous development of the TMR CS300 series system,
ABB August has made impressive strides in maximising system availability.
Typical values of system availability are in excess of 99.995%.

A value for system availability of 99.995% would mean that the equipment is
expected to run trouble free with out failure for at least 20,000 hours (which is
almost 2 years and 3 months), if again the downtime is only 1 hour before the
repair is implemented and the system is up and running again.

This has been accomplished through two main factors: the system's enhanced
on-line self-diagnostics and its ability to report and withstand the effects of
multiple faults while continuing in full automatic mode.

The ability to diagnose faults down to module level allows for comprehensive
fault and remedial action reporting. Any module found to be faulty may be easily
identified and repaired on-line by maintenance personnel without affecting the
safeguarding or control of the process plant.

Also, each CS300 series input/output may be changed remotely by manual

keyboard command (by using the Engineering Workstation), or automatically
(configured in the Ladder Logic), should a fault be found.

This unique feature provides a significant increase in availability in particular

applications, such as unmanned oil and gas production platforms, where the
Mean Time to Repair may be set by the frequency of the regular maintenance.

Issue ** Jan 97 Page 24 of 230

 ABB August Ltd
CS300 Safety System Training Manual

3.3 Typical Applications

Typical applications include, but are not limited to, the following:

High Integrity Shutdown and Control,

Fire and Gas Detection and Protection,
Emergency shutdown,
Process Shutdown,
Process Supervisory Control,
Sequence and Interlock Control,
Burner and Boiler Management,
Machinery Control and Protection,
Continuous Process Control, and
Turbine/Anti-surge Control and Protection.

3.4 The Main Features of the CS300 System

The main features of the CS300 System include:

High availability (typically 99.995%),

Triple Modular Redundant (TMR) Fault Tolerant Design,
Continuous Correct Operation,
Transient Error Proof,
On-line Fault Detection,
On-line 'Hot' Replacement and Repair,
Supports Ladder Logic,
Ultra-reliability,
Superior Diagnostics (often down to board level).

3.5 The Fault Tolerant Concept

Fault tolerance is the ability of a system to identify faults and adopt corrective
action on the failure of any of its control system elements.

It must also continue to operate correctly and predictably in spite of the presence
of any internal faults.

Issue ** Jan 97 Page 25 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Faults may be caused by component failures, transient disturbances or invalid

inputs. The ABB August TMR (Triple Modular Redundant) and SIFT (Software
Implemented Fault Tolerance) approach allows the implementation of safety and
control strategies with the assurance that system faults will not affect the ability of
the CS300 to protect and control without process interruption. The combination
of TMR & SIFT is the most effective hardware and software solution ever devised
for industrial safety applications. Its objective is to eliminate the effects of system
failures, and thereby maximise availability and safety to a degree which cannot
be provided by other technologies.

The CS300 System employs three basic techniques to achieve fault tolerant
reliability.

i. Redundancy - At the heart of the CS300 System is a triplicated set of

control computers, called Integrated Computer Control Boards (ICCBs),
each of which executes a copy of the programme. The three ICCBs are
asynchronous in operation but are brought into synchronisation
periodically (a mode of operation known as 'loose synchronisation'). In this
mode, no single failure can degrade system availability. In addition the
triplicated hardware and the executive software are used extensively
throughout the system to ensure an extremely high degree of reliability.

ii. Isolation - A read-only link between each ICCB prevents a faulty ICCB
from corrupting another. All faults are, therefore, isolated and not
permitted to propagate. The read-only scheme allows each ICCB to read,
but not write to, the other ICCBs (neighbours) memories. This permits
communication while providing fault containment.

iii. Voting - The read-only link allows each ICCB to read and verify - via the
software-controlled synchronised vote - the input status, logic results and
output status of the other ICCBs. In a fault-free system all three ICCBs
will agree. If a fault occurs, the incorrect ICCB determines its minority
status, faulty operation will be diagnosed and the result changed by
software control to agree with the majority, enabling it to continue as a
voting member. Thus, errors due to a single fault are detected and
prevented from propagating to another part of the system.

Issue ** Jan 97 Page 26 of 230

 ABB August Ltd
CS300 Safety System Training Manual

3.6 Fault Tolerant Operation

The operation of the Fault Tolerant concept is simply that when a signal (usually
a logic 1) appears on one of the inputs to the system, the signal should be seen
by all three processors.

Each processor is totally aware of what its neighbours are seeing and if all three
agree then a resulting action is taken accordingly.

If for some reason one processor differs from the other two then a simple
majority vote decides which is faulty. The faulty input is then isolated and
corrected whilst the discrepancy is annunciated.

In the unlikely event of a total failure of a single ICCB, the other two neighbouring
ICCBs will detect the disagreement, mask the results of the failed unit and raise
an alarm.

Operation of the CS300 System is accomplished under the supervision of the

RTTS (Real Time Task Supervisor), the RTTS handles the control of the SIFT
(Software Implemented Fault Tolerant) operating system which makes fault
tolerance transparent to the applications software.

3.7 Real Time Task Supervisor (RTTS)

The RTTS is a real-time multi-tasking executive software programme that has

been designed to facilitate the implementation of System Control Logic via ABB
Augusts easy-to-use TRIGARD Ladder Logic Symbology.

The executive software programme enables the RTTS to provide the software
environment so that application level programs need not be concerned with the
fact that they are running in a triplicated, voted or synchronised environment.

By using object-orientated architecture the RTTS is able to provide all the

capabilities expected of an advanced multitasking executive as well as providing
features for diagnostics, monitoring and trouble shooting.

RTTS is designed to supervise the scheduling and execution of tasks in a real-

time environment. Tasks may be scheduled and dispatched by priority,
periodically, on the occurrence of events, or on request from other tasks.

Issue ** Jan 97 Page 27 of 230

 ABB August Ltd
CS300 Safety System Training Manual

RTTS provides the ability to ensure that tasks operate with correct data by voting
the data in the triple-redundant hardware. Any errors are immediately detected
and corrected, or masked.

RTTS handles all inter-module co-ordination and provides all the facilities
necessary to support an object-orientated architecture.

The CS300 System continuously executes the following functions:

Discrete I/O, and Analogue Inputs,

Communication to other Systems,
Diagnostics to detect faults,
Voting agreements, Health of the three processors,
Tracking of maintenance activities (monitoring of PIM modules),
Latent fault detection and the
Status and condition of any hot repair modules.

3.8 Software Implemented Fault Tolerance (SIFT)

It is the unique concept of SIFT, which is embedded within the RTTS executive
software package, which provides a mechanism for detecting result
discrepancies between the ICCBs. The use of the SIFT concept provides the
system with the ability to synchronise, majority vote, intelligently make decisions
and execute those decisions in the form of correct control action and/or the
maximisation of system operation under fault conditions, by isolation of faulty
circuits.

3.9 Software Voting

Software voting techniques are transparent to the system users, unless a vote
detects a discrepancy. All inputs are read by each independent ICCB and
compared and voted using the ABB August SIFT (Software Implemented Fault
Tolerance) voting algorithm.

This enhances the system diagnostics and guarantees correct voted results,
allowing ICCB channels with the incorrect input data to correct this data, yet
ensuring that all active processors recognise where the error exists.

Issue ** Jan 97 Page 28 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The ICCBs 'read' section allows each processor to read the contents of the other
processors memory through a pair of isolated links. In order to fully implement
software voting each ICCB is allowed to read and verify the inputs, intermediate
results, and final results of the neighbouring processors.

3.10 3-2-0, 3-2-1 Controlled Degradation

If the results of a computer are repeatedly outvoted, a maintenance alarm is

activated. The faulty unit can then be taken off-line for repair while the other two
continue to operate the process.

The actual repair will take seconds as it simply a case of plugging in a new
computer board (ICCB) and activating a warm start command.

With a system configured as 3-2-0, then as long as 2 channels remain healthy

the system will continue to operate,

and;

With a system configured as 3-2-1, then the system will continue to operate with
two faulty channels.

Emergency Shutdown Systems (ESD) are configured typically as 3-2-0.

In the event of a second channel developing a fault the system will automatically
carry out a Failsafe Shutdown procedure.

Fire and Gas Systems (F&G) are typically configured as 3-2-1.

3.11 Hot Repair I/O Facilities

Once every second the RTTS runs the hot-repair task which addresses each
card to determine whether a hot-repair maintenance is required. The hot-repair
task also checks each configured slot for the status of each card (on-line, off-line,
missing, wrong card). Wrong cards are not permitted to be hot repaired into the
system.

When a component failure is detected, the faulty card can be 'hot-repaired'

without interruption to system operation. This is accomplished by inserting a

Issue ** Jan 97 Page 29 of 230

 ABB August Ltd
CS300 Safety System Training Manual

replacement board into a slot dedicated for this purpose. The toggle switch on
the front panel is then activated to initiate the change in status, and control
transferred to the replacement board. Once the fitted replacement card comes
'on-line', then the faulty card can be removed. The sequence of operations for a
monitored pair output board configuration is illustrated below.

3.12 Self Diagnostic Routines

Diagnostic routines pervade the entire CS300 TMR PLC, but can be separated
into off-line/start-up diagnostics and on-line/continuous diagnostics. Many system
diagnostic facilities, such as fuse alarm and power failure, are provided by
hardware and taken in via standard digital inputs to the system.

Issue ** Jan 97 Page 30 of 230

 ABB August Ltd
CS300 Safety System Training Manual

3.13 Off-Line/Start Diagnostics

When the system is first powered up, a number of start-up diagnostic events
occur. These may be summarised as follows and occur in the order shown:

ECC Initialisation - ECC initialises RAM by filling memory with all 'O's.

ICCB Configuration - ICCB reads configuration links for items such as memory
size and memory type.

ICCB Memory Size - ICCB checks memory configuration.

ICCB Memory - ICCB writes 'CC' into all initialised memory locations ensuring
that the interrupt trap vector is present in all unused memory locations.

ICCB ROM Shadow - ICCB copies ROM to RAM.

ICCB ROM checksum - ICCB calculates and confirms that the ROM checksums
are correct.

ICCB Set Ready - The ICCB sets its 'ready registers' and then starts to monitor
its neighbours registers.

ICCB Sees Neighbour - If the ICCB is able to detect that one of its neighbours
'ready registers' are set, it will then reads the neighbours checksums and
configuration and confirm if in agreement.

ICCB Waits for 2nd Neighbour - Both ICCBs wait for up to 25 seconds for the
3rd ICCB to become initialised.

ICCBs Start Application - If the third ICCB fails to initialise during the 25 second
wait period then the first two ICCBs start the application software.

When one or two ICCBs are operating, a new ICCB will run through its start-up
diagnostic routine and then monitor its running neighbours' registers while
awaiting a warmstart command. The warmstart command allows the checksums
to be confirmed and transient data (I/O) to be copied. Warmstarting a ROM
based ICCB takes a fraction of a second. On systems configured as 3-2-1 all
three ICCBs must be present on initial start-up.

Issue ** Jan 97 Page 31 of 230

 ABB August Ltd
CS300 Safety System Training Manual

During the initiation of the start-up routine the AUX LEDs located on the front of
each ICCB should cycle for two or three seconds whilst the diagnostics are being
checked.

3.14 On-Line Diagnostics

All memory reads and writes are automatically checked for errors by the board
Error Checking and Correcting (ECC) device. This guarantees that all single
memory errors are detected and corrected, it also guarantees that all multiple
errors are detected. It should also be noted that the SIFT voting software also
provides a mechanism for detecting result discrepancies between ICCBs.

Corrected memory errors are not alarmed however, the diagnostic information
being available from the diagnostic history. If multiple errors are detected, the
ICCB is halted and its watchdog is tripped. Once a watchdog is tripped an
external alarm can be generated to alert maintenance personnel.

Additionally, the operating system memory is checksum monitored and the result
voted. As a background task, the complete memory map is voted, testing the
ICCBs memory and inter-processor communications.

Serial communications to the TRIGARD/TRIDAS IBM compatible PC

workstations incorporate a CRC 16 polynomial checksum, guaranteeing the
correction of messages to an extremely high probability. The standard dual
communication links utilise both communication lines constantly, transmitting on
one line and receiving acknowledgement on the redundant line, thus ensuring no
latent faults exist in the communication links. Any errors found are immediately
reported at both ends of the communication link.

All input and output reads and writes are communicated over the PIM,s
independent triplicated bus. Each input read and output write is then voted in a
two-out-of-three (2oo3) vote, ensuring bus integrity.

Data being read from the input channels is voted on by the SIFT voting algorithm
thus guaranteeing that any latent faults on an input channel can be detected and
alarmed. Data being written to outputs is voted prior to outputting, and then voted
in a 2oo3 manner by single six element switch hardware voters on the digital
output cards.

The PIM I/O 'Hot Repair' task regularly scans all configured I/O slots to determine
their status. All cards have unique type registers, which allows the hot repair task
to confirm the status of all fitted cards with the following possibilities:

Issue ** Jan 97 Page 32 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Correct Card Type Fitted On-Line

Correct Card Type Fitted Off-Line (In maintenance or hot repair)
Card Missing No card fitted, correct type is 'XXX'
Wrong Card Type Fitted Card fitted is 'XXX', card should be 'YYY'

3.15 Achieving Fault Tolerance

For a system to be defined as Fault Tolerant then within the system there must
exist adequate Redundancy so that in the event of a failure the system can still
continue to operate.

All critical control action circuits need to be Triplicated in order to ensure that
valid Voting Actions are carried out.

There must be sufficient Isolation between each circuit so that a failure of any
one component or circuit will not be allowed to propagate and cause any further
corruption to any other part of the system.

In a Triplicated system using Voting Actions if all three are in agreement then the
system can be defined as being Fault Free.

By carrying out extensive Voting Actions the system can become immune to
transient failures. The system can therefore operate continuously without any
downtime occurring or loss in the ability to execute both Accurate and Valid
Control Functions.

In the case where permanent faults arise these are masked by the action of the
two healthy circuits. The fault is then reported to the processors so that the
system can continue to carry out Valid Control Actions.

In certain situations or circumstances its possible that when multiple faults occur
these can be tolerated without losing the ability to execute control.

For any item of hardware to have Triple Modular Redundancy built into the
system then:

all hardware must be triplicated, and

all hardware must be modular.

Issue ** Jan 97 Page 33 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The CS300 TMR System has been specifically designed to provide a complete
fault tolerance where full auto testing of its major components or critical circuits
are in-built into the architecture of the system.

The purpose of the system therefore is to provide the correct level of redundancy
and its management to guarantee that the system will respond at all times to
valid control actions whilst minimising false alarms.

Within the CS300 System, three independent asynchronous microprocessors

(ICCBs) perform all the critical operations, each comparing and validating their
data at every stage of the safeguarding cycle in a two-out-of-three (2oo3) vote.

The voting operation ensures the integrity of data and outputs for controlled
degradation to 3-2-0 typically for Emergency Shutdown (ESD) Systems, or 3-2-1
for Fire & Gas (F&G) and Safety and Control applications.

Issue ** Jan 97 Page 34 of 230

 ABB August Ltd
CS300 Safety System Training Manual

4. CS300 System

At the heart of each CS300 Triple Modular Redundant Programmable Control

System is August Systems own Safety and Control System which consists of the
following major sub-systems:

Three Integrated Control Computers (ICCBs), each with 1M byte of RAM and
384K bytes of EPROM.

Process Interface Modules (PIMs) which house the ICCBs and the systems
Input/Output cards,

Triplicated PIM Power Supply Modules,

Termination Panels for interfacing all field signals,

Termination and Field Power Supply Units

4.1 CS300 System Architecture

At the operating centre of the CS300 System is the Resident Process Interface
Module (PIM) Chassis which houses the three Integrated Control Computer
Boards (ICCBs), housed on the right-hand side of the chassis. Arranged in the
slots on the left hand side are located up to 15 Process I/O and/or
Communication Cards.

The PIM I/O cards communicate with the ICCBs via a triplicated bus which
traverses the system backplane.

Incoming process signals are transmitted by the triplicated process input cards to
the ICCBs and the output signals are transmitted from the ICCBs the
appropriate output card where a single output signal is generated by patented
hardware voting circuitry.

Any type of PIM I/O card - digital input, digital output, analogue input, analogue
output or serial I/O can be configured in any of the 15 I/O slots.

All PIM I/O cards are designed to be inserted or removed from the CS300 on-line
and without disturbing the process.

Issue ** Jan 97 Page 35 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Specifically designed 'tuning-fork-and-blade' type connectors are used to ensure

the proper sequence of power, ground and signals, to safely enable or disable
boards being inserted or removed.

4.2 CS300 Resident PIM Chassis

In addition to the Resident PIM chassis a system would also include a Triplicated
Power Supply Unit, a Triplicated Cooling Fan Unit and a System Diagnostic
Panel. Up to 14 additional Local PIM chassis can be added to the CS300
Resident PIM module in order to increase the capacity of a single CS300 System
to a maximum of 7200 digital I/O points.

All process inputs and outputs are connected to the CS300 PIM I/O cards via
Termination Modules.

Issue ** Jan 97 Page 36 of 230

 ABB August Ltd
CS300 Safety System Training Manual

4.3 Termination Modules

All field input and output signals are connected through to various Termination
Modules. The Termination Modules are used to interface the various types of
field signals and also ISOLATE and PROTECT the system from any High
Voltages or Noisy field devices.

The Termination Modules are also powered from separate dual redundant power
supplies to the field signals in order to provide additional isolation.

The Termination Modules which are either panel or DIN rail mounted depending
on the type used are connected to the PIM backplane by multiway ribbon cables.

Various types of Termination Modules are available and are suitable for
operation with most input/output circuits or field devices.

Most Input or Output Termination Modules can be configured to suit either

Simplex or Dual Tested applications and if required additional line monitoring of
the field device can also be provided.

Issue ** Jan 97 Page 37 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The various Output Termination Modules used not only provide the field interface
but also to provide the ability for powering either high or low voltage devices or
switching volt-free contacts.

The Output Termination Modules have been designed to suit normally energised,
normally de-energised, monitored, or un-monitored field devices as well as being
suitable for either Simplex or Dual Tested applications.

Signals from each of the Termination Modules are routed to the Process
Interface Modules (PIM) via multiway ribbon cables. The Analogue or Digital
Input Cards housed in the PIM produce triplicated voted signals which are then
presented to each of the three ICCBs via their own independent, isolated data
paths.

Once the ICCBs have completed their processing tasks the resulting (voted)
output data signals from each ICCB is transmitted via the same independent,
isolated data path to a Digital Output Card.

A single, six element output voter circuit used by the Digital Output Card to
provides an isolated voted output signal to the Output Termination Module which
in turn then provides an isolated connection to the field device.

4.4 TRIGARD Engineering Workstation

The TRIGARD Engineering Workstation comprises typically of a IBM type PC

using as a minimum MS-DOS version 3.1 and having at least one serial port
(typically 9600 Baud) for communication with the CS300 system.

TRIGARD/VP125 programming software allows for both the on-line or off-line

development of ladder logic and application software. The workstation can be
used for system development, testing, editing and maintenance.

A printer would be used to provide documentation of the ladder logic networks

and application software.

Issue ** Jan 97 Page 38 of 230

 ABB August Ltd
CS300 Safety System Training Manual

4.5 Communication Links to Third Party Systems

ABB August provide a wide range of field proven communication protocols for
interface between CS300 nodes and between the CS300 series system and
proprietary computer based systems.

TRIGARD Peer-to-Peer (Trademark of ABB August Limited)

A fast, fault-tolerant peer-to-peer protocol providing secure
communications via multiple redundant, self-tested links.

MODBUS RTU (Trademark of AEG Modicon)

Emulates industry-standard MODBUS protocol; also used for
communication with proprietary DCS systems.

TEXAS INSTRUMENTS RTU (Trademark of Texas Instruments)

Emulates industry-standard TI protocol; also used for communication with
proprietary DCS systems.

ALLEN BRADLEY PROTOCOL (Trademark of Allen Bradley)

Emulates industry-standard AB protocol; also used for communication with
proprietary DCS systems.

4.6 Communications to Proprietary Computer Based Systems

Typical of the Third-Party systems to which communication protocols have been

established are:

ABB-MOD300
Bailey Network 90
Honeywell TDC2000/TDC3000
Yokogawa Centum
Toshiba Tosdic
Modicon PLCs
GE Fanuc PLCs
GEC GEM 80
Fisher-Rosemount Provox
Foxboro IA
Fisher-Rosemount System 3

Issue ** Jan 97 Page 39 of 230

 ABB August Ltd
CS300 Safety System Training Manual

4.7 Theory of Operation

The CS300 Series TMR Fault Tolerant Safety & Control System is based around
a triple modular redundant configuration of three 80836 compatible processors
operating at 16mhz. These are referred to as CS386 boards.

Typical scan times can range from 30-100mS (milliseconds) dependent on the
system size. 1 MByte of ECC RAM memory is available as standard.

The CS386 boards can also be fitted with EPROM memory for both executive
and application programmes. This is commonly referred to as a Prommed
system.

4.8 CS300 Minimum System

The CS300 is the generic type number for ABB Augusts Triple Modular
Redundant PLC.

The minimum CS300 system consists of the following assemblies and associated
cabling:-

3 off Industrial Control Computer Boards (ICCBs)

1 off Process Interface Module Chassis (PI317)
1 off Triple Redundant Power Supply (PI331)
1 off Serial I/O Communication Board (PI774)
1 off Triple Fan Unit (PI110)

The PIM chassis provides 15 slots for the process I/O cards and three
slots for the ICCBs

The serial communication card (PI774) is required to allow communication with

an engineering workstation. The first cards is always fitted in Slot 15 of PIM 1 as
this is the default defined in the RTTS operating system.

The PIM Triplicated Power Supply Unit (PI-331) has the capacity to power
up to four PI-317 Process Interface Modules.

Issue ** Jan 97 Page 40 of 230

 ABB August Ltd
CS300 Safety System Training Manual

4.8.1 Operating System Firmware

This is the most basic level of software. It controls the fundamental operation of
the system and allows the ICCBs to communicate with each other and the rest of
the system. The operating system provides a platform for the application
software.

Operation of the system is accomplished under the supervision of RTTS (Real

Time Task Supervisor); this includes the Software Implemented Fault Tolerance
(SIFT) operating system which makes the use of fault tolerance transparent to
the application software. This highly configurable system has been designed to
facilitate implementation of systems control via the easy to use TRIGARD Ladder
Logic programming language.

RTTS uses an object orientated architecture to provide all the capabilities

expected in an advanced multitasking executive. It also provides a unique set of
features for supporting the fault tolerant control capabilities of the ICCBs. The

Issue ** Jan 97 Page 41 of 230

 ABB August Ltd
CS300 Safety System Training Manual

RTTS also operates under either 3-2-0 or the 3-2-1 control, the choice of
operation being dependent on the firmware contained in EPROM.

4.8.2 Application Software

The application software is specifically written for each system and provides the
instructions to operate in accordance with its requirements and provide the
system with special routines for system support.

4.8.3 Module Support

The module software provides the support routines for communications, system
testing, event processing, Matrix Panel LED lamp status control and DCS time
dating.

4.8.4 Network Ladder Software

This is the control software which consists of a sequence of instructions in the

form of ladder networks written using the TRIGARD language. The networks
operate along the line of relays supporting Boolean gate logic.

Issue ** Jan 97 Page 42 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5. CS300 Hardware

The following section provides an itemised description of some of the systems

components that may be used or configured as part of the system.

For ease of use this has been broken down into five categories, which are as
follows
Main System Components
Process Interface Module Cards
I/O Termination Modules
Fire & Gas Detection Modules
Special Function Modules

5.1 CS300 Series Main Components

This section covers the modules that form the main parts of the CS300 system.

More specific information on individual equipment can be found in the

appropriate Short Form Hardware Maintenance manuals, which include
configuration options and replacement procedures.

Issue ** Jan 97 Page 43 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.1.1 PI-317 Process Interface Module

The function of the Process Interface Module (PIM) in the CS300 system is
twofold. One function is to house the process control computers, providing the
required power and signal interconnections. The second function is to house the
process I/O cards, providing them with the necessary power and interface links
between the Process Control Computers (ICCBs) and the various transducers,
sensors and actuators in the process environment.

The Main features of the PIM include:

modular architecture
complete I/O flexibility
on line repair/replacement
up to 480 I/O points
up to 15 I/O cards
extensive range of I/O cards

Up to 15 PI-317 Process Interface Modules can be inter-connected together to

form a single CS300 System. All Analogue, Digital or Serial PIM I/O cards are
addressed on a PIM/SLOT/CHANNEL address format allowing each independent
ICCB processor to access over its independent I/O bus the appropriate input or
output value.

The modular construction and flexibility of the PIM allows any of the following
types of card to be fitted or configured in any of the 15 I/O slots:

Digital Input,
Digital Output,
Analogue Input,
Analogue Output,
Serial Communications Interface

The structure of each I/O bus consists of 8 bits of data and a number of address
and control lines. Each PIM chassis is identical, with the individual PIM address
being set by hardware links.

Issue ** Jan 97 Page 44 of 230

 ABB August Ltd
CS300 Safety System Training Manual

A PIM is defined as being either Resident or Local. A system can only contain
one Resident PIM (PIM 1). The Resident PIM consists of a chassis and
motherboard, containing three Integrated Control Computer Boards (ICCBs) and
slots for up to 15 process I/O card.

The motherboard forms the backplane of the PIM and contains three
independently powered, isolated PIM BUSs which are interconnected to the
three ICCB slots and the 15 I/O card slots. Additionally the motherboards
backplane contains the three isolated PIM interface BUSs that connect the
ICCBs of the Resident PIM to the associated PIM Interface Boards (PIBs) of any
Local PIMs.

The backplane also contains the signal paths of the Interprocessor Interface
BUSs (used for communication and synchronisation between the ICCBs) and
the signal path of the Serial Interface which is used for serial communicating
directly with the ICCBs.

The process I/O cards plug into connectors on the motherboard and provide the
actual interface between the process and processor.

Issue ** Jan 97 Page 45 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The Local PIMs (PIM 2 to PIM 15) consists of the same motherboard and
chassis used in the Resident PIM but instead of three ICCBs it is fitted with three
PIM Interface Boards (PIBs). The chassis provides slots for inserting the three
PIBs plus up to 15 process I/O boards. The motherboard forms the backplane of
the PIM and contains three independently powered, isolated BUSs to which the
PIBs and the I/O cards connect. All handshaking and control of communication
between the particular ICCB and the I/O cards is accomplished by the PIM
Interface Boards. The Resident PIM is connected to the Local PIMs by means of
a multidrop daisy chain ribbon cable. There is a separate ribbon cable for each
independent interface BUS, A, B & C.

Input signals from the process or field devices are routed through various
termination modules to the appropriate PIM input card in the CS300 system. The
signals are then processed by the triplicated input card to produce three
independent, isolated signals. In the case of a Local PIM, the signals are sent
separately through the three PIM Interface boards to the associated ICCB in the
Resident PIM. In the Resident PIM the signals go directly to each of the ICCBs.

Output signals from the CS300 System to the process or field devices follow a
similar path, in the opposite direction, through a PIM digital output card. On the
digital output card, the signals are presented to a single six element voter which
ensures the integrity of the signals being transmitted to the process.

Designed as a fault tolerant interface, the PIM with its system of replicated bus
logic sets, operates with a very high degree of data integrity. Its output voter logic
ensures that no single component failure can cause the system to malfunction.
Redundant input circuitry provides an independent path to each processor in the
computer. Isolation assures that a failure in any one path will not affect the other
paths.

Issue ** Jan 97 Page 46 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.1.2 PI-331 PIM Power Supply Unit

The Triplicated Power Supply Module (PI-331) which is used to provide power to
the Process Interface Modules (PIMs) consists of three individual power supply
units and a triplicated fan unit. The PSU has the capacity to provide the power
requirements for up to four PIMs, with each PIM containing as many as 15 I/O
cards.

PIM Power Supply Units

PIM Power Supply Cooling Fans

Each individual power supply unit (PSU) provides power to one of the three sets
of BUS logic, including one ICCB located in the Resident PIM and one PIM
Interface Board housed in each of the Local PIMs. Any two fans in the triple fan
unit are capable of providing sufficient through flow of air to cool the Power
Supply Units. Thus, the PSUs and the associated fans are included in the
system for redundancy to allow for fault tolerant operation.

Each power supply unit monitors not only its output supply voltages for both over
and under voltage conditions but also the operating temperature of the unit. Both
these conditions combine to form a single alarm output for fault reporting to a
diagnostic circuit which is located separate from each power supply module.

The Triplicated PIM Power Supply also features "soft start", zero crossover
inrush current limiting, to avoid power up interaction between the various power
supplies in an operating CS300 System.

The Triplicated PIM Power Supply Units are designed to comply, as much as
practical, with any applicable international third party safety and EMI/RFI
requirements (UL/CSA/VDE/IEC/FCC).

Issue ** Jan 97 Page 47 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.1.3 PI-110 Triple Fan Unit

The PI-110 PIM Cooling Unit supplies cooling air to the Process Interface Module
(PIM) and consists of a chassis and three fans. One cooling unit is installed
below the primary PIM to move air upward through the vertically mounted circuit
boards.

The cooling unit is a rack mounted chassis with three 5 inch axial flow fans
installed horizontally in order to direct their air flow vertically. Each fan is fitted
with a removable filter.

PIM Cooling Fans

Each fan is wired in a separate circuit with its own fuse and indicator located on
the front panel and power connector on the rear panel.

Flow Rate: 120 Cubic Feet/Min. (each fan)

Issue ** Jan 97 Page 48 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.1.4 TM117-SA Serial I/O Termination Panel

The TM117-SA Serial I/O Termination Panel provides for the connection for up to
16 external serial input/output devices such as modems, terminals, printers,
workstations, or other such computer peripheral devices. The panel can be
configured, through wire-wrapped straps on the circuit board, as either a DTE
(data terminal equipment) device or as a DCE (data communications equipment)
device.

When configured as a DTE device, the panel can support full modem control for
either synchronous or asynchronous modems.

It is important to note that the PIM Serial I/O Communications card normally
operates as a DTE device. To enable the PIM Serial I/O Board to operate as a
DCE device, a scheme referred to as 'null modem' can be implemented on the
termination module. The scheme provides the required signal swapping through
strap changes to enable the PIM Serial I/O Communications Board to emulate
the principal DCE functions and effectively operate as a DCE device.

Interconnection between the panel and the peripheral devices are

accommodated through 25-pin female connectors (port) per device.

Interconnection between the panel and the PIM Serial I/O Communications card
is via a 40 way ribbon-cable.

Issue ** Jan 97 Page 49 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.1.5 CD-901 System Diagnostic Panel

The CD-901 System Diagnostic Panel is normally installed below the PI-331 PIM
Power Supply Module and is used to display any fault alarms generated by the
CS300 system.

The CD-901 System Diagnostic Panel contains 12 pairs of LED status indicators.
A red LED is used to indicate an error or an alarm condition whereas a green
LED indicates normal system (healthy) operation. Under normal operation at
least one LED of each pair should be lit, however, if the audible alarm switch
located on the back of the panel is disabled, the green Watchdog LED will be
disabled and extinguished.

The 12 system status indicators are configured as follows:

CCM1 Alert
PIM System Alert
CCM2 Alert
System Alert
CCM3 Alert
Maintenance Alert
Watchdog Alert
Auxiliary 1 Alert
Auxiliary 2 Alert
Auxiliary 3 Alert
Auxiliary 4 Alert
Auxiliary 5 Alert

Issue ** Jan 97 Page 50 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Panel Switches

The Diagnostic Panel also contains five switches, allowing the operator to
perform the following control functions:

A Warm Start Switch,

A Diagnostic Report Switch,
An Indicator Test Switch,
An Alarm History Clear Switch, and
An Alarm Acknowledge Switch.

Panel Relays

The Diagnostic Panel contains 4 external relays terminated at the rear of the
panel. One relay is configured as a external alarm and is energised if a watchdog
alarm occurs. The remaining three single pole changeover relay outputs can
configured as required.

Auxiliary Inputs

The Diagnostic Panel also provision for five external switch inputs and an
external acknowledge alarm input.

Maintenance

The Diagnostic Panel can be installed or removed and powered up or down

without disrupting control of the process. The panel is hinged at one end to allow
it to swing out from the cabinet for ease of maintenance.

Issue ** Jan 97 Page 51 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.1.6 CD905 System Diagnostic Switch

The System Diagnostic Switch enables a serial peripheral device such as a
workstation, terminal etc., to communicate with one or all of the control
computers of the CS300 system in order to develop, load or debug the process
software in the control computers.

Located on the front panel of the System Diagnostic Switch are two rotary
switches and a keyswitch. These switches can be used to determine the
communication path between the workstation or terminal and the process
computers located in the CS300.

The System Diagnostic Switch is not required for debugging application ladder
logic.

Issue ** Jan 97 Page 52 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.1.7 PM108-D 5 VDC Termination Panel Power Supply

The Termination Panel Power Supply, PM108-D provides a dual redundant

+5VDC supply which can be utilised to power the logic supplies required on
various termination panels.

The PM108-D is a 19 rack mount module containing two removable power

supplies, 12 separately fused outputs and alarm monitoring for both the fuses
and the power supplies.

Issue ** Jan 97 Page 53 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.1.8 PM108-A 24VDC Termination Panel Power Supply

The Termination Panel Power Supply, PM108-A provides a dual redundant

+24VDC supply which can be utilised to power the logic supplies required on
various termination panels.

The PM108-A is a 19 rack mount module containing two removable power

supplies, 12 separately fused outputs and alarm monitoring for both the fuses
and the power supplies.

Issue ** Jan 97 Page 54 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2 CS300 Process Interface Module (PIM) Cards

This section covers the PIM cards that are available for use within a CS300
system.

There was until recently two series of cards on production, 6 series and 7 series.

In most cases the difference between the two series of cards was cosmetic and
not functional. The 6 series cards have now been declared obsolete and should
a replacement for a 6 series card be required then a 7 series card will be
supplied.

For this reason this manual only concerns itself with 7 series cards.

More specific information on individual equipment can be found in the

appropriate Short Form Hardware Maintenance manuals, which include
configuration options and replacement procedures.

Issue ** Jan 97 Page 55 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2.1 CS386 ICCB - Industrial Control Computer Board

The ICCB forms the heart of the ABB August CS300 Process Control System.
Three ICCBs are required for a fully triplicated system. Each ICCB is fitted into
one of the three dedicated slots in the 'resident' PIM, and is electrically
connected to one of the three I/O interface BUSs.

The three ICCBs each consist of a complete control computer having an 80386
16MHz microprocessor, 1M byte of ECC (Error Checking and Correcting) RAM
and a minimum of 256k bytes of EPROM (programmed with only the RTTS/SIFT
Operating system).

An inter-board communicator provides the read only communication required to

achieve fault detection and tolerance whilst maintaining the isolation in the event
of a fault occurring.

The ICCB uses a separate processor and additional logic, including separate
voting, to form a Real Time Clock (RTC). This allows the main processor to be
interrupted at specific intervals, usually a multiple of 10ms. The RTC allows a
time of day clock to be maintained by the main processor and schedules the
execution of tasks based upon real time requirements.

The ICCBs 'read' section allows each processor to read the contents of the other
processors memory through a pair of isolated links. In order to fully implement
software voting each ICCB is allowed to read and verify the inputs, intermediate
results, and final results of the neighbouring processors.

An internal state machine is used by the ICCB to generate the PIM bus control
signals for both the Resident and Local PIM Bus Interfaces.

ICCB Watchdog

A programmable latch is used to control the state of four LEDs (three yellow and
one red) located on the front of each ICCB. The green LED which is not
controlled directly by the programmable latch is illuminated whenever the
processor ALE is actively being pulsed.

The red Watchdog LED is controlled by a deadman timer which must be pulsed
periodically by the software in order to keep the LED extinguished and the ICCB
healthy. The three yellow LEDs are controlled directly by the programmable
latch.

Issue ** Jan 97 Page 56 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The three yellow LEDs are used to indicate the following:

AUX1 Comms activity, indicates the system is communicating through the

serial I/O card with another system or Engineering Workstation.
AUX2 Diagnostic Task Running, flashes every time the PIM diagnostic health
checks are run (once every second).
AUX3 I/O, flashes every time a PIMIO call is read by the ladder logic and the
I/O is executed.

A switch is provided on the front plate of the ICCB to allow a manual interrupt to be
actioned (this will halt the processor) or a reset. The reset function will reinitialise
the ICCB and leave it in a ready state awaiting a warm start command.

The board uses a tuning fork and blade connector that guarantees the proper
sequence of power and ground to enable the board to be inserted or removed
under full power.

The ICCB can be configured for 3-2-0 or 3-2-1 modes of operation.

Issue ** Jan 97 Page 57 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2.2 PI751 PIM BUS Interface Card

The PIM BUS Interface Cards reside in the Local PIMs and form the link
between the Resident PIM and the I/O cards mounted in the Local PIMs.

Each PIM BUS Interface Card is associated with one of the three ICCBs
mounted in the Resident PIM. The PIM BUS Interface card, under the direction
of the ICCB controls all the activity on the BUS to which it interfaces.

The PIM BUS Interface cards can only be mounted in one of the three end slots
(A, B or C) of a Process Interface Module.

The board uses a tuning fork and blade connector that guarantees the proper
sequence of power and ground to enable the board to be inserted or removed
under full power.

The PIM BUS Interface Card can be configured for 3-2-0 or 3-2-1 modes of
operation.

Issue ** Jan 97 Page 58 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2.3 PI774 4 Port Serial I/O Card

The Serial I/O Communications Board is located in the Process Interface Module
(PIM) and is electronically situated between the Serial I/O Termination Panel and
the ICCBs.

The PI774 triplicated card provides four RS232 C serial I/O interfaces so that the
CS300 Control System can be interfaced with other peripheral devices, such as:
TRIGARD Engineering workstations
System Printer
Demultiplexed Display Drivers (TM117-DMX)
Other CS300 Systems
DCS or Third Party Systems
Data Logging Devices

All serial data, control and timing signals which interface to peripheral devices are
buffered by RS-423 drivers and receivers. The RS-423 buffers permit
compatibility to the RS-232C standard.

Issue ** Jan 97 Page 59 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Configuring a port for either DTE or DCE operation is accomplished through link
settings on the termination module.

The PI774 card has Direct Memory Access (DMA) capability to increase the
boards message handling performance. The DMA controller and the
microprocessor are able to transfer messages between the on-board RAM and
the ICCBs.

The PI774 card houses up to 48k bytes of static RAM for message buffering and
128k bytes of non-volatile EPROM for program execution.

The PI774 card is fitted with 3 green LEDs on the front plate to provide a visual
indication of power status. Under normal conditions all 3 LEDs will be illuminated
indicating all three power supplies to the board are healthy.

The PI774 card is also fitted with the standard channel status indicators and a
maintenance switch. The red channel status LEDs, when illuminated, will
indicate either an inactive channel if only one LED is lit or if all three status LEDs
are illuminated that the unit is in an off-line condition.

The maintenance switch is used when boards are being replaced to notify the
ICCBs that the status of the board is to be changed.

The board uses a tuning fork and blade connector that guarantees the proper
sequence of power and ground to enable the board to be inserted or removed
under full power. This allows the board to be hot-repaired without interrupting the
input monitoring.

The PI774 serial I/O card can be configured for 3-2-0 or 3-2-1 modes of
operation.

Issue ** Jan 97 Page 60 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2.4 PI716 Digital Input Card

The PI-716 Digital Input Card is located in the Process Interface Module (PIM)
rack and is electronically situated between the Digital Termination Panel(s) and
the systems control computers (ICCBs).

The 32 channel triplicated card provides an interface between the incoming

signals and the CS300 Control System.

The board may be 'hot-repaired' on-line without affecting system integrity.

Each of the 32 input channels is triplicated and resistively isolated from its
adjacent channels to prevent a failure on one channel from affecting or
corrupting data or information on the other two channels.

An on-board fully buffered cross-read facility allows each channel to compare its
latched data with the data latched in the other two channels.

Issue ** Jan 97 Page 61 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The 32 digital input signals are presented to three independent resistively

isolated circuits. The 32 inputs are initially organised into four 8-bit ports, this
enables the Control Computers (ICCBs) to sample 8 inputs (one port) at a time.
The Port Selector Voter circuitry guarantees that the three ICCBs simultaneously
select the same port.

The 8 bit data held in the selected port is then latched, the latching mechanism is
also voter controlled to ensure that all three ICCBs latch the same data at the
same time.

The PI716 Digital Input Card has three 'on-board' channel status indicators and a
maintenance notification switch.

The red channel status LEDs, when illuminated, will indicate either an inactive
channel if only one LED is lit or if all three status LEDs are illuminated that the
card is in an 'off-line' condition.

The maintenance notification switch is used when cards are being replaced to
notify the ICCBs that the status of the card is to be changed.

All PI716 Digital Input Cards use a tuning fork and blade connector that also
guarantees the proper sequencing of power and ground to enable the card to be
inserted or removed under full power. This allows the card to be hot-replaced
without interrupting the input monitoring.

The PI716 Digital Input card can be configured for 3-2-0 or 3-2-1 modes of
operation.

Issue ** Jan 97 Page 62 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2.5 PI-726 Digital Output Card

The PI-726 Digital Output Card is located in the Process Interface Module (PIM)
rack and is electronically situated between the Digital Output Termination
Panel(s) and the control computers (ICCBs).

The 32 channel triplicated card provides an interface between outgoing signals

and the CS300 Control System.

Depending on the system configuration and the type of output being driven the
card may be 'hot-repaired' on-line without affecting system integrity.

Each of the 32 fault tolerant output signals pass through an on-board digital
hardware (single six element) voter circuit controlled by the three ICCBs.

Each of the triplicated channels consists of four 8-bit ports, each of the ports (8
outputs) is selected in turn by the ICCB. The ICCBs then write to the selected
port and output the 8-bit value to that port.

Issue ** Jan 97 Page 63 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Each of the triplicated channels is isolated from its adjacent channel to prevent a
failure on one channel from affecting or corrupting data or information on the
other two channels.

Each of the 32 output lines generated by the four 8-bit ports pass through a six
element digital voter circuit. The three ICCBs each provide health protocol
signals to the board so that the voted outputs can be dynamically adapted to
account for the absence of one channel. In a 3-2-0 mode the voter input will be
correct when at least 2 of the 3 channels agree in their data.

The card has three 'on-board' channel status indicators and a maintenance
switch. The channel status LEDs, when illuminated, will indicate either an
inactive channel if only one LED is lit or if all three status LEDs are illuminated
that the card is in an 'off-line' condition.

The maintenance switch is used when cards are being replaced to notify the
ICCBs that the status of the card is to be changed.

The card uses a tuning fork and blade connector that also guarantees the proper
sequencing of power and ground to enable the card to be inserted or removed
under full power. This allows the card to be hot-repaired without interrupting the
input monitoring.

Should the output card require replacement, a check should be made on the
system configuration to establish if a 'hot-repair' partner has been configured and
also on the type of output being driven.

The PI726 Digital Output card can be configured for 3-2-0 modes of operation
only.

Issue ** Jan 97 Page 64 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2.6 PI727 Digital Output Board

The PI-727 Digital Output Card is located in the Process Interface Module (PIM)
rack and is electronically situated between the Digital Output Termination
Panel(s) and the control computers (ICCBs).

The 32 channel triplicated card provides an interface between outgoing signals

and the CS300 Control System.

Depending on the system configuration and the type of output being driven the
board may be 'hot-repaired' on-line without affecting system integrity.

Each of the 32 fault tolerant output signals pass through an on-board digital
hardware (single six element) voter circuit controlled by the three ICCBs.

The PI727 Card supports a controlled degradation for 3-2-1 operation via the
health protocol resident in each of the three ICCB channels.

Issue ** Jan 97 Page 65 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Each of the triplicated channels consists of four 8-bit ports, each of the ports (8
outputs) is selected in turn by the ICCB. The ICCBs then write to the selected
port and output the 8-bit value to that port.

Each of the triplicated channels is isolated from its adjacent channel to prevent a
failure on one channel from affecting or corrupting data or information on the
other two channels.

Each of the 32 output lines generated by the four 8-bit ports pass through a six
element digital voter circuit. The three ICCBs each provide health protocol
signals to the card so that the voted outputs can be dynamically adapted to
account for the absence of one channel. In a 3-2-0 mode the voter input will be
correct when at least 2 of the 3 channels agree in their data. In a 3-2-1 mode the
voter output will be valid as long as any one of the channels are healthy. When
no channels are healthy, the output is determined by one of two link selectable
options - hold the last value, or default to off.

The card has three 'on-board' channel status indicators and a maintenance
switch. The channel status LEDs, when illuminated, will indicate either an
inactive channel if only one LED is lit or if all three status LEDs are illuminated
that the card is in an 'off-line' condition.

The maintenance switch is used when cards are being replaced to notify the
ICCBs that the status of the card is to be changed.

The card uses a tuning fork and blade connector that also guarantees the proper
sequencing of power and ground to enable the card to be inserted or removed
under full power. This allows the card to be hot-repaired without interrupting the
input monitoring.

Should the output card require replacement, a check should be made on the
system configuration to establish if a 'hot-repair' partner has been configured and
also on the type of output being driven.

The PI727 Digital Output card can be configured for 3-2-0 or 3-2-1 modes of
operation.

Issue ** Jan 97 Page 66 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2.7 PI732 Analogue Input Card

The 16 channel PI732 Analogue Input Card which is located in the Process
Interface Module (PIM) rack is electronically situated between the Analogue
Termination Panel(s) and the systems control computers (ICCBs).

The 16 channel triplicated card provides both interface and digital conversion so
that the incoming analogue signals can be read by the CS300 Control System.

The card may be 'hot-repaired' on-line without affecting system integrity.

Each of the 16 input channels is triplicated and resistively isolated from its
adjacent channels to prevent a failure on one channel from affecting or
corrupting data or information on the other two channels.

The 'on-board' cross read facility enables each channel to compare its latched
data with that of the other channels. The ICCBs can each read the data latched
on all three channels and then vote on that data.

Issue ** Jan 97 Page 67 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The Analogue Input Card accepts 16 differential inputs from field process
devices via the analogue termination modules. The Analogue Input Card
converts these signals into a digital form and applies the resultant data to each of
the control computers (ICCBs). The Analogue Input Cards range (0-5V, 0-10v,
0-5V or 0-10V) is factory configured.

The 16 differential analogue input signals are presented in turn through a

multiplexer to the three 12-bit Analogue-to-Digital Converters (A-D), each
channel being isolated from the others to prevent a failure on one channel from
affecting or corrupting data or information on the other two channels.

Each of the 16 differential analogue input signals is selected by the Voter

Control. The Voter Control requires two of the three Control Computers (ICCBs)
to select the same channel to be converted.

On selecting a channel a 'start conversation' signal is sent to each A-D converter.

The use of the Channel Select Voter circuitry ensures that the same value is
presented to all three A-D converters at the same time.

The selected analogue signal is converted into a 12-bit binary value, the
conversion of one value taking about 25s. After completing the conversion an
'end of conversion' signal is passed to the ICCBs. The 12-bit output values are
now available for reading by the three ICCBs. Once the values are read the
ICCBs will select another input signal and repeat the conversion process.

The board has three 'on-board' channel status indicators and a maintenance
switch. The channel status LEDs, when illuminated, will indicate either an
inactive channel if only one LED is lit or possibly that the unit is in an 'off-line'
condition if all three status LEDs are illuminated.

The maintenance switch is used when cards are being replaced to notify the
ICCBs that the status of the card is to be changed.

The card uses a tuning fork and blade connector that also guarantees the proper
sequencing of power and ground to enable the card to be inserted or removed
under full power. This allows the card to be hot-repaired without interrupting the
input monitoring.

The PI732 Analogue Input card can be configured for 3-2-0 or 3-2-1 modes of
operation.

Issue ** Jan 97 Page 68 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.2.8 PI741 Analogue Output Card

The 4 channel PI741 Analogue Output Card which is located in the Process
Interface Module (PIM) rack is electronically situated between the Analogue
Output Termination Panel(s) and the systems control computers (ICCBs).

The 4 channel triplicated card provides an interface and digital to analogue

conversion between the outgoing analogue signals and the CS300 Control
System.

Depending on the system configuration and the type of output being driven the
card may be 'hot-repaired' on-line without affecting system integrity.

Each of the 4 output channels is triplicated and isolated from its adjacent
channels to prevent a failure on one channel from affecting or corrupting data or
information on the other two channels.

Issue ** Jan 97 Page 69 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The Analogue Output Card takes a 12 bit digital value form the ICCBs and
converts it, by using Digital to Analogue converters (DAC), to a voltage
compatible with the termination modules that provide the field / process
interface.
The outputs of the DACs are presented to an analogue voter circuit which
performs a mid value selection to ensure signal integrity. This mid value selection
process insures the continued and correct value of the analogue output by
preventing any single faulty DAC or device on the board from corrupting the
correct signal level.

The PI741 card has three 'on-board' channel status indicators and a
maintenance switch. The channel status LEDs, when illuminated, will indicate
either an inactive channel if only one LED is lit or possibly that the unit is in an
'off-line' condition if all three status LEDs are illuminated.

The maintenance switch is used when cards are being replaced to notify the
ICCBs that the status of the card is to be changed.

The card uses a tuning fork and blade connector that also guarantees the proper
sequencing of power and ground to enable the card to be inserted or removed
under full power. This allows the card to be hot-repaired without interrupting the
input monitoring.

The PI741 Analogue Output card can be configured for 3-2-0 modes of operation
only.

Issue ** Jan 97 Page 70 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.3 TERMINATION MODULES

Termination modules operate as the interface between the Process Control

System and the various field devices such as thermocouples, valves, solenoids
or peripheral devices such as printers and workstations.

Additionally the termination modules also provide signal conditioning, impedance

matching, isolation, noise immunity and system protection from hazardous
process characteristics, such as high voltage, surges, spikes etc..

The provision of interfacing field signals remote from the PIM rack gives the
CS300 System a significant advantage over its competition with respect to RFI
and noise immunity.

The conditioned signals from the termination modules are then applied to the
Process Control System (PIM rack) via multiway ribbon cables.

There are three generic ranges of termination panels in use today, they are:
TM117 Panel Mounted
TM118 Rail Mounted
TM119 Rack Mounted

The range of August Systems digital and analogue termination modules include
features such as line monitoring, dual tested inputs, dual tested outputs and
multiplexed LED drivers.

Dual configured, fully tested termination modules are often used in critical
applications to provide a level of high integrity protection.

The dual configured termination modules are then tested by the application
software running in the CS300 System to detect for any hidden or latent faults.
The frequency of automatic testing is set within the systems software.

A hidden fault, caused by a component failure, may often remain undetected in a

simplex I/O configuration. With dual configured termination modules the faulty
unit can be replaced 'on-line' providing that one of the pair remains fault free.

Various levels of testing and monitoring of field devices can be achieved by using
different combinations of termination modules and PIM I/O cards.

Issue ** Jan 97 Page 71 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4 117 Series Termination Modules

5.4.1 TM117-AC 16 Channel Input or Output

The TM117-AC (formerly known as TM117-D) Digital Panel provides 16 single

state inputs or outputs suitable for applications driving low/medium power field
devices utilising AC voltages.

The termination module can be utilised for inputs by connecting it to a PI716 PIM
Digital Input card and fitting the appropriate AC input solid state relays (SSRs).
These are normally yellow in colour.

The termination module can be utilised for outputs by connecting it to a PI726 or

PI727 PIM Digital Output card and fitting the appropriate AC output SSRs. These
are normally black in colour.

Input Mode
The SSRs are switched on by applying a voltage from the field. The PIM digital
input card floats at a quiescent high level and a channel is switched on when the
SSR pulls the signal LOW down to 0V. The channel status LED will be
illuminated to provide a local visual indication that the input is on.

Output Mode
The SSRs are controlled by sixteen channels of a PIM output card. The PIM
digital output card has an open collector output that sinks or pulls LOW the input
to the SSR. When the signal is pulled LOW, the SSR becomes activated and its
output closes, the channel status LED adjacent to the SSR is illuminated.

Issue ** Jan 97 Page 72 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Each panel terminates up to 16 digital signals and provides isolation through the
use of the plug-in solid state relays. All signals (input or output) are isolated from
each other. The SSRs are available for a variety of voltage and current ranges.

User connections to the termination module are accomplished via screw clamp
terminals accepting ring or spade crimps.

Issue ** Jan 97 Page 73 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.2 TM117-DC 16 Channel Input or Output

The TM117-DC (formerly known as TM117-DD) Digital Panel provides 16 single

state inputs or outputs suitable for applications driving low/medium power field
devices utilising DC voltages.

The termination module can be utilised for inputs by connecting it to a PI716 PIM
Digital Input card and fitting the appropriate DC input solid state relays (SSRs).
These are normally white in colour.

The termination module can be utilised for outputs by connecting it to a PI726 or

PI727 PIM Digital Output card and fitting the appropriate DC output SSRs. These
are normally red in colour.

Input Mode
The SSRs are switched on by applying a voltage from the field. The PIM digital
input card floats at a quiescent high level and a channel is switched on when the
SSR pulls the signal LOW down to 0V. The channel status LED will be
illuminated to provide a local visual indication that the input is on.

Output Mode
The SSRs are controlled by sixteen channels of a PIM output card. The PIM
digital output card has an open collector output that sinks or pulls LOW the input
to the SSR. When the signal is pulled LOW, the SSR becomes activated and its
output closes, the channel status LED adjacent to the SSR is illuminated.

Issue ** Jan 97 Page 74 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Each panel terminates up to 16 digital signals and provides isolation through the
use of the plug-in solid state relays. All signals (input or output) are isolated from
each other. The SSRs are available for a variety of voltage and current ranges.

User connections to the termination module are accomplished via screw clamp
terminals accepting ring or spade crimps.

Issue ** Jan 97 Page 75 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.3 TM117-DIS 16 Channel Input with Override Switch

Issue ** Jan 97 Page 76 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.4 TM117-DR 16 Channel Volt Free Change Over Output

The TM117-DR is a panel mounted termination module that provides 16 two pole
change-over (form C) relay contact outputs suitable for volt-free applications or
driving medium power field devices.

The relays provided are of a plug in type and possess a retaining clip for
additional security. User wiring access is thorough standard screw terminals.

The output relays are controlled by sixteen channels of a PI726 or PI727 output
card of the CS300 System. Each output relay is energised when the
corresponding control input sinks current to the module supply reference, ie.
open drain/collector driver. Diode suppression for the inductive kick-back of the
coil is also provided.

A channel status LED adjacent to each relay is illuminated whenever its

associated drive circuit is energised.

Issue ** Jan 97 Page 77 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The power output circuit of the relays consists of two change-over (form C) dry
contacts separately fused. Voltage/current ratings permit a 2 amp output at 24V
DC. Arc suppression components have been omitted since the requirements
differ according to the application.

A third contact of each output relay can be wired back to a PI716 32 channel
digital input card. In this way the output relays can be checked for output
discrepancies.

Issue ** Jan 97 Page 78 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.5 TM117-DR/5

Issue ** Jan 97 Page 79 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.6 TM117-DR/30 8 Channel Volt Free Change Over Output @

30 Amps

Issue ** Jan 97 Page 80 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.7 TM117-P16 16 Channel Pulse Input

Issue ** Jan 97 Page 81 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.8 TM117-RMD 8 Channel Monitored Relay Output

The TM117-RMD is a panel mounted termination module that provides 8 line

monitored normally de-energised relay outputs, suitable for safety critical field
devices such as ESD valve solenoids.

Each field output is controlled by a PI726 or PI727 digital output card. Each
output circuit incorporates both field device and relay monitoring circuits.

When a relay coil is de-energised the supply to the field device is disconnected
and a small sensing current is allowed to flow through the field device. The
sensing current is monitored by a comparator against pre defined limits. This
enables the board to detect open or short circuit faults should they occur.

Each output channel has a link option to accommodate high or low field device
loads and an inhibit link to render the fault sensing inoperative if the channel is a
spare.

Issue ** Jan 97 Page 82 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Each channel can provide a fault feedback signal which is connected to a PI716
digital input card. The channel faults can also be combined to give a common
fault signal.

Issue ** Jan 97 Page 83 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.9 TM117-RME 15 Channel Line Monitored Dual Relay Output

The TM117-RME Digital Output Termination Module provides terminations for

digital signals to field loads of up to 50 watts each. The termination modules have
been designed to work as a normally energised tested pair. Each pair terminates
15 output signals through hermetically sealed relays. The modules are panel
mounted and user connections to the termination module is accomplished
through the 15 sets of 4 way screw terminals.

Each TM117-RME module consists of a circuit board with 15 plug in 4 pole

relays, current and voltage monitors, monitoring logic and interfaces that allow
signal connection to the user's process devices and to the Process Interface
Module (PIM). Each output is provided with short circuit protection and includes a
fuse in its signal path.

There are three variants of the TM117-RME available. These are as follows:
TM117-RME/24 Suitable for 24VDC field devices,
TM117-RME/48 Suitable for 48VDC field devices,
TM117-RME/110 Suitable for 110VDC field devices.

The testing of these termination modules is accomplished by use of the RMET

call element in the VP125 application ladder logic. This element provides the
facility to periodically perform a Walk Through auto test and also provides us
with constant fault monitoring.

In the event that an output fault should occur, the fault will be detected and the
board where the fault is found will be de-energised and a diagnostic alarm
generated. The de-energisation of the board removes all field power from that
board while maintaining the field device in it correct state via the other board in
the dual redundant pair.

Issue ** Jan 97 Page 84 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The primary function of this type of testing is to ensure that even under fault
conditions should the need arise to perform an ESD function the output can be
de-energised and the plant made safe.

To perform these tests the board has feedback signals which are normally wired
back into the system via TM118-DH termination modules.

Also associated with each TM117-RME module is a Master Relay which is used
to energise or de-energise the board. This is normally a large solid state relay
and is controlled by channel sixteen of the TM117-RME module.

Issue ** Jan 97 Page 85 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.10 TM117-SME 15 Channel Line Monitored Dual SSR

Output

The TM117-SME Digital Output Termination Module provides terminations for

normally energised field loads. The termination modules have been designed to
work as a tested pair. Each pair terminates 15 output signals through MOSFET
based solid state switches. The modules are panel mounted and user
connections to the termination module is accomplished through the 15 sets of 4
way screw terminals.

Each TM117-SME module consists of a circuit board with 15 solid state relays,
current and voltage monitors, monitoring logic and interfaces that allow signal
connection to the user's process devices and to the Process Interface Module
(PIM). Each output is provided with short circuit protection and includes a fuse in
its signal path.

There are four variants of the TM117-SME available. These are as follows:
TM117-SME/24 Suitable for 24VDC field devices,
TM117-SME/L/24 Suitable for 24VDC low power field devices,
TM117-SME/48 Suitable for 48VDC field devices,
TM117-SME/110 Suitable for 110VDC field devices.

Issue ** Jan 97 Page 86 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.11 TM117-DIB 16 Channel I.S. Barrier Input

Issue ** Jan 97 Page 87 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.12 TM117-DOB 16 Channel I.S. Barrier Output

Issue ** Jan 97 Page 88 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.13 TM117-AIB 16 Channel I.S. Barrier Analogue Input

Issue ** Jan 97 Page 89 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.14 TM117-DLP 16 Channel Line Proved Input

The TM117-DLP is a panel mounted termination module that provides 16 line

monitored field inputs, suitable for safety critical field switch contacts.

Each input loop is fitted with a series and parallel resistor in the field to provide a
resistor window which is monitored to determine when the following states occur,
closed contact, open contact, short circuit fault and open circuit fault.

The signals that are available to the CS300 system as inputs to a PI716 card are
Contact state, Short circuit fault & Open circuit fault. The open and short circuit
faults can be combined to give a common fault signal by means of a link option
which can be hard wired for diagnostic purposes.

Issue ** Jan 97 Page 90 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.15 TM117-DLP/3 16 Channel Line Proved Input

The TM117-DLP/3 is a panel mounted termination module that provides 16 line

monitored field inputs, suitable for safety critical field switch contacts.

Each input loop is fitted with a series and parallel resistor in the field to provide a
resistor window which is monitored to determine when the following states occur,
closed contact, open contact, short circuit fault and open circuit fault.

The signals that are available to the CS300 system as inputs to a PI716 card are
Contact state, Short circuit fault & Open circuit fault. The open and short circuit
faults can be combined to give a common fault signal by means of a link option
which can be hard wired for diagnostic purposes.

Issue ** Jan 97 Page 91 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.16 TM117-TMR 8 Channel Triplicated Relay Output

The TM117-TMR is a panel mounted termination module that provides 8

triplicated mechanical relay volt free normally energised or normally de-energised
voted outputs with a status feedback.

Each field output is controlled by three separate PI726 or PI727 digital output
cards. Each card controls one of the three relays which go to make up a 2 out of
3 six element voted circuit.

A spare contact on each of the relays is utilised to provide a feedback signal

which is connected to a PI716 digital input card. This feedback circuit can be link
configured to suit either normally energised outputs or normally de-energised
outputs.

The TM117-TMR can be fully autotested to detect failed relays and therefore is
normally used for safety critical outputs.

Issue ** Jan 97 Page 92 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.17 TM117-DRM 8 Channel Line Monitored Output

The TM117-DRM is a panel mounted termination module that provides 8

normally de-energised mechanical relay outputs with a status feedback for either
AC or DC operated field devices.

Each field output is controlled by a PI726 or PI727 digital output card. Each
output circuit incorporates both field device and relay monitoring circuits.

When a relay coil is de-energised the supply to the field device is disconnected
and a small sensing current is allowed to flow through the field device. The
sensing current is monitored by a comparator against pre defined limits. This
enables the board to detect open or short circuit faults should they occur.

Each output channel has a link option to accommodate high or low field device
loads.

A spare contact on each of the relays is utilised to provide a feedback signal

which is connected to a PI716 digital input card.

Issue ** Jan 97 Page 93 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.18 TM117-AO11 16 Channel Non-Isolated Voltage Output (0-

10)

The TM117-AO11 Output Termination panel is a 1 U high 19 rack mounted unit

which provides 16 voltage mode outputs. These outputs are capable of providing
a
0-10 volt output.

The TM117-AO11 provides the interface between the PI741 Analogue Output
card located in the system and the field device. Four PI741 cards are required to
provide the 16 outputs.

The TM117-AO11 card is fitted with a monitoring capability which can be

connected to a PI732 Analogue Input card.

Issue ** Jan 97 Page 94 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.19 TM117-AO2 16 Channel Non-Isolated Current Output

The TM117-AO2 Output Termination panel is a 1 U high 19 rack mounted unit

which provides 16 current mode outputs. These outputs are capable of providing
a
0-20mA or 4-20mA output.

The TM117-AO2 converts a 0-5V signal from the PI741 Analogue Output card
located in the system to current. Four PI741 cards are required to provide the 16
outputs.

The TM117-AO2 card is fitted with a monitoring capability which can be

connected to a PI732 card.

Issue ** Jan 97 Page 95 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.20 TM117-AO3 4 Channel Isolated Current Output

Issue ** Jan 97 Page 96 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.21 TM117-AO4 4 Channel Isolated Current Output

Issue ** Jan 97 Page 97 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.22 TM117-AI11 16 Channel Voltage Input

The TM117-AI11 Analogue Input Termination Module is a 1 U high 19 rack

mounted unit which provides terminations for analogue signals from field
transmitters or devices. The panel terminates 16 Input signals through a resistive
network, to provide protection for the triplicated analogue input card PI732. The
module is housed in its own rack and user connections to the termination module
is accomplished through 8 groups of 4 way screw terminals.

Each input of the termination module has a voltage limiter circuit to prevent
damage to the triplicated analogue input card.

The TM117-AI11 can accommodate either 0-5V or 0-10V signals depending on

what type of triplicated analogue input card it connected to.

Issue ** Jan 97 Page 98 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.23 TM117-AI12 16 Channel Current Input - Internally Powered

The TM117-AI12 Analogue Input Termination Module is a 1 U high 19 rack

mounted unit which provides terminations for analogue signals from field
transmitters or devices. The panel terminates 16 Input signals through a current
sensing resistor. The module is housed in its own rack and user connections to
the termination module is accomplished through 8 groups of 4 way screw
terminals.

Each input of the termination module has a voltage limiter circuit to prevent
damage to the triplicated analogue input card.

The TM117-AI12 can accommodate a 0-20mA input signal and is configured to

be internally powered.

Issue ** Jan 97 Page 99 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.24 TM117-AI13 16 Channel Current Input - Externally Powered

The TM117-AI13 Analogue Input Termination Module is a 1 U high 19 rack

mounted unit which provides terminations for analogue signals from field
transmitters or devices. The panel terminates 16 Input signals through a current
sensing resistor. The module is housed in its own rack and user connections to
the termination module is accomplished through 8 groups of 4 way screw
terminals.

Each input of the termination module has a voltage limiter circuit to prevent
damage to the triplicated analogue input card.

The TM117-AI13 can accommodate a 0-20mA input signal and is configured to

be externally powered.

Issue ** Jan 97 Page 100 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.25 TM117-AI2 8 Channel Isolated Current Input

The TM117-AI2 Analogue Input Termination Module is a 1 U high 19 rack

mounted unit which provides terminations for analogue signals from field
transmitters or devices. The panel terminates 8 Input signals through a current
sensing resistor and then through an Analogue Devices isolating amplifier to the
CS300 system. The module is housed in its own rack and user connections to
the termination module is accomplished through 8 groups of 2 way screw
terminals.

The TM117-AI2 can accommodate a 0-20mA input signal

Issue ** Jan 97 Page 101 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.26 TM117-AI22 16 Channel Isolated Current Input

Issue ** Jan 97 Page 102 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.27 TM117-T/C 16 Channel Thermocouple Input

Issue ** Jan 97 Page 103 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.4.28 TM117-CM

Issue ** Jan 97 Page 104 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.5 118 Series Termination Modules

5.5.1 TM118-AC 8 Channel Input or Output

The TM118-AC (formerly known as TM118-D) Digital Panel provides 8 single

state inputs or outputs suitable for applications driving low/medium power field
devices utilising AC voltages.

The termination module can be utilised for inputs by connecting it to a PI716 PIM
Digital Input card and fitting the appropriate AC input solid state relays (SSRs).
These are normally yellow in colour.

The termination module can be utilised for outputs by connecting it to a PI726 or

PI727 PIM Digital Output card and fitting the appropriate AC output SSRs. These
are normally black in colour.

Input Mode
The SSRs are switched on by applying a voltage from the field. The PIM digital
input card floats at a quiescent high level and a channel is switched on when the

Issue ** Jan 97 Page 105 of 230

 ABB August Ltd
CS300 Safety System Training Manual

SSR pulls the signal LOW down to 0V. The channel status LED will be
illuminated to provide a local visual indication that the input is on.

Output Mode
The SSRs are controlled by eight channels of a PIM output card. The PIM digital
output card has an open collector output that sinks or pulls LOW the input to the
SSR. When the signal is pulled LOW, the SSR becomes activated and its output
closes, the channel status LED adjacent to the SSR is illuminated.

Issue ** Jan 97 Page 106 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.5.2 TM118-DC 8 Channel Input or Output

The TM118-DC (formerly known as TM118-DD) Digital Panel provides 8 single

state inputs or outputs suitable for applications driving low/medium power field
devices utilising DC voltages.

The termination module can be utilised for inputs by connecting it to a PI716 PIM
Digital Input card and fitting the appropriate DC input solid state relays (SSRs).
These are normally white in colour.

The termination module can be utilised for outputs by connecting it to a PI726 or

PI727 PIM Digital Output card and fitting the appropriate DC output SSRs. These
are normally red in colour.

Input Mode
The SSRs are switched on by applying a voltage from the field. The PIM digital
input card floats at a quiescent high level and a channel is switched on when the
SSR pulls the signal LOW down to 0V. The channel status LED will be
illuminated to provide a local visual indication that the input is on.

Issue ** Jan 97 Page 107 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Output Mode
The SSRs are controlled by eight channels of a PIM output card. The PIM digital
output card has an open collector output that sinks or pulls LOW the input to the
SSR. When the signal is pulled LOW, the SSR becomes activated and its output
closes, the channel status LED adjacent to the SSR is illuminated.

Issue ** Jan 97 Page 108 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.5.3 TM118-DH 16 Channel Input

The TM118-DH Input Termination Panel is rail mounted and provides up to

sixteen digital input circuits suitable for both normally energised and normally de-
energised circuits.

The TM118-DH Digital Termination Panel provides a termination for the wiring
from inputs for which isolation and over-voltage protection is not of prime
importance, such as internal panel inputs. Typical panel inputs are those
generated internally within the system and are usually limited to diagnostic
signals (such as those generated by a fuse failure), monitoring signals (feedback
inputs) or inputs from any keyswitches or pushbuttons mounted on an integral
mimic/matrix panel.

Each panel terminates up to 16 digital input signals and provides isolation

through the use of opto-coupling devices. Each input is derived from a passive
device requiring a current to be provided form an external source.

Issue ** Jan 97 Page 109 of 230

 ABB August Ltd
CS300 Safety System Training Manual

All inputs Input voltages can range from 3V dc to 30V dc with transient
capabilities up to 100V dc.

Each of the 16 channels are isolated from each other and are provided with a
board mounted LED indicator which is illuminated to signal the presence of an
input signal.

User connections to the termination module are accomplished via screw

terminals onto a plug and socket connector, accepting solid or stranded wire up
2
to 4mm .

Issue ** Jan 97 Page 110 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.5.4 TM118-DH/2 16 Channel Input

The TM118-DH/2 Input Termination Panel is rail mounted and provides up to

sixteen digital input circuits suitable for both normally energised and normally de-
energised circuits.

The TM118-DH/2 Digital Termination Panel provides a termination for the wiring
from inputs for which isolation and over-voltage protection is not of prime
importance, such as internal panel inputs. Typical panel inputs are those
generated internally within the system and are usually limited to diagnostic
signals (such as those generated by a fuse failure), monitoring signals (feedback
inputs) or inputs from any keyswitches or pushbuttons mounted on an integral
mimic/matrix panel.

Each panel terminates up to 16 digital input signals and provides isolation

through the use of opto-coupling devices. Each input is derived from a passive
device requiring a current to be provided form an external source.

Issue ** Jan 97 Page 111 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Input voltages can range from 3V dc to 30V dc with transient capabilities up to

100V dc.

Each of the 16 channels are isolated from each other and provided with a board
mounted LED indicator which is illuminated to signal the presence of an input
signal.

User connections to the termination module are accomplished via screw

terminals onto a plug and socket connector, accepting solid or stranded wire up
2
to 4mm .

Issue ** Jan 97 Page 112 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.5.5 TM118-AR 8 Channel Annunciator Repeater

The TM118-AR/24 Digital Termination Module is used for both Input and Output
signals. The module has 8 two pole changeover (nitrogen filled) relays fitted. The
module is rail mounted and has user connections to each of the two sets of
changeover contacts and to the coils of the relays.

The coils of the relays also have a ribbon header for connection to either a digital
Input or Output card.

Issue ** Jan 97 Page 113 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.6 119 Series Termination Moules

5.6.1 TM119-DH 16 Channel Rack Mounted Input

The TM119-DH is a slot mounted board which provides 16 self powered inputs.
Each board has a common fuse fail indication monitoring all of the channels on
the board.

The boards have been specifically designed to be used in a 6 U high 19 rack.

This design enables the boards to be operated in dual redundant pairs and
permits autotesting of the boards for fault detection.

The front of the board is fitted an LED indication for each channel to provide local
indication of the input status of each channel.

Issue ** Jan 97 Page 114 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.6.2 RK119-DH 128 Channel Input Rack

The RK119-DH mounting rack has been specifically designed to house up to 8

pairs of TM119-DH input cards and provides all of the necessary power, signal
and autotest connection for the input cards.

All connections are made via the backplane which also provides the interface
between the gas modules by use of standard DIN 41612 connectors.

The field connections are made via 38 way Varelco connectors mounted directly
on the back of the rack. This permits field wiring to be terminated directly to the
rack if required.

All power connections and supplies for the field devices and TM119-DH cards
are made via the backplane of the rack and are dual configured.

Issue ** Jan 97 Page 115 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7 Fire & Gas Detection Modules

5.7.1 FM100 2 Channel Fire Detector Input

The FM100 Twin Zone Fire Module has been specifically designed to be used in
Fire and Gas detection systems as an interface with the vast majority of industrial
fire detection devices such as Flame detectors, Smoke detectors and Heat
detectors.

The unit is mounted in a specifically designed 3 U high 19 rack. The rack can
hold a maximum of 16 FM100 modules and allows for quick replacement of a
faulty module..

The FM100 module has been designed with line proving circuits to detect faults
in the field as well as being a fully autotested module in its own right.

The FM100 has local indications on the front panel to advise operators as to the
status of the field device. An inhibit and reset switch are provided on the front
panel to allow routine maintenance tasks to be completed.

Issue ** Jan 97 Page 116 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.2 FM101

Issue ** Jan 97 Page 117 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.3 EM100 2 Channel ESD Module

Issue ** Jan 97 Page 118 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.4 FT100 16 Slot Fire Module Rack

The FT100 rack can accommodate up to 16 fire modules (FM100) and provides
all of the necessary power, signal and autotest connection for the fire modules.
All connections are made via the backplane which also provides the interface
between the fire modules by use of standard DIN 41612 connectors.

Issue ** Jan 97 Page 119 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.5 GM100-C 1 Channel Combustible Gas Module

The GM100-C Single Channel Module has been specifically designed to be used
in Fire and Gas detection systems as an interface between catalytic gas
(constant current) detection devices and the CS300 system.

The unit is mounted in a specifically designed 3 U high 19 rack. The rack can
hold a maximum of 16 Gas modules and allows for quick replacement of a faulty
module..

The GM100-C module has been designed with line proving circuits to detect
faults in the field as well as being a fully autotested module in its own right.

The GM100-C has local indications on the front panel to advise operators as to
the status of the field device, this includes a 0-100 LEL readout. An inhibit and
reset switch are provided on the front panel along with a calibration selection
switch to allow routine maintenance tasks to be completed.

Issue ** Jan 97 Page 120 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.6 GM100-T 1 Channel Toxic Gas Module

Issue ** Jan 97 Page 121 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.7 GM100-H 1 Channel Toxic Gas Module

The GM100-H Single Channel Module has been specifically designed to be used
in Fire and Gas detection systems as an interface between 4-20mA source or
sink toxic gas detection devices and the CS300 system.

The unit is mounted in a specifically designed 3 U high 19 rack. The rack can
hold a maximum of 16 Gas modules and allows for quick replacement of a faulty
module..

The GM100-H module has been designed with line proving circuits to detect
faults in the field as well as being a fully autotested module in its own right.

The GM100-H has local indications on the front panel to advise operators as to
the status of the field device, this includes a 0-50 PPM readout. An inhibit and
reset switch are provided on the front panel along with a calibration selection
switch to allow routine maintenance tasks to be completed.

Issue ** Jan 97 Page 122 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.8 GM101

Issue ** Jan 97 Page 123 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.9 AM100 1 Channel Toxic Gas Module

The AM100 Single Channel Module has been specifically designed to be used in
Fire and Gas detection systems as an interface between 4-20mA source or sink
toxic gas detection devices and the CS300 system.

The unit is mounted in a specifically designed 3 U high 19 rack. The rack can
hold a maximum of 16 Gas modules and allows for quick replacement of a faulty
module..

The AM100 module has been designed with line proving circuits to detect faults
in the field as well as being a fully autotested module in its own right.

The AM100 has local indications on the front panel to advise operators as to the
status of the field device, this includes a mA readout. An inhibit and reset switch
are provided on the front panel along with a calibration selection switch to allow
routine maintenance tasks to be completed.

Issue ** Jan 97 Page 124 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.10 AM100-C 1 Channel Combustible Gas Module

The AM100-C Single Channel Module has been specifically designed to be used
in Fire and Gas detection systems as an interface between 4-20mA source or
sink combustible gas detection devices and the CS300 system.

The unit is mounted in a specifically designed 3 U high 19 rack. The rack can
hold a maximum of 16 Gas modules and allows for quick replacement of a faulty
module..

The AM100-C module has been designed with line proving circuits to detect
faults in the field as well as being a fully autotested module in its own right.

The AM100-C has local indications on the front panel to advise operators as to
the status of the field device, this includes a 0-100% LEL readout. An inhibit and
reset switch are provided on the front panel along with a calibration selection
switch to allow routine maintenance tasks to be completed.

Issue ** Jan 97 Page 125 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.11 AM101 1 Channel Line Of Sight Gas Module

Issue ** Jan 97 Page 126 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.12 GT100 16 Slot Gas Module Rack

The GT100 rack can accommodate up to 16 Gas modules and provides all of the
necessary power, signal and autotest connection for the gas modules. All
connections are made via the backplane which also provides the interface
between the gas modules by use of standard DIN 41612 connectors.

Issue ** Jan 97 Page 127 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.13 TM118-DEC Fire & Gas Autotest Decoder Board

The TM118-DEC board has been specifically designed to receive the ribbon
cable signal used to drive the autotest outputs from the CS300 system and drive
the signals onto the Fire or Gas racks. The TM118-DEC is a rail mounted device.

Each Fire Rack or Gas rack will have one TM118-DEC associated with it.

Issue ** Jan 97 Page 128 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.7.14 TM118-FGAD Fire & Gas Autotest Distribution Board

The TM118-FGAD is a rail mounted board which has been specifically designed
to provide a convenient means of distributing the ribbon cable connection that is
required to drive the autotest on the fire and gas racks found in Fire & Gas
detection systems

The incoming signals on the ribbon cable are split and repeated on the board.

Issue ** Jan 97 Page 129 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8 Special Function Modules

5.8.1 TM118-TWD Triplicated Watchdog

Most CS300 Systems are fitted with an external watchdog module which is used
solely to monitor the health state of the three processor modules.

The watchdog module is fitted with three daughter boards each of which are
individually pulsed by a separate triplicated output from the CS300 System.

If any one of the three daughter boards fails to receive a pulse for a set period of
time the watchdog circuit times out and the associated relay on the motherboard
is de-energised.

The output from the relay is then used externally to generate an alarm condition
and if required initiate an executive action.

The triplicated watchdog module can be configured for either 3-2-1 or 3-2-0
operation. With the module configured to operate in the 3-2-0 mode a second
alarm will be generated in the event of either another processor (ICCB) failing or
a second watchdog circuit being allowed to time out.
On typical ESD Systems the second output (3-2-0) from the watchdog module is

Issue ** Jan 97 Page 130 of 230

 ABB August Ltd
CS300 Safety System Training Manual

connected in series with the power supply unit and any termination modules
providing power to normally energised ESD outputs.

Then if a system failure occurs and the watchdog circuits time out then any
normally energised ESD outputs will automatically be de-energised and released.

Issue ** Jan 97 Page 131 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.2 TM118-TWD/2 Triplicated Watchdog

Most CS300 Systems are fitted with an external watchdog module which is used
solely to monitor the health state of the three processor modules.

The watchdog module is fitted with three daughter boards each of which are
individually pulsed by a separate triplicated output from the CS300 System.

If any one of the three daughter boards fails to receive a pulse for a set period of
time the watchdog circuit times out and the associated relay on the motherboard
is de-energised.

The output from the relay is then used externally to generate an alarm condition
and if required initiate an executive action.

The triplicated watchdog module can be configured for either 3-2-1 or 3-2-0
operation. With the module configured to operate in the 3-2-0 mode a second
alarm will be generated in the event of either another processor (ICCB) failing or
a second watchdog circuit being allowed to time out.

Issue ** Jan 97 Page 132 of 230

 ABB August Ltd
CS300 Safety System Training Manual

On typical ESD Systems the second output (3-2-0) from the watchdog module is
connected in series with the power supply unit and any termination modules
providing power to normally energised ESD outputs.

Then if a system failure occurs and the watchdog circuits time out then any
normally energised ESD outputs will automatically be de-energised and released.

Issue ** Jan 97 Page 133 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.3 TM232 4 Port Serial Booster

The TM232 Booster Adapter has been specifically designed to interface between
the PI774 Serial I/O card and it associated TM117-SA termination panel.

The TM232 plugs onto the back of the TM117-SA board and boosts the serial
signals from the PI774 card up to higher voltage levels to comply with the EIA
RS-232 specifications.

The TM232 is powered by a dual redundant 24V supply which is then regulated
by an on board isolated DC-DC converter.

The increased voltage levels provided by the TM232 are capable of driving signal
modems.

Issue ** Jan 97 Page 134 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.4 TM117-DMX 64 Channel De-Multiplexed Display Driver

The TM117-DMX is a multi-channel display driver with the capacity of driving 64

display elements from a single communications interface. Its design incorporates
a dual-redundant configuration to ensure high availability. A total of up to 65 units
can be configured on a single multi-drop communications link.

The module is driven from the August Systems serial communications card using
a dumb protocol. The information sent from the SIO card contains a device
address and data containing the output conditions for that device. The message
is read by each of the modules on the multidrop loop but is accepted only by
those modules whose address is valid for that message. When a device
recognises its address, its communication watchdog circuit is updated.

The on-board watchdog circuit output remains set (normally closed loop) as long
as the module receives the correct address codes within a specified time window.
If no comms are received, the output of the watchdog circuit becomes tripped
with the on-board LED being lit and the fault relay de-energised.

Issue ** Jan 97 Page 135 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The circuit will be automatically reset (relay energised, LED extinguished) should
healthy communications be re-instated.

Open collector Darlington drivers are used to drive (sink LOW) low current
devices (eg LEDs) directly or higher current devices via external relays or other
external drivers. Each output driver is capable of sinking 40 mA.

Issue ** Jan 97 Page 136 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.5 FM118-FSM 16 Channel Fuse / Supply Monitor

The FM118-FSM is specifically designed for monitoring either fuses or supplies

to enable detection of loss of supply or fuse failure.

The FM118-FSM provides outputs in the form of volt free relay contacts to
annunciate alarm or failure conditions. An onboard LED provides a visual
indication of status and a current limited output is provided to drive a remote LED
indication.

There are a number of modules provided by August Systems to cater for different
voltage applications. The nominal voltage ranges provided for are :
110/120V AC
220/240V AC
24V DC
48V DC
110V DC

The mode of operation, fuse monitoring or supply monitoring, is determined by

user configurable switches and links. The alarm relay output from the module can

Issue ** Jan 97 Page 137 of 230

 ABB August Ltd
CS300 Safety System Training Manual

be configured as normally energised or normally de-energised by means of an on

board link.

Issue ** Jan 97 Page 138 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.6 FM-112 12 Channel Fuse Module

The FM-112 fuse alarm board provides 12 independently fused distribution

outputs from a single 24V DC input. The alarm facility from each of the fuses are
connected in parallel and on to a terminal which provides a junction point
allowing for the alarm output to be linked to further fuse alarm boards in order to
provide an alarm on a common services or diagnostic panel driven from the
CS300 process control system.

These modules are used to monitor the health of the fuses supplying power to
24V DC devices such as termination modules, fans, DMX drivers etc.

Issue ** Jan 97 Page 139 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.7 TM118-R3 Triplicated Relay Module

Issue ** Jan 97 Page 140 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.8 RM118-D Single Relay Module

The RM118-D Relay Module is a single rail mounted relay which can be used for
interposing purposes.

The relay has a 24VDC operated coil and four volt free change over contacts.

An indicating LED is mounted on the board to provide a visual indication of the

relay status.

Issue ** Jan 97 Page 141 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.9 DM118-AIM 1 Channel Analogue Input Display Module

Issue ** Jan 97 Page 142 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.10 DM118-DIM 1 Channel Digital Input Display Module

Issue ** Jan 97 Page 143 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.11 DM118-DOM 1 Channel Digital Output Display Module

Issue ** Jan 97 Page 144 of 230

 ABB August Ltd
CS300 Safety System Training Manual

5.8.12 DM118-ESD 1 Channel ESD Status Display Module

Issue ** Jan 97 Page 145 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6. TRIGARD Engineering Workstation

6.1 Introduction

The TRIGARD Engineering Workstation allows for either on or off-line software

configuration of the CS300 system from an IBM compatible PC. A serial port is
used to provide the communication link to the CS300 control computers, EPROM
programming unit and printer. A TRIGARD Engineering Workstation is usually
supplied with most CS300 systems for system diagnostics, re-configuration and
maintenance activities.

6.2 Hardware

The Engineering Workstation comprises the following hardware:

IBM compatible personal computer

MS-DOS Version 3.1 or higher
640k or more of RAM
Serial communications port

If used for creating new PCS systems (Ladder Software) then >640k of RAM and
at least a 10 Mbytes of hard disk are required.

6.3 Software

The TRIGARD workstation software is the interface to TRIGARD PCS, the

software resident is the CS300 which allows the CS300 to interpret and run the
ladder logic programs. TRIGARD PCS is part of the CS300 RTTS operating
system.

The workstation uses a graphical display of relay ladder logic and function blocks
similar to that of other programmable logic controllers. Ladder logics are used for
logical control applications and the functional blocks for sequential, analogue and
batch control operations.

The control ladder logic networks are developed from cause and effect charts.
Verification of the ladder logic against original cause and effect data can be
achieved by using software analysis tools such as SAPTU (Simulation
Application Programme Test Unit). SAPTU is particularly useful in many critical
applications where system testing to the highest integrity is required.

Issue ** Jan 97 Page 146 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The TRIGARD Engineering Workstation contains a group of 6 programs that run

under MS-DOS. The main program is a supervisory program from which the
other 5 programs run, namely VP125, COM125, MAKE123, ANN125 CONF125
and SIM125.

6.3.1 VP125

The VP125 (Video programmer) is used to create, edit and save control ladders.
The Video Programmer communicates with the PCS software in the control
computers (ICCBs). This communication link with the PCS enables on-line
editing and modifications of the control ladder networks to be carried out whilst
the system continues to operate and handle all executive control actions. The
ability to carry out on-line editing whilst running control ladder network speeds up
the debugging of control action logic.

6.3.2 COM125

The COM125 program is used for communicating between the workstation and
the RTTS operating system in the CS300 control computers. The loading of the
PCS software, setting of RTTS time and reading RTTS I/O reports are all
functions of the COM125 (PCS Communication) program.

6.3.3 ANN125

The ANN125 program is a document package that enables written descriptions

to be added to the print ladder listings. A written description of each network's
function can be included with a ladder as well as being able to assign discrete
elements and registers with identifying labels which appear every time the
devices are printed out. The printout can also include a cross reference listing of
all the devices used.

6.3.4 CONF125

The CONF125 (I/O Configurator) program is used to configure the PIM I/O tables
used in the PCS Software. Any changes in the number and types of I/O required
can easily be implemented to the on-site equipment should the need arise.

Issue ** Jan 97 Page 147 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.3.5 MAKE125
The MAKE125 (Make PCS Load Module) program facilitates the building of
customised PCS Software. The program also stores the special software routines
which are required so that other devices such as de-multiplexed drivers or
printers are able to be interfaced or controlled by the system.

6.3.6 SIM125
The SIM125 (TRIGARD offline simulator) program facilitates the running of
application ladder logic in an offline state to provide a de-bugging tool useful for
initial logic de-bugging and verification when generating application ladder logic
from scratch.

6.4 TRIGARD Ladder Logic

The TRIGARD ladder logic program uses a ladder organisation that is similar in
context to programmable controllers supplied by other companies such as
Modicon or Allen Bradley.

TRIGARD ladder logic programs implement all the traditional ladder logic
elements along with a number of special and flexible function blocks. When
running the VP125 program, the TRIGARD ladders are organised into networks
in a similar layout as with MODICON 584.

Each LADDER NETWORK is scanned or looked at in turn and each element of

each network is scanned in a set operational mode, top to bottom far left hand
column, top to bottom second column and so on.

The Ladder Logic Networks and the various elements used form the heart of
every TRIGARD system. Each Ladder network is a matrix layout consisting of 7
rungs and 8 columns, therefore a maximum of up to 56 elements can be used to
make up each network.

Some of the available TRIGARD elements include the following:

Coils, contacts and transitional elements for logical control

Timers, counters and stepper elements for stepper control
Boolean elements for performing logical operations
Special function blocks for I/O, analogue control, diagnostics,
communications and other expanded functionality.

Issue ** Jan 97 Page 148 of 230

 ABB August Ltd
CS300 Safety System Training Manual

TRIGARD ladders can be created and edited on or off-line by running the VP125
program on the engineer's workstation. Network operation and data can be
viewed and changed at the workstation whilst the PCS continues to run the
CS300 System.

The states of coils and contacts can be forced on or off and the contents of
registers can be changed to enable testing, debugging, or for the overriding of
outputs.

TRIGARD ladders manipulate an area of the control computers memory called

the TRIGARD MAP which contains both the discretes and registers resident in
the RAM of the CS300 System.

The TRIGARD MAP is linked to the physical control process through the PIM
where, by using the PIM I/O, the interaction between the MAP and the outside or
'physical world' can be controlled.

Some of the outstanding features of TRIGARD include:

Analogue control packages and floating point registers,

Multirate network processing for system load levelling,
Ladder annotation to label discretes, registers and networks for
documentation purposes,
View/Set scratch pad for viewing and changing the values of registers,
discretes and floating point registers,
Discrete force capabilities within the network enables logic control to be
overridden and invalid I/O values to be forced to enable a fail safe state or
condition to exist,
Capability to set initial values for registers to ensure that the system start-up
routine is initiated in a correct sequence,
Print functions which allow the formatted printing of user-defined messages
under network control.

Issue ** Jan 97 Page 149 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.5 TRIGARD Ladder Logic Element Reference

Introduction

This section contains a reference list of the TRIGARD elements including the
callable subroutines such as PMIO. The functionality of each element is described,
and further detailed explanation of the Analogue Control elements is available in
the TRIGARD Users Manual.

All of the elements contained in this section of the training manual are available
within the VP125 programme but some are not used anymore. These elements
were originally designed for use with the TRIDAC operator workstation package,
which is no longer supplied. The elements designated as TRIDAC specific are
identified as such in the text.

Symbols And Terminology

In the element descriptions that follow, "INPUT = 1" and "INPUT is set to ON"
means power is supplied to the line labelled "INPUT". Likewise, "OUTPUT is set to
OFF" is the same as "OUTPUT = 0" and means that power is not supplied to the
line labelled "OUTPUT". The terms ON and OFF, 1 and 0, and high and low are
used interchangeably throughout the TRIGARD literature to represent the binary or
Boolean states of 1 and 0.

In the element symbols the element parameters are represented as PXXXX,

PYYYY, and PZZZZ, or RXXXX, RYYYY, and RZZZZ.

A parameter that is preceded by a "P" can be either a constant that you key right
into the element or a register that holds the value to be used by the element. If you
want it to be a constant, simply key in the number (up to five digits). If you want it to
be a register address, key in "R" and then the address of the register.

Element parameters that are preceded by an "R" in the element definitions must be
register addresses. You must key in an R before a register address.

Discrete addresses are represented as XXXXX, YYYYY, ZZZZZ, and other

symbols that are not preceded by a "P" or an "R".

Issue ** Jan 97 Page 150 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The following element reference is divided into two categories:

The Basic TRIGARD Elements,

The TRIGARD Call Elements

6.6 The Basic TRIGARD Elements

The elements covered in this section of the reference are the elements that are all
available straight from the computer keyboard with one keystroke and as such form
the fundamental and most commonly used elements when writing a piece of
application ladder logic.

The elements that appear in this section are as follows.

Keystroke Element Page

1 Normally Open Contact 153
2 Normally Closed Contact 154
3 Output Coil 155
4 Horizontal Shunt 156
5 Vertical Shunt 157
U Up Transition 158
D Down Transition 161
+ Add 162
- Subtract 163
* Multiply 165
/ Divide 166
Q Binary Coded Decimal In 167
W Binary Coded Decimal 168
Out
T Move Register To 169
Register
9 Timer 171
7 Up Counter 173
8 Down Counter 175
6 Stepper Switch 176
R Register MID Value 177
E Dead Band 178
G Goto 179
A Register Left Shift 180
S Register Right Shift 181

Issue ** Jan 97 Page 151 of 230

 ABB August Ltd
CS300 Safety System Training Manual

B Boolean Blocks 182

Issue ** Jan 97 Page 152 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.1 Normally Open Contact

The [1] key

Symbol:

XXXXX

Definition:
input output

XXXXX

Where XXXXX is the discrete address of the element.

Description:

The open contact refers to a discrete in the TRIGARD Map to determine its
function. Only when power is present at the left side of the open contact and
discrete XXXXX equals 1 is power passed to the right side.

Discretes in the TRIGARD Map can serve as simple logical "flag" variables with no
correspondence to any physical connection to the real world, or through a PIM
table and a PMIO call, discretes can correspond directly to a digital input or output
on the system. The TRIGARD Map is described elsewhere in the training manual.

Logic:

IF input = 1 AND XXXXX = 1

THEN output = 1
ELSE output = 0

Issue ** Jan 97 Page 153 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.2 Normally Closed Contact

The [2] key

Symbol:

XXXXX

Definition:
input output

XXXXX

Where XXXXX is the discrete address of the contact.

Description:

Like the open contact, the closed contact refers to a discrete bit in the TRIGARD
Map to determine its function. When power is supplied to INPUT, power is passed
to OUTPUT only if discrete XXXXX is currently set to 0. The closed contact has the
opposite function of the open contact with respect to discrete XXXXX.

Discretes in the TRIGARD Map can serve as simple logical "flag" variables with no
correspondence to any physical connection to the real world, or through a PIM
table and a PMIO call, discretes can correspond directly to a digital input or output
on the system. The TRIGARD Map is described elsewhere in the training manual.

Logic:

IF input = 1 AND XXXXX = 0

THEN output = 1
ELSE output = 0

Issue ** Jan 97 Page 154 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.3 Coil

The [3] key

Symbol:

XXXXX

Definition:
input output

XXXXX

Where XXXXX is the discrete address of the coil.

Description:

Coils are used to set or clear discretes in the TRIGARD Map. If power is present at
the left side of a coil, power is passed to the right side and discrete XXXXX is set to
1.

If no power is present on the left side of the coil, the discrete is set to 0 and no
power is passed to the right side.

Discretes in the TRIGARD Map can serve as simple logical "flag" variables with no
correspondence to any physical connection to the real world, or through a PIM
table and a PMIO call, discretes can correspond directly to a digital input or output
on the system. The TRIGARD Map is described elsewhere in the training manual.

Logic:

IF input = 1
THEN XXXXX = 1 AND output = 1
ELSE XXXXX = 0 AND output = 0

Issue ** Jan 97 Page 155 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.4 Horizontal Shunt

The [4] key

Symbol:

Definition:
input output

Description:

The horizontal shunt transfers power from left to right from one element to another.
Power never flows from right to left. The drawing below illustrates this restriction on
power flow direction:

Power at B flows to A.

Power at A will not flow to B.

Logic:

output = input (flowing left to right only)

Issue ** Jan 97 Page 156 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.5 Vertical Shunt

The [5] key

Symbol:

Description:

The vertical shunt transfers power between two rungs of a network. Power flows in
either direction (from top to bottom or from bottom to top) depending on where it
originates. The following diagram shows one of many possible configurations of the
vertical shunt:

input 1 output 1

input 2 output 2

A vertical shunt can connect to an element, a horizontal shunt or another vertical

shunt. The left leg of every ladder network is made up of multiple vertical shunts.

Logic:

IF (input1 = 1 or input2 = 1)
THEN (output1 = 1 and output2 = 1)
ELSE (output1 = 0 and output2 = 0)

Issue ** Jan 97 Page 157 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.6 Up Transition

The [U] key

Symbol:

XXXXX

Definition:
input output

XXXXX

Where XXXXX is the discrete address of the element.

Description:

The up transition element provides one mechanism for comparing the current state
(1 or 0) of a discrete with its state during the previous scan. A discrete is said to
have made an "up transition" when its state has changed from 0 to 1.

Whenever INPUT is set ON, the element checks to see if discrete XXXXX has
made an up transition (gone from 0 to 1) since INPUT was last ON. If the discrete
has made an up transition, OUTPUT is set ON (power is passed to the right side).

Each time power is supplied to INPUT, the current state of discrete XXXXX is
stored for future reference.

The up transition element passes power to OUTPUT for just one scan each time
an up transition occurs on discrete XXXXX. The transition elements (including the
down transition element) may be used to count, print, or otherwise detect a state
change in a discrete.

For example, the following network will print the message at Register 2000 each
time discrete 01000 becomes one:

Issue ** Jan 97 Page 158 of 230

 ABB August Ltd
CS300 Safety System Training Manual

00000
PRNT
01000 R2000

Warning: Only one transitional element may be used with a particular discrete
in the TRIGARD Map. Each discrete maintains only enough
information to support one transitional element. If more than one
transitional element are referred to the same discrete, only the first
energised one occurring after the transition will "see" the transition
only.

In order to detect both an up transition and a down transition on the same discrete,
another temporary discrete can be used to store the state of the discrete of
interest. For example, the network shown below uses discrete 05000 to temporarily
store the state of discrete 01000. This network prints a message whenever either
an up or down transition occurs on discrete 01000.

00000

01000 PRNT

R2000

01000 05000

05000

When using up transition or down transition elements, remember that they record
an internal "previous state" of the discrete only when power is applied to the left
side of the element (INPUT is set ON). For example, if a transitional element is
powered only once every ten scans and the discrete alternates state
(ON/OFF/ON/OFF) during those ten scans, the transition will not be detected. The
state of the discrete is checked and saved for transition only when the transitional
element is powered.

For example, look at the following network which has the same function as the
network on the previous page.

Issue ** Jan 97 Page 159 of 230

 ABB August Ltd
CS300 Safety System Training Manual

00000

01000 PRNT

R2000

01000 05000 05000

In the above network, if the bottom horizontal shunt were missing, the down
transitional element looking at 05000 would only be powered when discrete 05000
is ON, so a transition would never be detected.

Logic:

If the state of discrete XXXXX during the current INPUT ON condition is

represented as XXXXX(now) and the state of discrete XXXXX during previous
INPUT ON condition is represented as XXXXX(previous), then the logical
representation of the up transition element is as follows:

IF input = 0 THEN output = 0

IF input = 1 AND XXXXX(now) = 1
AND XXXXX(previous) = 0
THEN output = 1
ELSE output = 0

Issue ** Jan 97 Page 160 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.7 Down Transition

The [D] key

Symbol:

XXXXX

Definition:
input output

XXXXX

Where XXXXX is the discrete address of the element.

Description:

The down transition element provides another mechanism for comparing the
current state (1 or 0) of a discrete with its state during the previous scan. A discrete
is said to have made an "down transition" when its state has changed from 1 to 0.

For further description of the transition elements, see the previous pages and the
description of the up transition element. The down transition element has the same
features and is subject to the same restrictions as the up transition element.

Logic:

If the state of discrete XXXXX during the current INPUT ON condition is

represented as XXXXX(now) and the state of discrete XXXXX during previous
INPUT ON condition is represented as XXXXX(previous), then the logical
representation of the down transition element is as follows:

IF input = 0 THEN output = 0

IF input = 1 AND XXXX(now) = 0
AND XXXXX(previous) = 1
THEN output = 1
ELSE output = 0

Issue ** Jan 97 Page 161 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.8 Add Element

The [+] key

Symbol:
PXXXX
+
PYYYY
=
RZZZZ

Definition:
input PXXXX valid
+
PYYYY overflow
=
RZZZZ

PXXXX and PYYYY are either values or 16 bit registers in the TRIGARD Map that
contain the values to be summed.
RZZZZ is the 16 bit register destination.

Description:

When power is applied to INPUT, this element adds the values in PXXXX and
PYYYY and stores the result in RZZZZ. Power is passed to VALID unless an
overflow condition is encountered. If the result is too large to fit in RZZZZ an
overflow condition is encountered in which case power is passed to OVERFLOW.

Logic:

IF input = 0 THEN output1 = output2 = 0 (no sum)

IF input = 1 THEN IF PXXXX + PYYYY does not overflow
THEN RZZZZ = PXXXX+PYYYY
AND output1 = 1 AND output2 = 0
ELSE output1 = 0 AND output2 = 1

Issue ** Jan 97 Page 162 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.9 Subtract Element

The [-] key

Symbol:
PXXXX
-
PYYYY
=
RZZZZ

Definition:
input PXXXX positve
-
PYYYY zero
=
RZZZZ negative

PXXXX and PYYYY are either values or 16 bit registers in the TRIGARD Map that
contain the values to be subtracted.
RZZZZ is the 16 bit register destination.

Description:

This element serves two purposes. First, it is a mechanism for subtracting PYYYY
from PXXXX, storing the result in RZZZZ. And second, it is a mechanism for
comparing the two 16 bit values PXXXX and PYYYY and for having the flow of
power depend upon the result of that comparison.

Issue ** Jan 97 Page 163 of 230

 ABB August Ltd
CS300 Safety System Training Manual

When power is supplied to INPUT, PYYYY is subtracted from PXXXX and the
result is stored in RZZZZ. Power is then passed to one of the outputs (POSITIVE,
ZERO, OR NEGATIVE) depending on the sign of RZZZZ. An Overflow condition
will turn off all outputs.

Logic:

IF input = 0 THEN all outputs = 0 (no subtraction)

IF input = 1 THEN RZZZZ = PXXXX-PYYYY
IF RZZZZ > 0 THEN positive = 1 (other outputs = 0)
IF RZZZZ = 0 THEN zero = 1 (other outputs = 0)
IF RZZZZ < 0 THEN negative = 1 (other outputs = 0
IF OVERFLOW THEN all outputs = 0
AND RZZZZ is not changed

Issue ** Jan 97 Page 164 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.10 Multiply Element

The [*] key

Symbol:
PXXXX
*
PYYYY
=
RZZZZ

Definition:
input PXXXX output
*
PYYYY
=
RZZZZ

PXXXX and PYYYY are either values or 16 bit registers in the TRIGARD Map that
contain the values to be multiplied.
RZZZZ is the first register of a two register pair for the result (RZZZZ+1 holds the
most significant bits).

Description:

When power is applied to INPUT, this element multiplies the values in PXXXX and
PYYYY and stores the result in RZZZZ and RZZZZ+1. Power is passed to
OUTPUT.

Logic:

IF input = 0 THEN output = 0 (no multiplication)

IF input = 1 THEN RZZZZ to RZZZZ+1 = PXXXX * PYYYY
AND output = 1

Issue ** Jan 97 Page 165 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.11 Divide Element

The [/] key

Symbol:
PXXXX
/
PYYYY
=
RZZZZ

Definition:
input PXXXX valid
/
PYYYY overflow
=
RZZZZ

PXXXX is either a 16 bit constant or a register where PXXXX and PXXXX+1 are
two 16 bit registers in the TRIGARD Map that are combined to hold one 32 bit
value (PXXXX is the least significant word and PXXXX+1 is the most significant
word).

PXXXX is divided by PYYYY which can be a value or a 16 bit register address.

RZZZZ stores the 16 bit result and RZZZZ+1 stores the 16 bit remainder of the
division.

Description:

When power is supplied to INPUT, the 32 bit value specified by PXXXX is divided
by the 16 bit value in PYYYY. The 16 bit result is stored in RZZZZ and the 16 bit
remainder is stored in RZZZZ+1. If no overflow is encountered, then power is
passed to VALID. If an overflow is encountered, power is passed to OVERFLOW
(400,000/1 overflows).

Logic:
IF input = 0 THEN all outputs = 0
IF input = 1 THEN RZZZZ = PXXXX/PYYYY
AND RZZZZ+1 = remainder
IF no overflow THEN output1 = 1 AND output2 = 0
AND RZZZZ and RZZZZ+1 are not changed
IF overflow THEN output2 = 1 AND output1 = 0

Issue ** Jan 97 Page 166 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.12 BCD In Element

The [Q] key

Symbol:
PXXXX
BCDI
RYYYY

Definition:
input PXXXX output
BCDI
RYYYY

PXXXX specifies a 16 bit value interpreted to be a four decade (4 bits each) BCD
value.

Description:

This element converts the 4 Binary Coded Decimal digits in PXXXX to a value from
0 to 9999 and stores this value in RYYYY. This is a useful function for interacting
with LED or LCD alphanumeric displays and other devices that output BCD values.
The discretes in register PXXXX can be defined to correspond with the digital
inputs that are connected to some device's BCD output.

Logic:

IF input = 0 THEN output = 0 (no conversion)

IF input = 1
THEN RYYYY = PXXXX MOD 16 +
((PXXXX DIV 16) MOD 16) * 10 +
((PXXXX DIV 256) MOD 16) * 100+
((PXXXX DIV 4096) MOD 16) * 1000

Issue ** Jan 97 Page 167 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.13 BCD Out Element

The [W] key

Symbol:
PXXXX
BCDO
RYYYY

Definition:
input PXXXX output
BCDO
RYYYY

PXXXX is either the address of a 16 bit register that holds a binary value (for
example R525) or it is a value in itself.
RYYYY is a 16 bit destination register.

Description:

This element converts the value specified by PXXXX to 4 Binary Coded Decimal
digits and stores these BCD digits in RYYYY. This is a useful function for
interacting with LED or LCD alphanumeric displays and other devices that input
BCD values. The discretes in register RYYYY can be defined to correspond with
digital outputs that are connected to some device's BCD input. PXXXX should be
between 0 and 9,999.

Logic:

IF input = 0 THEN output = 0 (no conversion)

IF input = 1 THEN
IF PXXXX > 9999
THEN output = 0 AND RYYYY = 9999H
ELSE output = 1 AND
RYYYY = PXXXX MOD 10 +
(PXXXX DIV 10) MOD 10) * 16 +
(PXXXX DIV 100) MOD 10) * 256 +
(PXXXX DIV 1000) MOD 10) * 4096

Issue ** Jan 97 Page 168 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.14 Move Register To Register

The [T] key

Symbol:
PXXXX
MOVE
PZZZZ
RYYYY

Definition:
input PXXXX output
MOVE
PZZZZ
RYYYY

PXXXX is the address of the array to be moved if it is keyed in as a register (for

example R3000), or the value to be moved if keyed in as XXXXX (with no
preceding "R").
PZZZZ is the number of registers to be moved.
RYYYY is the starting destination register address.

Description:

The MOVE element is used both for storing numbers in 16 bit registers and for
moving blocks of registers from one location to another in the TRIGARD Map.

When power is present at INPUT, the number or block of registers is moved. If this
is successful, OUTPUT is turned ON.

If PXXXX is specified as a number with no R preceding it to distinguish it as a

register address, then a copy of PXXXX is stored in every register starting with
register RYYYY and ending with register (RYYYY + PZZZZ - 1).

If PXXXX is a register address (a four digit number preceded with an R), then the
block of PZZZZ registers starting at register PXXXX is copied so that it starts at
RYYYY.
Logic:

Issue ** Jan 97 Page 169 of 230

 ABB August Ltd
CS300 Safety System Training Manual

IF R (YYYY + PZZZZ - 1) is beyond the end of the Map

THEN no operation occurs and output = 0.
ELSE IF PXXXX is a register
THEN RYYYY = PXXXX
RYYYY+1 = PXXXX+1
RYYYY+2 = PXXXX+2
and so on until
R(YYYY + PZZZZ - 1) = R(XXXX + PZZZZ - 1)
IF PXXXX is a value
THEN RYYYY+1 = PXXXX
RYYYY+2 = PXXXX
and so on until
R(YYYY + PZZZZ - 1) = PXXXX

Example

This move function will move a value of 1 into R1100

1 00001
each time the element is activated by the up transition
01000
associated with discrete 1000.
MOVE

00001
2
R1100

This move function will move the value contained in

3 R1200
R1200 to R1400, R1401, R1402, R1403 and R1404
02000
each time the element is activated by the up transition
MOVE
associated with discrete 2000.

00005
4
R1400

Issue ** Jan 97 Page 170 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.15 Timer Element

The [9] key

Symbol:
PXXXX
TYY
RZZZZ

Definition:
time PXXXX GE ref
TYY
clear RZZZZ LT ref

PXXXX is either a value or a register address that specifies the 16 bit reference
unit time in either seconds or tenths of seconds.
YY is the unit time (either 1.0 for seconds or 0.1 for tenths of seconds).
RZZZZ is a 16 bit register that holds the accumulated time.

Description:

The timer is used to pause for the length of time specified by PXXXX before setting
GE REF to ON. When both TIME and CLEAR are set ON, the timer accumulates
time in units of TYY (where YY is either 1 for seconds or .1 for tenths of seconds)
up to the reference time specified by PXXXX. When it reaches the reference time it
sets GE REF to ON and LT REF to OFF and it stops accumulating time. LT is
always set ON when GE is OFF.

Notice that time is accumulated only when both TIME and CLEAR are ON. When
CLEAR is set to OFF, the timer is reset (RZZZZ is set to zero).

Whenever an active timer is encountered, the amount of time taken by the last
scan is added to the accumulated time in RZZZZ. Since the time for a scan may
well be less than 0.1 second, the system accumulates its own time more
accurately. A timer may see several scans where no time is accumulated and then
a scan where one unit is added.

Issue ** Jan 97 Page 171 of 230

 ABB August Ltd
CS300 Safety System Training Manual

As long as the accumulated time is less than the reference time, LT REF is set ON
regardless of the states of TIME and CLEAR. When the accumulated time equals
or exceeds the reference time, LT REF is set OFF and GE REF is set high. When
TIME is OFF, the timer does not accumulate time for that scan.

Logic:

IF clear = 0 THEN RZZZZ = 0, GE = 0, LT ref = 1

IF time = 0 THEN time is not accumulated
IF RZZZZ >= PXXXX THEN GE ref = 1 AND LTref = 0

IF TIME = 1 AND CLEAR = 1 AND RZZZZ <= PXXXX

THEN accumulate time AND LT ref = 1

Warning:

Timers may not reliably accumulate time if the TIME input oscillates ON and OFF
and a rate that approaches the unit of time specified by TYY. Also, timers skipped
by GOTO's will only accumulate time for the scans when they are not skipped.
Timers present in multi-rate networks add only the time from the previous scan
and thus do not accurately accumulate time.

Example

When discrete 1000

1 10
is energised the latch
01000 05000 07000
formed by 5000 will
1.0 make and the timer
will start
2 R0800 accumulating. Upon
05000 07000 the timer reaching
maturity the coil 7000
will be energised
causing the latch to
3 drop out and the timer
to be reset to 0.

Issue ** Jan 97 Page 172 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.16 The Up Counter Element

The [7] key

Symbol:
PXXXX
CTU
RYYYY

Definition:
count PXXXX GE ref
CTU
clear RYYYY LT ref

PXXXX is the 16 bit reference count..

RYYYY is a 16 bit register that accumulates the count.
R(YYYY+1) holds the previous state of the input COUNT.

Description:

The counter starts at 0 and accumulates one count for each 0 to 1 transition of the
COUNT input. The counter counts up to the reference count, sets GE REF to 1,
and stops counting. The counter is reset by setting clear to 0.

The accumulated count is stored in register RYYYY. As long as the accumulated

count is less than the reference count, LT REf is set to 1 and GE REF is set to 0.
When the accumulated count in RYYYY reaches PXXXX, GE REF is set to 1.

When CLEAR is set to 0, the counter is reset (RYYYY = 0), GE REF is set to 0 and
LT REF is set to 1.

Issue ** Jan 97 Page 173 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Logic:

IF clear = 0
THEN RYYYY = 0 AND GE ref = 0 AND LT ref = 1
ELSE IF RYYYY >= PXXXX
THEN GEref = 1 AND LTref = 0
ELSE IF clear = 1 AND count = 1
AND R(YYYY+1) = 0
THEN RYYYY = RYYYY + 1
AND R(YYYY+1) = R(YYYY+1) .OR. -32768
IF count = 0 THEN R(YYYY+1) = 0

Issue ** Jan 97 Page 174 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.17 The Down Counter Element

The [8] key

Symbol:
PXXXX
CTD
RYYYY

Definition:
count PXXXX GE ref
CTD
clear RYYYY LT ref

PXXXX is the 16 bit reference count.

RYYYY is a 16 bit register that accumulates the count.
R(YYYY+1) holds the previous state of the input COUNT.

Description:

The counter starts at the reference count and counts down one count for each 0 to
1 transition of the COUNT input. The counter counts down to zero from the
reference count, sets EQ0 to 1, and stops counting. The counter is reset by setting
clear to 0.

The reference count is stored in register RYYYY. As long as the number in RYYYY
is greater than zero, GT0 is set to 1 and EQ0 is set to 0. When RYYYY reaches 0,
EQ0 is set to 1.

When CLEAR is set to 0, the counter is reset (RYYYY = PXXXX), EQ0 is set to 0
and GT0 is set to 1.

Logic:

IF clear = 0 THEN RYYYY = PXXXX AND EQ0 = 0

AND GT0 = 1
IF clear = 1 AND count = 1 AND R(YYYY+1) = 0
THEN RYYYY is decremented AND R(YYYY+1) = -1
IF RYYYY = 0 THEN EQ0 = 1 AND GT0 = 0
IF count = 0 THEN R(YYYY+1) = 0

Issue ** Jan 97 Page 175 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.18 The Stepper Switch Element

The [6] key

Symbol:
STEP
RXXXX

Definition:
input STEP output
RXXXX

RXXXX is a register that contains the address of the first discrete in the stepper
switch.
R(XXXX+1) contains two bytes of information pertaining to the stepper switch as
shown below:

Description:

The stepper switch acts on a set of sequential discretes which are conceptually
organised in a ring. The switch steps around the ring setting one discrete at a time.
When it moves forward one step, it sets the discrete it steps to and clears the
discrete it stepped from. No other discretes are affected.

Power at INPUT causes the stepper switch to move forward one step. The two
registers RXXXX and R(XXXX+1) should be allocated and initialised by the
STEPPERINIT data base described in the TRIGARD Users Manual. The first
discrete specified in the switch is set to 1 upon initialisation.
As long as power is present at INPUT, the stepper switch will step forward one
position per execution. If the discretes are numbered from 0 to N-1, the switch will
move sequentially from 0 up to N-1 then start over at 0. The maximum number of
N is 255.

If no power is present at INPUT, the switch is not active and no stepping takes
place.

Logic:
IF input = 0 THEN output = 0 (no stepping)
IF input = 1 THEN step the switch
IF nth step THEN step to discrete 0.

Issue ** Jan 97 Page 176 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.19 The MID Value Element

The [R] key

Symbol:
PWWWW
PXXXX
PYYYY
MID
RZZZZ

Definition:
input PWWWW output
PXXXX
PYYYY
MID
RZZZZ

Description:

Whenever power is applied to INPUT, it is passed to OUTPUT and this element

inspects the three values designated by PWWWW, PXXXX, and PYYYY and
stores the mid-value of the three in register RZZZZ. After execution, RZZZZ will
always contain one of the values designated by either PWWWW, PXXXX, or
PYYYY.

Logic:

IF input = 1
THEN RZZZZ = middle value of (PWWWW, PXXXX, or PYYYY)

output = input

Issue ** Jan 97 Page 177 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.20 The Dead Band Element

The [E] key

Symbol:
PXXXX
>=
PYYYY
>=
PZZZZ

Definition:
input PXXXX high
>=
PYYYY in band
>=
PZZZZ low

Description:

The dead band element determines if the value (constant or register) designated
by PYYYY is between (or equal to) the values designated by PXXXX and PZZZZ
and it sets the output accordingly. When power is supplied to INPUT, if PYYYY is
greater than PXXXX, HIGH is set on (the other outputs are off), if PYYYY is less
than PZZZZ, LOW is set ON and if neither HIGH nor LOW is ON, IN BAND is set
ON as long as power is supplied to INPUT. When INPUT is OFF, all outputs are
OFF.

Logic:

IF input = 0 THEN high, in band, and low = 0

IF input = 1
THEN IF PYYYY > PXXXX
THEN high = 1 AND in band = 0 AND low = 0
ELSE IF PYYYY < PZZZZ
THEN low = 1 AND high = 0 AND in band =0
ELSE in band = 1 AND low = 0 AND high = 0

Issue ** Jan 97 Page 178 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.21 The GOTO Element

The G key

Symbol:
GOTO
PXXXX

Definition:
input GOTO output
PXXXX

PXXXX is the label number of the destination network.

Description:

GOTO allows the user to jump to any labelled network in a TRIGARD ladder.
GOTO is executed when power is supplied to INPUT during a scan.

If PXXXX is a register, the contents of the register specify the label number. If
PXXXX specifies a 0, the rest of the current network is skipped and TRIGARD will
jump to and begin processing the next network in the logic..

All elements between an executing GOTO in a network and its jump destination
are skipped for that scan. Timers do not accumulate time, transition elements do
not check their reference discretes, coils to not change state, etc.

Warning: A GOTO used to jump to a previous network may cause the system to
hang in an endless loop. It is best to avoid backwards jumps in a
TRIGARD ladder.

Logic:

IF input = 0 THEN no action AND output = 0

IF input = 1 THEN jump to network specified by PXXXX
IF input = 1 AND network label PXXXX does not exist
THEN output = 1

Issue ** Jan 97 Page 179 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.22 The Left Shift Element

The [A] key

Symbol:
PXXXX
LSHF
RYYYY

Definition:
input PXXXX output
LSHF
RYYYY

PXXXX specifies the number of bit positions that the 16-bit value in the RYYYY
register is shifted left.

Description:

This routine shifts a 16-bit value in the RYYYY register PXXXX positions to the left.
Bits are shifted out of the register on the left with 0's filling in on the right (least
significant bit).

Logic:

IF input = 0 THEN output = 0 (no operation)

IF input = 1 THEN output = 1 AND the value in RYYYY is
shifted left PXXXX positions.

Issue ** Jan 97 Page 180 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.23 The Right Shift Element

The [S] key

Symbol:
PXXXX
RSHF
RYYYY

Definition:
input PXXXX output
RSHF
RYYYY

Where PXXXX specifies the number of bit positions that the 16-bit value in the
RYYYY register is shifted right.

Description:

This element shifts a 16-bit value in the RYYYY register PXXXX positions to the
right. Bits are shifted out of the register on the right with 0's filling in on the left
(most significant bit).

Logic:

IF input = 0 THEN output = 0 (no operation)

IF input = 1 THEN output = 1 AND the value in RYYYY is
shifted right PXXXX positions.

Issue ** Jan 97 Page 181 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.6.24 The Boolean Elements

The [B] Key

Pressing the [B] key in the network editor brings up a menu of six Boolean
elements. These elements are virtually self-explanatory and are documented here
as a group. This explanation assumes you have a full working knowledge of the
basic Boolean operations.

The six available Boolean elements in TRIGARD are the AND_GATE, OR_GATE,
NAND_GATE, NOR_GATE, XOR_GATE (Exclusive OR), and NOT_GATE. As you
would expect, all of the Boolean elements have one output and depending on their
function they can have one, two, or up to six inputs. (NOT has one input. XOR has
two inputs. The other four can have from two to six inputs). When you select any of
the elements AND_GATE, OR_GATE, NAND_GATE, or NOR_GATE from the
menu, you will be prompted for a number of inputs:

NOT XOR AND

(OR)
(NAND)
(NOR)

The inputs are combined according to the chosen Boolean operation (for example,
input1 OR input2 OR input3) and the output is the Boolean result.

The NOT element is handy for use as a "portable power source" in a network. It
can be placed anywhere in the 8 x 7 field and as long as no power is supplied to its
input, it will supply power to its output.

Issue ** Jan 97 Page 182 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7 The TRIGARD Call Elements

The elements covered in this section of the reference are all functions or sub-
routines that are accessed through the TRIGARD Call Element which provides
access to a menu from which all of the call functions can be selected.

The functions that appear in this section are as follows:

Name Function Page

CALL To access the callable sub-routines 184
ACAL Analogue Output Calibration Assistance 185
DFLT Digital Filter 187
DIAG TRIDAC Diagnostic Report 188
DIPT Digital Input Discrepancy Monitor 189
DUMP Print History Collected By HIST 191
ERCL Clear RTTS and PIMSS Error Tables 193
FALT Get RTTS Status 194
GDIA TRIDAC PIM I/O Diagnostics 195
HIST Collect Registers & Discretes Historically 196
INIT Data Initialisation 199
INPM Cold Initialise PIMSS 200
LED Set ICCB Auxiliary LEDs to Pattern 201
LLDO TRIDAC Digital Output Processing 203
MDBS Perform MODBUS I/O 204
NOFM N out of M group 206
PAUS Timed Ladder Execution Suspension 207
PERR Print Error Report 209
PMIO RTTS PIM I/O Call 210
PRNT Send Formatted Output to Printer 211
RECV Receive Peer to Peer Communications 213
RMET RME Dual Output Discrepancy Monitor 214
SEND Send Peer to Peer Communications 216
SQRT Integer Square Root Function 217
SYNC RTTS Synchronisation Call 218
TDAC TRIDAC Processing 220
THLD Threshold Check on Registers 221
TINI TRIDAC Initialisation 228
USR* User Definable Functions 229
WARM ICCB Warmstart Request 230

Issue ** Jan 97 Page 183 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.1 The TRIGARD Call Function Element

The [C] Key

Symbol:
PXXXX
NAME
PYYYY

Definition:
input PXXXX succeed
NAME
PYYYY fail

Description:

This element calls a subroutine or task. PXXXX and PYYYY are arguments passed
to the subroutine or task. When INPUT is set to 1, the subroutine called, executed
and, depending on the outcome of the subroutine, power is passed to either the
SUCCEED or ERROR outputs.

After pressing the [C] key to bring up the CALL element, the name of the desired
subroutine must be selected from the menu.

Logic:

IF input = 0 THEN succeed = 0 AND fail = 0

IF input = 1
THEN call routine (NAME)
IF routine returns zero
THEN succeed = 1 AND fail = 0
ELSE succeed = 0 AND fail = 1

Issue ** Jan 97 Page 184 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.2 ACAL (Analogue Output Calibration Assistance)

Key: [C] (call menu)

Symbol:
PXXXX
ACAL
PYYYY

Definition:
input PXXXX succeed
ACAL
PYYYY fail

Where PXXXX specifies a register (the element fails if it does not).

PYYYY, if a constant, specifies the first of the 4 output registers. If PYYYY
specifies a register, the register contains the register number of the first of the 4
output registers (PYYYY specifies indirection).

Description:

The ACAL subroutine treats each of the three control processors independently. It
provides a means of moving 3 different values into the same register in the
TRIGARD Map.

Processor 1 gets the first value, processor 2 gets the 2nd value and processor 3
gets the 3rd value. The outputs is in four sequential registers, all of which are
assigned the same value according to the processor number. In this way, 3
different values can be sent to the analogue output board to ensure that the voter
circuitry (mid-value selection) is operating correctly, and each channel and port can
be tested individually.

Issue ** Jan 97 Page 185 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Caution:
ACAL is essentially the reverse of the RTTS voting operation: It
creates a data disagreement between processors. Use of any of the
resulting register in a decision or a calculation leading to a decision
could send the processors in different execution paths and result in a
complete system crash. Attempting to output any of the registers
through SIO (via MDBS, SEND/RECV or viewing through VP125) will
result in erroneous data transmission if the values differ.

EXAMPLE:

Initial conditions:

R200 = 1000 R400 = 1024 R401 = 2048 R402 = 3072

Calling form:

R0400
ACAL
R0200

Results:

Register Processor
ONE TWO THREE

1000 1024 2048 3072

1001 1024 2048 3072
1002 1024 2048 3072
1003 1024 2048 3072

Issue ** Jan 97 Page 186 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.3 DFLT (Digital Filter)

Key: [C] (call menu)

Symbol:
PXXXX
DFLT
PYYYY

Definition:
filtered output
input PXXXX
high
DFLT
filtered output
PYYYY
low

Where: PXXXX is the pointer to a two register list - the first containing the value for
the low-to-high filter time constant; the second, the high-to-low filter time constant.
The time is entered in centiseconds.

PYYYY is the identifier for this block - an integer in the range 0 - 1999. This must
be a unique identifier for each filter element. The parameter may be provided as a
constant within the element, or as a register argument.

Input is the input from any ladder network element but would normally be an input
contact on which the element would provide the filter eg. contact debounce on a
field input.

Description:

Once the input has transitioned low, or high, for the filter time constant, the output
power flow will be from the relevant element exit ie. for a high input the exit will be
through filtered output high, a low input will cause filtered output low to be active.

Issue ** Jan 97 Page 187 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.4 DIAG (TRIDAC diagnostic report)

Key: [C] (call menu)

This element is specific to TRIDAC systems only and is

documented in the TRIDAC User's manual.

Issue ** Jan 97 Page 188 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.5 DIPT (Digital Input Discrepancy Monitor)

Key: [C] (call menu)

Symbol:
PXXXX
DIPT
PYYYY

Definition:
exit with
input PXXXX
no alarms
DIPT
exit with new
PYYYY
alarms found

Where: PXXXX is the function to be performed, this is normally a register

where the function code is placed
PYYYY is the first register of a register group containing the parameters required
for the DIPT call to function

Description:

This function monitors the state of digital inputs which are scanned via dual
termination panels. Each field input is brought into the system via two termination
modules. Every test cycle - usually one per hour but configurable in the ladder logic
- the system tests the states of the inputs, as read by each of the input termination
banks, separately. The results of the two scans are then compared for any
discrepancies. Additionally, the test will confirm that, with both of the input
termination module banks isolated, the inputs are seen to be off.

Test functions vary according to the type of input arrangement:

With the single input card the test function is called multiple times during the
test scan (after each PIMIO call associated with the monitored inputs).

With the dual input cards the test function needs to be called only once since
the scanned results are put into two separate areas of the database.

Issue ** Jan 97 Page 189 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Any discrepancy messages can be printed out in the following format, by called the
print function:

Time and Date INPUT_TAGNAME INPUT_FAULT TAG_DESCRIPTION

The parameters required for this function are:

1 Function to be performed

1 = Block move for single input card

2 = Block compare for single input card
3 = Isolate test for single input card
4 = Reserved
5 = Reserved
6 = Reserved
7 = Discrepancy monitor for dual input cards
8 = Isolate test for dual input cards
9 = Reserved
10 = Reserved
11 = Reset fault array
12 onwards = Invalid

2. First register of a list of register containing:

PYYYY Starting discrete for bank A

PYYYY+1 Number of discretes in the block
PYYYY+2 Starting discrete for bank B
PYYYY+3 Start of the fault array
PYYYY+4 Specifies the message index offset

The DIPT module is capable of operating in two different modes to suit ESD or
control actions. In the ESD mode the DIPT call performs an AND function on the
two discrete inputs. In the control mode the DIPT call performs an OR function on
the two discrete inputs. These different modes or operation are defined in the
TRIGARD build software and are not configurable on line.

Issue ** Jan 97 Page 190 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.6 DUMP (Dump History)

Key: [C] (call menu)

Symbol:
PXXXX
DUMP
PYYYY

Definition:
input PXXXX succeed
DUMP
PYYYY fail

Where PXXXX is the number of the history to be printed and PYYYY is the first
register of a print message.

Description:

The DUMP element works in conjunction with the HIST element. It is the means by
which a history queue is output to a serial channel (printer). The output produced
by executing a dump consists of a header, which is a string of the type used by the
print element (PRNT), followed by a table of the history of entries. There is one line
per entry which consists of:

Time in hours, minutes, seconds, and hundredths.

Registers. A list of three digit values, separated by a blank, which have
been scaled into a special range. The value printed is: (input - 819) /
(4096 - 819) * 1000. If the result is less than zero, the output is three
asterisks (***). If the result is greater than 999, the output is 999. The
result here corresponds to ten times the percent of full scale for an
analogue input value in the 1-5 volt range or 4-20ma.
Discretes. A list of discretes represented by an underscore (_) or
asterisk (*), depending on whether the bit is off or on, respectively.

Dump will return fail if a print of this history is already in progress or if space is not
available in the output queue. Execution of the ladder is not delayed for the print
operation. Also see the PRNT and HIST elements.

Issue ** Jan 97 Page 191 of 230

 ABB August Ltd
CS300 Safety System Training Manual

This history function must be enabled in the PCS software configuration for DUMP
and HIST to work.

Refer to Chapter 7 of the TRIGARD Users Manual for further information.

Issue ** Jan 97 Page 192 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.7 ERCL (Clear RTTS and PIMSS error tables)

Key: [C] (call menu)

Symbol:
PXXXX
ERCL
PYYYY

Definition:
input PXXXX succeed
ERCL
PYYYY

Description:

ERCL clears all entries in the system error table and the PIM error table. ERCL
requires no parameters and it always succeeds.

Issue ** Jan 97 Page 193 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.8 FALT (Get RTTS status)

Key: [C] (call menu)

Symbol:
PXXXX
FALT
PYYYY

Definition:
input PXXXX succeed
FALT
PYYYY fail

Description:

FALT is used to determine if system or I/O errors are present. The first parameter
is used as a mask to determine which error types will return FAIL. Use 255 to
detect all errors. If the second parameter is a register, FALT will return the
unmasked results of the call to FALT in that register.

FALT uses the RTTS "system alert" call to enquire about PCS hardware and
software status. The information is returned as a 16 bit integer bit mask:

bit 0 (lsb) - Entry in system error table

bit 1 - PIM data errors
bit 2 - PIM LFD
bit 3 - PIM monitor errors
bit 4 - PIM initialisation errors
bit 5 - CCM 1 out of synchronisation
bit 6 - CCM 2 out of synchronisation
bit 7 - CCM 3 out of synchronisation

If all bits set in PXXXX are clear in the status word, FALT succeeds. If any status
bit is set, FALT fails.

Issue ** Jan 97 Page 194 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.9 GDIA (PIM I/O diagnostics)

Key: [C] (call menu)

This element is specific to TRIDAC systems only and is

documented in the TRIDAC User's manual.

Issue ** Jan 97 Page 195 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.10 HIST (Collect registers and discretes historically)

Key: [C] (call menu)

Symbol:
PXXXX
HIST
PYYYY

Definition:
input PXXXX succeed
HIST
PYYYY fail

Where PXXXX is the history queue number as pre-defined. PYYYY is the first
register of the argument list.

Description:

The HIST element allows a TRIGARD network to maintain a running history of

certain analogue and digital values from the TRIGARD Map. By activating the
history element (HIST), the state of these values is recorded in a FIFO queue
along with the time of day. Each HIST queue is of finite length. When the queue
becomes full, the oldest entries are overwritten, leaving the queue with the last n
entries, where n is the length of the queue.

There may be up to 10 history queues. Each of the queues has a pre-defined set
of attributes which remain fixed for the execution of the ladder. The attributes are:

1. History Number. This is the identification by which one queue is

distinguished from another (0-9).

2. Number of Registers to queue. This is the number of registers from the

TRIGARD Map that have their values placed in the queue at each HIST
invocation.

3. Number of Discrete Bits to queue. This is the number of discrete values

from the Map that are placed in the queue at each HIST invocation.

Issue ** Jan 97 Page 196 of 230

 ABB August Ltd
CS300 Safety System Training Manual

4. Length of the Queue. This determines how many entries the queue
holds or how many entries can be stored before one is overwritten.

The history queues are configured through the SYSCON file at the time the
TRIGARD PCS software is created.

Entries into a history queue are made by executing a HIST element. Each
execution of a HIST causes an entry to be written into a queue for all registers and
discretes contained in the associated arguments list. Written with the entry is the
time of day, in hundredths of a second. The HIST element determines which
registers and which discrete values to put in the queue from the queue number
(PXXXX) and the argument list (starting at PYYYY). When the HIST element is
activated, if the action is completed successfully, "succeed" is set ON. If not, FAIL
is set ON.

HIST fails if any of the following conditions exist:

The history function is not configured.

PYYYY is not a register.

PXXXX is not between 0 and the number of histories, inclusive.

A print item started by the DUMP function is busy printing history PXXXX.

PYYYY points to a list of entries that determine which registers and discretes are
saved. This list should be at least as long as the number of entries configured for
saving. The list first contains the register numbers to be saved.

Argument List:

PYYYY Register containing the register address for the 1st Analogue Value
to queue.
PYYYY+1 Register containing the register address for the 2nd Analogue Value
to queue.
PYYYY+2 Register containing the register address for the 3rd Analogue Value
to queue.


PYYYY+N-1 Register containing the register address for the Nth Analogue Value
to queue.

Issue ** Jan 97 Page 197 of 230

 ABB August Ltd
CS300 Safety System Training Manual

PYYYY+N Register containing the discrete address for the first discrete to
queue.
PYYYY+N+1 Register containing the discrete address for the second discrete to
queue.


PYYYY+N
+M-1 Register containing the discrete address for the Month discrete to queue.

Execution of the HIST element adds approximately 1 millisecond plus 4

microseconds per argument list entry to the scan cycle time.

The history collected by the HIST element can be printed using the DUMP
element. Note that both the HIST and DUMP elements can be activated by logic to
determine when history data collection and printing will occur.

Issue ** Jan 97 Page 198 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.11 INIT (peer to peer initialisation)

Key: [C] (call menu)

Symbol:
PXXXX
INIT
PYYYY

Definition:
activate PXXXX succeed
INIT
PYYYY fail

INIT is a used to initialise TRIGARD Peer-to-Peer I/O. One uses the INIT call
element to tell the PCS what node number it is and what external nodes are
attached to its TRIGARD Peer-to-Peer Protocol Ports.

PXXXX is the first register of a register list detailing what nodes to communicate
with and what communications functions are allowed.

Issue ** Jan 97 Page 199 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.12 INPM (Cold Initialise PIMSS)

Key: [C] (call menu)

Symbol:
PXXXX
INPM
PYYYY

Definition:
activate PXXXX succeed
INPM
PYYYY fail

Description:

INPM is a routine that performs an initialisation of the Process Interface Module.

This RTTS function is automatically performed each time the system is started.
Normally ladders would never execute this element. INPM requires no parameters.

INPM succeeds if there are no PIM initialisation errors. If any required cards are
missing, or there is an error in the PIMSS configuration, INPM fails.

INPM is a subroutine that performs an initialisation of the Process Interface

Module. This function is automatically performed each time the system is started,
so ladders would normally never call this element.

Issue ** Jan 97 Page 200 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.13 LED (Set ICCB auxiliary LED's to pattern)

Key: [C] (call menu)

Symbol:
PXXXX
LED
PYYYY

Definition:
activate PXXXX succeed
LED
PYYYY

PXXXX is a value or specifies a register and PYYYY is ignored.

Description:

When LED is activated, the least significant 3 bits of PXXXX define the new
pattern on the ICCB auxiliary light emitting diodes. If PXXXX is a register, the least
significant 3 bits of the register are used. The value is bit-mapped to the 3 auxiliary
light emitting diodes. PYYYY is ignored. This call is quietly ignored on a CS306.
The element always succeeds.

The standard RTTS definitions for the light emitting diodes are as follows:

Aux 1: indicates the SIO task is active.

Aux 2: indicates PIMSS hot repair task is active.
Aux 3: indicates PIMSS I/O is in progress.

The "LED call definition" of the Aux LED's remains only until the next time the
LED's are updated, either by the "LED" call or by one of the above RTTS
operations.

To make a displayed pattern more apparent, it may be helpful to follow the LED
call with a PAUS element.

Issue ** Jan 97 Page 201 of 230

 ABB August Ltd
CS300 Safety System Training Manual

LED does NOT synchronise processors. The operation is local to each processor.
The three least significant bits in PXXXX form a parameter that can take on any of
the values 0 through 7. This three bit value maps to the LED's as follows:

Parameter Resulting LED Display

Value AUX 1 AUX 2 AUX 3
0 off off off
1 off off ON
2 off ON off
3 off ON ON
4 ON off off
5 ON off ON
6 ON ON off
7 ON ON ON

Issue ** Jan 97 Page 202 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.14 LLDO (TRIDAC digital output processing)

Key: [C] (call menu)

This element is specific to TRIDAC systems only and is

documented in the TRIDAC User's manual.

Issue ** Jan 97 Page 203 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.15 MDBS (Perform MODBUS I/O)

Key: [C] (call menu)

Symbol:
PXXXX
MDBS
PYYYY

Definition:
activate PXXXX succeed
MDBS
PYYYY fail

PXXXX is the function code for read/write access.

PYYYY is the destination register for MODBUS port status.

Description:

MDBS causes any current pending MODBUS messages to be processed and

schedules the originating MODBUS masters for acknowledgement. Every time the
MDBS element is executed the CS300 will accept and process one message from
each port configured for MODBUS communications (maximum of 16 ports). If any
new messages are received and successfully processed, then the upper power bar
of the element is energised. Otherwise the lower power bar will be energised.

PXXXX controls whether the MASTER is permitted to write to the discretes and/or
registers in the SLAVE. The CS300 can only be configured as a SLAVE. The
MASTER is always allowed to read the registers and discretes.

PXXXX Function

0 master can not write registers nor discretes

1 master can write discretes
2 master can write registers
3 master can write registers and discretes

PYYYY can be a register destination that returns the active or inactive status of the
MODBUS ports on the system. The lowest bit in the register corresponds to port 1,

Issue ** Jan 97 Page 204 of 230

 ABB August Ltd
CS300 Safety System Training Manual

bit 2 to port 2 etc. These bits can be used to monitor the health of the MODBUS
communications.

Issue ** Jan 97 Page 205 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.16 NOFM (N out of M alarm)

Key: [C] (call menu)

Symbol:
PXXXX
NOFM
PYYYY

Definition:
activate PXXXX no alarm
NOFM
PYYYY alarm

Description:

NOFM is used to determine if the requested NOFM block is in an alarm state. The
block is deemed to be in the alarm state if at least N of the block's inputs are in the
true state. The block is configured at the system build time to have M inputs to it
and up to four alarm output states from it. Each of these alarm states can be
independently accepted.

The configuration file is pre-processed to provide the data for the NOFM
processing. In a running system the M value itself may not be changed but the
values of the M input states may be set/reset in ladder logic.

The input parameters are:

PXXXX the N value required

PYYYY the block number (this is taken from the configuration file).

Issue ** Jan 97 Page 206 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.17 PAUS (Timed ladder executing suspension).

Key: [C] (call menu)

Symbol:
PXXXX
PAUS
PYYYY

Definition:
activate PXXXX succeed
PAUS
PYYYY fail

Description:

When activated, PAUS suspends ladder execution for the time specified by
PXXXX. PYYYY is ignored. If PXXXX is a register, the contents of the register are
used. The element always succeeds.

The time parameter is interpreted as the delay in RTTS real time clock (RTC) ticks.
The RTC frequency is set in the system software configuration structure.

A delay of 0 requests no pause. A delay of 1 will delay execution until the next
clock tick. For example, with a system configured for a two centisecond RTC
frequency, a delay of 5 would result in an execution delay of (at least) between 8 to
10 centiseconds. The uncertainty is attributable to the unknown amount of time
passed between the last RTC tick and calling PAUS as shown below:

PXXXX = 2 centiseconds (confiured in system build software)

Time (seconds) 0.00 0.02 0.04 0.06 0.08 0.10

Time (RTC ticks)

PAUS Ladder
called execution resumes

Issue ** Jan 97 Page 207 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The ladder task (a task in RTTS that carries out ladder execution), although
suspended, still has control of the TRIGARD Map during PAUS through a
database lock. Thus, other tasks desiring to update the database (eg. VP125
network modify) cannot do so until the end-of-scan processing is complete (or, for
low-priority-SIO specified in the system configuration, until the network achieves
the SCAN rate specified). For a description of task scheduling, refer to section
2.3.1 of the RTTS reference manual (BASIC part number 008-3120-xx).

Issue ** Jan 97 Page 208 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.18 PERR (Print Errors)

Key: [C] (call menu).

Symbol:
PXXXX
PERR
PYYYY

Definition:
activate PXXXX succeed
PERR
PYYYY fail

Description:

When PERR is activated, a message is generated for the serial channel (printer)
which shows the state of the PIM slot-by-slot and the system error table. This
element fails if a PERR is currently in progress or no space is available in the
output queue.

The output is equivalent to executing the PIMSS "configuration" command followed

by the "history" command at the RTTS System Monitor/Surgeon.

Issue ** Jan 97 Page 209 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.19 PMIO (Perform Process I/O)

Key: [C] (call menu)

Symbol:
PXXXX
PMIO
PYYYY

Definition:
activate PXXXX succeed
PMIO
PYYYY fail

Description:

The PMIO routine executes the Process Interface Module (PIM) Input/Output
RTTS system call. This software call updates all input and output values int he PIM
table specified by the PXXXX parameter of the element. At least one PMIO
subroutine call should be in a ladder or no I/O will be performed to and from the
TRIGARD Map. PXXXX specifies the PIM Execution Table that determines the
specific I/O to perform for this PMIO call. PIM Execution Tables are discussed
more in Chapter 7.

PYYYY returns a status code from the I/O operation. Refer to the RTTS manual
(section 3.11.8).

Issue ** Jan 97 Page 210 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.20 PRNT (Print Message)

Key: [C] (call menu)

Symbol:
PXXXX
PRNT
PYYYY

Definition:
activate PXXXX succeed
PRNT
PYYYY fail

PXXXX is the mode of print and PYYYY is the argument pointer.

Description:

There are three modes of message printing for which PRNT may be used. They
are: single message, multiple message, and special time + two message. The
mode is determined by the entry for PXXXX. If the PXXXX entry is a constant zero,
the mode is single message. If PXXXX is a non-zero constant, then the mode is
multiple message. How PXXXX and RYYYY are interpreted is a function of mode
(hence PXXXX) as follows:

1. Single Message. If PXXXX is a constant zero, then RYYYY is the first register
of an ASCII message to be printed. The form of printable ASCII messages is
described below.

2. Multiple Message. If PXXXX is a non-zero constant, then RYYYY is the first

register of a list of one or more registers, each of which contains a pointer
(register number) to an ASCII message to print. The number of pointers (and
thus the message) in the list is the value of PXXXX. The multiple messages, if
more than one, will be concatenated to form a single string to be printed.

3. Special Time + 2 Message. If PXXXX is a register, then the message to be

printed will have five parts which are concatenated in the following order:

Issue ** Jan 97 Page 211 of 230

 ABB August Ltd
CS300 Safety System Training Manual

The time of day (same form as code 91 below).

A blank.
ASCII message at PXXXX.
ASCII message at PYYYY.
Carriage return, line feed.

ASCII messages are located in the register portion of the TRIGARD Map. Each is
a series of bytes starting at some register and continuing through increasing
registers, 2 per register, until an end of message byte. The meaning of the bytes
are as follows:

Byte Value (HEX) Meaning

0-7FH Normal ASCII characters including control characters.

80H End of message.
81-88H 1 to 8 blanks as well as ending message.
90H Carriage return, line feed as well as end of message.
91H Time of day on the 24-hour clock to hundredths of a second at
the time the message is encountered by a PRNT or other print
element. The format of the 11 characters put into the message
are "hh:mm:ss.cc".
92H The date at the time the message is encountered by a PRNT
or other print element. The format of the 8 characters are
mm/dd/yy.

Issue ** Jan 97 Page 212 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.21 RECV (peer-to-peer I/O receive)

Key: [C] (call menu)

Symbol:
PXXXX
RECV
PYYYY

Definition
response to most recent message
activate PXXXX
received
RECV
PYYYY response not received yet

The SEND and RECV elements are used within VP125 to process the TRIGARD
peer to peer communications between CS300 systems or operator workstations.
This element operates in conjunction with the SEND element.

PXXXX is the same register as specified in the associated SEND element. When a
SEND has been actioned the RECV will then look for the correct response
message which is returned as part of the TRIGARD peer to peer protocol.

PYYYY is a time out period in centiseconds for which the RECV will wait for the
response message

Issue ** Jan 97 Page 213 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.22 RMET (RME/SME dual output discrepancy monitor)

Key: [C] (call menu)

Symbol:
PXXXX
RMET
PYYYY

Definition:
activate PXXXX exit with no errors
RMET
PYYYY exit with errors found

Where: PXXXX is the first register of the list

PYYYY is the function to be performed.

Description:

RME termination modules are arranged in pairs - bank A and bank B - each pair
controlling a group of digital outputs.

Testing is implemented as a function called from ladder logic. Arguments passed

to this function determine the number of RME modules to test, the output points to
be tested and the function to be performed. These functions are:

0 = Do nothing
1 = Do test of RMEs
2 = Abort test
3 = Reset errors
4 = Map outputs

The test function is called periodically, selected by the application and takes
several scan cycles to complete. It is desirable to test all the RME modules in one

Issue ** Jan 97 Page 214 of 230

 ABB August Ltd
CS300 Safety System Training Manual

test. If required to be tested on an individual basis, a performance penalty is

imposed on the system.

Any discrepancy messages can be printed out in the following format by calling the
print function.

Time and Date OUTPUT_TAGNAME RME_ FAULT TAG_DESCRIPTION

The parameters required for this function are:

1. First register of a list of register containing

RXXXX First master register number
RXXXX+1 First output register for group a
RXXXX+2 First output register for group b
RXXXX+3 First discrete number for feedback status
RXXXX+4 Number of RMEs per bank for the test
RXXXX+5 Master register number for error reset

2. Function to be performed
0 = Do nothing
1 = Do test
2 = Abort test
3 = Reset error state
4 = Map outputs
5 onwards = Invalid

The return status indicates:

true function performed with no errors

false function performed with errors found

The test is invoked by the application with a function type of 1.

If the test completes with no errors then the test function returns 'true'.
If an error is detected, it returns 'false'.

Issue ** Jan 97 Page 215 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.23 SEND (peer-to-peer I/O transmit)

Key: [C] (call menu)

Symbol:
PXXXX
SEND
PYYYY

Definition
activate PXXXX message sent OK
SEND
PYYYY message not sent OK

The SEND and RECV elements are used within VP125 to process the TRIGARD
peer to peer communications between CS300 systems or operator workstations.
This element operates in conjunction with the RECV element.

PXXXX is the same register as specified in the associated RECV element. This
register is the first register of a register list detailing the composition of the
message or data requiring to be sent and the destination to send it to. When a
SEND has been actioned the RECV will then look for the correct response
message which is returned as part of the TRIGARD peer to peer protocol.

PYYYY is not utilised in this element.

Issue ** Jan 97 Page 216 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.24 SQRT (Integer square root function)

Key: [C] (call menu)

Symbol:
PXXXX
SQRT
PYYYY

Definition:
activate PXXXX succeed
SQRT
PYYYY fail

PXXXX specifies a 16-bit input value and PYYYY is the result register.

Description:

The SQRT element will compute the square root of a single word positive value.
The input is given as PXXXX and may be a register specification or a constant.
The output result will be placed int he register specified by RYYYY.

If the input is less than zero or RYYYY is not a register, the SQRT element will set
FAIL to ON. Otherwise, the element will succeed. In the event that a negative input
is given, the output register remains unchanged.

The returned square root is a truncated integer result. For example:

PXXXX PYYYY

25 5
24 4
256 16
255 15

Issue ** Jan 97 Page 217 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.25 SYNC (RTTS synchronise call).

Key: [C] (call menu)

Symbol:
PXXXX
SYNC
PYYYY

Definition:
activate PXXXX succeed
SYNC
PYYYY

Where both PXXXX and PYYYY are ignored. SYNC always succeeds.

Description:

SYNC, when activated, causes the RTTS synchronise function to occur. All active
processors wait for each other, then continue at virtually the same time. A
synchronise occurs implicitly each time the processors perform peripheral I/O or an
RTTS system call.

The processors drift away from synchronisation due to variations in individual

hardware tolerances and from the effects of asynchronous events on processors
not perfectly synchronised at all times. Implicit synchronisations occur at the
beginning and end of each ladder scan, and when the following subroutines are
called: DIAG, DUMP, ERCL, FALT, GDIA, INIT, INPM, LLDO, MDBS, PAUS,
PERR, PMIO, PRNT, RECV, SEND, SYNC, WARM. Additionally the user-
definable USR1 through USR4 functions may also perform implicit synchronising
operations depending on their definition.

Normally, implicit synchronisations are sufficient to keep the system functioning

properly. The SYNC subroutine is used in the circumstance where ladders execute
for an extended length of time without a system call. As a general guideline, 50 to
100 centiseconds (0.5 to 1.0 second) is the maximum length of time that can be
tolerated without a synchronising operation (after which time the processors could
be unrecognisably "far apart" when they at a synchronise).

Issue ** Jan 97 Page 218 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Note: SYNC is designed primarily for our internal use. Ladders you create should
not require this element.

Issue ** Jan 97 Page 219 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.26 TDAC (TRIDAC processing)

Key: [C] (call menu)

This element is specific to TRIDAC systems only and is

documented in the TRIDAC User's manual.

Issue ** Jan 97 Page 220 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.27 THLD (THRESHOLD Subroutine)

Key: [C] (call menu)

Symbol:
PXXXX
THLD
PYYYY

Definition:
activate PXXXX succeed
THLD
PYYYY

RXXXX is the first register of a list of registers that define all the variable
information required by the element. RYYYY is an output register that contains the
number of changes in state to sixteen discretes (the location of which is defined in
the register list) detected by the element.

Description:

The THLD function provides 6 types of limit checking on up to 224 registers (most
likely containing analog inputs). The results of these limit checks can be read as
discretes in the TRIGARD Map. In addition, a serial message will be produced for
each transition of these discretes. The message will indicate the condition, discrete
number and register value.

The registers involved in the limit checks must be sequentially arranged. Each of
the input registers will have associated with it a set of 10 threshold and hysteresis
values whose meanings are as follows.

1. High Danger (HD)

2. High Alert (HA)
3. Low Alert (LA)
4. Low Danger (LD)
5. Rate-up Danger (RUD)
6. Rate-down Danger (RDD)

Issue ** Jan 97 Page 221 of 230

 ABB August Ltd
CS300 Safety System Training Manual

7. Significant Change (SC)

8. Predetermined Alarm State (PDS)
9. Hysteresis (HS)
10. Spare (not used by THLD)

These values are stored in registers, and a pointer from the register list attaches
the appropriate 10 register block to each input as shown in the following diagram.

Issue ** Jan 97 Page 222 of 230

 ABB August Ltd
CS300 Safety System Training Manual

activate PXXXX no changes

THLD
PYYYY changes

# of inputs (N) PXXXX

# of scans per rate check PXXXX+1
First input (R address)

# of changes PYYYY First discrete address
1st threshold set address
2nd threshold set address



Nth threshold set address
First discrete
Sixteenth discrete



(16 (N-1)+1)th discrete First input
Second input
Third input



10 register set of Nth input
threshold values

10 register set of
threshold values

10 register set of
threshold values

The discrete bits that THLD operates on are defined as follows (NOTE: The
discrete in the TRIGARD Map that is specified for bit zero must be a multiple of 8):

Bit Meaning

0 (LSB) High Danger

1 High Alert (HA)

Issue ** Jan 97 Page 223 of 230

 ABB August Ltd
CS300 Safety System Training Manual

2 Low Alert (LA)

3 Low Danger (LD)
4 Rate-up Danger (RUD)
5 Rate-down Danger (RDD)
6 Significant Change (SC)
7 Disable Input
8-15 Spare (not used by THLD)

Logic:

Every scan that the element is activated, each input register is checked according
to the following logic, where the input being checked is noted as INP, the number
of scans per rate check is noted as N, IP(n) is the value of this input N scans ago,
and a save value for the significant change determination is noted as SCV.

If INP>=HD then HD bit is set

If INP<HD-HS the HD bit is cleared

If INP>=HA then HA bit is set

If INP<HA-HS then HA bit is cleared

If INP<LA then LA bit is set

If INP>LA+HS then LA bit is cleared

If INP<=LD then LD bit is set

If INP>LD-HS then LD bit is cleared

If INP-INP (n)>=RUD then RUD bit is set

If INP-INP (n)<RUD then RUD bit is cleared

If INP (n)-INP>=RDD then RDD bit is set

If INP (n)-INP<RDD then RDD bit is cleared

If INP-SCV>=SC then SC bit is set and SCV is set to

INP, otherwise SC bit is cleared

If disable input (bit 7) is set then

HD bit is set to PDS bit 0 (LSB)
HA bit is set to PDS bit 1
LA bit is set to PDS bit 2
LD bit is set to PDS bit 3
RUD bit is set to PDS bit 4
RDD bit is set to PDS bit 5

Issue ** Jan 97 Page 224 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Each change of state in bits 0 to 5, 7, 9, 11, and 13 will produce a 33 character

print message on the print serial channel. The format of the message is as follows:

Character Contents
1 colon (:)
2-3 address of this machine
4-5 function field
6 space
7-10 time-minutes since midnight
11 space
12-15 time-centiseconds since the last minute
16 space
17-20 discrete number which caused this message
21 space
22-23 status of discrete (00 or 01)
24 space
25-28 input value
29 space
30-31 block check
32-33 carriage return/line feed

Transitions of bits 0-5 will produce a message with the function field set to F0.
Transitions of bits 7, 9, 11 and 13 will produce a message with the function field set
to F1.

Bits 8, 10, 12 and 14 are used by THLD to determine which scan has caused a
transition in bits 7, 9, 11 and 13 respectively.

All data in the message is ASCII-HEX that is, from the set (0-9, A-F). The block
check is the lower order 2 digits of the 2's compliment of the sum of the 11 pairs of
HEC values.

Example Message:

:01F0 0011 000A 020E 01 0800 DB cr/lf

The above message states that at 00:17 00.10, discrete number 526 changed from
0 to 1 and that the input associated with that discrete had the value 2,048.

Element Example:

An example setup for the THLD element might be as follows where RXXXX =
R600 and RYYYY = R400.

Issue ** Jan 97 Page 225 of 230

 ABB August Ltd
CS300 Safety System Training Manual

Register Value Meaning

R600 5 # of inputs.
R601 3 # of scans per rate change.
R602 101 1st input. Registers 101-105 are the inputs.
R603 1000 1st discretes. Discretes 1000-1080 are discrete
outputs.
R604 610 Value Set for input #1.
R605 620 Value Set for input #2.
R606 630 Value Set for input #3.
R607 620 Value Set for input #4.
R608 610 Value Set for input #5.
R609

R610 3000
R611 2500
R612 1000
R613 500
R614 15 1st value set of thresholds used for
R615 15 inputs #1 and #5.
R616 50
R617 6
R618 20
R619 0

R620 3500
R621 3300
R622 3000
R623 2000
R624 4 2nd value sets of thresholds used
R625 3 for inputs #2 and #4.
R626 25
R627 0
R628 10
R629 0

R630 1024
R631 1000
R632 800

Issue ** Jan 97 Page 226 of 230

 ABB August Ltd
CS300 Safety System Training Manual

R633 700
R634 8 3rd value set of thresholds used for
R635 7 input #3.
R636 40
R637 6
R638 5
R639 0

Issue ** Jan 97 Page 227 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.28 TINI (TRIDAC initialization)

Key: [C] (call menu)

This element is specific to TRIDAC systems only and is

documented in the TRIDAC User's manual.

Issue ** Jan 97 Page 228 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.29 USR1, USR2, USR3, USR4 (User Definable Functions)

Key: [C] (call menu)

Symbol:
activate PXXXX succeed
USRn
PYYYY fail

These functions call user-written code.

The parameters (activate, succeed & fail) are available for the functions to use.
The user-written function determines whether the element succeeds or fails.

Issue ** Jan 97 Page 229 of 230

 ABB August Ltd
CS300 Safety System Training Manual

6.7.30 WARM (Warmstart call).

Key: [C] (call menu)

Symbol:
PXXXX
WARM
PYYYY

Definition:
activate PXXXX succeed
WARM
PYYYY fail

Description:

WARM invokes the RTTS system warmstart function which is used to bring a
single Control Computer that has been offline into synchronisation with the system.
Warmstart always succeeds. The WARM subroutine will not be activated unless a
processor is waiting to warmstart.

Issue ** Jan 97 Page 230 of 230