Technical Application Note #42, Revision 1

Subject: Module-Configurable TÜV Application Logic Examples for

Triconex Emergency Shutdown (ESD) Systems

Affected Products
All Tricon™, Trident™, and Triconex® General Purpose (Tri-GP) Emergency Shutdown
Systems (ESD) programmed with TriStation™ 1131

Introduction
This application note provides sample Tricon and Trident/Tri-GP application logic for
implementing the TÜV-recommended guidelines for degraded mode operation. These
examples outline an implementation technique that allows you to select which modules to
include in the shutdown strategy.

Background
In the TriStation 1131 v3.0 standard libraries, Invensys released new function blocks
specifically for TÜV shutdown logic. These new function blocks allow for the use of module-
selectable TÜV shutdown logic. For the Tricon system, these function blocks are
TR_CRITICAL_IO and TR_SHUTDOWN. For the Trident or Tri-GP system, these function
blocks are SYS_CRITICAL_IO and SYS_SHUTDOWN.

Tricon Function Blocks

Figure 1 – Tricon TÜV Shutdown Function Blocks

Invensys Global Customer Support (GCS) Center +1-866-746-6477 (toll-free, US & Canada)
http://support.ips.invensys.com +1-508-549-2424 (worldwide)

Technical Application Note 42 March 23, 2011 Part No. 9791005-042, Rev 1
 2 of 6

The Tricon TR_CRITICAL_IO function block is used to select which modules will be included
in the shutdown strategy. The cumulative processing of these function blocks is handled by
the TR_SHUTDOWN function block.
TR_CRITICAL_IO has six inputs:
 CI
 INIT
 CHASSIS
 SLOT
 APP
 RELAY_OK
Inputs CI and INIT are used only for initialization of this logic, which will be discussed later
in this document.
Inputs CHASSIS and SLOT are used to configure the function block to monitor a specific
chassis and logical slot within the system. The SLOT is configured using the odd-numbered
physical slot, which is the left slot of each logical slot. The function block internally uses the
physical slot number along with the physical slot number plus 1 as part of its monitoring.
Inputs APP and RELAY_OK are used for digital output (DO) modules, allowing for the use of
an external relay for controlling loop power to the termination panel. A single voter fault on
a DO module will degrade the system from TMR to SINGLE. Installing a relay on the loop
power distribution, and then configuring it in the TR_CRITICAL_IO function block, will
instead degrade the system from TMR to DUAL, since the relay provides a third channel in
the voter circuit for shutdown.
Input APP sets the application type as either de-energized or relay.
 De-energized denotes that there is no relay installed to control loop power to the
digital output points. It is configured by connecting a DINT value of 2 to the APP
input.
 Relay denotes that there is a relay installed on loop power. It is configured by
connecting a DINT value of 1 to the APP input.
Input RELAY_OK has a Boolean data type. Connecting a TRUE to this input implies that the
installed relay is functioning normally, while connecting a Boolean FALSE to this input
implies that the relay is not functional.

Technical Application Note 42 March 23, 2011 Part No. 9791005-042, Rev 1
 3 of 6

Trident/Tri-GP Function Blocks

Figure 2 – Trident/Tri-GP TUV Shutdown Function Blocks

The Trident/Tri-GP SYS_CRITICAL_IO function block is used to select which modules will be
included in the shutdown strategy. The cumulative processing of these function blocks is
handled by the SYS_SHUTDOWN function block.
SYS_CRITICAL_IO has six inputs:
 CI
 RESET
 IOP
 SLOT
 APP
 RELAY_OK

Inputs CI and RESET are used only for initialization of this logic, which will be discussed
later in this document.
Inputs IOP and SLOT are used to configure the function block to monitor a specific
baseplate within the system. SLOT is configured using the baseplate number in a given IOP
string.
As mentioned in the previous Tricon section, inputs APP and RELAY_OK are used for DO
modules, allowing for the use of an external relay for controlling loop power to the
termination panel. Please refer to the previous section for further configuration details for
these inputs.

Technical Application Note 42 March 23, 2011 Part No. 9791005-042, Rev 1
 4 of 6

Recommendations and Exceptions

Tricon Controllers
The first two networks of this logic are used for initialization purposes. The first network
should call TR_CRITICAL_IO once, with INIT set to TRUE and APP set to DE_ENERGIZED
(2). The second network should also call TR_CRITICAL_IO once, with INIT set to FALSE, CI
set to TRUE, APP set to DE_ENERGIZED (2), and RELAY_OK set to FALSE to complete the
initialization. The key factor is to assign the same name to each of the TR_CRITICAL_IO
function blocks throughout all of the logic. In the following example, the function blocks are
named SCIO.

Figure 3 – Initialization of Logic

Each of the following networks should call the TR_CRITICAL_IO function block repeatedly,
once for each critical I/O module.
Note: A Model 3636R or 3636T Relay Output (RO) module should not be configured as a
critical module.
For the Tricon TR_CRITICAL_IO function block, the following module types should be
configured based on Table 1:
 Digital Input (DI)
 Analog Input (AI)
 Digital Output (DO)
 Analog Output (AO)

I/O Module APP RELAY OK

DI RELAY (1) TRUE
AI RELAY (1) TRUE
AO DE_ENERG (2) FALSE
DO (with relay) RELAY (1) TRUE
DO (no relay ) DE_ENERG (2) FALSE

Table 1 – TR_CRITICAL_IO Module Configurations

Note: The Tricon Digital Input (DI) module runs leg-to-leg diagnostics, which can be
confused by chattering inputs and may result in erroneously setting the voter fault flag and
degrading the module from TMR to SINGLE. The Tricon Analog Input (AI) module may also
exhibit this problem. For a complete list of affected DI and AI modules, as well as

Technical Application Note 42 March 23, 2011 Part No. 9791005-042, Rev 1
 5 of 6

recommended actions, see Technical Advisory Bulletin #166, available on the Invensys
Global Customer Support website. To prevent the erroneous voter fault flag issue from
degrading the module to SINGLE mode, we recommend configuring the DI or AI module as
if a relay is connected to the loop power of this module (APP=RELAY, RELAY_OK=TRUE).

Figure 4 – Module-Configurable TR_CRITICAL_IO Function Blocks

The last TR_CRITICAL_IO function block should be connected to the TR_SHUTDOWN

function block to complete the logic, as shown below. TR_SHUTDOWN should be configured
to match the desired operating parameters for MAX_TIME_DUAL, MAX_TIME_SINGLE, and
MAX_SCAN_TIME. Please refer to the Safety Considerations Guide for Tricon Systems for
more detailed information regarding these parameters.

Figure 5 – Connecting TR_CRITICAL_IO to TR_SHUTDOWN

Trident and Tri-GP Controllers

The Trident and Tri-GP shutdown logic can be implemented using the same procedure as
outlined for the Tricon controller, by substituting TR_CRITICAL_IO with SYS_CRITICAL_IO
and TR_SHUTDOWN with SYS_SHUTDOWN.
To initialize the logic, call SYS_CRITICAL_IO once, with RESET set to TRUE. Then call it
again with RESET set to FALSE, CI set to TRUE, APP set to DE_ENERGIZED (2), and
RELAY_OK set to FALSE.

Technical Application Note 42 March 23, 2011 Part No. 9791005-042, Rev 1
 6 of 6

The SYS_CRITICAL_IO function blocks should be configured for selected modules using the
following table:

I/O Module APP RELAY OK

DI DE_ENERG (2) FALSE
AI DE_ENERG (2) FALSE
DO (no relay ) DE_ENERG (2) FALSE
DO (with relay) RELAY (1) TRUE
AO DE_ENERG (2) FALSE

Table 2 – SYS_CRITICAL_IO Module Configurations

If you have any questions regarding this Technical Application Note, contact your regional
Invensys support office or the Invensys Global Customer Support center.

Changes from Initial Release

Page or Section Description of Change

Affected Products  Included the Triconex General Purpose (Tri-GP) System

Throughout  Added “Tri-GP” wherever Trident is mentioned, as information pertaining to the

Trident controller also pertains to the Tri-GP controller
Table 1  Changed (AI) Module configuration to the proper settings to prevent the
erroneous voter flag issue from causing the AI and DI modules to degrade from
TMR straight to SINGLE (TAB#166 issue)
Recommendations  In Note 2, added “and degrading the module from TMR straight to SINGLE mode.
and Exceptions The Tricon Analog Input (AI) module may also exhibit this problem. For a
complete list of affected DI and AI modules, as well as recommended actions, see
Technical Advisory Bulletin #166, available on the Invensys Global Customer
Support website. To prevent the erroneous voter fault flag issue from degrading
the module to SINGLE mode, we recommend”

© 2007, 2011 Invensys Systems, Inc. All rights reserved. Invensys, Invensys logo, Triconex, Tricon, Trident, and TriStation are trademarks of

Invensys plc, its subsidiaries and affiliates. All other brands may be trademarks of their respective owners.

Technical Application Note 42 March 23, 2011 Part No. 9791005-042, Rev 1