TRICONEX Tricon TMR 3604E Digital Output Module Ready For Ship

The TRICONEX 3604E is a high‑density Triple Modular Redundancy (TMR) digital output module designed for the Tricon safety instrumented system. The 3604E drives 16 non‑commoned 24 Vdc outputs with 2 A continuous current per channel. Each output is backed by three independent measurement circuits that perform 2‑out‑of‑3 (2oo3) hardware voting, masking a single circuit failure and preventing false trips. On‑board diagnostics include continuous self‑test, voltage loopback, open‑circuit and short‑circuit detection, and per‑channel LOAD/FUSE alarms. Certified to IEC 61508 SIL 3, the TRICONEX 3604E supports hot‑swap replacement, accepts a wide field supply voltage (22 – 45 Vdc) and is compatible with multiple External Termination Panel (ETP) options. It is deployed worldwide in Emergency Shutdown (ESD), Fire & Gas (F&G), Burner Management (BMS) and turbine control applications across oil & gas, petrochemical, power generation and pharmaceutical industries.

Emergency Shutdown (ESD) Systems – drives safety‑critical solenoid valves, dump valves and emergency block valves in refineries, LNG plants, chemical reactors and offshore platforms

Fire & Gas (F&G) Protection – energises sprinkler deluge valves, audible/visual alarms, ventilation dampers and fire suppression release circuits upon gas or flame detection

Burner Management Systems (BMS) – controls flame safety shut‑off valves, purge dampers, ignition transformers and master fuel trip relays for boiler and furnace safety

Turbine Control & Overspeed Protection – drives overspeed trip solenoids, emergency stop circuits, lubrication system cut‑offs and governor actuators for gas and steam turbines

High‑Integrity Process Control – operates critical final elements such as motor starters, compressor anti‑surge valves, pump stop circuits and heater interlocks

Pharmaceutical & Biotech Manufacturing – controls batch reactor safety valves, clean‑in‑place (CIP) circuits and containment interlock systems under SIL‑3 rated safety logic

Triple Modular Redundancy (TMR) with 2oo3 voting – three independent output circuits per channel; any single circuit failure is automatically masked; the remaining two circuits maintain correct output state

IEC 61508 SIL 3 certified – TÜV approved for safety instrumented functions up to the highest integrity level; suited for de‑energise‑to‑trip (fail‑safe) and energise‑to‑act applications

16 non‑commoned (fully isolated) output channels – each channel has its own isolated return; no shared wiring between points; eliminates ground loops and cross‑channel interference

2 A continuous / 10 A surge current rating – direct drive capability for large solenoid valves, contactors, relays, alarm annunciators and motor starters without external interposing relays

Wide field voltage range (22 – 45 Vdc) – accepts 24 Vdc nominal supplies with large tolerance; suitable for industrial power fluctuations and long cable runs

1500 Vdc opto‑galvanic isolation – channel‑to‑channel and channel‑to‑backplane isolation prevents fault propagation and protects the Tricon processor from field‑side electrical disturbances

Continuous online self‑diagnostics – voltage loopback circuit verifies each output switch independently of load presence; detects open‑circuit (no load), short‑circuit to power/ground, over‑current and fuse failure

Voltage loopback and LOAD/FUSE alarm – active read‑back of actual output voltage; any mismatch between commanded state and measured voltage triggers a field alarm without requiring external sensing

Hot‑swap capability – online module replacement without system power‑down or process interruption; reduces maintenance downtime in live safety‑critical environments

Per‑channel front‑panel LED indicators – visual status for ON (green), OFF (off), LOAD/FUSE fault (amber), and channel fault (red); PASS, FAULT and ACTIVE LEDs for module‑wide health

Mechanical keying and ejector levers – module is keyed to prevent insertion into an incorrect chassis slot; ejector levers ensure secure seating and proper backplane connection

Compatible with multiple External Termination Panels (ETPs) – works with commoned, basic, non‑incendive (hazardous location) and loop‑back termination panels for flexible field wiring

Enhanced “E” version diagnostics – compared to base models, the 3604E offers advanced supervised fault detection, including load side monitoring and improved diagnostic coverage for demanding safety functions

Triplicated output driving with hardware voting – each of the 16 output channels contains three independent solid‑state switch circuits (one per TMR slice). Output data from the three main processors is transmitted to the module over the triplicated I/O bus. The module’s quadruplicated output voter (2oo3) compares the three signals; if two agree, that value is passed to the field, masking a single divergent circuit.

Voltage loopback read‑back verification – a dedicated analog‑to‑digital converter per channel continuously measures the actual output voltage at the field terminal. The measured value is compared with the commanded state (ON or OFF). A mismatch (e.g. output commanded off but voltage present, or commanded on but voltage absent) latches a LOAD/FUSE alarm and illuminates the corresponding LED.

Open‑circuit (no load) detection – when the output is commanded OFF, a small diagnostic current is injected through the field circuit. If the return current is below the minimum load threshold (≈ 10 mA), the module reports an open‑circuit fault (missing or broken load). This feature verifies field wiring integrity without energising the final element.

Short‑circuit and over‑current protection – output current is monitored continuously. If a sustained over‑current condition (short‑circuit) is detected, the output is latched off and the channel fault indicator is activated. A non‑replaceable fusible link provides absolute protection against catastrophic failure. An external 2.5 A fast‑acting fuse (on the termination panel) offers additional field wiring protection.

Continuous self‑diagnostics – the module periodically tests all critical circuits: power supply voltages, internal reference voltages, the output voter logic, the voltage loopback ADC, and the communication interface to the main processors. Any diagnostic failure sets the FAULT LED and reports the condition to the application via the I/O data table.

Hot‑swap operation – when a 3604E is removed from a running chassis, the main processors detect the loss and continue to operate using the remaining healthy modules in the slot (if a hot‑spare is present). When a replacement 3604E is inserted, the system automatically re‑initialises and re‑educates the module, restoring full 2oo3 voting without a power cycle.

Per‑channel alarm reporting – the module provides four discrete status bits per channel: ON/OFF state (from the application), median‑voted output status (actual field condition), line fault status (open‑circuit or short‑circuit), and channel health (slice fault). These are mapped into the I/O data structure for use in the safety logic.

Cold start and power‑up initialisation – on power‑up, the module performs a complete self‑test. If passed, the module waits for configuration from the main processor. Outputs remain de‑energised until the processor sends the active run command. The FAULT RESET button on the main processor clears latched output faults after a field fault has been repaired.

Fallback / fail‑safe state – if communication with the main processor is lost, or if a critical internal fault is detected, the module de‑energises all outputs (fail‑safe default). The default state can be over‑ridden in the module configuration for specific channels where a de‑energised state is not the safe condition.