AADvance

The Next Step in Automation

AADvance Controller

Troubleshooting and Maintenance Manual

Issue: 08 DOCUMENT: 553634 (ICSTT-RM406_EN_P) (ICSTT

Troubleshooting and Maintenance Manual (AADvance Controller)

This page intentionally left blank

ii

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Notice In no event will Rockwell Automation be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment. The examples given in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated with any particular installation, Rockwell Automation does not assume responsibility or reliability for actual use based on the examples and diagrams. No patent liability is assumed by Rockwell Automation, with respect to use of information, circuits, equipment, or software described in this manual. Reproduction of this manual in whole or in part, without written permission of Rockwell Automation is prohibited. All trademarks are acknowledged. Disclaimer It is not intended that the information in this publication covers every possible detail about the construction, operation, or maintenance of a control system installation. You should refer to your own (or supplied) system safety manual, installation instructions and operator/maintenance manuals. Revision and Updating Policy This document is based on information available at the time of its publication; however, the document contents are subject to change from time to time. You should contact Rockwell Automation Technical Support by e-mail icstsupport@ra.rockwell.com to check if you have the latest version of this publication. Copyright Notice, Rockwell Automation 2012 This document contains proprietary information that is protected by copyright. All rights are reserved. Documentation Feedback Your comments will help us to serve your documentation needs better. If you discover any errors or have any suggestions on how to improve this publication send your comments to our product support group: icstsupport@ra.rockwell.com

This technical manual applies to AADvance Release 1.3.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

iii

Troubleshooting and Maintenance Manual (AADvance Controller)

Issue Record
Issue 01 02 03 04 05 06 07 08 Date Dec 2008 Feb2009 Apr 2009 Nov 2010 Mar 2011 Aug 2011 Apr 2012 June 2012 Comments First Issue Update with official product titles Change title and add calibration procedures Add fuse replacement Release 1.2 Update Release 1.2 version for TUV review comments Update Release 1.2 to add Analogue Output Module information Update for Release 1.3 & 1.3.1

iv

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Notes and Symbols used in this manual

This symbol calls attention to items which "must" be considered and implemented when designing and building an AADvance controller for use in a Safety Instrumented Function (SIF). It appears extensively in the AADvance Safety Manual.

Note: Notes are used extensively to provide important information about the product. Standard Warnings and Cautions Cautions
WARNING ELECTRICAL ARCS AND EXPLOSION RISK IN HAZARDOUS AREAS If you connect or disconnect wiring, modules or communications cabling while power is applied, an electrical arc can occur. This could cause an explosion in hazardous location installations. Do not remove wiring, fuses, modules or communications cabling while circuit is energized unless area is known to be non hazardous. Failure to follow these instructions may result in personal injury.

WARNING

MAINTENANCE Maintenance must be carried out by people who are experienced in working on electronic equipment and in particular safety related systems.They should have knowledge and experience of local operating and safety standards. Failure to follow these recommendations may result in situations that can lead system damage and even personal injury.

CAUTION

RADIO FREQUENCY INTERFERENCE Most electronic equipment is influenced by Radio Frequency Interference. Caution should be exercised with regard to the use of portable communications equipment around such equipment. Signs should be posted in the vicinity of the equipment cautioning against the use of portable communications equipment.

CAUTION

HEAT DISSIPATION AND ENCLOSURE POSITION System and field power consumption by modules and termination assemblies is dissipated as heat. You should consider this heat dissipation on the design and positioning of your enclosure; e.g. enclosures exposed to continuous sunlight will have a higher internal temperature that could affect the operating temperature of the modules. Modules operating at the extremes of the temperature band for a continuous period can have a reduced reliability.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Troubleshooting and Maintenance Manual (AADvance Controller)

Foreword This technical manual describes how to maintain, troubleshoot and repair an AADvance Controller. Who Should Should Use this Manual This manual is for plant maintenance personnel who need to trace and repair a fault in an AADvance system and perform routine maintenance tasks. You should be trained and experienced in the operation and maintenance of electronic equipment and in particular with safety systems. If the information contained in this manual does not assist you to discover the cause of the failure then contact technical support at icstsupport@ra.rockwell.com.

vi

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Troubleshooting and Maintenance Manual (AADvance Controller)

Contents
Chapter 1
Introduction to Maintenance Activities ................................................ 1-1 Making Repairs Promptly ................................................................................................................................. 1-1 Resolving Multiple Faults .................................................................................................................................. 1-1 Required Tools Standard AADvance ............................................................................................................ 1-2 Required Test Equipment ................................................................................................................................ 1-2 Return a Module ................................................................................................................................................ 1-3 Conventions Used in Flow Charts ................................................................................................................ 1-3 Preventive Maintenance ......................................................................... 2-1 Preventive Maintenance Schedule .................................................................................................................. 2-2 Check Fuses ........................................................................................................................................................ 2-2 Check Wiring Terminals .................................................................................................................................. 2-3 Check Seating of Plug-in Components ......................................................................................................... 2-3 Check Physical Condition and Environmental Conditions ...................................................................... 2-3 Check Ground Connection............................................................................................................................. 2-3 Check Analogue Input Module Calibration ................................................................................................. 2-3 Check Digital Input Module Calibration....................................................................................................... 2-4 Perform the Manual Test ................................................................................................................................. 2-5 About Troubleshooting .......................................................................... 3-1 Prerequisites for Troubleshooting................................................................................................................. 3-1 Recovery Mode and How it Affects Controller Operation .................................................................... 3-2 Internal Diagnostics ........................................................................................................................................... 3-2 Actions of the Diagnostic Systems ................................................................................................................ 3-3 Latching and Non-Latching Faults .................................................................................................................. 3-3 Common Fault Alarm ....................................................................................................................................... 3-4 Fault Indications.................................................................................................................................................. 3-4 Fault Reporting Reference Information ........................................................................................................ 3-8 Status Indicators on the T9110 Processor Module ............................................................................. 3-8 Status Indicators on the T94xx Series Input and Output Module ................................................. 3-10 Module Shutdown State and Possible Causes ..................................................................................... 3-12 I/O Module Channel Degradation and Shutdown .............................................................................. 3-13 Understanding the State Variable (<tagname>.STA)............................................................................... 3-15 Correlation of LEDs with State Variable for a Digital Input............................................................ 3-15 Correlation of LEDs with State Variable for an Analogue Input .................................................... 3-16 Correlation of LEDs with State Variable for a Digital Output ....................................................... 3-16 Correlation of LEDs with State Variable for an Analogue Output ................................................ 3-17 View Module Firmware Versions ................................................................................................................. 3-17

Chapter 2

Chapter 3

viii

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 4

Troubleshooting and Rectifying Module Faults .................................... 4-1 Troubleshooting System and Module Faults ............................................................................................... 4-2 Rectify a Critical Firmware/Hardware Failure ............................................................................................ 4-3 Install a T9110 Processor Module ................................................................................................................. 4-3 Upgrade a Processor Module Firmware ................................................................................................ 4-4 Install a Processor Back-up Battery ......................................................................................................... 4-4 Processor Module Start Up Process ....................................................................................................... 4-7 Install I/O Modules .......................................................................................................................................... 4-10 I/O Module Start Up Process.................................................................................................................. 4-10 Troubleshooting and Rectifying Channel/Field Faults ......................... 5-1 Examine the State Variable .............................................................................................................................. 5-2 Start Troubleshooting Channel/Field Faults ................................................................................................ 5-3 Diagnose a Digital Input Channel ............................................................................................................. 5-3 Diagnose an Analogue Input Channel ..................................................................................................... 5-6 Diagnose a Digital Output Channel......................................................................................................... 5-8 Diagnose an Analogue Output Channel ............................................................................................... 5-10 Replacing Fuses ................................................................................................................................................. 5-12 Replace Input Channel Fuse .................................................................................................................... 5-12 Replacing Digital Output Fuses............................................................................................................... 5-13 Install a New Termination Assembly .......................................................................................................... 5-14 Operation and Maintenance Plan ........................................................ 6-15 Input Module Calibration ............................................................................................................................... 6-16 Planned Maintenance....................................................................................................................................... 6-16 Field Device Maintenance .............................................................................................................................. 6-17 Module Fault Handling .................................................................................................................................... 6-17 Monitoring ......................................................................................................................................................... 6-18 Maintaining Functional Safety ........................................................................................................................ 6-18 Input Module Calibration ......................................................................................................................... 6-18 Product Level Module and Firmware Updates ................................................................................... 6-19 Baselines ....................................................................................................................................................... 6-19 Modification Records ................................................................................................................................ 6-19 Decommissioning ............................................................................................................................................. 6-20 Parts List .................................................................................................. 7-1 Glossary of Terms ................................................................................... 8-1

Chapter 5

Chapter 6

Chapter 7 Chapter 8 Chapter 9

Additional Resources .............................................................................. 9-1 Regional Offices.................................................................................................................................................. 9-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

ix

Chapter 1
Introduction to Maintenance Maintenance Activities
Corrective maintenance activities for the AADvance controller embrace troubleshooting activities and the subsequent remedial work to rectify the problem and return the controller to normal operation. In addition, some preventive testing and maintenance should be done to make sure the system is available and healthy.

In This Chapter
Making Repairs Promptly .................................................................................. 1-1 Resolving Multiple Faults ................................................................................... 1-1 Required Tools Standard AADvance ............................................................. 1-2 Required Test Equipment ................................................................................. 1-2 Return a Module ................................................................................................. 1-3 Conventions Used in Flow Charts ................................................................. 1-3

Making Repairs Promptly

A fault indication does not necessarily mean a vital part of the controller is not operational. Some faults have no immediate consequence for example, the fault may be within one of the diagnostic systems. Nevertheless, the problem should still be rectified in a timely manner. System repair must be done promptly, to ensure faults do not accumulate. This principle applies as much to a redundant arrangement, which needs to ensure continued fault-tolerant operation, as to a simplex controller. Multiple failures can cause a plant shutdown.
SAFETY Never allow an AADvance controller used for a safety-critical function to operate for an extended period with a failed module. Replace the module within the MTTR assumed for PFD calculations to preserve the SIL level for the system. For PFD & PFH data refer to Doc No. 553847 PFH avg and PFD avg Data

Resolving Multiple Faults

The fault diagnosis procedures described in this manual will locate and resolve a single fault. If you follow one of the processes to its conclusion but a fault indication persists, one or more additional faults remain. Quarantine any defective items you have removed during your first investigation, then start again at the beginning of the appropriate procedure.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

1-1

Troubleshooting and Maintenance Manual (AADvance Controller)

Required Tools Standard AADvance

The installation and maintenance of the AADvance controller requires the following tools: Standard Tools Screwdriver, flat 0.8 x 9.0mm (1/25 c 3/8 inch), for the module clamp screws and blanking covers Screwdriver, cross head number 0, for battery cover on T9110 processor module screwdriver, flat 0.8 x 4.0mm (1/25 x 5/32 inch), for locking screws on extension cables Torque screwdriver, flat 0.6 x 3.0 mm(1/40 x 1/8 inch, for dc power wiring terminals Torque screwdriver, flat 0.4 x 2.0mm (1/64 x 5/64), for field wiring terminals 2 x wrench, open end, 10mm, for ground stud nuts Allen key (hex wrench), 2.5mm, for plug and sockets assemblies used with extension cables Special Tool Long nosed pliers to remove the fuses on termination assemblies.

Required Test Equipment

The maintenance of the AADvance controller requires the following test equipment. Note: All test equipment used should be calibrated and regularly tested for accuracy. Current measurement devices should be accurate to 0.01mA. 1) Digital voltmeter DC voltage range 0 to 32V or better. Resistance resolution 0.01 or better. 2) Current simulation instrument Output range 4 to 20mA with an accuracy better than 0.05mA. 3) Bench power supply Output range 0 to 32V dc.

1-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Return a Module
If you need to return a module for any reason you should in the first instance contact your regional office (see list of regional offices at the back of this publication) to obtain an a Return Material Authorization (RMA) number. If for some reason no one is available in your regional office you may obtain an RMA number using the following procedure: 1) Create an empty email and set the title to 'RMA request' (without the quote marks). 2) Send the email to returns@icstriplex.com. You will receive an automated reply which includes instructions. 3) Follow the instructions in the email.

Conventions Used Used in Flow Charts

This technical manual includes flow charts. The charts use solid and broken lines to denote different kinds of activities.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

1-3

Troubleshooting and Maintenance Manual (AADvance Controller)

This page intentionally left blank

1-4

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 2
Preventive Maintenance Maintenance
Safety systems are designed to run continuously without manual intervention. However, some preventive maintenance should be done to make sure the system is available and healthy. This chapter describes the preventive maintenance activities for an AADvance controller.

WARNING

ELECTRICAL ARCS AND EXPLOSION RISK IN HAZARDOUS AREAS If you connect or disconnect wiring, modules or communications cabling while power is applied, an electrical arc can occur. This could cause an explosion in hazardous location installations. Do not remove wiring, fuses, modules or communications cabling while circuit is energized unless area is known to be non hazardous. Failure to follow these instructions may result in personal injury.

In This Chapter
Preventive Maintenance Schedule................................................................... 2-2 Check Fuses ......................................................................................................... 2-2 Check Wiring Terminals ................................................................................... 2-3 Check Seating of Plug-in Components .......................................................... 2-3 Check Physical Condition and Environmental Conditions ....................... 2-3 Check Ground Connection ............................................................................. 2-3 Check Analogue Input Module Calibration .................................................. 2-3 Check Digital Input Module Calibration ....................................................... 2-4 Perform the Manual Test .................................................................................. 2-5

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

2-1

Troubleshooting and Maintenance Manual (AADvance Controller)

Preventive Maintenance Schedule

Table 1: Recommended Schedule for Preventive Maintenance Preventive Maintenance Task Review status LEDs Check fuses Check wiring terminals Check seating of plug-in components Check for contamination, general condition and adequate environmental protection Check ground connection Check analogue input module calibration Check digital input module calibration Perform manual test Interval Daily 3 months 3 months 3 months 3 months 3 months 2 years 3 years Manual Test Interval

Note: Testing of the logic solver and its associated field devices must be carried out according to the appropriate plant or process safety analysis and the safety integrity validation. The manual test interval is used by the Probability of Failure on Demand (PFD) data analysis as part of the certification process. Refer to the document "PFH and PFD Data for AADvance Controllers" - Doc No: 553847.

Check Fuses
To check the controller fuses do the following:

1) Open the fuse cover on each termination assembly to inspect the fuses. 2) Look for signs of overheated, damaged or incorrectly seated fuses.

2-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Check Wiring Terminals

To check the wiring terminals do the following: Inspect the field, power and network wiring and look for any evidence of physical stress such as chafing. Tighten terminal screws to avoid open circuits causing trips. Note: For controller power and field wiring terminals, apply a minimum tightening torque of 0.5 Nm (0.37 ft lb) to the terminal screws. For serial connections and the processor alarm, apply a minimum tightening torque of 0.22 Nm (0.16 ft lb) to the terminal screws.

Check Seating of PlugPlug-in Components

To check the seating of plug-in components, do the following: Examine the AADvance controller assemblies and make sure all plug-in items, including cable assemblies and base unit bus connectors, are correctly seated.

Check Physical Condition and Environmental Conditions

To check the physical condition of the controller and the environmental conditions, do the following: Examine the AADvance controller assemblies for contamination, corrosion, dampness and dust. Look for unauthorised modifications and observable deterioration such as missing covers, open wires and damaged insulation. Make sure that local ventilation and air conditioning systems are operating correctly.

Check Check Ground Connection

To check the controller ground connection, do the following: Measure the resistance of the connection to the ground stud on the 9100 processor base unit. It should be less than 0.2.

Check Analogue Input Module Calibration

The AADvance controller detects possible calibration drift by continually checking its measured input values. The controller uses diverse hardware to compare two measurements. It is recommended that you carry-out this calibration drift check every two years. You can verify that an analogue input is within the stated accuracy (0.05mA) without taking a module out of service. To check the analogue input module calibration, do the following: 1) Use the AADvance Workbench to lock the input channel. The present input value freezes, allowing the process to continue operating.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

2-3

Troubleshooting and Maintenance Manual (AADvance Controller)

2) Disconnect the field device at the termination assembly and connect a calibrated current simulation instrument in its place. 3) Set the current simulation instrument to provide 4mA, verify that the input value is in the range 3.95 to 4.05mA. 4) Set the current simulation instrument to provide 12mA, verify that the input value is in the range 11.95 to 12.05mA. 5) Set the current simulation instrument to provide 20mA, verify that the input value is in the range 19.95 to 20.05mA. 6) Disconnect the current simulation instrument and reconnect the field device. Note: Apply a minimum tightening torque of 0.5 Nm (0.37 ft lb) to the terminal screws. 7) Verify that the field device is reading an acceptable value. 8) Unlock the input channel. The input is back in service. If desired, you can include this calibration check in the proof test for the loop instead. To do this, insert a calibrated current meter in series with the field device in step 2; use the field device to drive the input.

Check Digital Input Module Calibration

The AADvance controller detects possible calibration drift by continually checking its measured input values. The controller uses diverse hardware to compare two measurements. It is recommended that you carry-out this calibration drift check every two years. You can verify that a digital input is within the stated accuracy (0.5V) without taking a module out of service. To check the digital input module calibration, do the following: 1) Use the AADvance Workbench to lock the input channel. The present input value freezes, allowing the process to continue operating. 2) Disconnect the field device at the termination assembly and connect a bench power supply and a calibrated digital voltmeter in its place. 3) Set the bench power supply to provide 2V, verify that the input value is in the range 1.5 to 2.5V. 4) Set the bench power supply to provide 16V, verify that the input value is in the range 15.5 to 16.5V. 5) Set the bench power supply to provide 30V, verify that the input value is in the range 29.5 to 30.5V.

2-4

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

6) Disconnect the test equipment and reconnect the field device. Note: Apply a minimum tightening torque of 0.5 Nm (0.37 ft lb) to the terminal screws. 7) Verify that the field device is reading an acceptable value. 8) Unlock the input channel. The input is back in service.

Perform the Manual Test

The manual test checks for hidden failures of components which the AADvance controller alarms cannot reveal. To perform the manual test do the following: Transition each digital input to its opposite state and then back to its current state. Subject each analogue input to its full range (minimum to maximum) and check accuracy. At the same time, check each output operates as expected. Use the application software to force any outputs which cannot be seen to operate. Carry out a manual test to exercise every input and output.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

2-5

Troubleshooting and Maintenance Manual (AADvance Controller)

This page intentionally left blank

2-6

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 3
About Troubleshooting
Troubleshooting covers system faults, module and channel faults, termination assemblies and field fault. The corrective troubleshooting and maintenance regime is founded on a series of automatic diagnostic systems, fault warning through module status indicators (LEDs) or reported to the application through the Workbench and a principle of repair by replacement. All modules are replaceable.

In a safety critical redundant configuration remove only one module at a time unless a system shutdown is planned.

In This Chapter
Prerequisites for Troubleshooting ................................................................. 3-1 Recovery Mode and How it Affects Controller Operation ..................... 3-2 Internal Diagnostics ............................................................................................ 3-2 Actions of the Diagnostic Systems ................................................................. 3-3 Latching and Non-Latching Faults ................................................................... 3-3 Common Fault Alarm ........................................................................................ 3-4 Fault Indications .................................................................................................. 3-4 Fault Reporting Reference Information ......................................................... 3-8 Understanding the State Variable (<tagname>.STA) ............................... 3-15 View Module Firmware Versions.................................................................. 3-17

Prerequisites for Troubleshooting

The troubleshooting procedures described in this manual make the premise that the System Healthy alarm is connected to a variable in the AADvance Workbench and the alarm can be used as a starting point for activities or, the processor module has defaulted to the Recovery Mode because of a critical firmware failure. The fault finding procedures make the following assumptions: The controller was fully operational before the fault arose. A serviceable spare module is available. There is a working network connection between the computer workstation and the AADvance controlle.r Note: You must fit the Program Enable Key (supplied with the T9100 processor base unit) in order to download application software onto the controller.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-1

Troubleshooting and Maintenance Manual (AADvance Controller)

Recovery Mode and How it Affects Controller Operation

Recovery Mode Recovery Mode is a shutdown mode and uses a base level firmware. It is entered automatically when a critical firmware failure occurs or it can be entered manually by pressing the processor Fault Reset button immediately after the module has booted up. As an alternative firmware version it allows the following maintenance activities: Update the firmware using the ControlFLASH utility Program the processor IP Address with the AADvance Discover utility Extract diagnostic information In Recovery Mode the Ready, Run, Force and Aux LEDs go Amber and the Healthy and System Healthy LEDs stay Green. The System Healthy and Healthy LEDs may go Red if a fault is detected while in the Recovery Mode. Note: When in Recovery Mode the I/O communications are disabled and the Application code is not running.

Internal Diagnostics
The AADvance controller contains comprehensive internal diagnostic systems to identify faults that develop during operation and raise appropriate alarm and status indications. The diagnostic systems run automatically and check for system faults associated with the controller, and field faults associated with field I/O circuits. Serious problems are reported immediately, but faults on non-essential items are filtered to avoid spurious alarms. The diagnostic systems monitor such non-essential items only periodically, and need a number of occurrences of a potential fault before reporting it as a problem. The diagnostic systems use simple LED status indications to report a problem. The LED indications identify the module and can also identify the channel where the fault has occurred. There is also a summary system healthy indication for the whole controller. The application software uses its variable structures to report a problem; these variables proved status reports and are configured using the AADvance Workbench. A Fault Reset button on each processor module serves to clear a fault indication. However, the diagnostic systems will report a serious problem again so quickly there will be no visible change in the status indications. Pressing the Fault Reset button when no fault is indicated has no effect.

3-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Actions of the Diagnostic Systems

The diagnostic systems filter potential but non-critical fault conditions by sampling at periodic intervals and requiring a number of matching error reports before reporting a problem. Typically the diagnostic systems maintain a counter for a particular fault. If an error is found, the counter increments. If an error is not found, the counter decrements, but by a smaller value. Once the counter reaches a threshold, the diagnostic systems latch the counter and raise alarm and status indications to report the fault. As an example, a non-essential item might be monitored every three hours and reported after 24 hours like this.

Pressing the Fault Reset button resets every counter which has reached the fault threshold.

Latching and NonNon-Latching Faults

Faults occurring in the T9110 processor module are non-latching. The controller will recover automatically, and the fault indication will clear, once the fault condition has been remedied. Faults occurring in the I/O subsystem are latched. In order to clear them, you must remedy the source of the fault (usually by replacing a module) and then press the Fault Reset button on the processor module. During the reset operation, the application software continues to run at its normal scan rate. There is no change in system performance and no additional vulnerability to faults. Indications of field faults (which appear as an amber Channel status indicator) are nonlatching. You may not see some short term problems. The fault indication clears as soon you remedy the source of the problem.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-3

Troubleshooting and Maintenance Manual (AADvance Controller)

Common Fault Alarm

A variable in the Workbench application program can be set up to provide a common fault alarm. The alarm is functionally equivalent to the System Healthy indicator on a processor module, and is usually the starting point for investigations into system faults.

Fault Indications
To review status LEDs and rectify faults, do the following: 1) Review the status LEDs on each module. Note: Some output faults are only visible when outputs are energised, so check for these while testing field devices. 2) If the status LEDs reveal faults, use the procedures in this document to diagnose and rectify the problems. Note: There are no user-serviceable parts inside AADvance modules. A defective module must be returned to Rockwell Automation.

3-4

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Fault Indications The diagnostic systems detect four classes of fault: System fault, pertaining to the AADvance system Module fault, pertaining to a particular module Channel fault, pertaining to the circuits inside an I/O module or TA serving a particular channel Field fault, pertaining to the field loop wiring outside the I/O module and TA serving a particular channel A channel fault produces a module fault and similarly a module fault produces a system fault. The diagnostic systems use some of the status indicators (LEDs) on the controller modules to show the presence of a fault. The indicators show the location and where possible the nature of a fault, and provide the information you need to locate the problem. The following groups of status indicators can show faults: The System Healthy LED on each processor module The Healthy LED on each processor and I/O module The Channel LED on each I/O module The relationships between the classes of faults and the status indicators are as shown.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-5

Troubleshooting and Maintenance Manual (AADvance Controller)

System Fault The controller indicates system fault when it detects a fault associated with itself rather than a field condition or a field device. Such a fault may be any of the following: A module fault (below) A fault the controller cannot isolate it to a single module. An example would be the absence of every I/O module in a termination assembly group. The System Healthy LED on each processor module will show red. Module Fault The controller indicates a module fault when it detects a fault and can isolate it to the hardware of a particular module. The Healthy LED on the faulty module will show red and the System Healthy LED on each processor module will also show red. Channel Fault The controller indicates a channel fault when it detects a fault and can isolate it to a hardware fault on a specific channel of a single I/O module. The controller always reports a channel fault as a module fault as well. This means that the Channel LED will show red, the Healthy LED of the I/O module will show red and the System Healthy LED on each processor module will also show red. Field Fault The AADvance controller indicates a field fault when it detects a fault and can isolate it to a field condition or a field device. Examples are an open circuit field connection or an out-of-range signal. The Channel LED on the relevant I/O module will show amber.

3-6

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Recovery Mode Indications When the processor enters the Recovery Mode the following indications are displayed on the processor front panel when the module contains an application: Recovery Mode No Fault Present

Recovery Mode Fault Present

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-7

Troubleshooting and Maintenance Manual (AADvance Controller)

Fault Reporting Reference Information

Each module has a set of front panel status indicators. The purpose and meaning of these indicators relevant to each module is as follows:

Status Indicators on the T9110 Processor Processor Module

Table 2: Indicator Healthy

Status Indicators on the 9110 Processor Module Status Description Provides an indication of the module's fault status and poweron/operational status OFF RED No power

Module has a fault Flashes RED briefly after being installed as the module is booting up or reset is in progress controller is off-line
As the module is installed and receives power it flashes RED for a second then goes GREEN as the module boots up (10 to 20 seconds). When the module has booted up and is operational the LED stays GREEN and indicates that the module has no hardware faults. When in the recovery Mode and no faults are present the LED is GREEN Note: 1. If Healthy is GREEN and all the other indicators are OFF then the module has failed to boot up 2. If Healthy is GREEN and the Ready and Run are RED then the module is said to be in its shutdown state ( See topic - Module Shutdown

GREEN

3-8

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

State and Possible Causes in the Troubleshooting Manual Chap 3). Ready OFF RED GREEN Provides an indication of the module's education and synchronisation status No power Module is booting up (10 to 20 seconds) or not educated or synchronised with partners Module is educated and synchronised with partners

Flashing GREEN Education or synchronisation is in progress (may be a very short period of flashing then Green) Amber Run OFF RED Module is in the Recovery Mode Provides an indication of the module's application status. Should be the same for all educated and synchronised processors No power and stays off while the module is booting up (10 to 20 seconds) Module is not educated/synchronised; No application loaded; The processor module is in the Recovery Mode and the base level firmware is running The application is present and running Module is in the Recovery Mode or The application is present but not running, press Fault Reset to start it running. System Healthy Provides an indication of the global health of the system, including all processors and I/O modules. Must be the same indication for all educated and synchronized processors OFF RED No power and stays off while the module is booting up (10 to 20 seconds) System or module faults present or the application has stopped running because the module has entered the Recovery Mode. GREEN Force No system or module faults present during normal operation and when in the recovery Mode. Provides an indication that variables are being locked/forced by the application. The same indication will show for all educated and synchronised processors OFF GREEN AMBER No power and stays off while the module is booting up (10 to 20 seconds) No variables are being locked/forced Module is in the Recovery Mode. or an operating controller has at least one variable being locked/forced Aux This LED is controlled by the application. The application can turn it on/off and any colour except when the processor is in the Recovery Mode and the application is stopped OFF No power and stays off while the module is booting up (10 to 20

GREEN AMBER

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-9

Troubleshooting and Maintenance Manual (AADvance Controller)

seconds), or under application control GREEN AMBER Under application control Module is in the Recovery Mode or under application control Serial 1 and 2 OFF RED GREEN AMBER Ethernet 1 and 2 OFF GREEN AMBER Provides an indication of serial port activity No power and stays off while the module is booting up (10 to 20 seconds) Pulse stretched Tx Pulse stretched Rx Tx and Rx activity in close proximity Provides an indication of Ethernet port activity No power and stays off while the module is booting up (10 to 20 seconds) Ethernet link present Tx or Rx activity

Note: When inserting more than one processor module they MUST be inserted one at a time and the module allowed to educate (in the case of a 2nd and 3rd processor).

Status Indicators on the T94xx Series Input and Output Module

3-10

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Table 3: Indicator Healthy

Status Indicators on the 94xx Series Input and Output Module Status Description Provides an indication of the general status of the module OFF GREEN RED No power No module faults present One or more module faults are present Note. 1. The Healthy indicator may turn RED immediately upon application of power to the module, before then turning GREEN 2. If Healthy is GREEN and the Ready and Run are RED then the module is said to be in its "shutdown state" refer to the Troubleshooting Manual - Chap 3 for more information on the shutdown state.

Ready OFF GREEN RED Run OFF GREEN AMBER RED Channel 1 - 8 OFF

Provides an indication of the module's ability to report channel values to a running application No power or unlocked Locked and ready to report channel values Locked but not ready to report channel values Provides an indication that the module is reporting channel values to a running application No power or unlocked Module is online and providing data to/receiving data from application Module is inserted into a running system but not online. Press the Fault Reset button on any processor module to enable the module to go online Module is ready to go online but no application is running Provides an indication of the status of each input or output channel Input module: field switch is open Output module: output is in its de-energised state If the run indicator is not green (the module is not reporting channel values), all channel indicators will be off GREEN AMBER RED Input module: Channel input is on Output module: Output is in its energised state Field fault Channel fault

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-11

Troubleshooting and Maintenance Manual (AADvance Controller)

Module Shutdown State and Possible Causes

Processor Module The processor module shutdown state is the Recovery Mode. If the application was running and it has been re-booted and the Fault Reset button pressed the module enters the Recovery Mode. Here the System Healthy LED will stay Green for a few seconds then go Red. Refer to the following topics: Recovery Mode and How it Affects Controller Operation Rectify a Critical Firmware/Hardware Failure I/O Module A module (Processor or I/O Module) is in a shutdown state indicated by the following: Healthy: Ready: Run: GREEN RED RED

Note: When the module is operational and before loading an application program the module is in the shutdown state. The module can also enter the shutdown state when the application stops running. This is not a fault but a normal state of operation. Possible Causes to be Investigated Investigated However, other faults or problems such as the following can cause a module to enter this state: The module is not in the processor's application control; i.e. the processor has not started the module and it stays in the shutdown state. Check: the application program to see if the I/O module is installed in the equipment and if so if it is installed into the correct I/O Bus and Slot. Check: the module PST value is it set to the correct value or has it been left at zero. Check: the communication link between the processor module and the I/O module (possible I/O base unit fault or loose bus cable)

3-12

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

I/O Module Channel Degradation and Shutdown

Process Safety Time Each simplex module (or group of modules) has a defined process safety time (PST), which determines the maximum length of time that can elapse between successive reporting of channel values to the application before the channel is declared faulty. The module PST is usually the same as the system PST, however, it can be set to a different value within the AADvance Workbench when the controller is first configured, or later changed by an on-line update. The minimum PST value for a module is 20ms and the maximum 60,000ms (1 minute). Input Module NonNon-degraded Status Degradation for input modules is on a channel-by-channel basis. A channel is considered not degraded when when all the modules in a group are on-line and none of them are reporting a fault for the particular channel. The Workbench reports the module status variable 'Discrepancy' as FALSE. A non-degraded simplex module configuration reports the channel values to the application. A non-degraded dual module configuration reports the channel values to the application based on the count value from either module. A non-degraded triple module configuration reports the values from any of the three channels in the group. Input Module Degraded Status A channel is considered fully degraded when no modules in a group are reporting values for that channel, or there is a fault reported on that channel for all modules in the group and either condition exists for longer than the PST. The module status variable 'Discrepancy' is reported as TRUE and the module reports 'safe' values back to the application for the faulty channel. Output Module Shutdown When an output module does not receive updated command values from a running application within the PST, it automatically enters a shutdown mode. This action applies to all situations when commanded state updates are not received, including communication errors, lack of processing modules, and stopping an application. Degraded Input Channel Reporting Values When a fault exists on a channel, the module will report safe values for that channel and the Discrepancy status variable reports TRUE. Simplex Module Configuration Configuration When a simplex module channel fault exists for longer than the module PST the channel indicates a fault condition and the following status values are reported: Channel State = 7 Channel Input State = FALSE Line fault = TRUE

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-13

Troubleshooting and Maintenance Manual (AADvance Controller)

Discrepancy = TRUE Channel fault = TRUE Channel reports a voltage value = 0 Dual Module Configuration When the reported values between modules in digital/analogue modules of a dual configurations diverge by more than twice the safety margin specification for a period of two application scans, that is by the following values: Digital input modules diverge by more than 2.0V dc Analogue input modules diverge by 400A. the lower of the two values will be reported and a discrepancy flag is set and the configuration degrades to a simplex operation. Triple Module Configuration When the reported values between modules in digital/analogue triple configuration diverge by more than twice the safety margin specification for a period of two application scans, that is by the following values: Digital input module by more than 2.0V dc Analogue input module by 400A. the lower of the two values will be reported and a discrepancy flag is set and the configuration degrades to a dual operation. Output Channel Shutdown In shutdown mode the output module drives its outputs to their configured shutdown settings; for example, de-energized or hold last state. The shutdown mode and channel drive states remain in place until new command states are received from a running application, or until the module loses power. On power up or module insertion, a module de-energizes all channels and they remain de-energized until command states are received from a running application. Group Output Module Shutdown As long as one module in a group continues to receive updated command state values from a running application within the PST, each channel is driven according to its commanded state. This covers the situation when only one module out of a pair goes into shutdown mode with some channels energized (from a hold last state setting). This makes sure that these channels do not get stuck energized, and that the remaining module is able to energize or de-energize these channels according to the commanded state received from a running application.

3-14

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Understanding the the State Variable (<tagname>.STA)

The state variable (<tagname>.STA) is one attribute of the full structure for input and output channels. The variable reports a numeric value (from 1 to 7) which reflects the current state of the channel. States 2 and 4 represent normal operation for digital inputs and outputs; state 3 represents normal operation for an analogue input. The other states represent a fault. A digital input channel without line monitoring can detect and report states 2, 3, 4, 6 and 7, but cannot recognize an open circuit or short circuit. A line monitored input can detect and report every state, including an open circuit or short circuit. Analogue input channels are always line momitored. The state variable updates in real time. The fault diagnosis procedures for field faults use the value of the state variable.

Correlation of LEDs with State Variable for a Digital Input

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-15

Troubleshooting and Maintenance Manual (AADvance Controller)

Correlation of LEDs with State Variable for an Analogue Input

Correlation of LEDs with State Variable for a Digital Output Output

3-16

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Correlation of LEDs with State Variable for an Analogue Output

View Module Firmware Versions

Using the AADvance Workbench you can view the module firmware information on screen and save this information with your project. Using an update function view the latest information and save it as an external text file. To do this proceed as follows: Note: To view the firmware version numbers of the modules you must be connected using Debug to a running controller. 1) Select the Equipment View tab. 2) Select the desired configuration node Config4(9000 Series Controller) in example shown below. 3) Select the Version Information tab. The version information window appears. If the version information has previously been requested and saved (applied) then it will be visible in this window.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-17

Troubleshooting and Maintenance Manual (AADvance Controller)

4) Click the Update button. The window now shows your controller's current firmware version information.

3-18

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

The information displayed is as follows: MAC Addresses - MAC addresses for the controllers. There are two addresses per controller set by the BUSP chip inserted into the processor base unit; However, 6 MAC addresses are displayed regardless if the system is a Single, Dual or Triple processor system. The module Information is as follows: Slot - the slot the module has been allocated Module - the module identity Serial - the module hardware serial number Versions - The firmware versions in the module 1) Click Apply The information is saved with the project so that next time the project is opened you can view it. 2) To save the information to a text file select the Save As button. 3) A window opens with a default text file name Version_Report.txt; Enter your own file name and click Save. The saved text file can be viewed in Notepad.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3-19

Troubleshooting and Maintenance Manual (AADvance Controller)

This page intentionally left blank

3-20

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter Chapter 4
Troubleshooting and Rectifying Module Faults
The AADvance controller indicates a system fault through the common fault alarm for the system. This chapter explains how to troubleshoot and rectify a system and module fault.

WARNING ELECTRICAL ARCS AND EXPLOSION RISK IN HAZARDOUS AREAS If you connect or disconnect wiring, modules or communications cabling while power is applied, an electrical arc can occur. This could cause an explosion in hazardous location installations. Do not remove wiring, fuses, modules or communications cabling while circuit is energized unless area is known to be non hazardous. Failure to follow these instructions may result in personal injury.

In This Chapter
Troubleshooting System and Module Faults ................................................ 4-2 Rectify a Critical Firmware/Hardware Failure ............................................. 4-3 Install a T9110 Processor Module .................................................................. 4-3 Install I/O Modules ........................................................................................... 4-10

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

4-1

Troubleshooting and Maintenance Manual (AADvance Controller)

Troubleshooting System and Module Faults

Use this flow chart to begin every system fault investigation.

4-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Rectify a Critical Firmware/Hardware Failure

When a single critical firmware failure occurs, such as a software watchdog failure, or self-test detects a hardware failure, the processor module will automatically reboot into the Recovery Mode. In Recovery mode the application is stopped so the processor displays the following changes to the status indications occurs: READY goes Amber RUN goes Amber FORCE goes Amber AUX goes Amber SYSTEM HEALTHY stays Green and after a short delay goes Red HEALTHY goes Red You should do the following: 1) Collect the logs from the processor and contact Product Support at " icstsupport@ra.rockwell.com and submit them for analysis by support. alternatively 2. You can replace the processor module and contact your regional office for an RMA number to return the faulty module.

Install a T9110 Processor Module

Note: All new processor modules are delivered with the latest firmware and a base level Recovery Mode firmware build. You can enter the Recovery Mode by pressing the Fault Reset button immediately after the module has booted up. Inspect the module: Before inserting a new I/O module, inspect it for damage. The identification labels on the sides of the I/O module will be hidden once the module is installed. Therefore before installation record the location of the module and the details shown on the label. If you are installing more than one processor module make sure they all have the same firmware build. To install each T9110 processor module, do the following:

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

4-3

Troubleshooting and Maintenance Manual (AADvance Controller)

1) Examine the coding pegs on the T9100 processor base unit and verify they complement the sockets on the rear of the processor module:

2) Place the processor module on to the dowel pins on the processor base unit. Make sure the slot on the head of the module clamp screw is vertical and then push the module home until the connectors are fully mated. 3) The module locking screw requires a quarter turn clockwise to lock. Use a broad (9mm) flat blade screwdriver to lock the locking screw. Note: The locking screw acts as a power interlock device. Therefore, the locking screw must be in the locked position after the power is applied otherwise the module will not boot up.

Upgrade a Processor Module Firmware

To upgrade ethe firmware use the Recovery Mode and follow the procedures using the ControlFLASH utility. Refer to the configuration Guide for detailed procedures on using the ControlFLASH utility. Note: If you need to downgrade the firmware to meet the requirements of your application and system contact Product support.

Install a Processor BackBack-up Battery

The T9110 processor module uses a battery to support its internal clock and memory when it is powered off. The battery condition is monitored by the module diagnostics every 24 hours. If the battery voltage is low, an application variable is set indicating there is a problem and the processor Healthy LED goes red. Note: The processor back up battery is supplied separately and must be installed into each new processor.

4-4

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

To install a new battery, do the following:

(Part No: T9905 Poly-carbonmonofluride Lithium Coin Battery, BR2032 (recommended type) , 20mm dia; Nominal voltage 3V; Nominal capacity (mAh) 190; Continuous standard load (mA) 0.03; Operating temperature -30C to 80C, supplied by Panasonic. The battery will last for approximately 10 years under normal operating conditions, or approximately six months if the module is not in use. 1) Use a small cross head screwdriver to release the battery cover. Remove the cover. 2) To remove an old battery pull on the ribbon in the battery holder and pull the battery out. 3) To install a new battery orientate the new battery with the positive (+) terminal to the right. Trap the ribbon behind the new battery so it can be removed in the future and then push the battery into the holder. 4) Reinstall the battery cover. 5) Press the Fault Reset button on the processor module. The processor Healthy LED will go green (applies if the module is part of a running system). If the battery is replaced when only a single processor module is installed and the processor module is not under power the processor clock will need to be be reset to the current time. Correct the clock at the earliest opportunity. If it is replaced when more than one processor module is installed then the clock will be updated through synchronization. If you have previously set up SNTP when you set up your processor module then the clock will be reset to the current time automatically. If you haven't set up SNTP it is recommended that you do so, as this will not only reset the processor clock but will also keep the time accurately during normal operation. Refer to the AADvance Configuration Guide, Chapter 4 for the SNTP set up instructions. Alternatively use the following procedures to set the processor clock using the Processor Variables.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

4-5

Troubleshooting and Maintenance Manual (AADvance Controller)

Set the Processor clock To set the processor clock you can use the RTC variables: 1) To monitor the time, wire variables to all the RTC Status points. 2) To configure the time to be set, wire variables to the RTC Program points. Hours Minutes and Seconds 3) Preset all RTC Program variables to the time that is to be programmed. It is recommended that you set the time to 03:00. Do not set the time to midnight or a slow clock will always be set back 24 hours. 4) To control the time setting, wire variables to the RTC Control points: RTC Write RTC Read and 5) Wire variables to RTC Control: Hours Minutes Seconds 6) Set RTC Read to be always True (The time will not be written unless this point is also True) 7) Set RTC Control elements Hours, Minutes and Seconds to be always True. 8) Use an external trigger to change RTC Write from False to True at the right time. The time will be set into the Real Time Clock Note: On the very first setting it will be necessary to program all the time elements manually (Year, Month, Day, etc.)

4-6

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Processor Module Start Up Process

Note: When inserting more than one processor module they MUST be inserted one at a time and the module be allowed to educate (in the case of a 2nd and 3rd processor).
Table 4: Step 1. 2. Task Install the processor into a processor base unit slot. All LEDs are off and after applying power the processor will display the following status indications: Healthy Ready Run System Healthy Force Aux Serial 1 Serial 2 Ethernet 1 Ethernet 2 Flashes RED for a second then goes GREEN as the module boots up (10 to 20 seconds) Will remain OFF as the module boots up (10 - 20 seconds) then goes RED Will remain OFF as the Module boots up (10 to 20 seconds) then goes RED Will remain OFF as the Module boots up (10 to 20 seconds) then goes GREEN Will remain OFF as the Module boots up (10 to 20 seconds) then stays OFF until the module has educated. Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection. Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection Single Processor Module Installation Procedure (New Processor Module)

You have to set up the processor IP Address so that the workstation can communicate with the processor module and download the latest firmware build and configure the processor variables. 3. Set the Controller IP Address for all the processor modules using the "AADvance Discover Utility". (Refer to the Configuration Guide for detailed instructions on using the AADvance Discover Utility Doc. No: 553633. Install a Program Enable Key. Download a valid application and press the FAULT RESET button. When the application is downloaded and valid the module will display the following indications: Valid Application Downloaded Healthy Ready Run System Healthy GREEN GREEN RED to GREEN (Flashes GREEN as the module educates) GREEN

4.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

4-7

Troubleshooting and Maintenance Manual (AADvance Controller)

Step

Task Force Aux Serial 1 Serial 2 Ethernet 1 Ethernet 2 GREEN Off (Application Dependent) Dependent on data connection Dependent on data connection Dependent on data connection Dependent on data connection

Table 5:

Procedure Procedure for Installation of a 2nd and 3rd Processor

Note: The second and third processor modules must be programmed with the same firmware as the first processor. Check the firmware revision on the labels and if required use the procedure in the Configuration Guide. If the firmware revision is different to the first processor module you can download the latest firmware build to all the processor modules using the ControlFLASH utility. When inserting a second and third processor module they MUST be inserted one at a time and allowed to educate before inserting the next one.

Step 1.

Task Place the processor module on slot B on the Processor Base Unit connectors and push the module home until the connectors are fully mated. Turn the locking screw with a flat bladed screwdriver to lock the module in position. All the Module LEDs are OFF until the module is installed. As soon as the module receives power it will boot up then educate and display the following indications: Healthy Ready Flashes RED for a second then goes GREEN as the module boots up (10 to 20 seconds) Will remain OFF as the module boots up (10 - 20 seconds) then goes RED for 10 secs then flashes GREEN as it educates and finally it goes to steady GREEN Will remain OFF as the module boots up (10 - 20 seconds) then goes RED until educated and then it goes AMBER Will remain OFF as the Module boots up (10 to 20 seconds) then goes GREEN Will remain OFF as the Module boots up (10 to 20 seconds) then stays OFF until the module has educated and the application is running Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection

Run System Healthy Force Aux Serial 1

4-8

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Step

Task Serial 2 Ethernet 1 Ethernet 2 Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection Will remain OFF as the Module boots up (10 to 20 seconds) then is dependent upon data connection

When the Run indicator goes AMBER press the Fault Reset button and the processor will display the following indications: 2. Healthy Ready Run System Healthy Force Aux Serial 1 Serial 2 Ethernet 1 Ethernet 2 3. Green GREEN (can flash for a short time as the module educates) AMBER to GREEN (AMBER as the module educates) GREEN Off to GREEN Off (application dependent) Dependent on Data Connection Dependent on Data Connection Dependent on Data Connection Dependent on Data Connection

To insert a 3rd processor module repeat step 1 and insert in Slot C.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

4-9

Troubleshooting and Maintenance Manual (AADvance Controller)

Install I/O Modules

Inspect the module: Before inserting a new I/O module, inspect it for damage. The identification labels on the sides of the I/O module will be hidden once the module is installed. Therefore before installation record the location of the module and the details shown on the label. Examine the coding pegs on the termination assembly and verify they complement the sockets on the rear of the new I/O module. To install each I/O module, do the following: 1) Examine the coding pegs on the termination assembly and verify they complement the sockets on the rear of the I/O module. 2) Place the I/O module on to the dowel pins on the T9300 I/O base unit. Make sure the slot on the head of the module clamp screw is vertical and then push the module home until the module connectors are fully mated with the I/O base unit and termination assembly connectors. 3) The locking screw requires a quarter turn clockwise to lock. Use a broad (9mm) flat blade screwdriver to lock the clamp screw. Note: The locking screw acts acts as a power interlock device and must be in the locked position when power is applied otherwise the module will not power up.

I/O Module Start Up Process

To start up an Input/Output Module follow this procedure: Note: The start up sequence is different when a module is installed into an on-line system that is running compared to installing the module into a system that is off-line and has processor modules but no I/O modules installed. The first part of this procedure covers the initial start up of an off-line system, the second part covers a system that is on line and you are adding I/O modules.
Table 6: Step 1. 2 3. Task This procedure applies to a single module installed or the first module of a redundant group. Install the Input/Output Module and turn the locking screw to the lock position. The input module will provide the following status indications: Healthy Ready GREEN RED Single Module or First First Module of a group Installation Procedure

4-10

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Run Channel 1 8 4. 5.

RED Off

The input module will enter its start up sequence during which the module will educate. Wait for approximately 3 seconds. The module will now provide the following status indications: Healthy Ready Run Channel 1 8 GREEN GREEN AMBER Off

6. 7.

Press the Fault Reset button on the processor module and the Run indication goes GREEN. The module will now be on-line with the following status indications: Healthy Ready Run Channel 1 8) GREEN GREEN GREEN Dependent on channel status

8.

If the module fails to educate and go on-line replace the module.

Table 7: Step 1. 2 3. Task

Second or third Module of a Group Installation Procedure

This procedure applies to a second or third module of a redundant group. Install the Input/Output Module and turn the locking screw to the lock position. The input module will provide the following status indications: Healthy Ready Run Channel 1 8 GREEN RED RED Off

4. 5.

The input module will enter its start up sequence during which the module will educate. Wait for approximately 3 seconds. The module will now provide the following status indications: Healthy Ready Run Channel 1 8 GREEN GREEN AMBER Off

6. 7.

Press the Fault Reset button on the processor module and the Run indication goes GREEN. The module will now be on-line with the following status indications: Healthy GREEN

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

4-11

Troubleshooting and Maintenance Manual (AADvance Controller)

Ready Run Channel 1 8) 8.

GREEN GREEN Dependent on channel status

If the module fails to educate and go on-line replace the module.

4-12

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 5
Troubleshooting and Rectifying Channel/Field Faults
The AADvance controller indicates a channel fault that could be a faulty termination assembly or field fault by a Channel LED on an I/O module showing amber instead of the usual green. This chapter provides recommended approaches to troubleshoot and remedy channel/field faults. It should be read in conjunction with the operation and maintenance manual or equivalent documentation for the system.

WARNING ELECTRICAL ARCS AND EXPLOSION RISK IN HAZARDOUS AREAS If you connect or disconnect wiring, modules or communications cabling while power is applied, an electrical arc can occur. This could cause an explosion in hazardous location installations. Do not remove wiring, fuses, modules or communications cabling while circuit is energized unless area is known to be non hazardous. Failure to follow these instructions may result in personal injury.

In This Chapter
Examine the State Variable ............................................................................... 5-2 Start Troubleshooting Channel/Field Faults ................................................. 5-3 Replacing Fuses.................................................................................................. 5-12 Install a New Termination Assembly ........................................................... 5-14

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

5-1

Troubleshooting and Maintenance Manual (AADvance Controller)

Examine the State Variable

You will use the State variable (<tagname>.STA) to trace field faults. To do this, you have to identify the tagname of the variable, and then add the variable to the Spy List. Do the following:

1) Select the Equipment tab to use the Project Tree View to locate the channel you wish to investigate. 2) Identify the reference for the State variable. This will be of one of two forms: %IBnnn.0.7 for an input module %QBnnn.0.7 for an output module (illustrated) Note: From Release 1.2, live data is available in the view shown above. For earlier releases, use the Spy List as described below. 3) Select Debug Target and then open the Spy List.

5-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

4) Double-click on the Name field. 5) Select the tagname for the state variable from the drop down list. The State variable is added to the Spy list. The value of the State variable ('2' in this example) will update in real time to reflect the state of the I/O channel. Note: If the Spy List is empty, double-click on the ellipsis (...) to create the entry.

Start Troubleshooting Channel/Field Faults

An investigation into a channel/field fault begins with a channel indication on an I/O module showing amber. Do the following: For digital input modules use chart 'A'. For analogue input modules use chart 'B'. For output modules use chart 'C'.

Diagnose a Digital Input Channel

Use this circuit diagram in conjunction with chart 'A'.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

5-3

Troubleshooting and Maintenance Manual (AADvance Controller)

5-4

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

5-5

Troubleshooting and Maintenance Manual (AADvance Controller)

Diagnose an Analogue Input Channel

Use this circuit diagram in conjunction with chart 'B'.

5-6

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

5-7

Troubleshooting and Maintenance Manual (AADvance Controller)

Diagnose a Digital Output Channel

Use this circuit diagram in conjunction with chart 'C'.

5-8

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

5-9

Troubleshooting and Maintenance Manual (AADvance Controller)

Diagnose an Analogue Output Channel

Use this circuit diagram in conjunction with chart 'D'.

5-10

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Tracing a Channel/Field Fault on an Analogue Output

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

5-11

Troubleshooting and Maintenance Manual (AADvance Controller)

Replacing Fuses
The digital/analogue Input Termination Assemblies and digital output termination assemblies have fuses that can be easily accessed and replaced without removing the module or the termination assembly. Use the following procedures to replace the fuses. Digital Input Fuses T9901: No 396/TE5 50mA time lag fuse; UL 248-14, 125 V,T Leadfree; manufactured by Littlefuse. Digital Output Fuses T9902: SMF Omni-Block, Surface Mount Fuse Block 154 010, with a 10A, 125V Fast Acting Fuse, Littlefuse.

WARNING

FUSE REMOVAL or REPLACEMENT

When the controller is installed in a Hazardous environment do not remove or replace a fuse when energized.

Replace Input Channel Fuse

To replace a digital or analogue channel fuse on a Termination Assembly carry out the following procedure: 1) Use a small screwdriver to open the fuse cover.

2) Locate the blown fuse and remove with a pair of long nosed pliers.

5-12

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

3) Insert new fuse using long nosed pliers.

4) Close the fuse cover.

Replacing Digital Output Fuses

To replace a Digital Output Termination Assembly fuse follow this procedure: 1) Use a small screwdriver to open the fuse cover.

2) Remove the blown fuse with a pair of long nosed pliers.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

5-13

Troubleshooting and Maintenance Manual (AADvance Controller)

3) Insert a new fuse using the same long nosed pliers.

4) Close the fuse cover.

Install a New Termination Assembly

To install a new termination assembly, do the following. Remove the I/O Module(s) Remove each I/O module that uses the termination assembly: 1) Locate the head of the clamp screw on the front of the module. Use a broad (8mm) flat blade screwdriver to turn the screw counterclockwise a quarter turn (so the slot is vertical) to unlock the clamp. 2) The module is aligned onto the controller by two steel dowel pins and is now retained by the friction of its backplane connectors. Grasp the module at the top and bottom and pull it away from the controller. Disconnect and Remove the Existing Termination Assembly 1) Record the identity and location of each wire at the terminal block. Then disconnect each wire.

5-14

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

2) Depress the retaining tab below the termination assembly (multiple tabs for dual and triple modular redundant versions) and then pull the termination assembly downwards. 3) Lift out the termination assembly.

Fit and Wire the the New Termination Assembly 1) Insert the retaining clip on the back of the termination assembly into the slot on the I/O base unit. Press the termination assembly onto the base unit and then slide the assembly upwards as far as it will go. Make sure each retaining tab clips over the printed circuit board to secure the termination assembly in position. 2) Connect the wiring to the screw terminal blocks. Apply a minimum tightening torque of 0.5 Nm (0.37 ft lb) to the terminal screws. 3) Insert the I/O module (refer to the I/O installation procedure).

Operation and Maintenance Plan

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

6-15

Troubleshooting and Maintenance Manual (AADvance Controller)

The provision of an Operation and Maintenance Plan ensures that functional safety can be maintained beyond the commissioning of the system. The in-service operation and maintenance is normally outside the responsibility of the system integrator, but the system integrator can provide guidance and procedures to ensure that the persons or organizations responsible for operation and maintenance can ensure the system operates to the specified safety levels. The Operating and Maintenance Plan shall include the following items: Clear definitions of power up and down sequences. These definitions shall ensure that the sequences cannot result in periods when the system is unable to respond safely whilst a hazard may be present. The procedures for re-calibrating sensors and actuators. The recommended calibration periods shall also be included. The procedures for periodically testing the system, together with definitions of the maximum intervals between testing. Definitions of the overrides to be applied to be able to carry maintenance of the sensors and actuators. The procedures for maintaining system security.

Input Module Calibration

The Operation and Maintenance Plan shall include recommendations to check the calibration of controller input modules. The calibration of each analogue input module should be checked every two years; the calibration of each digital input module should be checked every five years.

Planned Maintenance
In most system configurations there will be some elements that are not tested by the system's internal diagnostics for example, the final passive elements in I/O modules, the sensors and actuators themselves, and the field wiring. A regime of planned maintenance testing shall be defined to ensure that any faults, which could ultimately lead to the system's inability to perform its safety functions, do not accumulate. The maximum interval between these tests shall be defined before installation. It is highly recommended the test interval be less than the Proof Test Interval used to calculate the PFD values.

6-16

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Field Device Maintenance

The Operation and Maintenance Plan shall include field maintenance activities, such as re-calibration, testing and replacement of devices, which were specified by the system design requirements. In general, adequate provision for these measures will be defined by the client. As long as the necessary maintenance overrides and other facilities are implemented, no further safety requirements will be needed. It is highly recommended the I/O forcing capability is NOT used to support field device maintenance. Should I/O forcing be used to support field device maintenance, the requirements defined for 'Input and Output Forcing' in this manual shall be applied.

Module Fault Handling

When the AADvance controller uses modules in a dual or triple redundant configuration, the controller can continue to operate if one of its modules should develop a fault. However, when a module does have a fault it should be replaced as recommended in the Safety Manual (all modules allow live removal and replacement in redundant configurations) to ensure that faults do not accumulate and that multiple failure conditions result in a plant shutdown. On-site repair is not supported except for the replacement of fuses within some termination assemblies. All failed modules should be returned for repair or fault diagnosis in accordance with the warranty and return policy documentation delivered with your system.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

6-17

Troubleshooting and Maintenance Manual (AADvance Controller)

Monitoring
To ensure that the safety objectives are met through the lifetime of the system it is important to maintain records of all faults, failures and anomalies as they occur. This requires the maintenance of records by both the end-user and the System Integrator. It is highly recommended the following information is included: Description of the fault, failure or anomaly Details of the equipment involved, including module types and serial numbers where appropriate When the fault was experienced and any circumstances leading to its occurrence Any temporary measures implemented to correct or work around the problem Description of the resolution of the problem and reference to remedial action plans and impact analysis You should define the procedure for field returns, and repair and defect handling. The information requirements placed on the end user because of this procedure should be clearly documented and provided to the end user. The defect handling procedure shall include: Method of detecting product related defects and the reporting of these to the original designers Methods for detecting systematic failure that may affect other elements of the system or other systems, and links to the satisfactory resolution of the issues Procedures for tracking all reported anomalies, their work around and resultant corrective action where applicable

Maintaining Functional Safety

Design changes will inevitably occur during the system life-cycle; to ensure that the system safety is maintained, such changes shall be carefully managed. Procedures defining the measures for updating the plant or system shall be defined and documented. These procedures are the responsibility of the end user, but the system integrator shall provide sufficient guidance to so that the procedures maintain the required level of functional safety during and after the changes.

Input Module Calibration

The Operation and Maintenance Plan shall include recommendations to check the calibration of controller input modules. The calibration of each analogue input module should be checked every two years; the calibration of each digital input module should be checked every five years.

6-18

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Product Level Module and Firmware Updates

Special consideration shall be given to procedures for product level module and firmware updates. Updates to the system shall include the modification requirements for application changes and firmware changes. The procedures shall include the need to undertake impact analysis of any such changes, and the measures to change the system and its application programs as a result of the the modification requirements. Specifically, the additional requirements defined here shall be applied, as well as the requirements defined for the following items: Scope definition Hazard and risk analysis System Functional and Safety Requirements System engineering Application programming System production System integration Installation and commissioning The definition of these procedures shall include the review and authorization process to be adopted for system changes.

Baselines
Baselines shall be declared, beyond which any change shall follow the formal change management procedure. The point within the lifecycle at which these baselines are declared depends on the detail of the processes involved, the complexity of the system, how amenable to change these processes are, and the required safety requirements class. It is recommended the baseline for formal change process be the completion of each step in the lifecycle. However, as a minimum the baseline shall be declared before start-up, when the potential hazards are introduced.

Modification Records
Modification records, to provide traceability of each requested or required change, shall be maintained. The change management procedure shall include the consideration of the impact of each such change before authorizing the change. The implementation of the change should repeat the safety lifecycle phases which are affected by the change. The test of the resultant changes should include non-regression testing as well as test of the change itself. All test results should be documented.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

6-19

Troubleshooting and Maintenance Manual (AADvance Controller)

Decommissioning
The procedure for decommissioning the system shall be defined. This procedure should include specific requirements for the safe decommissioning of the system and, where applicable, the safe disposal or return of materials. As with commissioning, it is likely the decommissioning will be performed in a phased manner. The decommissioning procedure shall ensure that a plan be developed that maintains the functional safety whilst the corresponding hazards are present. Similarly, the physical environment of the control equipment shall be maintained whilst the equipment is required to function. The procedure for decommissioning shall address the following items: The sequence in which the hazards are to be removed. Methods which permit the removal of interactions between safety functions whilst maintaining functional safety for the remaining potential hazards and without initiating safety responses. This shall include the interaction between systems. A definition of the modules and materials which are to be returned to Rockwell Automation for safe disposal following decommissioning.

6-20

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 7
Parts List
Bases Part No. T9100 T9300 Part Description Processor base unit I/O base unit (3 way)

Modules Part No. T9110 Part Description Processor module

T9401 T9402 T9451

Digital input module, 24Vdc, 8 channel, isolated Digital input module, 24Vdc, 16 channel, isolated Digital output module, 24Vdc, 8 channel, isolated, commoned

T9431 T9432

Analogue input module, 8 channel, isolated Analogue input module, 16 channel, isolated

T9481 T9482

Analogue output module, 3 channel, isolated Analogue output module, 8 channel, isolated

Special Application Modules Part No. T9441 Part Description Frequency Input Module (Product not yet released. Contact Sales for more information)

Termination Assemblies Part No. T9801 T9802 T9803 Part Description Digital input TA, 16 channel, simplex, commoned Digital input TA, 16 channel, dual Digital input TA, 16 channel, TMR

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

7-1

Troubleshooting and Maintenance Manual (AADvance Controller)

T9831 T9832 T9833

Analogue input TA, 16 channel, simplex, commoned Analogue input TA, 16 channel, dual Analogue input TA, 16 channel, TMR

T9851 T9852

Digital output TA, 24Vdc, 8 channel, simplex, commoned Digital output TA, 24Vdc, 8 channel, dual

T9881 T9882

Analogue output TA, 8 channel, simplex commoned Analogue output TA, 8 channel, dual

T9844 T9845 T9846 T9847 T9848 T9849

Frequency Input Module TA, Simplex, Active (not yet released) Frequency Input Module TA, Dual, Active (not yet released) Frequency Input Module TA, TMR, Active (not yet released) Frequency Input Module TA, Simplex, Passive (not yet released) Frequency Input Module TA, Dual, Passive (not yet released) Frequency Input Module TA, TMR, Passive (not yet released)

Expansion Cable Assembly Expansion cable assembly, comprising expansion cable and two adaptors Part No. T9310-02 Part Description Backplane expansion cable, 2 metre

Blanking Covers Part No. T9191 T9193 Part Description Blanking cover (tall) for I/O positions with no TA fitted Blanking cover (short) for I/O positions with TA or a Processor

Spares & Tools Part No. T9901 T9902 Part Description Replacement input fuse 50mA (pack of 20)* see notes (for T9801/2/3 and T9831/2/3) Replacement output fuse 10A (pack of 20) * see notes (for T9851/2)

7-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

T9903 T9904 T9905 T9906

Replacement coding pegs (pack of 20) Replacement backplane clips (pack of 20) Replacement processor 3V lithium cell (pack of 20) *see notes Replacement program enable key

T9907 T9908

Installation tool kit Fuse Extractor Tool

Software Part No. T9082U T9082D Part Description IEC 61131 Workbench, USB key, single user, single controller IEC 61131 Workbench, hard disk key, single user, single controller

Part No. T9083U T9083D

Part Description IEC 61131 Workbench, USB key, multiple controllers IEC 61131 Workbench, hard disk key, multiple controllers

Part No. T9084U T9085

Part Description IEC 61131 Workbench, 5 user USB key, multiple controllers 5 additional user licenses, for use with T9084U

Part No. T9030 T9033

Part Description OPC portal server AADvance DTM (for use with HART Passthru feature)

Demonstration Unit Part No. T9141 Part Description AADvance Demonstration Unit (Including HMI)

Micellaneous Items Part No. T9020 Part Description Euro BUSP Kit

Notes: T9901: No 396/TE5 50mA time lag fuse; UL 248-14, 125 V,T Leadfree; manufactured by Littlefuse.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

7-3

Troubleshooting and Maintenance Manual (AADvance Controller)

T9902: SMF Omni-Block, Surface Mount Fuse Block 154 010, with a 10A, 125V Fast Acting Fuse, Littlefuse. T9905: Poly-carbonmonofluride Lithium Coin Battery, BR3032, 20mm dia; Nominal voltage 3V; Nominal capacity (mAh) 190; Continuous standard load (mA) 0.03; Operating temperature 30C to 80C, supplied by Panasonic

7-4

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Glossary of Terms

Glossary of Terms
A
accuracy
The degree of conformity of a measure to a standard or a true value. See also 'resolution'.

asynchronous
A data communications term describing a serial transmission protocol. A start signal is sent before each byte or character and a stop signal is sent after each byte or character. An example is ASCII over RS232-C. See also 'RS-232-C, RS-422, RS-485'.

achievable safe state

A safe state that is achievable. Note: Sometimes, a safe state cannot be achieved. An example is a non-recoverable fault such as a voting element with a shorted switch and no means to bypass the effect of the short.

availability
The probability that a system will be able to carry out its designated function when required for use normally expressed as a percentage.

actuator
A device which cause an electrical, mechanical or pneumatic action to occur when required within a plant component. Examples are valves and pumps.

B
backplane clip
A sprung, plastic device to hold together two adjacent AADvance base units. Part number 9904. Used in pairs.

AITA
Analogue input termination assembly.

base unit
One of two designs which form the supporting parts of an AADvance controller. See 'I/O base unit' and 'processor base unit'.

alarms and events (AE)

An OPC data type that provides time stamped alarm and event notifications.

bindings
Bindings describe a "relationship" between variables in different AADvance controllers. Once a variable is "bound" to another variable, a unique and strong relationships is created between the two variables and the SIL 3 Certified SNCP protocol is used to ensure that the consuming variable is updated with the data from the producing variable.

allotted process safety time

The portion of the total process safety time allotted to a sub function of that process.

application software
Software specific to the user application, typically using logic sequences, limits and expressions to read inputs, make decisions and control outputs to suit the requirements of the system for functional safety.

black channel
A communication path whose layer (i.e. cabling, connections, media converters, routers/switches and associated firmware/software, etc.) has no requirement to maintain the integrity of safety critical data transferred over it. Measures to detect and compensate for any errors introduced into the black channel must be implemented by the safety critical sender and receiver (by software and/or hardware means) to make sure the data retains its integrity.

architecture
Organizational structure of a computing system which describes the functional relationship between board level, device level and system level components.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

8-1

Troubleshooting and Maintenance Manual (AADvance Controller)

blanking cover
A plastic moulding to hide an unused slot in an AADvance base unit.

C
CIP
Common Industrial Protocol. A communications protocol, formally known as 'CIP over Ethernet/IP', created by Rockwell Automation for the Logix controller family, and which is also supported by the AADvance controller. AADvance controllers use the protocol to exchange data with Logix controllers. The data exchange uses a consumer/producer model.

boolean boolean
A type of variable that can accept only the values 'true' and 'false'.

BPCS
Basic process control system. A system which responds to input signals and generates output signals causing a process and associated equipment to operate in a desired manner, but which does not perform any safety instrumented functions with a claimed safety integrity level of 1 or higher. Refer to IEC 61511 or to ANSI/ISA 84.00.012004 Part 1 (IEC 61511-1 Mod) for a formal definition. Equivalent to the Process Control System (PCS) defined by IEC 61508.

clearance
The shortest distance in air between two conductive parts.

coding peg
A polarization key, fitted to the 9100 processor base unit and to each termination assembly, which ensures only a module of the correct type may be fitted in a particular slot. Part number 9903.

breakdown voltage
The maximum voltage (AC or DC) that can be continuously applied between isolated circuits without a breakdown occurring.

coil
In IEC 61131-3, a graphical component of a Ladder Diagram program, which represents the assignment of an output variable. In Modbus language, a discrete output value.

BS EN 54
A standard for fire detection and fire alarm systems.

Compiler Verification Tool (CVT)

The Compiler Verification Tool (CVT) is an automatic software utility that validates the output of the application compilation process. This process, in conjunction with the validated execution code produced by the AADvance Workbench, ensures a high degree of confidence that there are no errors introduced by the Workbench or the compiler during the compilation of the application.

BS EN 60204
A standard for the electrical equipment of machines, which promotes the safety of persons and property, consistency of control response and ease of maintenance.

bus
A group of conductors which carry related data. Typically allocated to address, data and control functions in a microprocessor-based system.

configuration
A grouping of all the application software and settings for a particular AADvance controller. The grouping must have a 'target', but for an AADvance controller it can have only one 'resource'.

bus arbitration
A mechanism for deciding which device has control of a bus.

8-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 7 Glossary of Terms

consumer
The consuming controller requests the tag from the producing controller.

dictionary
The set of internal input and output variables and defined words used in a program.

contact
A graphical component of a Ladder Diagram program, which represents the status of an input variable.

discrepancy
A condition that exists if one or more of the elements disagree.

continuous mode
See high demand mode.

DITA
Digital input termination assembly.

controller
A logic solver; the combination of application execution engine and I/O hardware.

DOTA
Digital output termination assembly.

E
element
A set of input conditioning, application processing and output conditioning.

controller system
One or more controllers, their power sources, communications networks and workstations.

energise to action
A safety instrumented function circuit where the outputs and devices are de-energized under normal operation. Application of power activates the field device.

coverage
The percentage of faults that will be detected by automated diagnostics. See also 'SFF'.

creepage distance
The shortest distance along the surface of an insulating material between two conductive parts.

EUC
Equipment Under Control. The machinery, apparatus or plant used for manufacturing, process, transportation, medical or other activities.

cross reference
Information calculated by the AADvance Workbench relating to the dictionary of variables and where those variables are used in a project.

expansion cable assembly

A flexible interconnection carrying bus signals and power supplies between AADvance base units, available in a variety of lengths. Used in conjunction with a cable socket assembly (at the left hand side of a base unit) and a cable plug assembly (at the right hand side of a base unit).

D
data access (DA)
An OPC data type that provides real-time data from AADvance controllers to OPC clients.

F
fail operational state
A state in which the fault has been masked. See 'fault tolerant'.

dede-energize to action
A safety instrumented function circuit where the devices are energized under normal operation. Removal of power de-activates the field devices.

fail safe
The capability to go to a pre-determined safe state in the event of a specific malfunction.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

8-3

Troubleshooting and Maintenance Manual (AADvance Controller)

fault reset button

The momentary action push switch located on the front panel of the 9110 processor module.

function block diagram

An IEC 61131 language that describes a function between input variables and output variables. Input and output variables are connected to blocks by connection lines. See 'limited variability language'.

fault tolerance
Built-in capability of a system to provide continued correct execution of its assigned function in the presence of a limited number of hardware and software faults.

functional safety
The ability of a system to carry out the actions necessary to achieve or to maintain a safe state for the process and its associated equipment.

fault tolerant
The capability to accept the effect of a single arbitrary fault and continue correct operation.

G
group
A collection of two or three input modules (or two output modules), arranged together to provide enhanced availability for their respective input or output channels.

fault warning receiving station

A centre from which the necessary corrective measures can be initiated.

fault warning routing equipment

Intermediate equipment which routes a fault warning signal from the control and indicating equipment to a fault warning receiving station.

H
handhand-held equipment
Equipment which is intended to be held in one hand while being operated with the other hand.

field device
Item of equipment connected to the field side of the I/O terminals. Such equipment includes field wiring, sensors, final control elements and those operator interface devices hard-wired to I/O terminals.

HART
HART (Highway Addressable Remote Transducer) is an open protocol for process control instrumentation. It combines digital signals with analogue signals to provide field device control and status information. The HART protocol also provides diagnostic data. (For more details of HART devices refer to the HART Application Guide, created by the HART Communication Foundation, and their detailed HART specifications. You can download documents from www.hartcomm.org.)

fire alarm device

A component of a fire alarm system, not incorporated in the control and indicating equipment which is used to give a warning of fire for example a sounder or visual indicator.

fire alarm receiving station

A centre from which the necessary fire protection or fire fighting measures can be initiated at any time.

high demand mode

Where the frequency of demands for operation made on a safety-related system is greater than once per year or greater than twice the proof test interval. Applies to safety-related systems that implement continuous control to maintain functional safety. Sometimes known as 'continuous mode'.

fire alarm routing equipment

Intermediate equipment which routes an alarm signal from control and indicating equipment to a fire alarm receiving station.

8-4

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 7 Glossary of Terms

hot swap
See live insertion.

instruction list
An IEC 61131 language, similar to the simple textual language of PLCs. See 'limited variability language'.

I
I/O base unit
A backplane assembly which holds up to three I/O modules and their associated termination assembly or assemblies in an AADvance controller. Part number 9300. See 'I/O module' and 'termination assembly'.

integer
A variable type defined by the IEC 61131 standard.

IXL
IXL stands for ISaGRAF eXchange Layer.This is the communication protocol between ISaGRAF based components.

I/O module
A collation of interfaces for field sensors (inputs) or final elements (outputs), arranged in a self-contained and standardized physical form factor.

K
key connector
The receptacle on the AADvance controller for the program enable key. A 9-way 'D' type socket, located on the 9100 processor base unit.

IEC 61000
A series of international standards giving test and measurement techniques for electromagnetic compatibility.

IEC 61131
An international standard defining programming languages, electrical parameters and environmental conditions for programmable logic controllers. Part 3, which is entitled 'Programming Languages', defines several limited variability languages.

L
ladder diagram
An IEC 61131 language composed of contact symbols representing logical equations and simple actions. The main function is to control outputs based on input conditions. See 'limited variability language'.

IEC 61508
An international standard for functional safety, encompassing electrical, electronic and programmable electronic systems; hardware and software aspects.

LAN
Local area network. A computer network covering a small physical area, characterised by a limited geographic range and lack of a need for leased telecommunication lines.

IEC 61511
An international standard for functional safety and safety instrumented systems (SIS) for the process industry, encompassing electrical, electronic and programmable electronic systems, hardware and software aspects.

live insertion
The removal and then reinsertion of an electronic module into a system while the system remains powered. The assumption is that removal of the module and reinsertion will cause no electrical harm to the system. Also referred to as 'hot swap'.

indicator
A device which can change its state to give information.

low demand mode

Where the frequency of demands for operation made on a safety-related system is no greater than one per year and no greater than twice the proof-test frequency.

input (Workbench variable)

In the context of an AADvance Workbench variable, this term describes a quantity passed to the Workbench from a controller.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

8-5

Troubleshooting and Maintenance Manual (AADvance Controller)

M
manual call point
A component of a fire detection and fire alarm system which is used for the manual initiation of an alarm.

OPC
A series of standards specifications which support open connectivity in industrial automation.

output (Workbench variable)

In the context of an AADvance Workbench variable, this term describes a quantity passed from the Workbench to a controller.

Modbus
An industry standard communications protocol developed by Modicon. Used to communicate with external devices such as distributed control systems or operator interfaces.

P
peer to peer
A Peer to Peer network consists of one or more Ethernet networks connecting together a series of AAdvance and/or Trusted controllers to enable application data to be passed between them.

Modbus object
A representation of the configuration settings for a Modbus master or for its associated slave links, within the AADvance Workbench. The settings include communication settings and messages.

pinging
In Modbus communications, sending the diagnostic Query Data command over a link and by receiving a reply ensuring that the link is healthy and the controller is able to communicate with the master. No process data is transferred or modified. In the case of slave devices that will not support pinging then the Standby command will default to Inactive state, but no error will be returned.

module locking screw

The AADvance latch mechanism seen on the front panel of each module and operated by a broad, flat-blade screwdriver. Uses a cam action to lock to the processor base unit or I/O base unit.

N
NFPA 85
The Boiler and Combustion Systems Hazards Code. Applies to certain boilers, stokers, fuel systems, and steam generators. The purpose of this code is to contribute to operating safety and to prevent uncontrolled fires, explosions and implosions.

portable equipment
Enclosed equipment that is moved while in operation or which can easily be moved from one place to another while connected to the supply. Examples are programming and debugging tools and test equipment.

NFPA 86
A standard for Ovens and Furnaces. Provides the requirements for the prevention of fire and explosion hazards in associated with heat processing of materials in ovens, furnaces and related equipment.

process safety time (PST)

For equipment under control this represents the period of time a dangerous condition can exist without the protection of a safety instrumented system before a hazardous event occurs.

O
onon-line
The state of a controller that is executing the application software.

processor base unit

A backplane assembly which holds all of the processor modules in an AADvance controller. Part number 9100. See also 'processor module'.

8-6

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 7 Glossary of Terms

processor module
The application execution engine of the AADvance controller, housed in a selfcontained and standardized physical form factor.

RSRS-232232-C, RSRS-422, RSRS-485

Standard interfaces introduced by the Electronic Industries Alliance covering the electrical connection between data communication equipment. RS-232-C is the most commonly used interface; RS-422 and RS-485 allow for higher transmission rates over increased distances.

producer
A controller producing a tag to one or more consumers, at the request of the consumers.

RTC
Real-time clock.

program program enable key

A security device that protects the application from unauthorized access and change, in the form factor of a 9-way 'D' type plug. Part number 9906. Supplied with the processor base unit. See also 'key connector'.

RTU
Remote terminal unit. The Modbus protocol supported by the AADvance controller for Modbus communications over serial links, with the ability to multi-drop to multiple slave devices.

project
A collection of configurations and the definition of the linking between them. See 'configuration'.

S
safe state
A state which enables the execution of a process demand. Usually entered after the detection of a fault condition; it makes sure the effect of the fault is to enable rather than disable a process demand.

protocol
A set of rules that is used by devices (such as AADvance controllers, serial devices and engineering workstations) to communicate with each other. The rules encompass electrical parameters, data representation, signalling, authentication, and error detection. Examples include Modbus, TCP and IP.

safety accuracy
The accuracy of an analogue signal within which the signal is guaranteed to be free of dangerous faults. If the signal drifts outside of this range, it is declared faulty.

PST
Process Safety Time

safetysafety-critical state
A faulted state which prevents the execution of a process demand.

R
real
A class of analogue variable stored in a floating, single-precision 32-bit format.

sensor
A device or combination of devices that measure a process condition. Examples are transmitters, transducers, process switches and position switches.

redundancy redundancy
The use of two or more devices, each carrying out the same function, to improve reliability or availability.

sequential function chart

An IEC 61131 language that divides the process cycle into a number of well-defined steps separated by transitions. See 'limited variability language'.

resolution
The smallest interval measurable by an instrument; the level of detail which may be represented. For example, 12 bits can distinguish between 4096 values.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

8-7

Troubleshooting and Maintenance Manual (AADvance Controller)

SFF
Safe Failure Fraction. Given by (the sum of the rate of safe failures plus the rate of detected dangerous failures) divided by (the sum of the rate of safe failures plus the rate of detected and undetected dangerous failures).

synchronous synchronous
A data communications term describing a serial transmission protocol. A pre-arranged number of bits is expected to be sent across a line per second. To synchronise the sending and receiving machines, a clocking signal is sent by the transmitting computer. There are no start or stop bits.

SIF
Safety Instrumented Function. A form of process control that performs specified functions to achieve or maintain a safe state of a process when unacceptable or dangerous process conditions are detected.

T
TA
See 'termination assembly'.

target
An attribute of a 'configuration' which describes characteristics of the AADvance controller on which the configuration will run. Includes characteristics such as the memory model and the sizes of variable types for the controller.

SIL
Safety Integrity Level. One of four possible discrete levels, defined in IEC 61508 and IEC 61511, for specifying the safety integrity requirements of the safety functions to be allocated to a safety-related system. SIL4 has the highest level of safety integrity; SIL1 has the lowest. The whole of an installation (of which the AADvance system forms a part) must meet these requirements in order to achieve an overall SIL rating.

TCP
Transmission control protocol. One of the core protocols of the Internet Protocol suite. It provides reliable, ordered delivery of a stream of bytes from a program on one computer to another program on another computer. Common applications include the World Wide Web, e-mail and file transfer and, for an AADvance controller, Modbus communications over Ethernet.

SNCP
SNCP (Safety Network Control Protocol) is the Safety Protocol that allows elements of an AADvance System to exchange data. SNCP is a SIL 3 certified protocol which provides a safety layer for the Ethernet network making it a "Black Channel".

termination assembly
A printed circuit board which connects field wiring to an input or output module. The circuit includes fuses for field circuits. The board carries screw terminals to connect field wiring to the controller, and the whole assembly clips onto the 9300 I/O base unit.

SNTP
Simple Network Time Protocol. Used for synchronizing the clocks of computer systems over packet-switched, variablelatency data networks.

TMR
Triple modular redundant. A fault tolerant arrangement in which three systems carry out a process and their result is processed by a voting system to produce a single output.

structured text
A high level IEC 61131-3 language with syntax similar to Pascal. Used mainly to implement complex procedures that cannot be expressed easily with graphical languages.

TV certification
Independent third party certification against a defined range of international standards including IEC 61508.

8-8

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

Chapter 7 Glossary of Terms

U
U
Rack unit. A unit of measure used to describe the height of equipment intended for mounting in a standard rack. Equivalent to 44.45mm (1- inches).

V
validation
In quality assurance, confirmation that the product does what the user requires.

verification verification
In quality assurance, confirmation that the product conforms to the specifications.

voting system
A redundant system (m out of n) which requires at least m of the n channels to be in agreement before the system can take action.

W
withstand voltage
The maximum voltage level that can be applied between circuits or components without causing a breakdown.

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

8-9

Chapter 9
Additional Resources
For more information about the AADvance system refer to the associated Rockwell Automation technical manuals shown in this document map.

Publication Safety Manual

Purpose and Scope This technical manual defines how to safely apply AADvance controllers for a Safety Instrumented Function. It sets out standards (which are mandatory) and makes recommendations to ensure that installations meet their required safety integrity level. This technical manual describes the features, performance and functionality of the AADvance controller and systems. It sets out some guidelines on how to specify a system to meet your application requirements. This technical manual describes how to assemble a system, switch on and validate the operation of a your system. This manual defines how to configure an AADvance controller using the AADvance Workbench to meet your system and application requirements. This technical manual describes how to maintain, troubleshoot and repair an AADvance Controller. This manual describes how to install, configure and use the OPC Server for an AADvance Controller.

Solutions Handbook

System Build Manual Configuration Guide

Troubleshooting and Maintenance Manual OPC Portal Server User Manual

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08:

9-1

Troubleshooting and Maintenance Manual (AADvance Controller)

PFH avg and PFDavg Data

This document contains the PFHavg and PFDavg Data for the AADvance Controller. It includes examples on how to calculate the final figures for different controller configurations. The data supports the recommendations in the AADvance Safety Manual Doc No: 553630.

Regional Offices
Rockwell Automation Oil and Gas Resources are available in Regional Offices worldwide.

Rockwell Automation 4325 West Sam Houston Parkway North, Suite 100 Houston Texas 77043-1219 USA Tel: +1 713 353 2400 Fax: +1 713 353 2401

Rockwell Automation Hall Road Maldon Essex CM9 4LA England, UK

Rockwell Automation Millenium House Campus 1 Aberdeen Science & Tech Park Balgownie Road, Bridge of Don Scotland, UK +44-1224-227-780

Tel: +44 1621 854444 Fax: +44 1621 851531

Rockwell Automation. No. 2 Corporation Road #04-01 to 03 Corporation Place Singapore 618494

Abu Dhabi: 903, Bin Hamoodah Building 9th Floor Khalifa Street Abu Dhabi, UAE 971-2-627-6763

Dubai: Silvertech Middle East FZCO PO Box 17910 Jebel Ali Free Zone Dubai, UAE +9714 883 7070

Tel: +65 6622-4888 Fax: +65 6622-4884

Internet: http://www.rockwellautomation.com/icstriplex Technical support: icstsupport@ra.rockwell.com Sales enquiries: sales@icstriplex.com

9-2

Document: 553634 (ICSTT-RM406_EN_P) Issue: 08: