TRICONEX 3624 triple modular redundant supervised digital output module
TRICONEX 3624 is a supervised digital output (SDO) module with triple modular redundancy (TMR), designed for Tricon V9/V10/V11 SIS safety systems. It provides 16-channel isolated 24VDC solid-state output with comprehensive load/field diagnostics, meeting SIL3 (IEC 61508). Widely used in ESD, BMS, and safety interlock loops.
Description
1. Product Introduction
TRICONEX 3624 is a triple modular redundant supervised digital output module (Supervised Digital Output, SDO) belonging to the Tricon TMR safety instrument system under Schneider Electric, dedicated to driving 24VDC safety actuators in SIL 3 critical ESD and F&G safety loops. It adopts complete three independent redundant drive circuits with strict two-out-of-three hardware voting logic to eliminate single-point drive circuit failure risks of safety execution equipment such as solenoid trip valves, safety relays and isolation valve coils.
The module integrates 16 grouped commoned 24VDC output channels with built-in full-loop supervision circuit for every single channel, supporting real-time continuous detection of field wiring open circuit, short circuit and load loss faults. Each channel is equipped with independent self-recovery overcurrent short-circuit protection and optoelectronic isolation. It supports online non-stop hot-swap replacement without cutting off the whole rack power supply, and can run stably 24/7 under wide temperature, high vibration and strong electromagnetic interference industrial environments. Compared with the 3725 supervised DO module, the 3624 is a classic mid-density supervised output card widely used in early and medium-sized SIS projects, with mature loop diagnosis and stable load drive performance, widely deployed in petrochemical refining, onshore oil & gas stations, thermal power boiler protection and conventional chemical plant safety instrument systems.
2. Model Definition Explanation
The complete model TRICONEX 3624 consists of brand identifier, core hardware classification code and optional configuration suffixes, matched with dedicated terminal boards such as 3624T (source output) and 3624R (sink output) for field wiring mode switching:
Prefix TRICONEX: Brand mark, representing Tricon TMR safety control hardware series, distinguished from non-safety general automation I/O modules.
Four-digit core number 3624: Internal rack digital output module classification coding. The first digit "3" stands for digital input/output functional category; the middle two digits "62" mark classic supervised DC digital output circuit layout; the last digit "4" represents the base 16-channel commoned 24VDC supervised output hardware platform with full independent loop supervision per channel.
Optional suffix configuration codes attached after the model number to match differentiated project requirements:
No extra suffix: Standard mainframe module body, matched separately with 3624T source-type or 3624R sink-type field terminal board, standard indoor non-hazardous cabinet version.
-E: Full English firmware variant, all front panel fault codes, diagnostic prompts and TriStation configuration menu text displayed in English for overseas international projects.
-IS: Intrinsically safe matching variant with reinforced channel isolation barriers, applicable to Class I explosive hazardous area control cabinet deployment.
-HT: High-temperature extended operating variant, expanding stable upper operating temperature limit to +70°C for high-heat workshop cabinets.
3. Technical Specifications
Electrical Performance
The module obtains 24VDC working power from the Tricon rack backplane, rated power consumption lower than 10W, allowable input voltage fluctuation range 16VDC to 30VDC, absolute maximum withstand transient voltage 36VDC. It carries 16 grouped commoned output channels, supporting source or sink output mode determined by matched terminal board 3624T / 3624R. Single-channel continuous rated load current 0.7A, maximum 4.8A 10ms surge current for solenoid valve coil startup; minimum detectable load 30mA to realize effective loop supervision judgment. Each channel adopts independent optoelectronic isolation with 1500VDC isolation withstand voltage between internal TMR drive circuit and field load side.Built-in dedicated loop supervision circuit for each channel, capable of real-time identification of three core fault states: field wiring open circuit, load coil short circuit and complete load disconnection. Channel output response delay less than 10ms, full 16-channel state refresh cycle controlled within 20ms, each output state frame carries millisecond timestamps to guarantee high-precision SOE accident sequence recording. Every channel integrates self-recovery overcurrent and short-circuit protection; single-loop short-circuit fault only cuts off power supply of the corresponding channel without affecting normal drive of other safety interlock loops and main system logic operation. Typical channel voltage drop under full load less than 1.5VDC, maximum allowable load leakage current 4mA per channel.
Functional Safety & Reliability Index
TRICONEX 3624 fully complies with IEC 61508 SIL 3 and IEC 61511 process safety standards, and has passed UL, CE, ATEX, IECEx and API RP 14C industrial safety certifications. Three internal redundant drive circuits execute strict two-out-of-three hardware voting logic; abnormal drive signals generated by any single redundant channel will be automatically blocked, effectively avoiding false valve trip or misoperation of safety actuators caused by single circuit damage or electromagnetic interference. Hardware mean time to safe failure reaches 325,000 hours; mean time to repair is less than 10 minutes relying on online hot-swap function. It has complete single-fault masking capability; damage to one internal redundant circuit or fault of partial output channels will not cause full-module output failure. All loop fault alarm records are latched and stored in non-volatile memory for long-term factory safety audit traceability.
Environmental & Mechanical Parameters
Standard model operating ambient temperature range covers -40°C to +60°C; HT high-temperature variant extends upper stable operating limit to +70°C. Spare module storage temperature range spans -40°C to +85°C, suitable for long-term warehouse storage. Tolerable relative humidity ranges from 5% to 95% without condensation, protection grade IP20 for cabinet installation. The module passes complete industrial EMC anti-interference tests including electrostatic discharge, radiated radio frequency interference, surge impact and fast transient pulse interference. Designed for standard single-slot horizontal installation inside Tricon safety I/O rack, no forced air cooling required under full rated load. Mechanical vibration resistance meets onshore petrochemical plant, conventional gas station and thermal power plant application standards; long-term low-frequency continuous vibration will not lead to drive circuit failure, output signal drift or supervision circuit misjudgment. Not recommended for offshore platforms with severe continuous salt fog corrosion.
4. Interface and Communication Configuration
Hardware Interface Layout
The module integrates two independent hardware interface categories: rear internal backplane system interface and front field output wiring interface matched with supporting terminal board.The rear gold finger dedicated connector is Tricon proprietary TMR backplane bus interface, responsible for redundant power supply intake, three-way isolated bidirectional data exchange between the module and three redundant main CPU boards, and real-time uploading of module hardware faults and each channel loop fault codes to the rack mainframe.The front panel is equipped with multi-color LED grouped diagnostic indicator lights, including global PASS normal running indicator, global FAULT hardware alarm indicator, independent ON/OFF status light and LOAD fault alarm light for each of the 16 output channels, enabling maintenance personnel to directly judge the field actuator operating state and wiring fault location at the cabinet without relying on remote HMI viewing. All field load wiring terminals are arranged on supporting 3624T / 3624R terminal boards with dense screw-type terminals and independent shielding grounding terminals for each channel group, supporting crimp connection of double-shielded twisted-pair industrial cables for solenoid valve and safety relay wiring construction.
Internal Backplane Communication Mechanism
Data interaction between TRICONEX 3624 and triple redundant main processors relies on three completely isolated proprietary high-speed backplane buses, one-to-one corresponding to the three internal drive processing circuits of the module. Each redundant bus independently transmits safety interlock output control commands, channel supervision status and loop fault diagnostic information from each CPU to the digital output module. Before sending drive power signals to field output channels, the module executes two-out-of-three hardware voting on three groups of synchronous control commands to eliminate signal inconsistency caused by single CPU operation deviation. Faults such as backplane link disconnection, communication timeout and data parity errors will light the front panel global red FAULT indicator and upload detailed fault channel number and classification codes to TriStation configuration software and central monitoring HMI.
Output Channel Configuration Mode
The module does not carry independent Ethernet or serial communication ports; all channel safe failure state definition, supervision fault sensitivity threshold and output mode matching parameters are downloaded and stored in the redundant memory of Tricon main processors, and automatically synchronized to the 3624 module after power-on or hot-swap replacement. Operators can independently configure the safe state of each channel through TriStation software: set to trip cut-off state for emergency shutdown solenoid valves when module or communication fails; set to continuous power holding state for auxiliary isolation valves that need power to maintain closed position. The loop supervision function of each channel can be independently enabled or disabled according to the impedance characteristics of different field load coils to avoid misdiagnosis of low-power small loads.
5. Core Functions
- Triple Redundant 16-Channel Supervised Safety Output DriveThree independent redundant drive circuits synchronously receive safety interlock trip/hold commands from the mainframe, and only output 24VDC driving power to field loads after passing two-out-of-three hardware voting verification, completely avoiding misoperation of safety actuators caused by single circuit abnormality. Each channel is equipped with full real-time loop supervision function, which can capture hidden faults such as wire breakage, loose terminals and burnt valve coils that ordinary unsupervised digital output modules cannot identify. Fault of a single output channel only triggers local channel LOAD alarm and will not interfere with normal drive of other independent safety interlock loops.
- Per-Channel Independent Loop Fault Comprehensive DiagnosisContinuous background supervision diagnosis covers every field output loop, accurately identifying three typical dangerous fault modes: field wiring open circuit, load coil short circuit and complete load disconnection. All detected loop faults light the corresponding channel red LOAD fault indicator on the front panel, and upload fault channel serial number, fault occurrence timestamp and fault classification codes to the system central monitoring platform. Single-channel loop fault will not shut down the overall output function of the module, and all historical fault records can be exported for factory safety compliance audit and accident root cause analysis.
- Non-Stop Online Hot-Swap MaintenanceThe module supports plugging and replacement without cutting off the power supply of the entire safety rack. When pulling out a faulty 3624 module, the rack’s three redundant backplane bus architecture ensures that all safety interlock output logic of the system remains effective without interruption of field actuator control. After inserting a spare module of the same model and locking front panel fastening screws, the Tricon mainframe automatically completes hardware identification, redundant channel synchronization and all channel configuration parameter copying within 30 seconds; all 16 output channels resume normal drive and supervision functions without manual reconfiguration, eliminating production downtime caused by safety output module maintenance.
- Multi-Layer Electrical Isolation and Anti-Interference ProtectionEach output channel is equipped with independent optoelectronic isolation barriers with 1500VDC isolation withstand voltage to limit cross-transmission of abnormal energy between field hazardous process areas and internal TMR safety circuits, blocking lightning surges, static electricity and transient overvoltage from damaging core rack mainframe hardware. All field output cable shielding layers must implement single-point grounding at the control room cabinet ground bar to eliminate ground loop interference generated by long-distance workshop wiring. Internal circuit independent partitioning separates each channel drive and supervision circuit to avoid adjacent channel signal crosstalk leading to false load fault judgment.
- Customizable Safe State and Supervision Sensitivity MatchingThrough TriStation configuration software, operators can independently define the failure safe state of each output channel to match different types of safety execution equipment. For low-impedance or micro-power special coils, the supervision detection threshold of individual channels can be adjusted to adapt to load impedance differences of different manufacturers’ solenoid valves, reducing false alarm probability of supervision circuits. The module supports flexible switching between source and sink output modes by replacing supporting terminal boards without modifying module hardware configuration.
- Visual Independent Channel Status On-Site PromptThe front panel is equipped with independent ON/OFF status lights and LOAD fault alarm lights for each of the 16 channels. Maintenance personnel can directly check the actual power-on drive state of on-site safety valves and quickly locate wiring or coil fault channels at the cabinet, greatly improving daily equipment inspection and on-site troubleshooting efficiency of safety interlock loops.
6. Applicable Scenarios
- Medium and Large Petrochemical Refining ESD Emergency Shutdown SystemsUsed as safety actuator drive module for crude oil atmospheric-vacuum distillation, catalytic cracking and hydrogenation unit safety racks, driving emergency shutdown solenoid trip valves, safety isolation valves and trip relays. Built-in full-channel loop supervision continuously monitors the integrity of valve coil wiring to prevent hidden failure of shutdown execution loops that cannot be detected by ordinary output modules.
- Onshore Oil & Gas Station Fire and Gas Protection SystemsAdapted to onshore station control room environments with moderate humidity and vibration, driving fire suppression valve actuators, combustible gas alarm interlock relays and station pipeline emergency cut-off valves. The -IS intrinsically safe variant is adopted for control cabinets adjacent to Class I explosive hazardous production areas.
- Natural Gas Transmission Pipeline Compressor and Storage Station Safety Interlock SystemsServes station safety rack output expansion, driving pipeline overpressure emergency vent valves, compressor unit safety trip coils and remote valve group isolation actuators. The loop supervision function realizes timely alarm of damaged valve coils or broken signal cables of widely distributed pipeline valve groups.
- Conventional Thermal Power Plant Boiler Safety Protection SystemsApplied in medium-sized boiler SIS racks, driving boiler fuel cut-off solenoid valves, drum water level high/low interlock relays and furnace flame failure trip actuators, supporting fast response output for boiler overtemperature and dry-burning emergency shutdown protection.
- Medium-Sized Fine Chemical and Pharmaceutical Hazardous Production WorkshopsDeployed in Class I explosive hazardous area control rooms with -IS intrinsically safe configuration, driving reactor temperature/pressure safety relief valves, toxic gas interlock isolation valves and workshop emergency stop relays, realizing real-time monitoring of each safety actuator loop integrity.
- Coal Chemical and Hazardous Waste Incineration Plant Onshore Safety ControlSuitable for onshore production plants with high dust and slight corrosive indoor environments, driving incinerator emergency isolation doors, flue gas overpressure vent valves and storage tank overflow interlock actuators, maintaining stable drive and supervision performance under harsh field conditions.
7. Operation and Maintenance Instructions
Installation Requirements
TRICONEX 3624 main module must only be installed in dedicated supervised digital output single slots of standard Tricon TMR safety I/O rack, inserted horizontally into the card slot, and front panel fastening screws must be fully locked to ensure reliable contact between the rear backplane gold finger connector and rack bus. Corresponding supporting terminal board 3624T (source) or 3624R (sink) must be matched according to field load wiring requirements. All field output load cables must adopt double-shielded twisted-pair industrial cables; cable shielding layers must be single-point grounded at the control room cabinet ground bar, multi-point grounding on field valve equipment side is strictly prohibited to prevent ground loop induced interference. For intrinsically safe hazardous area cabinet installation, certified safety isolation barriers must be added between terminal board output terminals and field solenoid valves, strictly complying with intrinsic safety circuit parameter matching specifications. A ventilation gap of at least 15 centimeters must be reserved around the rack card slot; high-power heat-generating modules cannot be stacked beside the 3624 module to avoid overheating exceeding rated operating temperature and triggering channel overcurrent protection faults.
Daily Routine Inspection Standards
Conduct daily visual inspection to confirm the front panel PASS indicator stays steady green, the global FAULT alarm light remains off, and each channel ON/OFF status light matches the actual on-site valve working state without abnormal LOAD fault alarms. Log in to TriStation configuration software or system central HMI every day to check all 16 output channel supervision operating status, confirming no records of wiring open circuit, load short circuit, load loss or internal hardware faults. Every week, compare the channel drive state displayed by the module with the valve feedback signal collected by digital input modules to judge abnormal output drive deviation or supervision circuit misjudgment. Every month, clean dust accumulated on the front panel indicators, supporting terminal board wiring terminals and rack ventilation slits, check cabinet cooling fan operation status, and ensure the ambient temperature around the module stays within the specified -40°C ~ +60°C operating range.
Regular Inspection and Calibration Cycle
Under standard indoor control room operating conditions, full output channel drive function test and supervision circuit sensitivity calibration shall be performed every 12 months; for coastal salt fog workshops and high-temperature chemical production areas, the inspection cycle is shortened to 6 months. Before inspection, back up all channel safe state configuration and supervision threshold parameters stored in the Tricon main processor’s redundant memory. Use professional adjustable load simulators to inject standard coil load signals into each output channel one by one, verify normal drive function and accurate loop fault alarm judgment, adjust supervision impedance threshold parameters in configuration software if frequent load fault misjudgment occurs. After completing all channel tests, save updated configuration data to redundant system memory, and retain written inspection records including inspection date, operator name and fault test data for factory safety compliance audit.
Common Fault Handling Procedures
When a single channel LOAD fault alarm light is lit, first inspect the corresponding field solenoid valve coil and output wiring for breakage, short circuit or loose terminal joints, replace damaged valve coils or rework wiring after eliminating external load faults. If the front panel global FAULT red light is permanently lit and multiple output channels lose drive capability simultaneously, check rack 24VDC power supply voltage and whether the backplane connector has dust accumulation, corrosion or poor contact. If system diagnostics report internal drive circuit hardware failure of the module, direct hot-swap maintenance can be performed without rack power-off: unlock front fastening screws, steadily pull out the faulty module, insert a spare TRICONEX 3624 module of the same suffix version, lock screws tightly, wait for automatic synchronization of output configuration parameters to complete, then verify all 16 output channels resume normal drive and supervision functions and clear historical fault alarm logs. On-site disassembly of internal circuit components is forbidden; damaged modules must be returned to official authorized service centers for repair or scrapping. Unauthorized disassembly invalidates all SIL3 safety certifications of the hardware.
Spare Module Storage and Long-Term Service Management
Offline spare TRICONEX 3624 modules shall be stored in a constant-temperature dry warehouse with ambient temperature maintained at 0°C ~ 40°C and relative humidity controlled below 70%. Modules must be sealed in original anti-static packaging bags to prevent static electricity damage to internal drive and supervision chips, avoiding direct sunlight, corrosive gas and heavy dust environments. Every six months of shelf storage, take out spare modules for a 30-minute power-on aging test to activate internal circuit capacitors and prevent component performance degradation from long-term power-off state. The module’s design service life under rated normal operating conditions is 15 years; all on-site installed 3624 modules shall be batch-replaced upon reaching service life to maintain the overall SIL3 safety integrity level of the entire SIS system.
Maintenance Safety Prohibitions
Unauthorized modification of internal drive chips, independent firmware flashing or hardware wiring transformation of TRICONEX 3624 is strictly prohibited. Any modification voids functional safety certification and related industrial safety qualification certificates. Do not connect field loads with instantaneous single-channel current exceeding 0.7A continuous / 4.8A 10ms surge to output terminals; excessive overcurrent will permanently burn internal optoelectronic isolation and drive circuits. All maintenance operations involving module plugging, field output cable replacement or channel safe state parameter modification must be performed by certified SIS safety instrument maintenance personnel. Safety isolation measures for production safety interlock loops must be implemented before operation to avoid accidental triggering of emergency shutdown valves during maintenance. Hot-swap replacement of the module is forbidden during critical production startup, shutdown or emergency accident handling stages; all module maintenance work must be scheduled during planned equipment shutdown maintenance windows. This module is not recommended for new offshore platform SIS projects due to limited anti-salt fog corrosion performance.
Get a Quote