TRICONEX 3625 32-Channel TMR 24VDC Digital Output Module, SIL3 Certified
TRICONEX 3625 is a high-density triple modular redundant supervised digital output module designed for Schneider Tricon 3000 SIL3 safety instrument systems, developed originally by Invensys. It receives safety trip logic commands from three synchronized 3101 main processors and outputs 24VDC drive signals to field safety actuators including ESD solenoid valves, emergency trip interlock relays, fire suppression actuators, turbine shutdown contactors and alarm annunciators.
The module adopts three fully independent A/B/C redundant drive circuits to implement two-out-of-three hardware voting for all output signals, which avoids false tripping or failure-to-trip risks caused by single-channel hardware damage, electromagnetic surge interference and field wiring faults. It supports two configurable operation modes including supervised mode and non-supervised mode. Built-in continuous full-loop pulse diagnostic circuit, per-channel galvanic isolation, bidirectional TVS surge suppression and real-time backplane self-test circuits fully meet the high diagnostic coverage requirements of IEC 61508 and IEC 61511 SIL3 functional safety standards.
The complete safety control loop composed of TRICONEX 3625, TriBus backplane, triple redundant main processors and field safety equipment holds TÜV SIL3, UL508, CE EMC, ATEX Zone 2 cabinet and CSA hazardous location certifications. This module is widely deployed in petrochemical emergency shutdown racks, oil and gas fire and gas control cabinets, thermal power boiler burner management systems, steam and gas turbine overspeed protection racks and natural gas compressor anti-surge safety control platforms.
Description
TRICONEX 3625 is a high-density triple modular redundant supervised digital output module designed for Schneider Tricon 3000 SIL3 safety instrument systems, developed originally by Invensys. It receives safety trip logic commands from three synchronized 3101 main processors and outputs 24VDC drive signals to field safety actuators including ESD solenoid valves, emergency trip interlock relays, fire suppression actuators, turbine shutdown contactors and alarm annunciators.
The module adopts three fully independent A/B/C redundant drive circuits to implement two-out-of-three hardware voting for all output signals, which avoids false tripping or failure-to-trip risks caused by single-channel hardware damage, electromagnetic surge interference and field wiring faults. It supports two configurable operation modes including supervised mode and non-supervised mode. Built-in continuous full-loop pulse diagnostic circuit, per-channel galvanic isolation, bidirectional TVS surge suppression and real-time backplane self-test circuits fully meet the high diagnostic coverage requirements of IEC 61508 and IEC 61511 SIL3 functional safety standards.
The complete safety control loop composed of TRICONEX 3625, TriBus backplane, triple redundant main processors and field safety equipment holds TÜV SIL3, UL508, CE EMC, ATEX Zone 2 cabinet and CSA hazardous location certifications. This module is widely deployed in petrochemical emergency shutdown racks, oil and gas fire and gas control cabinets, thermal power boiler burner management systems, steam and gas turbine overspeed protection racks and natural gas compressor anti-surge safety control platforms.
2. Model Nomenclature
TRICONEX represents the triple modular redundant safety control brand under Schneider Electric. The number 3625 belongs to the high-density supervised digital output sub-series of Tricon I/O hardware.
The first two digits 36 stand for high-density supervised digital output module series, which differs from the 34 series low-density 16-channel supervised digital output modules. The last two digits 25 represent the hardware layout that supports 32 commoned output channels and dual configurable operation modes. This base model 3625 has a standard surge protection circuit and basic fault judgment logic, while the revised version 3625C1 optimizes electromagnetic interference resistance and expands diagnostic algorithms for harsh industrial environments.
Original TRICONEX 3625 modules must be adopted in SIL3 safety loops. Generic industrial digital output boards lack native triple redundant TriBus backplane matching circuits, complete load supervision functions and sufficient isolation performance, which will reduce system diagnostic coverage and invalidate the overall SIL certification of the safety instrument system. The module is only approved to be installed inside Zone 2 control cabinets. If field output cables extend to Zone 0 or Zone 1 explosive hazardous areas, certified intrinsically safe isolation barriers and flameproof junction boxes must be installed on the field wiring side.
3. Core Technical Parameters
Channel and Supervision Performance
The module provides 32 commoned 24VDC digital output channels with shared return rail design. The nominal field operating voltage is 24VDC, with a stable working range from 16VDC to 32VDC and maximum transient withstand voltage of 33VDC. Each channel supports continuous rated drive current of 0.5A with built-in self-limiting short-circuit protection, and can bear 6A surge current within 10 milliseconds.
Two working modes can be switched through TriStation configuration software. In supervised mode, low-amplitude test pulses are continuously injected into each output loop to detect wire breakage, disconnected actuator coils and missing load equipment, with a minimum detectable loop load current of 10mA. In non-supervised mode, the module only completes standard switching output without continuous loop monitoring, which is applicable to auxiliary non-safety loads.
The system judges loop working status through fixed voltage thresholds, 0 to 5VDC stands for off state, 6 to 14VDC is transition dead zone, and 15 to 32VDC represents on state. The output response delay from receiving backplane command to stable field drive signal is less than 1 millisecond. Each channel is equipped with 1500V RMS galvanic isolation between field load side and internal TMR backplane circuits. Independent fault containment design ensures that short circuit or open circuit fault on one channel only isolates the corresponding single loop without affecting the normal operation of the remaining 31 output channels.
Electrical Specifications
The module takes power from the redundant 24VDC TriBus backplane of the rack, with allowable voltage fluctuation range from 19.2VDC to 30VDC. The typical full-load power consumption is less than 480mA. Multi-layer protection circuits include input reverse polarity prevention, full-board bidirectional TVS transient surge absorption, per-channel automatic overcurrent cutoff and module over-temperature derating protection.
The module communicates with main processors through Tricon proprietary differential TriBus bus with fixed baud rate of 375kbps, and all triple redundant output commands and diagnostic feedback data adopt 32-bit hardware CRC verification. The total combined output current of all 32 channels cannot exceed 10A to avoid overheating damage to internal circuits.
Environmental and Mechanical Specifications
The continuous operating temperature range for rack installation is minus 40 degrees Celsius to plus 70 degrees Celsius, and the short-term storage temperature ranges from minus 40 degrees Celsius to plus 85 degrees Celsius. It can operate stably under relative humidity of 5% to 95% without surface condensation. Under normal operating state, it can withstand 2G vibration within the frequency band of 10Hz to 500Hz, and bear 30G transient mechanical impact during transportation without solder joint detachment and internal chip damage.
The shell adopts ribbed aluminum passive heat dissipation structure and UL94 V-0 low-smoke zero-halogen flame retardant composite material without cooling fan. It is a standard single-slot horizontal hot-swappable plug-in unit compatible with Tricon 8110 main chassis and 8111 expansion chassis. The overall dimension is 220 millimeters in depth, 169 millimeters in width and 44 millimeters in height, with net weight about 1.3 kilograms. The design service life reaches 15 years, consistent with the service cycle of Tricon main processors and redundant power supply modules.
Safety Certification Performance
The complete safety shutdown loop composed of TRICONEX 3625, TriBus backplane, three synchronized 3101 main processors and field safety actuators fully meets the SIL3 safety integrity matching standard of IEC 61508 and IEC 61511. If one A/B/C redundant internal drive path suffers hardware damage, communication distortion or power abnormality, the system only sends out a single-path hardware fault alarm, and the other two intact redundant paths execute two-out-of-three voting to maintain stable output drive signals, eliminating safety hazards such as accidental shutdown or failure to cut off equipment caused by single internal path failure.
4. Interface and Communication Configuration
Rear TriBus Backplane Edge Connector
The rear of the module is equipped with a large-area gold-plated locking edge connector, which is fully inserted into the universal I/O slot of the Tricon chassis backplane. It transmits three groups of independent triple redundant output drive commands, 32-channel load diagnostic feedback signals and isolated backplane power supply separately. The module supports full hot-swap operation, which means operators can plug and unplug the module when the rack is fully energized without interfering with the normal control logic of other DI, AI and communication modules in the same chassis.
The side plastic mechanical locking lever must be completely tightened after installation to avoid intermittent bus contact caused by long-term cabinet vibration and thermal expansion contraction. The three-way TMR differential signals inside the backplane are transmitted through separated twisted pairs, and the multi-stage isolation circuit built in the module further separates the A/B/C redundant paths to eliminate cross interference between drive channels.
Front Panel Status Indicator
The front panel is equipped with multiple groups of independent LED status lights for real-time hardware and channel monitoring. The green PASS light keeps steady on when the three-way TMR drive circuits work normally, and goes out once single or multiple paths have internal hardware faults. The red FAULT light will light up to alarm TriBus backplane communication failure, module over-temperature and internal power supply abnormality. There are 32 separate channel indicator lights, solid green represents the channel is energized with valid load detected, extinguished light means wire breakage or actuator loss, and flashing red stands for channel short circuit fault.
There are no DIP switches or adjustable potentiometers on the module body. All configuration parameters including supervision mode enable or disable, diagnostic cycle, fault alarm delay and output filtering threshold are uniformly set and downloaded through TriStation upper computer engineering software, and no local hardware adjustment function is supported.
Internal TMR Drive and Supervision Logic
Three completely independent drive circuits inside TRICONEX 3625 receive identical safety trip output commands sent by three A/B/C TMR main processors through TriBus backplane at the same time, and execute internal two-out-of-three voting logic to confirm valid drive signals before outputting 24VDC control voltage to each field loop.
Under supervised mode, tiny continuous test pulses are injected into every output channel to sample loop impedance and load current. The sampled feedback signals are synchronously transmitted back to three main processors for triple comparison judgment. Once wire breakage, short circuit or actuator coil loss is detected, timestamped fault records will be stored in the system NVRAM and uploaded to TriStation and DCS historian for maintenance traceability. TRICONEX 3625 only completes safety signal driving and loop supervision tasks, and cannot run independent safety interlock logic without matching triple redundant 3101 main processors and redundant rack power supplies.
5. Core Functions
First, it provides SIL3 TMR triple redundant high-density supervised safety digital output function. The configurable supervised mode meets the mandatory high diagnostic coverage requirements of IEC 61508 SIL3 emergency shutdown loops. Three independent drive paths realize fault-tolerant two-out-of-three voting, removing the risk of safety interlock misoperation caused by single drive path failure of critical ESD solenoid valves. Multi-stage galvanic isolation and TVS surge suppression circuits resist strong electromagnetic interference generated by frequency converters and large motors in chemical plants, ensuring the integrity of drive signals required by Tricon safety voting logic. The factory integrated gold-plated backplane edge connectors avoid poor contact risks brought by on-site manual wiring, satisfying the high full-loop diagnostic coverage standard of SIL3 safety circuits. Ordinary unmonitored digital output cards cannot replace this module because they lack TMR triple redundant matching and continuous load supervision mechanisms, which will break the continuous safety control loop and make the system SIL certification invalid.
Second, the single-slot 32-channel ultra-high-density modular design effectively reduces the total quantity of I/O cards in the control cabinet and saves cabinet installation space. It can be mixed installed with digital input, analog input, pulse acquisition and communication modules in the same main or expansion chassis without building independent auxiliary I/O racks. Per-channel overcurrent protection, surge suppression and diagnostic circuits are pre-integrated inside the module, eliminating on-site assembly of separate fuses, isolators and monitoring components, shortening cabinet wiring construction cycle and reducing wiring errors such as reversed power polarity and mismatched common return rails caused by manual operation. Unified mechanical size and single standard part number simplify centralized spare parts inventory management for multi-site petrochemical, oil and gas and thermal power enterprises.
Third, independent fault containment design for each channel ensures that short circuit, overload or wire breakage fault on one field actuator loop only triggers the corresponding channel LED alarm and isolates the single loop, without cutting off power and drive signals of the remaining 31 safety output loops. This design avoids full plant emergency shutdown caused by single field wiring fault. Independent channel status indicators allow maintenance staff to quickly locate faulty loops without relying on upper computer diagnostic software, reducing unplanned production downtime.
Fourth, fanless passive heat dissipation and flame retardant shell meet long-term unattended operation requirements of safety cabinets. The ribbed aluminum shell realizes natural convection heat dissipation, completely eliminating hidden danger of fan failure during 24-hour continuous operation and lowering daily maintenance workload. UL94 V-0 low-smoke zero-halogen material complies with fire protection standards of central control safety cabinets, and internal tinned copper circuit conductors resist oxidation under long-term high temperature and humid cabinet environments, extending the module service life to match the 15-year design cycle of Tricon core control hardware.
Fifth, full hot-swap online maintenance capability supports plug and play when the rack is fully energized. When replacing a faulty 3625 module, the remaining redundant TMR drive paths of the chassis maintain continuous safety output control of all field actuators, without triggering accidental safety trips or loss of interlock protection. The mechanical locking lever prevents accidental ejection during maintenance, and multi-dimensional real-time self-diagnosis can realize early warning of aging internal drive chips for planned offline maintenance arrangement.
6. Applicable Scenarios
This module is suitable for large petrochemical SIL3 emergency shutdown safety racks. The 32 output channels drive reactor emergency shutdown isolation valves, blowdown solenoid valves and fire suppression interlock relays, and continuously automatically detect broken valve wiring and disconnected actuator coils.
It can be deployed in Zone 2 control cabinets of onshore oil and gas production sites, outputting trip control signals to wellhead safety cut-off valves and vent actuators under long-term high vibration working environments, and uploading loop fault alarms to central SCADA system.
It fits boiler and steam turbine SIL3 protection racks of thermal power plants, providing supervised drive signals for fuel supply cutoff solenoid valves, turbine auxiliary overspeed trip relays and furnace safety isolation valves, and resisting voltage fluctuation noise generated by boiler auxiliary frequency conversion equipment.
It is applicable to anti-surge safety cabinets of natural gas processing plant compressors, controlling anti-surge recycle valve trip solenoid valves and compressor shutdown interlock contactors, and realizing full-loop supervision of all critical safety actuator circuits.
It can be used for reconstruction and spare parts replacement projects of old Tricon 3000 systems. Compatible with TriStation V9 to V11 engineering software, it can replace low-density 3401 16-channel digital output modules to reduce rack space occupation and upgrade system safety diagnostic coverage to meet updated SIL3 functional safety audit requirements. For workshops with strong electromagnetic interference, users can select the optimized revised version 3625C1 to replace the standard 3625 module.
7. Usage and Maintenance Instructions
Mandatory Installation Rules
To meet complete SIL3 fault tolerance specifications, the whole safety instrument system must adopt full TMR triple redundant hardware configuration including three synchronized 3101 main processors and redundant 83xx rack power supply modules. Single-path or single-module operation will downgrade the safety integrity level and void official SIL certification.
All field 24VDC output wiring must adopt shielded twisted pair industrial cables, which should be separated more than 10 centimeters from low-level analog signal cables to prevent power frequency noise from coupling into safety control loops. After inserting the module into the rack I/O slot, fully lock the side mechanical lever to eliminate loose contact risks caused by thermal expansion and long-term cabinet vibration. Reserve a vertical ventilation gap of at least 2 centimeters above and below the I/O slot for natural heat dissipation, and do not block the air intake and exhaust channels of the cabinet.
For hazardous area wiring compliance, TRICONEX 3625 is only certified for installation inside Zone 2 cabinets. If output cables extend to Zone 0 or Zone 1 explosive hazardous areas, certified intrinsically safe safety barriers and flameproof terminal junction boxes must be installed on the field wiring side to meet ATEX and CSA explosion-proof regulatory standards. Each output loop must be equipped with external matched overcurrent protection fuses consistent with the internal channel current limit parameters of the module.
Daily Inspection and Periodic Test Cycle
During daily patrol inspection, staff need to check the status of PASS, FAULT and channel LED lights, record abnormal open-circuit alarm information, inspect the module shell for overheating discoloration and loose wiring terminals. Carry out biweekly mechanical inspection to confirm the fastening state of the module locking lever and the cleanliness of cabinet ventilation filter screens. Conduct monthly maintenance to wipe dust on the front panel of the module with anti-static dry cloth, and prepare matched slow-blow spare fuses for emergency replacement of field loops.
For indoor central control rooms with low interference environment, complete module function verification, redundant TMR path switching test and channel isolation resistance measurement shall be carried out every 12 months. For coastal salt fog chemical plants, boiler side high temperature cabinets and compressor high vibration rooms, the comprehensive inspection cycle shall be shortened to 6 months.
During scheduled plant shutdown overhaul, manually simulate single-channel short circuit, wire breakage and single redundant path failure of the module to verify that TRICONEX 3625 only isolates the faulty channel and sends accurate fault alarms without interrupting other safety output loops, and confirm all timestamped fault records are completely uploaded to TriStation and external DCS alarm systems.
Get a Quote