TRICONEX 3006 second-generation Enhanced Main Processor (EMP II) triple modular
TRICONEX 3006 is a high‑integrity TMR main processor module for the Triconex 3008/3009 SIS platform (next‑gen after Trident). It acts as the central safety controller for ESD, BMS, FGS, and critical turbine/process safety, delivering enhanced performance, larger memory, and extended diagnostics in a compact TMR form factor, certified SIL3 (IEC 61508).
Description
1. Product Introduction
TRICONEX 3006 is the second-generation Enhanced Main Processor (EMP II) triple modular redundant main control module for classic Tricon TMR safety instrument systems, developed under Invensys Triconex (now Schneider Electric). It is the predecessor of the 3008 high-speed main processor, designed as the core computing unit of early Tricon SIS racks, requiring three identical 3006 cards to form complete three-channel redundant control architecture, implementing hardware 2oo3 voting for all safety logic, I/O acquisition and fault diagnosis.
The module adopts dual-subprocessor parallel architecture (main logic processor + independent I/O communication processor), built-in ECC error-correcting memory, 4Mbps low-speed TriBus backplane bus, isolated RS232 maintenance serial port, and battery-backed SRAM for SOE and fault log storage. It does not carry native Ethernet communication, and all upper data interaction must rely on matching external communication expansion modules. It cannot support online hot-swap; full rack power cut-off is mandatory for disassembly and replacement. Compared with the later upgraded 3008, its TriBus bandwidth, memory capacity and computing speed are limited, only matching early low-capacity Tricon systems. It runs stably 24/7 under wide-temperature, vibration industrial environments; single processor channel failure will not interrupt overall safety interlock operation, widely used in legacy onshore petrochemical, conventional thermal power, early gas station SIL3 safety instrument systems.
2. Model Definition Explanation
The complete model TRICONEX 3006 consists of brand identifier, core hardware classification code and optional configuration suffix variants:
Prefix TRICONEX: Brand mark, representing Tricon TMR safety control hardware series, distinguished from I/O and communication auxiliary modules.
Four-digit core number 3006: Internal rack main processor classification coding. The first digit "3" stands for core safety control processing category; middle two digits "00" represent triple redundant main control circuit layout; last digit "6" represents second-generation EMP II low-speed TriBus main processor hardware platform, differentiated from simplified 3007 and high-performance 3008.
Optional suffix configuration codes for differentiated project demands:
No extra suffix: Standard indoor control room version, universal non-offshore cabinet installation.
N suffix (3006N): Enhanced EMC noise suppression variant, optimized for medium electromagnetic interference workshop environments.
-E: Full English firmware variant; all front panel fault codes, diagnostic prompts and TriStation software text display in English for overseas early projects.
-HT: High-temperature extended variant, stable upper operating temperature extended to +70°C for furnace side high-heat cabinets.
3. Technical Specifications
Electrical Performance
The module takes 5VDC operating power from Tricon rack backplane, rated power consumption 10–15W per card, allowable backplane voltage fluctuation 4.75VDC ~ 5.25VDC.
Dual independent subprocessor architecture: Main logic 32-bit core + I/O communication Intel 80C152 (16MHz), I/O auxiliary processor Intel 80C31 (12MHz)
Memory allocation: 2MB ECC DRAM for program and real-time process data; 2MB battery-backed SRAM for SOE sequence records and fault logs; Flash EPROM for solidified firmware
TriBus backplane communication speed: Fixed 4Mbps, 16-bit DMA transmission, 16-bit CRC data error protection, three mutually isolated redundant buses
External interface: 1×25-pin optically isolated RS232 serial port (500VDC isolation) for TriStation program download, fault diagnosis and log export; no on-board Ethernet, external COM communication module required for upper HMI/DCS data exchange
System control capacity: Supports up to 512 I/O logical channels, suitable for small and medium-scale safety interlock logic
Configurable logic scan cycle: 20ms ~ 500ms adjustable; SOE event timestamp resolution 1ms, battery-backed clock drift ±2 seconds per day
Built-in multi-stage power protection: Backplane undervoltage, overvoltage and overcurrent lockout protection; single channel power abnormality only triggers local FAULT alarm without stopping cross-channel voting operation.
Functional Safety & Reliability Index
TRICONEX 3006 fully complies with IEC 61508 SIL 3 and IEC 61511 process safety standards, with TUV, UL and CE industrial safety certifications. Three independent 3006 processors execute identical safety programs synchronously; hardware 2oo3 voting filters calculation deviation from any single channel, avoiding false safety trip caused by single-point processor, memory or communication fault. Hardware mean time to safe failure reaches 290,000 hours; mean time to repair controlled within 30 minutes due to mandatory full rack power-off maintenance rules. It has complete single-fault masking capability; one processor channel damage will not lead to full system safety logic shutdown. All hardware faults, I/O loop faults and SOE trip events are latched in battery-backed SRAM, data reserved after rack power failure for safety audit traceability.
Environmental & Mechanical Parameters
Standard model operating temperature range: 0°C ~ +60°C; HT high-temperature variant extends stable upper limit to +70°C. Spare module storage temperature: -40°C ~ +85°C, applicable for long-term warehouse storage. Tolerable relative humidity: 5% ~ 95% non-condensing, cabinet installation IP20 protection grade. Passes basic industrial EMC tests including electrostatic discharge, radiated RF interference, surge and fast transient pulse interference; anti-salt fog performance is limited, not recommended for continuous offshore platform deployment. Standard single-slot horizontal installation in Tricon 8110 main rack, no forced air cooling required under full rated load. Vibration resistance meets onshore petrochemical, conventional gas station and small thermal power plant standards; long-term low-frequency vibration easily causes TriBus communication packet loss without complete shielded wiring.
4. Interface and Communication Configuration
Hardware Interface Layout
Two independent hardware interface categories: rear backplane triple TriBus redundant bus interface and front panel status indicator + maintenance serial port interface.The rear large gold finger connector is proprietary triple isolated TriBus bus interface, responsible for receiving backplane 5V power, three-way independent bidirectional I/O data exchange, and cross-synchronous data transmission with the other two main processors in the rack.Front panel layout: Multi-color grouped LED diagnostic indicators + 25-pin RS232 maintenance port + mechanical locking extraction handle.Status indicators include: PASS normal operation light, FAULT hardware fault alarm light, ACTIVE channel running indicator, MAINT maintenance prompt light, serial COM TX/RX transmit/receive lights, TriBus communication bus status lights. The 25-pin RS232 port adopts optoelectronic isolation to block external maintenance PC surge interference from invading the processor core circuit.
Internal TriBus Redundant Communication Mechanism
Three rack main processors (MPA/MPB/MPC) correspond to three independent 4Mbps TriBus buses separately; each 3006 independently completes full I/O module data polling on its own bus channel. After single-channel logic operation completes, three MPs exchange operation results through inter-chip synchronous circuits, and hardware 2oo3 voting generates final valid safety output commands issued to I/O output modules. Faults such as TriBus disconnection, communication timeout and CRC check error light the front panel red FAULT indicator, uploading simplified fault codes to TriStation software and central monitoring HMI without detailed fault classification positioning function compared with 3008.
System Configuration Mode
All safety interlock programs, I/O point mapping, scan cycle parameters and SOE trigger conditions are compiled and downloaded to 3006 Flash memory via TriStation software through the RS232 serial port. Configuration parameters automatically synchronize to three redundant main processors; after full rack power restart, three MPs load consistent programs to maintain synchronous voting operation. Upper monitoring data interaction must rely on external independent communication modules (Ethernet/Modbus serial COM card), the 3006 itself has no native network communication capability, unable to directly connect HMI or DCS systems.
5. Core Functions
- Triple Redundant Synchronous Safety Interlock Logic CalculationThree independent 3006 main processors run identical user safety programs synchronously, collect all digital, analog and pulse I/O signal data separately, and output valid safety trip/hold commands to field actuators only after passing hardware 2oo3 voting verification, eliminating false shutdown risks caused by single-channel processor hardware abnormality. Limited by memory and bus bandwidth, it is only suitable for small and medium-scale process unit safety logic, unable to carry complex multi-unit combined interlock algorithms supported by 3008.
- Full Rack I/O Data Polling, Voting and Basic Fault DiagnosisEach 3006 independently communicates with all rack I/O modules via 4Mbps TriBus, completes real-time collection of field contact, analog and pulse signals, and executes basic diagnosis of I/O channel open circuit, short circuit and hardware faults. All I/O fault information is summarized to the main processor for unified storage and upload; diagnosis granularity is coarser than 3008, lacking detailed channel fault classification prompts. Single redundant channel failure does not affect overall I/O data acquisition of the system.
- 1ms High-Precision SOE Sequence-of-Event RecordingBuilt-in hardware millisecond timestamp unit, marking time for all digital state changes, safety trip actions and module fault events, storing complete event sequences in battery-backed SRAM. Even if rack main power is cut off, historical SOE records will not be lost, supporting post-accident root cause analysis and factory safety compliance audit; SRAM capacity is smaller than 3008, requiring regular manual log export to avoid record coverage.
- Single Serial Port Offline Maintenance and Program DownloadOnly one isolated RS232 serial port for all maintenance work: program download, fault log reading, system hardware diagnosis and firmware upgrade. No separated online monitoring communication port; downloading programs or reading logs will temporarily occupy system communication bandwidth, easily causing upper data transmission delay if equipped with external communication modules. No native Ethernet remote maintenance function, all debugging must be completed on-site via serial cable connection.
- Full-Layer Background System Self-Diagnosis and Fault AlarmContinuous background diagnosis covers processor core operation status, ECC memory read-write integrity, TriBus bus communication quality, backplane power supply stability and I/O module online status. All detected system-level faults trigger front panel FAULT light alarm, uploading fault occurrence timestamp and simplified fault codes to the monitoring platform. Single processor channel fault only triggers alarm, the remaining two redundant channels maintain normal safety interlock operation without system shutdown.
- Triple Redundant Backup of System Programs and Configuration ParametersAll safety control programs and configuration parameters are stored in independent Flash memory of each 3006 main processor; three MPs automatically synchronize program files after power-on to realize triple redundant backup. When replacing a faulty 3006 with a spare module, the other two normal MPs automatically copy complete programs and configurations to the new card, without repeated manual download by maintenance personnel.
6. Applicable Scenarios
- Legacy Medium and Small Petrochemical Refining ESD Safety Instrument SystemsUsed as triple redundant main control core for early crude oil atmospheric-vacuum distillation and small catalytic cracking unit safety racks, undertaking single-unit safety interlock logic operation, limited mass I/O signal collection and basic SOE accident recording, matching low-density early Tricon I/O modules.
- Onshore Conventional Oil & Gas Station Fire and Gas Protection SystemsAdapted to onshore station control rooms with mild humidity and vibration, realizing integrated safety monitoring of wellhead pressure, combustible gas concentration and pipeline emergency cut-off valves; 3006N EMC enhanced variant is selected for workshops with moderate electromagnetic interference.
- Early-Built Small Natural Gas Pipeline Compressor Station Safety Interlock SystemsServes aging small station safety racks, processing scattered pipeline pressure, flow and valve position signals, executing basic overpressure safety trip logic, storing limited SOE fault records of pipeline equipment.
- Traditional Small Thermal Power Plant Boiler Basic Safety Protection SystemsApplied in old small boiler SIS racks, matching pulse input modules to collect furnace flame and auxiliary equipment speed signals, completing simple overtemperature, overpressure and flame failure safety interlock calculation, without complex turbine overspeed protection logic processing capability.
- Small-Scale Low-Risk Fine Chemical Legacy Production Workshop Safety ControlDeployed in non-offshore Class I hazardous area control rooms, undertaking single-reactor temperature and pressure safety monitoring logic operation, realizing independent safety interlock control of small batch reaction equipment.
- Legacy Tricon SIS System Spare Part Replacement and Maintenance ProjectsOnly used for spare card replacement of early Tricon racks equipped with EMP II generation main processors, strictly matching original low-speed TriBus system architecture; not recommended for new safety instrument system construction due to low bus bandwidth and lack of native Ethernet communication.
7. Operation and Maintenance Instructions
Installation Requirements
Three TRICONEX 3006 main processors must be installed in three dedicated main processor slots of standard Tricon 8110 safety main rack respectively; full rack power supply must be completely cut off before plugging or disassembly, online hot-swap operation is strictly prohibited. Insert the module horizontally into the card slot, fully lock the front panel mechanical handle to ensure reliable contact between rear TriBus gold finger connector and rack backplane bus. All RS232 maintenance cables adopt single-shielded twisted-pair cables; cable shielding layers must be single-point grounded at the control room cabinet ground bar, multi-point grounding on maintenance PC side is forbidden to prevent ground loop induced communication failure. A ventilation gap of at least 20 centimeters must be reserved around three main processor slots; high-power heat-generating I/O modules cannot be stacked beside 3006 modules to avoid overheating exceeding rated operating temperature and triggering TriBus communication fault alarms.
Daily Routine Inspection Standards
Conduct daily visual inspection to confirm front panel PASS indicator stays steady green, global FAULT alarm light remains off, ACTIVE running light is normally lit, and serial COM TX/RX lights flash normally during maintenance operation without constant bright or extinguished abnormal state. Log in to old-version TriStation configuration software or external communication HMI every day to check three-channel main processor synchronous running status, confirming no records of TriBus communication errors, memory ECC faults or I/O module offline alarms. Export full-system SOE and processor fault logs every two weeks to avoid log coverage caused by limited SRAM storage capacity. Every month, clean dust accumulated on module front indicators, RS232 serial port and rack ventilation slits, check cabinet cooling fan operating status, ensure ambient temperature around three main processors stays within specified 0°C ~ +60°C operating range.
Regular Inspection and Calibration Cycle
Under standard indoor control room conditions, full processor communication function test, program CRC integrity verification and memory fault scan shall be performed every 12 months; coastal salt-fog workshops and high-temperature furnace side cabinets shorten the inspection cycle to 6 months. Before inspection, back up complete safety control programs, I/O mapping parameters and historical SOE logs stored in three 3006 main processors to offline storage media. Use TriStation maintenance tools to execute full Flash program CRC verification, test RS232 serial communication stability, and check battery-backed SRAM battery voltage; replace aging backup batteries when voltage is lower than threshold to prevent log loss after power failure. After completing all inspection items, save updated backup program files, retain written inspection records including inspection date, operator name and fault test data for factory safety compliance audit.
Common Fault Handling Procedures
When a single main processor front panel FAULT red light is permanently lit, first check whether the module handle is fully locked in the slot, inspect rear backplane connector for dust accumulation, corrosion or poor contact, and verify cabinet 5V power supply output voltage is within normal range. If TriBus communication lights stop flashing and multiple I/O modules display offline alarms simultaneously, cut off full rack power supply first, re-plug three 3006 main processors and restart the rack to execute automatic cross-channel program synchronization. If system diagnostics report internal processor core or ECC memory hardware failure of the module, planned full rack shutdown maintenance must be arranged: cut off rack power, unlock front handle, steadily pull out faulty 3006 module, insert spare TRICONEX 3006 module of the same suffix version, lock handle tightly, restore rack power supply, wait for the other two normal main processors to automatically copy all programs and configuration parameters to the spare card, then verify three-channel synchronous running, full I/O data collection and external communication functions, clear historical fault alarm logs. On-site disassembly of internal processor, memory and communication circuit components is forbidden; damaged modules must be returned to official authorized service centers for repair or scrapping. Unauthorized disassembly invalidates all SIL3 safety certifications of the hardware.
Spare Module Storage and Long-Term Service Management
Offline spare TRICONEX 3006 modules shall be stored in constant-temperature dry warehouse with ambient temperature maintained at 0°C ~ 40°C and relative humidity controlled below 70%. Modules must be sealed in original anti-static packaging bags to prevent static electricity damage to internal dual-subprocessor and ECC memory chips, avoiding direct sunlight, corrosive gas and heavy dust environments. Every six months of shelf storage, take out spare modules for 30-minute power-on aging test to activate internal circuit capacitors and check SRAM backup battery voltage, preventing component performance degradation from long-term power-off state. The module’s design service life under rated normal operating conditions is 12 years, shorter than the 15-year service life of upgraded 3008 main processors; all on-site installed 3006 modules shall be batch-replaced upon reaching service life to maintain overall SIL3 safety integrity level of legacy SIS systems.
Maintenance Safety Prohibitions
Unauthorized modification of internal dual-subprocessor chips, independent firmware flashing or hardware circuit transformation of TRICONEX 3006 is strictly prohibited. Any modification voids functional safety certification and related industrial safety qualification certificates. Do not connect maintenance serial cables with instantaneous surge voltage exceeding 30V to RS232 ports for long durations; continuous surge will permanently burn internal optoelectronic isolation and processor core circuits. All maintenance operations involving module plugging, program download and serial communication parameter modification must be performed by certified SIS safety instrument maintenance personnel; full rack power supply must be cut off before disassembly of any main processor. Safety isolation measures for production safety interlock loops must be implemented before rack power-off maintenance to avoid full-unit safety logic loss and accidental equipment trip during shutdown replacement. Any disassembly or replacement of main processors is forbidden during critical production startup, full-load stable operation or emergency accident handling stages; all main processor maintenance work must be scheduled during planned equipment full-shutdown maintenance windows. This module is not suitable for new offshore platform and large-scale complex process SIS projects due to low TriBus bandwidth, limited memory capacity and lack of native Ethernet communication function.
Get a Quote