AI3351S2 Tricon v9/v10 TMR safety system chassis

Description

Product Overview

AI3351S2 is the analog input front end of a Tricon safety system, and the number that matters most in its name is not the channel count but the word commoned. Thirty-two 4–20 mA loops arrive on one module, and all thirty-two share a single return path. That is a wiring architecture, not a density trick, and it decides most of what follows: how the loops are powered, how a fault on one loop behaves on its neighbours, and why the field termination for this module looks different from the termination used on the differential-input modules that sit in the same chassis.

Inside, each of the thirty-two points is not one measurement but three. The module triplicates the signal path — separate conditioning and separate conversion per leg — and hands three digital values per point to the three main processors, which vote. A leg that drifts is discarded and the loop keeps working, while the discrepancy is reported. This is the architecture that lets a Tricon system claim SIL 3 availability without duplicating the field transmitter, and it is also the architecture’s honest limit: TMR protects against the failure of one leg inside the module, not against a failed transmitter, a lifted loop common or a flooded junction box, all of which are seen identically by all three legs.

The S2 suffix marks a later hardware revision of the 3351 family. It is not a different module in the way that a 16-point card is a different module; it is the same 32-point commoned front end built and screened to a later standard. What that means in practice is the ordinary, unglamorous thing that matters on a running plant: a spare should match the revision already in the slot, because revision affects the diagnostics the system executive expects to see from it.

The electrical signature is deliberately conservative. Nominal range 4–20 mA, absolute operational range 2–22 mA, a 3 dB bandwidth of 16 Hz and 180 Ω of input impedance. The 2–22 mA window exists so that readings outside the nominal span — an open loop falling under 2 mA, an overdriven transmitter climbing past 22 mA — are still measurable and can be diagnosed rather than merely clipped. The 16 Hz filter exists because a safety input should not react to a spike; it should react to the process. Neither number is a limitation to be worked around. Both are the reason the module is trusted with a trip function.

Technical Specifications

AI3351S2

Key Features and Advantages

Commoned inputs as a power-supply decision: thirty-two loops on one return means the module’s loop supply has to carry the sum, not the average. At 20 mA per point that is 640 mA of loop current behind one module, and the field power distribution — not the module — is usually where an installation is short. Sizing the loop supply and the termination assembly for the full complement is the difference between a module that reads 32 clean loops and one that reads a slow drift on the last eight.

The 2–22 mA window as a diagnostic instrument: because the module measures past both ends of the nominal span, an open loop and an overdriven transmitter produce distinguishable values rather than a rail. Safety logic can be written against those values instead of against a generic “bad input” flag, which is how a designer separates a failed transmitter from a genuinely high process reading without adding a second instrument.

A 16 Hz filter chosen for the trip, not for the trend: the deliberately slow front end rejects induced noise and momentary spikes that would otherwise nuisance-trip a plant, at the cost of being useless for fast dynamic measurement. On a compressor surge or a flare header, that is the right trade. Where a safety case genuinely needs fast analog response, this is not the module to specify — and knowing that before the cause-and-effect review saves a redesign.

TMR that is transparent to the application: the programmer sees one value per point, not three. Voting, discrepancy detection and fault masking happen in hardware and firmware, so a leg failure costs a diagnostic message and a maintenance ticket, not a shutdown. The corollary is that the module cannot report a fault it cannot see — a commoned return that has drifted will make all three legs agree on a wrong answer.

Hot swap without a configuration rebuild: channel scaling, engineering units and the safety logic live in the processors and the configuration database, not in the module. Pulling a AI3351S2 costs the slot’s data for the duration of the swap and nothing else, provided the chassis has a healthy spare slot and the executive procedure is followed.

Revision discipline instead of part-number optimism: S2 is a specific build of a legacy Tricon analog front end. Plants still running Tricon chassis at v9 or v10 buy this module as a form-fit replacement, and the practical rule is to match the revision of the module being replaced and to verify baseplate type, chassis firmware and TriStation compatibility before the purchase order, not after the delivery.

Applications

Emergency shutdown in refining and petrochemicals: separator level, reactor pressure and compressor suction pressure loops where the trip must survive the failure of a single measurement leg, and where the 16 Hz front end keeps a slug of liquid or a valve stroke from producing a spurious trip.

Fire and gas systems: 4–20 mA combustible and toxic gas detectors, flame scanners and deluge pressure monitoring, integrated into the same TMR chassis that carries the ESD logic so that the cause-and-effect matrix is executed by one safety controller.

Burner management on boilers and fired heaters: fuel and air flow, furnace pressure and stack temperature loops, where slow, filtered, high-integrity measurement is exactly what a BMS sequence expects.

High-integrity pressure protection: HIPPS loops on pipelines and wellheads where a voted overpressure signal must initiate isolation without a false trip, and where the under-range detection matters because a silent transmitter is as dangerous as a rising one.

Turbine and auxiliary protection in power generation: lube oil pressure, bearing temperature headers and drum level on units whose Tricon chassis predates the current analog module generation and where the installed base, not the catalogue, dictates what is bought.

Legacy chassis sustaining: v9 and v10 Tricon installations kept in service past their platform’s design life, where the available supply for analog front ends is new surplus and professionally refurbished stock, and where a tested module with a known revision is worth more than an unverified one at a lower price.

Related Products

AI3351 — the base revision of the same 32-point commoned module, earlier hardware build. 3704E — 32-point differential analog input module of the later Tricon generation; different front end, different termination. 3720 — analog input module in the same later generation, used where the installed chassis supports it. 3700 — 16-point analog input module of the earlier generation, the lower-density option in the same chassis. 3805E — analog output module, the counterpart used where the safety logic must drive a valve or positioner. 3503E — digital input module for the discrete side of the same ESD and F&G loops. 9760-210 (3000470-510) — 32-point current input termination panel for 0–5 VDC front ends; a different termination concept from the commoned 4–20 mA architecture here. External termination assembly (ETA) for the 3351 family — the field interface that carries the 32 loops and the shared return into the module. Tricon chassis v9/v10 baseplate — the carrier that provides the slots, the TMR bus and the redundant power feeds.

Installation and Maintenance

Before installation: confirm the revision of the module in the slot and match it, then confirm the chassis, baseplate and TriStation versions accept the replacement. Verify that the loop supply can carry the full 32-point common current plus the field devices’ own demand, that the shared return is landed at one point only, and that the termination assembly’s common is not bonded to earth somewhere else in the marshalling cabinet. Lifting the common in two places is the classic way to give a AI3351S2 thirty-two channels of ground-loop error that no diagnostic will attribute to wiring.

Maintenance practice: the module needs no field calibration, so effort belongs on the loops and the records. Compare the three legs’ behaviour by watching for repeated channel-discrepancy messages on one point, which usually precedes a leg failure; check terminal torque on the shared return at every outage, since a single loose common screw degrades all thirty-two readings at once; and log the module’s revision and slot position so the next spare matches. On hot swap, verify the replacement is recognised and let a full diagnostic cycle complete before returning the loop to the safety function, and record the pre-swap channel status so that scaling and engineering units can be confirmed against the database afterwards.

Warranty and Quality

Every AI3351S2 is supplied with its revision stated, because this is a module where S2 and the base 3351 are not interchangeable in the buyer’s mind even when they are in the same family. Units are inspected for connector condition, labelling and evidence of field-side damage, tested for current injection across the full 2–22 mA range, open and short diagnostics and insulation integrity, and carry a 12-month repair, replacement or refund commitment. Support concentrates on the decisions that make this module work in an old chassis: matching revision to the installed slot, confirming chassis and TriStation compatibility, and sizing loop supply and termination for a 32-point commoned front end before installation rather than after the first bad reading.

免费

今天 16:18