Triconex/Schneider DO3401 Digital Output Module

The TRICONEX DO3401 module is a high-reliability, high-load-capacity relay output module based on a TMR (Triple Modular Redundancy) architecture and fail-safe design. It converts the safety decisions of the Tricon controller into physical actions, directly controlling critical safety equipment. Its robust diagnostic capabilities ensure the integrity of the output circuit, making it an indispensable key execution component in safety instrumented systems (SIS).

• Module Type: Digital Output Module

• System Platform: Belongs to the Triconex Tricon V9/V10 system or Tricon CX platform.

• Safety Level: Designed to achieve SIL 3 (IEC 61508/61511) Safety Integrity Level, serving as a core component of safety shutdown loops.

• Main Role: Controls the power on/off of on-site equipment according to instructions from the controller, for example:

• Triggering the action of solenoids in Emergency Shutdown (ESD) Valves

• Shutting down critical pumps or compressors

• Activating fire and gas protection systems

• Enabling alarm horns or indicator lights

• Triple Modular Redundancy (TMR): Similar to the DI3361, the DO3401 internally contains three independent output circuits. Three main processors control these three output channels respectively, and the output is managed through a solid-state voting circuit. On-site equipment is only activated when at least two processors agree on the output. This ensures that a single fault will not cause false actuation or failure to actuate.
• Fail-Safe Design:

• De-energized to Trip: This is a standard design for SIS outputs. During normal operation, the DO module outputs a voltage to "energize" or "hold" on-site equipment (e.g., keeping a solenoid energized to maintain valve opening). When a safety action is required, the controller commands the DO module to cut off the output; the equipment loses power, causing the valve to close under spring force and the process to enter a safe state. The DO3401 defaults to Normally Open (NO) dry contact output, with contacts opening when de-energized.

• Output Type: Dry contact relay output. The voting circuit inside the module controls high-performance, high-reliability magnetic latching relays. These relays provide true physical isolation and operate with extremely low power consumption.

• Note: The module itself outputs "dry contacts," meaning it does not have a built-in power supply. These contacts require an external load power supply to ultimately drive on-site equipment (such as solenoids).

• On-Site Wiring and Protection: Connects to on-site cables via a dedicated Field Termination Assembly (FTA), such as the 4353B. The FTA is equipped with fuses, varistors (for surge protection), diagnostic LEDs, and terminals for connecting external load power supplies and on-site equipment, thereby protecting the main module.
• Robust Diagnostic Capabilities: The module continuously performs self-diagnostics, including:

• Diagnosis of the output loop voting circuit

• Monitoring of relay contact status (capable of detecting faults such as contact welding)

• Monitoring of on-site load power supply voltage (via the FTA)

• Monitoring of output loop current (detection of short circuits or open circuits)
  Any fault is immediately reported to the main controller and may trigger a system alarm.

• Hot-Swappable: Supports installation or removal of the module without powering down the system.

1. Logical Decision-Making: The Tricon main controller makes output decisions based on input logic and user programs.

2. Internal Voting: The three processors vote on the output command.

3. Relay Driving: After the vote is passed, the module energizes the internal magnetic latching relay, causing its contacts to close.

4. Loop Formation: When the DO contacts close, they complete the circuit of the external load power supply (e.g., 24V DC).

5. Equipment Driving: Current flows from the load power supply, passes through the fuse on the FTA, flows through the closed contacts of the DO module, and finally reaches on-site equipment (such as a solenoid) to trigger its action.

6. Diagnostics: The FTA and DO module continuously monitor the load power supply voltage, loop current, and contact status to ensure normal operation.

• Oil and Gas (offshore platforms, refineries, liquefied natural gas terminals, pipeline emergency shutdown)

• Chemical and Petrochemical (reactor emergency shutdown, high-pressure gas release)

• Power Plants (turbine overspeed protection, boiler protection)

• Oil and Gas Burner Management Systems (BMS)