Description
Key Technical Specifications
| Specification | Details |
|---|---|
| Part Number | 9802*3 (also listed as T9802 by some distributors; functionally equivalent) |
| Manufacturer | ICS TRIPLEX (now part of Rockwell Automation Process & Safety) |
| Product Type | Triple Modular Redundant (TMR) Controller Module |
| Redundancy Architecture | TMR — three independent processors executing identical logic in parallel with majority-vote output |
| Safety Integrity Level | SIL 4 (IEC 61508 certified) |
| Fault Tolerance | Hardware-Implemented Fault Tolerance (HIFT); supports 3-2-0 degraded operation (continues running with 2 of 3 channels active) |
| Fault Switching Time | ≤1 millisecond |
| Processor | High-performance processor (specific CPU model not publicly documented by manufacturer) |
| Communication Interfaces | RS-232, RS-485, Ethernet |
| Supported Protocols | Modbus (RTU/TCP), proprietary ICS TRIPLEX peer-to-peer |
| Power Supply | 24V DC, approximately 50W power consumption |
| I/O Expansion | Modular — supports digital and analog I/O channel expansion via companion I/O modules |
| Operating Temperature | -40°C to +85°C (-40°F to 185°F) |
| Storage Temperature | Not publicly specified; typical industrial range -40°C to +85°C |
| Humidity | Up to 95% non-condensing |
| Dimensions | Approximately 300 mm × 200 mm × 100 mm (varies by chassis configuration) |
| Weight | Approximately 5 kg (module only; varies with configuration) |
| Standards | IEC 61508 SIL 4, CE, UL (specific certifications vary by installation) |
| Typical Applications | Process Safety Systems (SIS), Emergency Shutdown (ESD), Fire & Gas (F&G), Turbine Control, Burner Management Systems (BMS), High-Availability DCS |
| Compatible I/O Families | ICS TRIPLEX TC-series TMR I/O modules (TC-201, TC-215, TC-301, TC-303, TC-305, TC-801, etc.) |
| Programming Environment | ICS TRIPLEX proprietary engineering workstation software (specific tool version depends on system generation) |
Product Introduction
The ICS TRIPLEX 9802*3 is a Triple Modular Redundant (TMR) controller module — the kind of hardware you find in the safety-critical heart of a refinery, a gas turbine control panel, or a nuclear auxiliary system. It’s not a standard PLC. It’s a safety-rated controller built on the principle that a single processor failure should never cause a process to trip or, worse, fail to trip when it should.
The “9802” is the base controller model. The “*3” suffix denotes the TMR configuration — three independent processor channels running the same control logic in lockstep, with a hardware voting mechanism that compares all three outputs on every scan cycle. If one channel deviates (due to a hardware fault, a cosmic ray bit-flip, or any single-point failure), the voter masks it out and the system continues operating on the remaining two channels — this is the “3-2-0” degraded operation capability. The switchover happens in hardware, not software, which is why the fault detection and masking time is ≤1ms. That’s fast enough that the process never sees the glitch.
This is the Hardware-Implemented Fault Tolerance (HIFT) architecture that ICS TRIPLEX pioneered. Unlike software-based redundancy schemes (like hot-standby dual-CPU systems that require a handshake and switchover sequence), HIFT is continuous and transparent. The three processors are physically separate, on separate boards, with separate power paths. A fault in one doesn’t propagate to the others. That’s what earns it the SIL 4 certification — the highest safety integrity level under IEC 61508.
Communication-wise, the 98023 offers RS-232, RS-485, and Ethernet interfaces, with Modbus support for integration with DCS hosts, HMIs, and third-party devices. The Ethernet interface also enables peer-to-peer communication between multiple 98023 controllers in a distributed safety system — useful when you have multiple ESD zones that need to share trip signals without going through a central DCS.
I/O expansion is modular. The 9802*3 doesn’t have onboard I/O terminals. Instead, it sits in an ICS TRIPLEX chassis alongside companion TMR I/O modules — the TC-series (TC-201 digital input, TC-215 digital output, TC-301 analog input, TC-303 analog output, TC-305 relay output, TC-801 communication interface, etc.). Each I/O module is itself TMR-rated, so the entire signal path from field sensor to controller to final element is triple-redundant. That’s the key differentiator from a standard PLC with a redundant CPU — here, every layer is redundant.
The 98023 is a legacy product. ICS TRIPLEX was acquired by Rockwell Automation in the 2000s, and the product line has since been superseded by the Rockwell Process & Safety portfolio (including the Trusted safety system platform). But there are thousands of 98023 installations still in service worldwide — in oil & gas (ESD systems on offshore platforms, pipeline compressor station shutdown logic), power generation (gas turbine overspeed protection, boiler F&G systems), chemical processing (reactor emergency relief systems), and nuclear (auxiliary safety systems). These are 20- to 30-year-old installations, and sourcing replacement 9802*3 modules is increasingly challenging. Refurbished units are available through independent industrial surplus dealers, but lead times are unpredictable and prices vary widely depending on condition and revision.
One critical point for anyone maintaining a 9802*3 system: this is not a module you swap casually. The TMR architecture means all three channels must be synchronized. Replacing a single channel requires careful procedure — typically, the faulty channel is isolated, the replacement is installed and synchronized with the two running channels, and then the voter is re-enabled. Doing this incorrectly can cause a nuisance trip. Always consult the system-specific maintenance manual and, if possible, have an experienced ICS TRIPLEX technician on hand. Also, document your firmware version, your I/O configuration, and your peer-to-peer communication settings before touching anything. These details matter when replacing a legacy module.
Troubleshooting Quick Reference
| Fault | Likely Cause | Relevancy | Quick Check | Fix |
|---|---|---|---|---|
| Single channel fault alarm (Channel A/B/C fault LED) | Processor fault, power supply issue on one channel, or memory error | ~30% | Check channel-specific fault LED; review diagnostic logs via engineering workstation | Isolate faulty channel per maintenance procedure; replace channel board; resynchronize with remaining channels |
| All three channels faulted (system trip) | Common-mode failure (power supply, backplane, or external event), or voter hardware failure | ~15% | Check 24VDC supply voltage; inspect backplane connections; verify voter board status | Restore power; check backplane seating; replace voter board if faulty; investigate root cause of common-mode failure |
| Communication loss to DCS/HMI | Ethernet/RS-485 interface fault, Modbus configuration mismatch, or network cable issue | ~20% | Ping controller IP; verify Modbus register mapping; check cable continuity | Replace network cable; verify Modbus configuration matches DCS host settings; reset communication interface |
| I/O module mismatch or fault | Companion TC-series I/O module fault, backplane communication error, or I/O configuration mismatch | ~15% | Check I/O module LEDs; verify I/O mapping in engineering software | Reseat I/O module; replace faulty TC-series module; verify I/O configuration matches physical hardware |
| Synchronization failure after channel replacement | Replacement channel firmware version mismatch, or synchronization procedure not followed correctly | ~10% | Compare firmware versions across all three channels; review synchronization procedure | Update firmware on replacement channel to match existing channels; follow proper synchronization procedure step-by-step |
| Intermittent fault alarms | Loose backplane connection, power supply ripple, or EMI interference on communication cables | ~5% | Check backplane connector seating; measure 24VDC supply for ripple; verify cable shielding | Reseat module; install power supply filter; replace unshielded communication cables with properly shielded counterparts |
| Voter board fault | Voter hardware failure, or voter power supply issue | ~5% | Check voter board LEDs; measure voter supply voltage | Replace voter board; verify voter power supply is within specification |
ICS TRIPLEX 9802 3
Application Scenarios & Pain Points
- Oil & gas (Emergency Shutdown Systems): Offshore platforms and onshore refineries use the 9802*3 as the core controller for ESD systems — monitoring pressure, temperature, and flow sensors, and triggering shutdown valves when process variables exceed safe limits. The TMR architecture ensures that a single controller failure doesn’t cause a false trip (which costs hundreds of thousands of dollars in production loss) or, worse, a failure to trip during a real emergency. The pain point: after 20+ years, the electrolytic capacitors on the processor boards can degrade, causing intermittent channel faults. Plants are struggling to source replacement modules as original stock dwindles, and refurbished units come with no guarantee of remaining service life.
- Power generation (gas turbine control): Combined-cycle power plants use the 9802*3 for turbine overspeed protection and auxiliary safety systems. The ≤1ms fault switching time is critical here — a turbine spinning at 3,600 RPM can’t tolerate a controller glitch. The TMR design ensures that even if one processor fails during a speed excursion, the other two continue to execute the overspeed trip logic correctly. The pain point: firmware version mismatches when replacing channels. If a replacement channel has different firmware than the two running channels, synchronization fails and the channel can’t rejoin the TMR group. Documenting firmware versions is essential.
- Chemical processing (reactor safety systems): Chemical reactors with exothermic reactions rely on the 98023 to monitor temperature, pressure, and agitator status, triggering emergency cooling and relief valves if conditions become unsafe. The SIL 4 certification is a regulatory requirement in many jurisdictions for these applications. The pain point: I/O module compatibility. The TC-series I/O modules that pair with the 98023 are also legacy, and finding replacement TC-201 or TC-301 modules can be as difficult as finding the controller itself. Some plants are migrating entire racks to modern platforms rather than trying to source individual modules.
- Pipeline compressor stations: Natural gas pipeline compressor stations use the 98023 for shutdown logic on compressor units — monitoring vibration, temperature, and pressure, and tripping the compressor if any parameter exceeds safe limits. The Modbus communication interface allows the 98023 to share status information with the station’s DCS for monitoring purposes. The pain point: communication interface failures. The RS-485 and Ethernet interfaces on older 9802*3 modules can degrade over time, especially in outdoor installations with temperature cycling. Communication loss doesn’t affect the safety function (the controller continues to execute its logic), but it blinds the operators to the system’s status, which is its own operational risk.
