The TMR Expander Interface features a fault-tolerant design based on a Triple Modular Redundant (TMR) architecture arranged in a lock-step configuration. The diagram above illustrates the basic structure of the TMR Expander Interface.

The module consists of three main Fault Containment Regions (FCRs): FCR A, B, and C. Each main FCR contains:

Communication with the TMR Processor occurs via the IMB on the backplane of the Controller Chassis. The IMB provides fault-tolerant, high-bandwidth communication between Interface Modules and the TMR Processor. All transactions are voted, which helps localize faults to the IMB should they occur.

Communication with the TMR Expander Processor in the Expander Chassis is via the Expander Bus. The Expander Bus features a triplicated, point-to-point architecture, with each channel comprising separate command and response media. Voting is performed at the Expander Bus Interface to ensure cable faults are tolerated, and the remainder of the Expander Processor operates in fully triplicated mode, even if cable faults occur.

A fourth FCR (FCR D) handles non-critical monitoring and display functions and is also part of the inter-FCR Byzantine voting structure.

Isolation is maintained between FCRs wherever interfaces are required, ensuring that faults cannot propagate between them.

All Trusted™ Modules are keyed to prevent insertion into the wrong position within a chassis. The polarization system consists of two parts: the module and the associated field cable.

Each module type is keyed during manufacture. The organization responsible for integrating the Trusted™ system must key the cable by removing the appropriate keying pieces so that they match the bungs fitted to the associated module before installation. This ensures correct module-cable alignment and prevents mis-insertion within the chassis.