AADvance vs Trusted: safety controller architectures, processor and I/O modules, and the SIL Rockwell states

AADvance and Trusted are the two safety instrumented system (SIS) platforms of Rockwell Automation used for emergency shutdown, fire and gas and similar duties. Both are certified to IEC 61508, but they are built differently: on AADvance the engineer chooses how many processor and I/O modules to fit for each part of the plant, while Trusted is built around a triple modular redundant (TMR) processor. This article sets out the architectures in each safety manual, the SIL Rockwell states for them, and the links to the process control system. Where they sit in a plant: What is an ICSS. What a SIL means for a safety function: What is SIL.

1. Two platforms in one safety portfolio

Rockwell's product page describes AADvance as a distributed, scalable, fault-tolerant SIS made of processor modules, I/O modules and field termination assemblies. Its configurations run from fail-safe to fault tolerant and TMR, different parts of a plant can get different levels of module redundancy, and functions from SIL 1 to SIL 3 can run in the same system. The page states IEC 61508 certification by TÜV and exida.

The Trusted product page describes a fault-tolerant SIS built around a TMR controller: three control slices with majority voting, so a slice that behaves differently from the other two is detected and reported. The page states TÜV certification for applications under IEC 61508:2010 and other standards it lists, such as EN 54-2 and NFPA 72, and mentions partial stroke testing of critical valves.

A SIL that Rockwell states for a controller is a property of the logic solver. It does not by itself give a safety function its SIL, which also depends on the sensors and final elements in the loop.

2. AADvance: what the controller is made of

The AADvance Controller Safety Manual (ICSTT-RM446S-EN-P, October 2024) describes the controller as a logic solver and I/O system designed for functional safety and critical control. It can run safety functions and non-safety functions that are critical to the business (pp. 12–16):

• Modules: processor modules on a processor base, I/O modules on I/O bases, and field termination assemblies; the module tables in chapter 3 name the T9110 processor on the T9100 base, I/O on T9300 bases and termination assemblies in simplex, dual and TMR versions (pp. 32–40). Modules mount on DIN rails in a cabinet or on a wall, and no forced-air cooling is needed (p. 15).
• Safety scope: designed to IEC 61508, for applications up to and including SIL 3, in de-energize to trip (DTT) and energize to action (ETA) configurations, at low and high demand.
• Fault tolerance: dual or triple modules, with the voting arrangements the manual names 1oo1D, 1oo2D and 2oo3D (1 out of 1, 1 out of 2 and 2 out of 3, each with diagnostics). Triplicated output modules are not provided, so outputs are at most dual.
• Applications the manual lists: critical process control, fire and gas protection, rotating machinery control, burner management, boiler and furnace control and distributed process monitoring and control, with emergency shutdown and fire and gas detection named as particularly suited.

The manual separates two goals (pp. 12–16). A fail-safe configuration takes the process to its safe state when it detects a dangerous fault. A fault-tolerant configuration keeps the process running without losing safety integrity, as long as the fault is repaired within the repair time (MTTR) used in the PFD calculation.

3. AADvance architectures and the SIL Rockwell states for each

Chapter 3 of the safety manual names the architectures. The main ones (pp. 31–39):

Points from the same chapter that matter on an existing system:

• Rockwell recommends the SIL 2 architectures for fail-safe, low demand applications (p. 31). High demand needs at least two processor modules (p. 35), and every SIL 3 architecture has at least two (p. 35).
• In the certified configurations table, the T9110 processor is listed for SIL 2 with two modules fitted and for SIL 3 with two or three. Digital and analog inputs are listed for SIL 3 with one, two or three modules. Outputs are listed for SIL 3 in DTT with one or two modules, and in ETA for SIL 2 with one module and SIL 3 with two (pp. 39–40).
• If the processors degrade to 1oo1D, the faulty module must be replaced within the MTTR assumed in the PFD calculation. Otherwise the application must shut down the affected safety functions, unless the safety requirements specification (SRS) defines compensating measures (pp. 31, 36).
• ETA needs at least two independent power sources, with power and line monitoring (p. 49). The fail-safe state of all AADvance modules is de-energized (p. 50).

4. Trusted: the TMR processor and its I/O

The Trusted TMR System Safety Manual (ICSTT-RM459K-EN-P, November 2023) states that the system and the manual were reviewed and certified by TÜV Rheinland to IEC 61508 SIL 3 (pp. 13–15). Its main points:

• Processor: a triplicated microprocessor with internal redundancy of critical circuits (p. 18). The T8110B, T8110C and T8111C processors are listed as 2oo3, certified up to SIL 3, as a single module or in an active and standby pair (p. 34).
• Degraded operation: voting goes from 2oo3D to 1oo2D and then to the fail-safe state, which the manual calls a 3-2-0 architecture (pp. 16–17).
• Online repair: all modules can be removed and replaced live (p. 27). Processors and interfaces are repaired online in adjacent slots (p. 34). For online repair, high-density I/O can be fitted as an active and standby pair, either in the adjacent slot or in a SmartSlot, where one spare position serves several active modules (pp. 38–40).
• I/O: modules such as the T8403 vote 2oo3 inside one module, and dual modules such as the T8402 use 1oo2D. Both are listed up to SIL 3 for DTT; for energize to trip, the manual certifies them only when the conditions in its energize to trip section are met (pp. 35–36, 42).
• Applications the manual names: oil and gas, refining, rail transit and power generation, for safety functions such as fire and gas detection and emergency shutdown (p. 18).

The Trusted product profile (PROCES-PP014B-EN-E, October 2016) adds turbomachinery control, burner management and HIPPS to the typical applications.

5. Programming tools

The AADvance manual covers AADvance Workbench 1.4 and 2.1 and AADvance-Trusted SIS Workstation 2.00, in system release 2.011 (pp. 4–5). The controller supports all five IEC 61131-3 languages, and a removable Program Enable key protects access to the program (pp. 12–16). For Trusted, the manual names the AADvance-Trusted SIS Workstation, or the legacy Trusted Toolset Suite on a PC running VMware (pp. 18–19).

6. Data to and from the process control system

On AADvance, safety data between controllers travels over SNCP (Safety Network Control Protocol), which the manual calls a SIL 3 certified protocol, using variable bindings, along with peer-to-peer (p. 41). Data to a ControlLogix system can use CIP produce and consume over EtherNet/IP, but the SIS Workstation 2.01 help says CIP should carry only non-safety data. The manual also lists Modbus, HART and OPC (pp. 12–16). For Trusted, the product profile lists Modbus TCP/IP, Modbus RTU and EtherNet/IP to controllers, plus OPC DA and OPC A&E. The SIS Workstation firewall page lists the ports, among them TCP 502 for the Modbus slave, 44818 for CIP and UDP 1123 and 1124 for SNCP bindings. A full table of these links is in What is an ICSS.

A SIL is not an IEC 62443 security level. Both safety manuals have their own system security sections, and network zoning is covered in IEC 62443: zones, conduits and security levels.

7. Lifecycle status

On Rockwell's product page for the T9110 AADvance processor module, the lifecycle status reads Active (read 14 November 2026). For other catalog numbers, including the Trusted modules, we check each one on Rockwell's product pages before quoting spares or an extension.

What TDL checks first

These are our own working habits on an existing AADvance or Trusted system:

• The SIL target comes from the plant's hazard and risk assessment and the safety requirements specification. We ask for both, and we implement and test against them.
• We list the architecture actually installed: processor count, input and output modules per group, DTT or ETA, and compare it with the architecture tables of the safety manual edition that applies.
• We read the controller diagnostics for processors or I/O running degraded, because the safety manual sets repair time limits for degraded modules.
• We take a tested backup of the Workbench, SIS Workstation or Toolset project and record the software and firmware release.
• We list every link to the process control system and check that CIP carries only non-safety data, while safety data between controllers uses SNCP or peer-to-peer.
• We check the lifecycle status of each catalog number before planning spares or changes.

How TDL approaches it

TDL builds safety instrumented systems for SIL 2 and SIL 3 functions on AADvance and Trusted, including ESD and fire and gas (ICSS and safety systems, AADvance and Trusted in TDL projects). For Vietsovpetro, we supplied AADvance and engineering consulting for the Central Compressor Platform SIL 3 fire and gas system and the BK-20 and BK-21 wellhead platform ICSS, and upgraded the Riserblock platform's Sieger fire and gas system to AADvance with fault-tolerant I/O. At Phu My Gas Distribution Station we replaced a PLC-5 / HIMA system with an ICSS on redundant ControlLogix and AADvance, then programmed AADvance and ControlLogix for the inlet shut-off valve system. At Thai Binh 2 Thermal Power Plant we provided consulting on the Trusted ESD system, including field testing per the SAT documents.