SAFETY MANUAL - Tuv-fs.com

SAFETY MANUAL
A failure in any element of each channel, e.g. Ch. A Input, will result in that
complete channel’s failure. If this failure is fail-safe, only 1 of the remaining
channels needs to respond to a demand condition to generate the safe reaction. If
a second channel fails safe then the overall system will fail-safe. This is therefore a
3-2-0 architecture. Typically diagnostics are used to ensure that the fail-safe state
can be assured, the operation is therefore 2-oo-3D, reverting to 1-oo-2D, reverting
to fail-safe.
The 8000 series is a TMR system; this means that each stage of the system is
triplicated, with the results from each preceding stage majority voted to provide both
fault tolerance and fault detection. Diagnostics are also used to ensure that covert
failures are detected and result in the correct fail-safe reaction. For example, a
fault within Input Ch. A will be localised to that input, and unlike the standard
triplicated system, will allow Processor Ch. A and Output Ch. A to continue
operation, i.e. the input is now operating 1-oo-2D whilst the remainder of the
system continues to operate 2-oo-3.
Diagnostics
INPUT
(Ch. A)
1
Diagnostics
PROCESSOR
(Ch. A)
1
Diagnostics
OUTPUT
(Ch. A)
1
Diagnostics
INPUT
(Ch. B)
1
Diagnostics
PROCESSOR
(Ch. B)
1
Diagnostics
OUTPUT
(Ch. B)
1
Diagnostics
INPUT
(Ch. C)
1
Diagnostics
PROCESSOR
(Ch. C)
1
Diagnostics
OUTPUT
(Ch. C)
1
The 8000 Series utilises this Triple Modular Redundant architecture with
diagnostics, supporting a 2-oo-3D reverting to 1-oo-2D reverting to fail-safe, or
3-2-0 operation. The 1-oo-2D operation is a transient mode of operation where
active and standby modules are installed; in this case, the degradation is 3-2-3-2-0.
The architecture, and hence degradation modes for low density I/O may be
selected as required, see para. 3.2 in this Manual for further details.
1.4 THE 8000 SERIES OVERVIEW
The TMR system is based on a triplicated microprocessor with internal redundancy
of all critical circuits. The system controls complex and often critical processes in
real time - executing programs that accept external sensor signals, solving logic
equations, performing calculations for continuous process control and generating
external control signals. These user-defined application programs monitor and
control real-world processes in the oil and gas, refining, rail transit, power
generation and related industries across a wide range of control and safety
applications. The TMR system is certified for use in safety-related applications
such as fire and gas detection, and emergency shutdown up to requirements class
6 according to DIN V 19250 and IEC 61508 SIL 3.
Application programs for the TMR system are written and monitored using the
IEC1131 TOOLSET , a Microsoft ® Windows NT, Windows 2000, or Windows
XP, based software suite running on a personal computer.
Doc Number P8094
Issue 14 September 2003 Page 25 of 67