SAFETY MANUAL - Tuv-fs.com

More documents

Recommendations

Info

SAFETY MANUAL 3.4 ACTUATOR CONFIGURATIONS As with sensor configurations it is recommended that redundant actuator configurations be used for safety-critical applications. Some applications may require multiple actuators and I/O points per safety function In safety-critical applications using a single actuator, it is important that the actuator failure modes be predictable and well understood, so that there is little probability of a failed actuator not responding to a critical process condition. In such a configuration, it is important that the actuator be tested regularly, either by dynamic process conditions that are verified in the TMR system, or by manual intervention testing. The function of a signal shall be considered when allocating the module and channel within the system. In many cases, redundant actuator configurations may be used, or differing actuator types provide alternate control and mitigation possibilities. Plant facilities frequently have related signals; in these cases it is important to ensure that failures beyond the system’s fault-tolerant capability do not result in either an inability to respond to safety demands or in inadvertent operation. In some cases, this will require that channels be allocated on the same module, to ensure that a module failure results in the associated signals failing-safe. However, in most cases, it will be necessary to separate the signals across modules. Where non-redundant configurations are employed, it is especially important to ensure that the fail-safe action is generated in case of failures within the system. Field loop power should be considered in the allocation of signals to output channels and modules. For normally energised configurations, field loop power failure will lead to the fail-safe reaction. As with the allocation of signals to modules, there may be related functions where loss of field power should be considered in the same manner as the signal allocation. Where signals are powered from separate power groups, it is important that this separation be maintained when allocating the signals to modules, i.e. that inadvertent coupling between power groups, and particularly return paths, are not generated. 3.5 PFD CALCULATIONS Systems that are configured to meet the needs of IEC 61508 will require the PFD for the safety instrumented functions to be calculated. For information regarding the calculation for the 8000 system and PFD numbers allocated for the 8000 system pleased refer to the TUV approved PFD calculation document listed in the approved version list. Doc No P8094 Page 50 of 67 Issue 14 September 2003
SAFETY MANUAL 3.6 PROCESSOR CONFIGURATION 3.6.1 Timing The TMR Processor supports a limited set of configuration options; the system will verify many of the configuration options, for example module locations against actual module types. The configuration options include the maximum application program scan time and sleep period between application program scans. It is important to ensure that the overall application program scan period (scan and sleep periods) be set according to the PST E . 3.6.1.1 ISAGRAF_CONFIG Section Sleep Period (ISA_SLEEP_PERIOD) This parameter defines the period that the application program should “sleep” between program scans. This parameter works in conjunction with the allowed scan time defined within the IEC1131 TOOLSET. The default value for this parameter is zero. This value may be increased to allow higher levels of processing resource to be allocated to other tasks, e.g. external communications. Increasing this parameter will increase the overall scan time. If this parameter is increased, it is important to ensure that this overall scan time does not result in a response time exceeding that dictated by PST E . The sleep period or the allowed scan time, set in the IEC1131 TOOLSET, should be adjusted to free up processing resource for other activities. If the sleep period is set to zero and the application execution to “fast as possible” the system will switch between the necessary activities as required. Allowing a “free” amount of resource reduces the switching, improves overall efficiency for the specific application and results in greater scan period consistency under a range of conditions, rather than a faster scan period, but variable depending on load. Maximum Scan Period (MAX_SCAN_TIME) This parameter defines the maximum application scan time. The default setting is 1000ms. If the defined time is exceeded the system will automatically and immediately initiate its overall fail-safe response. This value should be set to ensure that the overall scan time does not exceed the period dictated by PST E . Doc Number P8094 Issue 14 September 2003 Page 51 of 67
Page 1: 8000 SERIES TMR SYSTEM SAFETY MANUA
Page 4 and 5: SAFETY MANUAL This page intentional
Page 6 and 7: SAFETY MANUAL NOTICE The content of
Page 8 and 9: SAFETY MANUAL RADIO FREQUENCY INTER
Page 10 and 11: SAFETY MANUAL ABBREVIATIONS 1-oo-2
Page 12 and 13: SAFETY MANUAL elements disagree. DR
Page 14 and 15: SAFETY MANUAL similar to the simple
Page 16 and 17: SAFETY MANUAL RS-232C, RS-422, RS-4
Page 18 and 19: SAFETY MANUAL 8000 Series Certified
Page 20 and 21: SAFETY MANUAL 3.11.6 Program Testin
Page 22 and 23: SAFETY MANUAL 1. INTRODUCTION 1.1 P
Page 24 and 25: SAFETY MANUAL 1.3.1 Safety and Func
Page 26 and 27: SAFETY MANUAL The additional elemen
Page 28 and 29: SAFETY MANUAL The TMR architecture
Page 30 and 31: SAFETY MANUAL 2.2.1 Safety Lifecycl
Page 32 and 33: SAFETY MANUAL Tools used within the
Page 34 and 35: SAFETY MANUAL 2.2.1.9 Safety System
Page 36 and 37: SAFETY MANUAL • Method of detecti
Page 38 and 39: SAFETY MANUAL 2.3.1 Competency The
Page 40 and 41: SAFETY MANUAL 3.2.1 Safety-Related
Page 42 and 43: SAFETY MANUAL Pulse Generator 8444,
Page 44 and 45: SAFETY MANUAL 3.2.2 High-Density I/
Page 46 and 47: SAFETY MANUAL 3.2.3 Analog Input Sa
Page 48 and 49: SAFETY MANUAL 3.2.7 NFPA 86 Require
Page 50 and 51: SAFETY MANUAL shall be provided for
Page 54 and 55: SAFETY MANUAL 3.6.1.2 Composite Sca
Page 56 and 57: SAFETY MANUAL Power Fail Timeout (P
Page 58 and 59: SAFETY MANUAL • Access to the wor
Page 60 and 61: SAFETY MANUAL 3.11.1 IEC1131 Workbe
Page 62 and 63: SAFETY MANUAL 3.11.3 Testing of New
Page 64 and 65: SAFETY MANUAL 3.11.4 Application De
Page 66 and 67: SAFETY MANUAL Where the interaction
Page 68 and 69: SAFETY MANUAL In addition to Normal
Page 70 and 71: SAFETY MANUAL 1ºF/min Table 8 - Cl
Page 72 and 73: SAFETY MANUAL 2. Alternatively, the
Page 74 and 75: SAFETY MANUAL 4. CHECKLISTS This se
Page 76 and 77: SAFETY MANUAL Description Reference
Page 78 and 79: SAFETY MANUAL Description Reference
Page 80 and 81: SAFETY MANUAL 4.2.4 High Density Mo
Page 82 and 83: SAFETY MANUAL 5. PREVIOUSLY ASSESSE

SAFETY MANUAL - Tuv-fs.com

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?