SAFETY MANUAL - Tuv-fs.com

SAFETY MANUAL
interdependent programs shall then be re-tested. Whenever a program
modifies a shared variable all programs that use that same variable shall be
re-tested.
3.11.6.2 Code Comparison
After each phase of modification to the application as a whole, the TMR
system code comparison and run-time code version checker utilities shall be
used to identify those programs that have changed. Any program identified
as having undergone change, other than compiled variable addresses, shall
be re-tested.
After an application has been tested, and before any changes are made, a
reference copy of the compiled application should be made. After the application
has been modified, the new application is compared to the original application by
using the TicDiff utility. The utility will identify those programs that have changed
since the original application and are subject to re-test.
The TicVer utility is used to ensure that the reference copy of the original
application is the same as the application currently loaded into the TMR system.
3.12 ON-LINE MODIFICATION
As with any safety related system it is highly recommended that on-line changes
not be performed. Where changes have to be performed on-line, it is
recommended that they be performed when alternative safety measures are
provided or when the affected hazards cannot arise.
Certain modifications can be performed without directly affecting the system’s
safety function, for example the installation of additional modules. Although these
modifications will not affect the system’s operation until the system configuration
and application program have been modified, caution shall be exercised to ensure
that the modifications do not affect other safety functions.
The product allows for the on-line addition of modules, although these require
application program modification, which dictates the stop and reload of the
application. The addition of modules may be performed on-line to minimise the
period of plant downtime. Modifications to field and power wiring to accommodate
new modules shall be considered carefully. Changes that affect the system’s
ability to respond safely, or may cause other plant disruption shall not be
performed on-line unless alternate protection measures can be implemented
for the duration of such modifications.
3.12.1 Application Program
The Plantguard system supports two types of on-line updates: Normal Updates and
Intelligent Updates. Specifically, an on-line update consists of changing the
currently running application, loading those changes into the system, then having
the system “switch” to the updated application without interruption to the process
that the application is controlling. Normal updates are available in all released
versions of the Plantguard system.
With Normal Updates, the TMR system allows limited changes to be made to the
application program on-line. These pre-defined limits restrict changes to logical
operation. Modifications that exceed these predefined limits automatically preclude
on-line modification and dictate that the application program be stopped before
updating.
Doc Number P8094
Issue 14 September 2003 Page 65 of 67