Safety Considerations Guide for Triconex General ... - ICEWeb

General Guidelines 17
General Guidelines
This section describes standard industry guidelines that apply to:
• All safety systems
• Emergency shutdown (ESD) systems
• Burner management systems
• Fire and gas systems
All Safety Systems
These general guidelines apply to all user-written safety applications and procedures:
• A design-change review, code-change review, and functional testing are recommended
to verify the correct design and operation.
• After a safety system is commissioned, no changes to the system software (operating
system, I/O drivers, diagnostics, etc.) are allowed without type approval and recommissioning.
Any changes to the application or the control application should be
made under strict change-control procedures. For more information on change-control
procedures, see Project Change and Control on page 23. All changes should be
thoroughly reviewed, audited, and approved by a safety change control committee or
group. After an approved change is made, it should be archived.
• In addition to printed documentation of the application, two copies of the application
should be archived on an electronic medium that is write-protected to avoid accidental
changes.
• Under certain conditions, a PES may be run in a mode that allows an external computer
or operator station to write to system attributes. This is normally done by means of a
communication link. The following guidelines apply to writes of this type:
— The communication link should use Modbus or other approved protocols with CRC
checks.
— The communication link should not be allowed to write directly to output points.
— The application must check the value (of each variable written) for a valid range or
limit before its use.
— For information on the potential impacts of writes to safety-related variables that
result in disabling diagnostics such as Output Voter Diagnostics, see Module
Diagnostics on page 36.
• PID and other control algorithms should not be used for safety-related functions. Each
control function should be checked to verify that it does not provide a safety-related
function.
• Pointers should not be used for safety-related functions. For TriStation 1131
applications, this includes the use of VAR_IN_OUT variables.
• An SIS PES should be wired and grounded according to the procedures defined by the
manufacturer.
Safety Considerations Guide for Triconex General Purpose v2 Systems