Safety Considerations Guide for Triconex General ... - ICEWeb
Safety Considerations Guide for Triconex General ... - ICEWeb
Safety Considerations Guide for Triconex General ... - ICEWeb
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Operating Modes 35<br />
Operating Modes<br />
Each input or output point is considered to operate in one of four modes:<br />
• Triple Modular Redundant • Single mode<br />
• Dual mode • Zero mode<br />
The current mode indicates the number of channels controlling a point; in other words,<br />
controlling the output or having confidence in the input. For safety reasons, system mode is<br />
defined as the mode of the point controlled by the least number of channels.<br />
System variables summarize the status of input and output points. When a safety-critical point<br />
is in zero mode, the application should shut down the controlled process.<br />
You can further simplify and customize shutdown logic by using special function blocks<br />
provided by <strong>Triconex</strong>. By considering only faults in safety-critical modules, system availability<br />
can be improved. Using shutdown function blocks is essential to preventing potential false trips<br />
in dual mode and to guaranteeing fail-safe operation in single mode. For more in<strong>for</strong>mation, see<br />
Appendix C, <strong>Safety</strong>-Critical Function Blocks.<br />
A safety-critical fault is defined as a fault that prevents the system from executing the safety<br />
function on demand. <strong>Safety</strong>-critical faults include:<br />
• Inability to detect a change of state on a digital input point<br />
The controller’s diagnostics verify the ability to detect changes of state independently<br />
<strong>for</strong> each channel, typically every 500 milliseconds. For more in<strong>for</strong>mation on fault<br />
reporting time, see Calculation <strong>for</strong> Diagnostic Fault Reporting Time on page 39.<br />
• Inability to detect a change of value on an analog input point<br />
The controller’s diagnostics verify the ability to detect changes of value independently<br />
<strong>for</strong> each channel, typically every 500 milliseconds. For more in<strong>for</strong>mation on fault<br />
reporting time, see Calculation <strong>for</strong> Diagnostic Fault Reporting Time on page 39.<br />
• Inability to change the state of a digital output point<br />
The controller’s diagnostics verify the ability to control the state of each output point.<br />
• Inability of the system to:<br />
— Read each input point<br />
— Vote the correct value of each input<br />
— Execute the control application<br />
— Determine the state of each output point correctly<br />
The controller’s diagnostics verify the correct operation of all data paths between the<br />
I/O modules and the MPs <strong>for</strong> each channel independently, typically every 500<br />
milliseconds. For more in<strong>for</strong>mation on fault reporting time, see Calculation <strong>for</strong><br />
Diagnostic Fault Reporting Time on page 39.<br />
<strong>Safety</strong> <strong>Considerations</strong> <strong>Guide</strong> <strong>for</strong> <strong>Triconex</strong> <strong>General</strong> Purpose v2 Systems