Safety Considerations Guide for Triconex General ... - ICEWeb

Sample Safety-Shutdown Programs 53
When Some I/O Modules Are Safety-Critical
For some applications, not all modules may be critical to a process. For example, an output
module that interfaces to the status indicators on a local panel is usually not critical to a process.
The EX02_SHUTDOWN sample program shows how to increase system availability by
detecting the status of safety-critical modules. The user-defined function block CRITICAL_IO
checks the safety-critical I/O modules. The CRITICAL_IO outputs are connected to the inputs
of the CRITICAL_MODULES function block.
Note
The sample program is an element of project TdTUV.pt2 included as part of the
TriStation 1131 software installation. The default location of the project is C:\Documents
and Settings\\My Documents\Triconex\TriStation 1131 4.x\Projects.
When the output CRITICAL_MODULES_OPERATING is true, all critical modules are
operating properly. The input MAX_TIME_DUAL specifies the maximum time allowed with
two channels operating (with no connection, defaults to 40000 days). The input
MAX_TIME_SINGLE specifies the maximum time allowed with one channel operating (three
days in the example).
Note
In typical applications, the operating time restrictions in the table on page 22 should be
followed.
When CRITICAL_MODULES_OPERATING is false, the time in degraded operation exceeds
the specified limits; therefore, the control program should shut down the plant.
CAUTION
EX02_SHUTDOWN does not handle detected field faults, rare
combinations of faults detected as field faults, or output voter faults
hidden by field faults. The application, not the SYS_SHUTDOWN
function block, must read the NO_FLD_FLTS module status or FLD_OK
point status to provide the required application-specific action.
Program EX02_SHUTDOWN
Figure 11
EX02_SHUTDOWN Sample Program
Table 12
Parameter
CI
IO_CO
IO_TMR
IO_GE_DUAL
IO_GE_SINGLE
Input Parameters for SYS_SHUTDOWN Function Block in EX02_SHUTDOWN
Description
Control In
If false, then CO is false—no change in the output value
If true and ERROR_NUM is 0, then CO is true
Critical I/O control out
All critical I/O points are operating in triple modular
redundant mode
All critical I/O points are operating are operating in dual or
TMR mode
All critical I/O points are operating are operating in single,
dual, or TMR mode
Safety Considerations Guide for Triconex General Purpose v2 Systems