1756-RM001B-EN-P, Using ControlLogix in SIL2 ... - Tuv-fs.com

1-2 SIL PolicyThe TUV Rheinland has approved the ControlLogix system for use inup to SIL 2 safety related applications in which the de-energized stateis considered to be the safe state. All of the examples related to I/Oincluded in this manual are based on achieving de-energization as thesafe state for typical Emergency Shutdown (ESD) Systems.The ControlLogix is a modular and configurable system with theability to pre-configure outputs and other responses to faultconditions. As such, a system can be designed to meet requirementsfor “hold last state" in the event of a fault so that the system can beused in up to SIL 2 level Fire and Gas and other Applications thatrequire that output signals to actuators remain on. By understandingthe behavior of the ControlLogix system for an emergency shutdownapplication, the system design can incorporate appropriate measuresto meet other application requirements. These measures relate to thecontrol of outputs and actuators which must remain on to be in a safestate. The other requirements for SIL2 regarding inputs from sensors,software etc. must also be met. The measures and modificationswhich relate to Gas and Fire are listed below.• The use of a manual over-ride is necessary to ensure theoperator can maintain the desired control in the event of aController Failure. This is similar in concept to the function ofthe external relay or redundant outputs required to ensure ade-energized state is achieved for an ESD system should afailure occur that would prevent this from normally occurringsuch as a shorted output driver. The system knows it has afailure but the failure mode requires an independent means tomaintain control and either remove power or provide analternate path to maintain power to the end actuator.• If the application cannot tolerate an output that can fail shorted(energized) then an external means such as a relay or otheroutput must be wired in series to remove power when the failshorted condition occurs. (Refer to Figure 6.8 on page 6-11)If the application cannot tolerate an output that fails open(deenergized) then an external means such as a manual overrideor output must be wired in parallel. (Refer to the manualoverride Figure 1.1 on page 1-3). The user must supply thealternative means and develop the application program toinitiate the alternate means of removing or continuing to supplypower in the event the main output fails.Publication 1756-RM001B-EN-P - October 2003