AADvance Safety Manual - Tuv-fs.com

Chapter 4 AADvance System ArchitecturesSIL3 ArchitecturesSIL3 architectures have at least two processor modules and are suitable for use with: SIL3 de-energize to trip applications SIL3 energize to action applications when fitted with dual output modulesIn all SIL3 architectures, when the processor modules have degraded to 1oo1D on thefirst detected fault, the system must be restored to 1oo2D by replacing the faultyprocessor module within the MTTR.Faulted input modules in a SIL3 arrangement may be replaced without a time limit;faulted output modules must be replaced within the MTTR.SIL3 Fail-safe I/O, Fault Tolerant ProcessorA SIL3, fail-safe I/O with a fault tolerant processor architecture has a simplex input andoutput arrangement with dual or triple processor modules. The dual processormodules operate in 1oo2D under no fault conditions and degrades to 1oo1D ondetection of the first fault in either module. When there are faults on both modulesthe configuration will fail-safe.If required you can configure triple processor modules as a variation of this SIL3architecture. Using this arrangement the processor modules operate in 2oo3D underno fault conditions and 1oo2D on the detection of the first fault in any module. Theydegrade to 1oo1D on the detection of faults in any two modules, and will fail-safe whenthere are faults on all three modules.Document number 553630 Issue 7: February 2010 4-7