AADvance Safety Manual - Tuv-fs.com

Chapter 5 AADvance Functional Safety SystemImplementationVariable Bindings Sensors and actuators are electrically switched off during maintenance and arechecked manually.In some installations, the maintenance console may be integrated with the operatordisplay, or maintenance may be covered by other strategies. In such installations, theguidance given in section is to be followed. A checklist for the application of overridesis given in the Checklists chapter.The AADvance system uses variable bindings ('bindings') to pass safety-related databetween controllers. When using this mechanism, as with any other, it is important toensure that the overall system will respond within the required PST. This requirementapplies to normal operation and in the presence of a fault.For safety related applications, it is recommended that the binding communications useredundant networks. It should be noted that high network bandwidth usage by nonsafetyequipment may cause data timeout, and hence spurious trips, and thereforeseparate networks for safety data should be considered.The bindings are based on a producer/consumer model. A consumer systemestablishes a binding link with a producer system, and then repeatedly requests bindingdata.The bindings configuration includes the value of an age timeout. This timeout definesthe maximum age of data that can be used by a consumer system. Data older than thedefined timeout is discarded, and the system continues using its current state or value.The configuration also includes a timeout value for the response to a binding datarequest. Failure to receive a valid response containing fresh data within this timeoutcauses the consumer to disconnect from the producer. In the event of such a timeout,data received from the producer will either hold its current state or value, or go to apre-defined fail-safe state, depending on the configuration. If hold last state isselected it is important that the application programmer include handlingof this condition, including latching of the failure as necessary. For example,the loss of a binding communications link may require a specific safety reaction, or mayrequire that the corresponding data be set to specific states or pre-defined values.The configuration also includes a timeout value which is used by a producer system totimeout binding data requests from a consumer system. Should a producer fail toreceive a binding data request from a consumer within this timeout, the link to theconsumer system is closed. The consumer system, if still functional, will timeout thelink from its end.The timeout values shall be set within the fault tolerant capabilities of theBindings network, so the system can still respond within the required PST.The network propagation time must be included in the timeout periodcalculations, and should be verified after each change to the networkconfiguration.Document number 553630 Issue 7: February 2010 5-25