AADvance Safety Manual - Tuv-fs.com

AADvance Safety ManualEach safety function shall be responsible for the control of the corresponding outputs.Sharing of outputs between functions shall not be permitted.Individual Safety Related FunctionsMinimize Logic DepthThe AADvance Workbench allows the definition of up to 250 individual programswithin a single project. This facility should be exploited to enable the allocation ofindividual safety related functions to separate programs. Where such programs containindependent logic paths, these should be investigated to determine if they are separatesafety functions. Where they are separate, it is recommended that these be furtherallocated to their own program, subject to conforming to the recommendation tominimizing the coupling between programs.Cases should be looked for that allow the creation of individual logic paths by repeatingsmall sections of logic rather than fanning out the resultant signal(s).Where possible, the logic depth should be minimized. This helps reduce visualcomplexity, simplifies testing, minimizes the number of interconnects required andimproves program efficiency.Where there is nested logic, it shall be possible to establish the correct operation of allintermediate logic connections.The use of memory (latch) components within the safety function shall be minimized.Similarly, the permutation of conditions that lead to their activation shall be minimized.Communications InteractionThe AADvance system provides a range of communications options to allowinteraction with external systems. Where this communication is used for reporting (orout-going) communications, there are no specific safety requirements.Data received from external equipment that either controls safety-related functions oraffects their operation must be handled with caution. The Application Program shallhandle the received data.The received data should be such that it is limited to interactions which: Initiates safety operations, i.e. initiates shutdown sequences Resets signals, with the reset action only possible once the initiating conditionshave been removed Initiate timed start-up override signals which are removed automatically either onexpiration of the start period or once the associated signal has stabilized in thenormal operating condition Adjust control parameters within defined safe operational limits, i.e. lowering oftrip thresholds.5-30 Document number 553630 Issue 7: February 2010