Safety Considerations Guide, Tricon v9.0 - Tuv-fs.com

Guidelines for Tricon Controllers 27For information on data transfer time and examples of how to use Peer-to-Peerfunctions to transfer safety-critical data, see Appendix A, “Peer-to-PeerCommunication”.SIL3/AK5 GuidelinesFor SIL3/AK5 applications, the following guidelines should be followed:• If non-approved modules are used, the inputs and outputs should be checkedto verify that they do not affect safety-critical functions of the controller.• Two modes control write operations from external hosts:– Remote Mode—When the keyswitch setting is REMOTE, externalhosts, such as Modbus master, DCS, etc., can write to aliased variables inthe controller. When false, writes are prohibited.– Program Mode—When the keyswitch setting is PROGRAM, TriStationcan make program changes, including operations that modify thebehavior of the programs currently running. (For example, DownloadAll, Download Change, declaring variables, enabling/disablingvariables, changing values of variables and scan time, etc.)Remote mode and program mode are independent of each other. In safetyapplications, operation in these modes is not recommended. In other words,write operations to the controller from external hosts should be prohibited. Ifremote mode or program mode becomes true, the application programshould include the following safeguards:– When remote mode is true:• A program should turn on an alarm. For example, if using theTR_SHUTDOWN function block, the ALARM_REMOTE_ACCESSoutput could be used.• Aliased variables should be checked for adherence to the guidelinesdescribed in section “Maintenance Overrides” on page 32.– When program mode is true:• A program should turn on an alarm. For example, if using theTR_SHUTDOWN function block, theALARM_PROGRAMMING_PERMITTED output could be used.• Wiring and grounding procedures outlined in the Tricon Planning &Installation Guide should be followed.Chapter 2Application Guidelines