Safety Considerations Guide, Tricon v9.0 - Tuv-fs.com

Guidelines for Tricon Controllers 35Additional RecommendationsThe following procedures are recommended in addition to the recommendationsdescribed in the tables on page 33 and page 34:• A DCS program should regularly verify that no discrepancies exist betweenthe override command signals issued by a DCS and override-activatedsignals received by a DCS from a PES. The following diagram depicts thisprocedure:Safety-Instrumented SystemControllerSensorsSafeguardingApplicationProgramActuatorsPES Block DiagramHard-WiredSwitchMaintenanceOverride Handling(Application Program)OperatorWarningDistributedControl SystemInputsEngineeringWorkstation• Use of the maintenance override capability should be documented in a DCSor TriStation log. The documentation should include:– Begin- and end-time stamps of the maintenance override.– Identification of the maintenance engineer or operator who activates amaintenance override. If the information cannot be printed, it should beentered in a work-permit or maintenance log.– Tag Name of the signal being overridden.– Communication packages that are different from a type-approvedModbus should include CRC, address check, and check of thecommunication time frame.– Loss of communication should lead to a warning to the operator andmaintenance engineer. After loss of communication, a time-delayedremoval of the override should occur after a warning to the operator.Chapter 2Application Guidelines