Safety Considerations Guide for Trident v2 Systems - TUV ...

Operating Modes
Each input or output point is considered to operate in one of four modes:
• Triple Modular Redundant • Single mode
• Dual mode • Zero mode
Operating Modes 37
The current mode indicates the number of channels controlling a point; in other words,
controlling the output or having confidence in the input. For safety reasons, system mode is
defined as the mode of the point controlled by the least number of channels.
System variables summarize the status of input and output points. When a safety-critical point
is in zero mode, the application should shut down the controlled process.
You can further simplify and customize shutdown logic by using special function blocks
provided by Triconex. By considering only faults in safety-critical modules, system availability
can be improved. Using shutdown function blocks is essential to preventing potential false trips
in dual mode and to guaranteeing fail-safe operation in single mode. For more information, see
Appendix C, Safety-Critical Function Blocks.
A safety-critical fault is defined as a fault that prevents the system from executing the safety
function on demand. Safety-critical faults include:
• Inability to detect a change of state on a digital input point
The controller’s diagnostics verify the ability to detect changes of state independently
for each channel, typically every 500 milliseconds. For more information on fault
reporting time, see Calculation for Diagnostic Fault Reporting Time on page 41.
• Inability to detect a change of value on an analog input point
The controller’s diagnostics verify the ability to detect changes of value independently
for each channel, typically every 500 milliseconds. For more information on fault
reporting time, see Calculation for Diagnostic Fault Reporting Time on page 41.
• Inability to change the state of a digital output point
The controller’s diagnostics verify the ability to control the state of each output point.
• Inability of the system to:
— Read each input point
— Vote the correct value of each input
— Execute the control application
— Determine the state of each output point correctly
The controller’s diagnostics verify the correct operation of all data paths between the
I/O modules and the MPs for each channel independently, typically every 500
milliseconds. For more information on fault reporting time, see Calculation for
Diagnostic Fault Reporting Time on page 41.
Safety Considerations Guide for Trident v2 Systems