Safety Considerations Guide for Trident v2 Systems - TUV ...

Sample Safety-Shutdown Programs
Sample Safety-Shutdown Programs 51
This section describes sample programs and methods for implementing safety-shutdown
networks.
When All I/O Modules Are Safety-Critical
The sample program, EX01_SHUTDOWN, shows one way to verify that the safety system is
operating properly when every module in the safety system is safety-critical. This example uses
an instance of the Triconex Library function block SYS_SHUTDOWN named
CRITICAL_MODULES.
Note The sample program is an element of project TdTUV.pt2 included as part of the
TriStation 1131 software installation. The default location of the project is C:\Documents
and Settings\\My Documents\Triconex\TriStation 1131 4.x\Projects.
When the output CRITICAL_MODULES_OPERATING is true, all safety-critical modules are
operating properly. The input MAX_TIME_DUAL specifies the maximum time allowed with
two channels operating (with no connection, defaults to 40000 days). The input
MAX_TIME_SINGLE specifies the maximum time allowed with one channel operating (3 days
in the example).
Note In typical applications, the operating time restrictions in the table on page 25 should be
followed.
When CRITICAL_MODULES_OPERATING is false, the time in degraded operation exceeds
the specified limits; therefore, the control program should shut down the process under safety
control.
CAUTION
EX01_SHUTDOWN does not handle detected field faults, rare
combinations of faults detected as field faults, or output voter faults
hidden by field faults. The application, not the SYS_SHUTDOWN
function block, must read the NO_FLD_FLTS module status or FLD_OK
point status to provide the required application-specific action.
For information on improving availability using external, power-disconnect relays and
advanced programming techniques, see the sample program EX02_SHUTDOWN.
Safety Considerations Guide for Trident v2 Systems