Safety Considerations Guide for Trident v2 Systems - TUV ...

56 Chapter 4 Application Development
Table 12 Input Parameters for SYS_SHUTDOWN Function Block in EX02_SHUTDOWN
Parameter Description
CI Control In
If false, then CO is false—no change in the output value
If true and ERROR_NUM is 0, then CO is true
IO_CO Critical I/O control out
IO_TMR All critical I/O points are operating in triple modular
redundant mode
IO_GE_DUAL All critical I/O points are operating are operating in dual or
TMR mode
IO_GE_SINGLE All critical I/O points are operating are operating in single,
dual, or TMR mode
IO_NO_VOTER_FLTS If true, then no voter faults exist on a critical I/O module
If false, then a voter fault exists on a critical I/O module
IO_ERROR Error number: Zero indicates no error. Non-zero indicates a
programming or configuration error
MAX_TIME_DUAL Maximum time with only two channels operating
MAX_TIME_SINGLE Maximum time with only one channel operating
MAX_SCAN_TIME 50% of the maximum response time
Table 13 Output Parameters for SYS_SHUTDOWN Function Block in EX02_SHUTDOWN
Parameter Description
CO Control Out
OPERATING When true, all safety-critical modules are
operating properly
When false, the time in degraded operation
exceeds the specified limits; therefore, the
control program should shut down the process
TMR System is operating in triple modular redundant
mode
DUAL At least one safety-critical point is controlled by
two channels
SINGL At least one safety-critical point is controlled by
one channel
ZERO At least one safety-critical point is not controlled
by any channel
TIMER_RUNNING Time left to shutdown is decreasing
TIME_LEFT Time remaining before shutdown
ALARM_PROGRAMMING_PERMITTED True if application changes are permitted
Safety Considerations Guide for Trident v2 Systems