Allen-Bradley 1756-L6 Series, Reference Manual, Page: 92 / 134

92 Rockwell Automation Publication 1756-RM001I-EN-P - May 2012
Chapter 9 Use of Human-to-Machine Interfaces
Changing Safety-related Parameters in SIL-rated Systems
A parameter change in a safety-related loop via an external (that is, outside the
safety loop) device (for example, an HMI) is allowed only with the following
restrictions:
• Only authorized, specially-trained personnel (operators) can change the
parameters in safety-related systems via HMIs.
• The operator who makes changes in a safety-related system via an HMI is
responsible for the effect of those changes on the safety loop.
• You must clearly document variables that are to be changed.
• You must use a clear, comprehensive, and explicit operator procedure to
make safety-related changes via an HMI.
• Changes can only be accepted in a safety-related system if the following
sequence of events occurs.
a. The new variable must be sent twice to two different tags; that is, both
values must not be written to with one command.
b. Safety-related code, executing in the controller, must check both tags
for equivalency and make sure they are within range (boundary checks).
c. Both new variables must be read back and displayed on the HMI
device.
d. Trained operators must visually check that both variables are the same
and are the correct value.
e. Trained operators must manually acknowledge that the values are
correct on the HMI screen that sends a command to the safety logic,
which allows the new values to be used in the safety function.
In every case, the operator must confirm the validity of the change before
they are accepted and applied in the safety loop.
• Test all changes as part of the safety validation procedure.
• Sufficiently document all safety-related changes made via HMI, including:
– authorization.
– impact analysis.
– execution.
– test information.
– revision information.
• Changes to the safety-related system, must comply with IEC 61511
standard on process safety section 11.7.1 Operator Interface requirements.