52
Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Chapter 6
Safety Application Development
Basics of Application
Development and Testing
The application program for the intended SIL 3 system should be developed by
the system integrator or a user trained and experienced in safety applications. The
developer must follow good design practices:
•
Use functional specifications, including flow charts, timing diagrams, and
sequence charts.
•
Perform a review of safety task logic.
•
Perform application validation.
Table 9 - Controller Modes
Controller
Mode
Safety Task Status
Safety
(1)
(up to and including)
Comments
(A valid program has been downloaded to the controller.)
Program
Unlocked
No signature
•
I/O connections established
•
Safety Task logic is not being scanned.
Run
Unlocked
No signature
(Development purposes
only)
•
Forcing allowed
•
Online editing allowed
•
Safety memory is isolated, but is unprotected (read/write).
•
Safety Task logic is being scanned.
Primary and partner controllers process logic, cross-compare logic outputs. Logic outputs are
written to safety outputs.
Run
Locked
No signature
PLd/Cat. 3
Control reliable
SIL 2
•
New forces are not allowed. Existing forces are maintained.
•
Online editing is not allowed.
•
Safety memory is protected (read only)
•
Safety task logic is scanned.
•
Primary and partner controllers process logic, cross-compare logic outputs. Logic outputs are
written to safety outputs.
Run
Unlocked
With signature
Ple/Cat. 4
Control reliable
SIL 3
•
Forces are not allowed. (They must be removed to generate a safety task signature.)
•
Online editing is not allowed.
•
Safety memory is protected (read only).
•
Safety task logic is scanned.
•
Primary and partner controllers process logic, cross-compare logic outputs. Logic outputs are
written to safety outputs.
•
Safety task signature is unprotected and can be deleted by anyone who has access to the controller.
Run
Locked
With signature
Ple/Cat. 4
Control reliable
SIL 3
•
Forces are not allowed. (They must be removed to generate a safety task signature.)
•
Online editing is not allowed.
•
Safety memory is protected (read only).
•
Safety task logic is scanned.
•
Primary and partner controllers process logic, cross-compare logic outputs. Logic outputs are
written to safety outputs.
•
Safety task signature is protected. Users must enter the unlock password to unlock the controller
before they can delete the safety task signature.
(1) To achieved this level, you must adhere to the safety requirements defined in this publication.
