50
Rockwell Automation Publication ICSTT-RM446N-EN-P - April 2018
Chapter 3
AADvance System Architectures
SIL 3 Architectures
SIL 3 architectures have at least two processor modules and are suitable for use
with:
• SIL 3 de-energize to trip applications.
• SIL 3 energize to action applications which have dual digital/analogue
output modules.
Faulted input modules in a SIL 3 arrangement may be replaced without a time
limit; faulted output modules must be replaced within the MTTR assumed in
the PFD calculations.
In all SIL 3 architectures, when the processor modules have degraded to
1oo1D on the first detected fault, the system must be restored to at least
1oo2D by replacing the faulty processor module within the MTTR assumed in
the PFD calculations; also, unless compensating measures are defined in the
Safety Requirements Specification (SRS) and documented in operating
procedures, the application program must be designed to shut down safety
instrumented functions if a module failure due to a dangerous fault has not
been replaced within the MTTR.
Fail-safe I/O, Fault Tolerant Processor
A SIL 3, fail-safe I/O with a fault tolerant processor architecture has a simplex
input and output arrangement with dual or triple processor modules. The dual
processor modules operate in 1oo2D under no fault conditions and degrades
to 1oo1D on detection of the first fault in either module. When there are faults
on both modules the configuration will fail-safe.
If required you can configure triple processor modules as a variation of this SIL
3 architecture. Using this arrangement the processor modules operate in
2oo3D under no fault conditions and 1oo2D on the detection of the first fault
in any module. They degrade to 1oo1D on the detection of faults in any two
modules, and will fail-safe when there are faults on all three modules.
