Rockwell Automation Allen-Bradley AADvance T9110, Solutions Handbook

Page: 67 / 165

Rockwell Automation Publication ICSTT-RM447M-EN-P - July 2019 67
AADvance System Architectures Chapter 4
Table 8 - Modules for SIL 2 Fault Tolerant High demand Architecture
SIL 3 Architectures SIL 3 architectures have at least two or three processor modules and are
applicable for use with:
• SIL 3 de-energize to trip applications.
• SIL 3 energize to action applications when fitted with dual digital
output modules.
• SIL 3 high demand applications where the required safe state is more
than 4 mA, when fitted with dual analogue output modules (A ‘safe
state’ is an output configured to go to a specific value, or configured to
hold last state).
Faulted input modules in a SIL 3 arrangement can be replaced without a time
limit; faulted output modules must be replaced within the MTTR assumed in
the PFD calculations.
In all SIL 3 architectures, when the processor modules have degraded to
1oo1D on the first detected fault, the system must be restored to at least
1oo2D by replacing the faulty processor module within the MTTR assumed in
the PFD calculations or all SIL 3 safety instrumented function and high
demand safety instrumented functions must be shut down.
WARNING: For Continuous Mode applications the measures specified in this
section for High Demand applications must be applied.
Position Module Type
I/P A & B 2 × T9401/2 Digital Input Module, 24 Vdc, 8/16 C
T9802 Digital Input TA, 16 Channel, Dual or
2 × T9431/2 Analogue Input Module, 8/16 c
T9832 Analogue Input TA, 16 Channel, Dual
1 × T9300 I/O Base unit
CPU A & CPU B 2 x T9110 Processor, T9100 Processor Base Unit
O/P A & B 2 × T9451 Digital Output Module, 24 Vdc, 8 C T9852 Digital Output TA, 24
Vdc, 8 channel, T9300 Base Unit or
2 x T9481/T9842 Analogue Output Module, 3/8 Ch, Is
T9882 Analogue Output TA, 8 Ch, Dual and T9300 Base Unit