Issue 5 - September 2006
Page 33 of 65
6
Maintenance And Modifications
6.1 Introduction
This section of the Safety Manual covers the safety aspects of two life cycle functions of a
Triguard SC300E System, Maintenance and Modifications. The Operations and Maintenance
Manual supplied by the Systems Integrator will cover all standard operational and maintenance
procedures and be written specifically for the systems configuration supplied.
With a fault tolerant system such as the Triguard SC300E one of the primary tasks of
maintenance is to maintain the system in a 100% healthy state to enable the full power of the
fault tolerance provided, to be delivered to the safeguarding of the plant. Although the Triguard
SC300E is inherently fail-safe, on a second major fault it should be noted that an operating plant
is inherently more safe when operating than during a start-up or shutdown phase. Therefore,
unnecessary trips due to poor maintenance should be avoided.
6.2 Routine
Maintenance
As with all safety-related systems, there will be a number of routine maintenance tasks required
for any Triguard SC300E supplied. The routine maintenance tasks are documented in the
Operations and Maintenance Manual supplied with the System by the System Integrator and the
relevant Product User Manuals. This section deals only with specific safety aspects related to
routine maintenance.
6.2.1 System
Verification
When first connecting the TriBuild workstation to the Triguard System the on-line system is
checked against the off-line system stored on the workstation. If the systems are different a
warning is given and the off-line system must be closed down and the correct system selected
prior to connecting to the Triguard system.
6.2.1.1 Application
Logic
Verification
The application logic can be verified by using the TriBuild Ladder compare facility. This
compares the on-line ladder logic with the off-line ladder logic held on the TriBuild workstation.
6.2.2 Diagnostic
Alarms
and
Messages
The structure of the diagnostics in a Triguard SC300E System is both hierarchical and fail-safe.
In principle, whenever the first hardware fault is found the fault call indicates this error by
changing the status of the relevant fault call bit.
Certain fault call bits are specific and down effectively to module level (eg CPU health). The
majority of the input and output faults, however, appear as monitor errors, LFD errors, data/vote
errors or initialisation errors.
As stated in the application section, the initialisation error will cause, by correct use of
application logic, a shutdown to occur as this may indicate the removal of a vital input or output
module.
These initial diagnostic alarms are readily reported to the operator, by LED’s, lamps, alarm
sounders, printer messages or alarm messages on the operator display console and should
initiate action by Operations to inform Maintenance that a problem exists.
With the exception of catastrophic failures, which in general would need to be personnel
instigated (eg incorrectly removing an on-line module) all first failures are tolerated without the
need to shut down the process.
