Rockwell Automation Allen-Bradley AADvance T9110, Руководство по решениям

Страница: 68 / 165

68 Rockwell Automation Publication ICSTT-RM447M-EN-P - July 2019
Chapter 4 AADvance System Architectures
SIL 3 Fail-safe I/O, Fault Tolerant Processor
A SIL 3, fail-safe I/O with a fault tolerant processor architecture has a simplex
input and output arrangement with dual or triple processor modules. The dual
processor modules operate in 1oo2D under no fault conditions and degrade to
1oo1D on detection of the first fault in either module. When there are faults
on both modules the configuration fails-safe.
If required you can configure triple processor modules as a variation of this SIL
3 architecture. Using this arrangement the processor modules operate in
2oo3D under no fault conditions and 1oo2D on the detection of the first fault
in any module. They degrade to 1oo1D on the detection of faults in any two
modules and fail-safe when there are faults on all three modules.
Digital Output Modules
• For de-energize to action operation one 9451 output module is
sufficient for SIL 3 requirements. However, for energize to action
operation, dual digital output modules are required.
• A digital output module fault must be repaired within the MTTR
which was used in the PFD calculation. This rule applies to simplex
digital output modules in de-energize to trip applications and to dual
digital output modules in energize to action applications.
Analogue Output Modules
• The fail-safe state current of the analogue output module is less than 2
mA.
• If the required safe state is more than 4 mA, you must use dual analogue
output modules for high demand applications.
• An analogue output module fault must be repaired within the MTTR
which was used in the PFD calculation. This rule applies to simplex
analogue output modules where the safe state is less than or equal to 4
mA and to dual analogue output modules where the safe state is more
than 4 mA.