Rockwell Automation T8094 8000 Series TMR System Safety Manual - Manual (Page 42)

SAFETY MANUAL
D oc N umber T8094
I ssue 27 – June 2013
Page 21 of 103
TÜV Certified
Configuration
Conditions
Speed Monitor
Module
8442, Triplicated,
Internal 2oo3
(2oo3 implemented in
a single module)
Inputs:
Within the manufactures specified safety accuracy
limits.
Outputs:
Normally energized (de-energize to trip relays).
Normally open or Normally closed Contacts can be
used
Certified SIL 3.
Pulse Generator
8444, Triplicated,
24VDC
Not safety related but
interference free
Certified as non-interfering and can be used for non-
safety-critical devices.
Zone Interface
8448 Triplicated,
24VDC
Internal 2oo3
(2oo3 implemented in
a single module)
Outputs:
Normally energized (de-energize to trip): certified
SIL 3.
Normally de-energized (energize to trip): certified
only for applications that fulfil the requirements
under section 3.2.4.
May be used in single module or active/standby
configurations.
Inputs:
Normally de-energized (energize to trip): only for
applications that fulfil the requirements under
section 3.2.4, and only for “trip amplifier” (like gas
inputs) or quasi digital inputs (like fire loops).
Normally energized (de-energize to trip): certified
only if the inputs are dynamically transitioned at a
period not greater than the second fault occurrence
time.
Analog measurements: certified only if the input is
dynamically exercised over its full range within a
period shorter than the second fault occurrence
time
3 .
Non-interfering for non-safety-critical devices
Valve Monitor
8449, Triplicated,
24VDC
Internal 2oo3
(2oo3 implemented in
a single module)
Outputs:
Normally energized (de-energize to trip): certified
SIL 3.
Normally de-energized (energize to trip): certified
only for applications that fulfil the requirements
under section 3.2.4.
Safety critical valve may only be tested towards the
safe position.
May be used in single module or active/standby
configurations.
Inputs:
Certified as non-interfering and can be used for non-
safety-critical devices.
Table 5 - Multi-purpose Modules, High Density I/O
3 The analog input must be exercised over it’s full range (i.e. 0 to 4095) over a period of time related to the
safety accuracy specification of the module and the discrepancy detection time configured for the system.
For typical systems, the discrepancy detection time is 200 seconds.