Rockwell Automation T8094 8000 Series TMR System Safety Manual - Manual (Page 93)

SAFETY MANUAL
D oc N umber T8094
I ssue 27 – June 2013
Page 72 of 103
8.2 SAFETY RELATED INPUTS AND OUTPUTS
The Safety Loops, Cause and Effect Charts or other design data will define which
loops are to be considered as Safety Loops. All inputs and outputs associated with
Safety Loops must follow the design guidelines laid out in this section.
All Modules must be configured for 320 fail safe operation.
All output modules associated with Safety Loops must be configured with adjacent hot
repair partner slots. The hot repair partners for output modules must not be fitted
during normal operation.
If the process time constraint is less than 30 seconds, or only single sensors are
provided for process measurement, then all input modules associated with safety
loops must also be configured with adjacent hot repair partner slots.
8.2.1 Inputs
Safety inputs to a Safety System will be either Normally Energised Digital Inputs (De-
Energise to Trip) or Analogue Inputs.
8.2.1.1 Digital Inputs
De-energise to trip inputs (usually termed fail-safe) will be used for all safety digital
inputs. The number of safety monitoring signals required for each safety parameter
will depend primarily on the safety integrity level (safety classification) required to be
achieved, the 100% proof test cycle required and the level of diagnostics available
from the field device.
All safety digital inputs will be wired to a Digital Input Termination Card. Where the
safety integrity level requires that more than one field sensor monitoring a safety
parameter, each of these sensors should be, where practical, wired to separate
Termination Cards. The Simplex part of the termination card (e.g. fuses) must be
considered for reliability analysis as part of the field loop.
The Termination Card will be connected to the Triguard SC300E Input Module via a
standard system cable which connects to the socket on the appropriate Hot Repair
Adapter Card (THR) or chassis slot.
Through the hot repair adapter card, where required, and the chassis backplane
connector the input signal is connected to the configured digital input slot position
where a Digital Input Module would be located.
All the chassis slots and, where required, its hot repair partner slots configured for the
Digital Input Module must also have the polarisation keys fitted and configured for this
type of module as specified in the Module and Chassis Users Manuals.
Where the safety integrity level requires that separate sensors are used to monitor the
same safety parameters they should be configured to separate Digital Input Modules
where practical.