ABB Triguard SC300E User guide

Document Reference SS 0728
Issue 5 - September 2006
Triguard SC300E Safety Manual
Copyright © ICS Triplex Technology 1998-2006
Printed in England

Document Reference SS 0728
Issue 5 - September 2006
Revision History
DATE CHANGE
NOTE NO
ISSUE DESCRIPTION INITIALS
25th Jun 98 - A First Issue CJG
8th Jul 98 - B Updates following Review of Initial
TUV Test Results
CJG
27th Jul 98 - C Further Update following TUV
Review
CJG
18th Aug 98 - D Modifications Resulting from FMEA
Test
CJG
6th Jan 99 - E Further Updates incorporating TUV
Comments
CJG
13th Jan 99 F Updates to Fault Call Bit Allocation and example
networks
CJG
9th Mar 99 G Updates incorporating TUV Comments, TUV
Time Constraint times and example networks plus
general updates to structure
CJG
19th May 99 H Updates from final TUV Review CJG
29th Sep 99 J Updates from TUV Review and removal of Multiple
Fault Flag shutdown from example ladder.
CJG
3rd Nov 99 K References to SIL 4 removed at the request of
TUV.
PS
21st Dec 99 L Dual hot repair partners. PS
26th July 2000 M New template, changed ABB to ABB Industri,
Revised FALT table added appendices 4 and 5
DTW
16th Dec 2000 released 01 Added further fault diagnostic information, corrected
RTTS release info and product info
DTW
12th Sept 2001 02 Chapter replaced by section throughout manual.
3.5.8 - I/O module dependent fault flags bit 8
updated
3.6.1 – remove analogue restriction
3.6.11 - use of triplicated watchdog with remote
chassis added
4.1 - change reference to User Manual
Apdx 4 – bit 4 offline modules added
Apdx 5 - renumbered to 6
Apdx 5 - RTTS 8.30-007 references added
Apdx 6 - 48Vdc I/O modules and termination cards
added. TDOs revised. 120Vdc MDO16DNS
added. Other revisions as agreed with TUV.
DTW/PS
30th Sept 2003 03 Font change, ICSTT copyright added, ABB product
references removed, IEC 61508/SIL 3 references
added, F&G references added, ‘polarisation keys’
replaced by ‘coding blocks. Definitions &
Abbreviations section removed, contents added to
Glossary Appendix 6 version updates. System auto-
restart function described see section 3.6.4.
PS
7th Feb 2004 04 Appendix 6, MDI32BIS part number corrected. PS
28th Sept 2006 05 RTTS 8.30-009 and TriBuild 1.44 updates listed.
Auto hot repair referenced. Approved hardware list
updated as a result of TUV test reports.
PS

Document Reference SS 0728
Issue 5 - September 2006
Table of Contents
1Glossary of Terms ............................................................................................................. 6
2Introduction........................................................................................................................ 8
2.1 General Information........................................................................................................................ 8
2.2 Manual Organisation ...................................................................................................................... 8
2.3 Product Introduction and Overview................................................................................................ 8
2.3.1 The Triguard SC300E ................................................................................................................ 8
2.3.2 SC300E Functional Overview.................................................................................................... 9
2.3.3 Operating System..................................................................................................................... 10
2.3.4 Off-Line/Start-up Diagnostics...................................................................................................10
2.3.5 On-Line/Continuous Diagnostics ............................................................................................. 11
2.3.6 Verification................................................................................................................................ 11
2.3.7 Validation.................................................................................................................................. 11
3Configuration Application Design.................................................................................. 12
3.1 Introduction...................................................................................................................................12
3.2 Assumptions ................................................................................................................................. 12
3.3 Safety Related Inputs and Outputs .............................................................................................. 12
3.3.1 Inputs........................................................................................................................................13
3.3.2 Outputs ..................................................................................................................................... 15
3.4 Classification (SIL level) System Time Constraint.......................................................................16
3.4.1 Without System Time Constraint Dual Final Elements............................................................16
3.4.2 Without Time Constraint Dual Outputs .................................................................................... 18
3.4.3 Interposing Devices..................................................................................................................18
3.4.4 Systematic Software Faults...................................................................................................... 18
3.4.5 Process Fault Tolerant Time....................................................................................................18
3.5 Diagnostic Configuration ..............................................................................................................19
3.5.1 Diagnostic Message Generation.............................................................................................. 19
3.5.2 Printed Messages..................................................................................................................... 19
3.5.3 Diagnostic LED's ......................................................................................................................19
3.5.4 Display System Diagnostics.....................................................................................................19
3.5.5 Maintenance Workstations....................................................................................................... 19
3.5.6 Error Flags and Automatic Diagnostic Actions ........................................................................19
3.5.7 Monitor flag register.................................................................................................................. 23
3.5.8 I/O module dependant fault flags ............................................................................................. 23
3.5.9 Automatic Diagnostic Action .................................................................................................... 24
3.5.10 Without Time Constraint Configuration................................................................................ 24
3.5.11 With Time Constraint Configuration.....................................................................................24
3.5.12 Long Process Time Constraint System ............................................................................... 24
3.5.13 Initialisation Flags.................................................................................................................24
3.5.14 MPP A, MPP B, MPP C .......................................................................................................25
3.5.15 Power Supply Failures ......................................................................................................... 25
3.6 Application Software, Design, Verification and Validation...........................................................25
3.6.1 Non Safety Functions...............................................................................................................25
3.6.2 Modularity and Version Control................................................................................................25
3.6.3 Discretes and Register Validation............................................................................................25
3.6.4 Power-Up Initialisation.............................................................................................................. 25
3.6.5 Application Logic Verification ...................................................................................................26
3.6.6 Application Logic Validation ..................................................................................................... 26
3.6.7 Start-up Overrides .................................................................................................................... 26
3.6.8 System Acceptance Test ......................................................................................................... 26
3.6.9 Application Software Documentation....................................................................................... 26
3.6.10 Application Logic Driven External Triplicated Watchdog Timer .......................................... 26
3.6.11 Use of Triplicated Watchdog Timer with Remote Chassis..................................................27
3.7 TriBuild, Network Examples ......................................................................................................... 27
3.8 Environmental Functionality ......................................................................................................... 27
3.9 Security......................................................................................................................................... 27
3.10 System Power Supplies ...............................................................................................................27
3.11 Field Sensors and Final Elements ............................................................................................... 27

Document Reference SS 0728
Issue 5 - September 2006
3.11.1 Field Power Supplies ........................................................................................................... 27
3.11.2 Field Power Distribution .......................................................................................................28
3.11.3 Field Power Diagnostics ...................................................................................................... 28
4Installation And Commissioning .................................................................................... 29
4.1 Introduction................................................................................................................................... 29
4.2 Site Planning and Environment....................................................................................................29
4.3 Process Field Connection ............................................................................................................ 29
4.4 Systems Start-up and Shutdown Procedures.............................................................................. 29
4.4.1 General Description - Start-up Procedure ..............................................................................29
4.4.2 General Description - Shutdown Procedure ........................................................................... 30
4.4.3 Application Changes During Commissioning ..........................................................................30
4.4.4 Site Acceptance Test Validation .............................................................................................. 30
4.4.5 Permits to Work........................................................................................................................ 30
4.4.6 Module Slot Security ................................................................................................................ 30
5Operations........................................................................................................................ 31
5.1 Introduction................................................................................................................................... 31
5.2 Training......................................................................................................................................... 31
5.3 System Start-up............................................................................................................................31
5.3.1 Process Loading and Start-up ................................................................................................. 31
5.4 System Operation.........................................................................................................................31
5.4.1 Maintenance Alarm .................................................................................................................. 31
5.4.2 Maintenance Actions................................................................................................................ 32
5.4.3 Process Trips and Events ........................................................................................................ 32
5.4.4 Maintenance Engineering Station............................................................................................32
5.5 System Shutdown ........................................................................................................................ 32
5.5.1 Process Shutdown ................................................................................................................... 32
5.5.2 Triguard SC300E System Shutdown....................................................................................... 32
6Maintenance And Modifications ..................................................................................... 33
6.1 Introduction................................................................................................................................... 33
6.2 Routine Maintenance ................................................................................................................... 33
6.2.1 System Verification................................................................................................................... 33
6.2.2 Diagnostic Alarms and Messages ...........................................................................................33
6.2.3 Module Change-Out................................................................................................................. 34
6.2.4 Sequence of Repair.................................................................................................................. 35
6.2.5 System Time Constraints......................................................................................................... 36
6.2.6 Life Cycle Proof Test................................................................................................................ 36
6.2.7 Maintenance Overrides............................................................................................................ 36
5.3 Modifications.................................................................................................................................36
6.2.8 Minor Modifications .................................................................................................................. 36
6.2.9 HAZOPS...................................................................................................................................37
6.2.10 Design .................................................................................................................................. 37
6.2.11 Verification and Validation....................................................................................................37
6.2.12 Installation and Commissioning ........................................................................................... 37
6.2.13 Acceptance Test Validation .................................................................................................37
6.2.14 Personnel ............................................................................................................................. 37
6.3 Training......................................................................................................................................... 37
6.4 Security......................................................................................................................................... 37
6.5 Failure Reporting..........................................................................................................................38
6.6 Maintenance Completion ............................................................................................................. 38
7De-Commissioning .......................................................................................................... 39
7.1 Introduction................................................................................................................................... 39
7.2 Final Process Shutdown...............................................................................................................39
7.3 Dismantling and Removal ............................................................................................................ 39
7.3.1 Electronic and Electrical Modules ............................................................................................ 39
7.3.2 Mechanical Items ..................................................................................................................... 39
7.3.3 Safety Precautions ................................................................................................................... 39
8Appendix 1 - Safety Networks......................................................................................... 40

Document Reference SS 0728
Issue 5 - September 2006
9Appendix 2 - Time Constraint Table (Low Demand of operation)................................ 53
9.1 Admissible Repair Times in hours for Low Demand Mode of Operation .................................... 53
10 Appendix 3 - Approved RTTS Versions ......................................................................... 54
11 Appendix 4 - RTTS versions 8.30-005 and later versions............................................. 55
11.1 System Error Flags for RTTS version 8.30-005 and later versions.............................................55
11.2 MHB44IND 4 channels pulse input and 4 channel analogue output module.............................. 56
11.3 MAO04IND 4 channel analogue output module.......................................................................... 56
11.4 System identification.....................................................................................................................56
11.4.1 SC300E RTTS 8.30-005...................................................................................................... 56
11.4.2 SC300E RTTS 8.30-006...................................................................................................... 56
12 Appendix 5 – RTTS 8.30-007 and 008............................................................................. 57
12.1 System Identification RTTS 8.30-007 .......................................................................................... 57
12.2 Change History.............................................................................................................................57
12.3 System Identification RTTS 8.30-008 .......................................................................................... 57
12.4 Change History.............................................................................................................................57
13 Appendix 6 - TUV Approved Part Numbers and Revisions.......................................... 59
13.1 Hardware Approvals..................................................................................................................... 59
13.2 Software Approvals. ..................................................................................................................... 63
Table of Figures
Figure 1 System Overview .................................................................................................................... 10
Figure 2 Current to Voltage Conversion................................................................................................ 14
Figure 3 Dual Final Elements ................................................................................................................ 17
Figure 4 Dual outputs to single final element ........................................................................................ 18
Table of Tables
Table 1 FALT Error Flags (RTTS 8.30 versions 001 – 003).................................................................. 21
Table 2 Monitor Flag Register ............................................................................................................... 23
Table 3 Digital Output Fault Flags ......................................................................................................... 23
Table 4 Piano and Analogue Fault Flags .............................................................................................. 24
Table 5 System Alarms.......................................................................................................................... 24
Table 6 FALT flags RTTS 8.30-005 and later ....................................................................................... 55

Issue 5 - September 2006 Page 6 of 65
1Glossary of Terms
1oo2 One out of two voting
2oo2 Two out of two voting
2oo3 Two out of three voting
3-2-1 Three to two to one processor degradation
3-2-0 Three to two to zero processor degradation
A,B or C System channel reference
ac alternating current
BSI British Standards Institute
CE Indicates compliance with applicable European Community directives
CI Common Interface (a daughter board fitted to I/O modules).
dc direct current
EMC Electro Magnetic Compatibility
EPROM Erasable Programmable Read Only Memory
ESD Emergency Shutdown
F&G Fire and Gas
FAT Factory Acceptance Test
FPGA Field Programmable Gate Array
GTZ Go To Zero
HR Hot Repair
HW Hardware
id identity
I/O Input and/or Output
IEC International Electrotechnical Commission
ISO International Standards Organisation
LED Light Emitting Diode
LFD Latent Fault Detection
MBB Bus Buffer Interface module
MDR Mandatory Design Review
MPP Main Processor
MTTR Mean Time To Repair
PAC AC Power Supply for a Triguard system
PID Proportional, Integral and Derivative - process control signals
PLC Programmable Logic Controller
PSU Power Supply Unit
PVCS Product Version Control Specification
QA Quality Assurance
QM Quality Management
RAM Random Access Memory
ROM Read Only Memory
RS232C Serial binary data exchange standard
RTTS Real Time Task Supervisor (Main Processors operating system.)
SAT Site Acceptance Test
SIFT Software Implemented Fault Tolerance
SS Standard Specification
SW Software
System
channel
One third of a triplicated circuit
THR Hot Repair Adapter Card
TMR Triple Modular Redundancy
TriBuild Software application programming package for SC300E

Issue 5 - September 2006 Page 7 of 65
TÜV Technischer Überwachungs Verein, translates to Technical Supervisory
Association, of Germany
TWD Triplicated Watchdog
UL Underwriters Laboratories
V&V Verification and Validation
WI Work Instruction

Issue 5 - September 2006 Page 8 of 65
2Introduction
2.1 General Information
This Safety Manual provides the information necessary to safely configure, install, operate,
maintain and de-commission Triguard SC300E Safety Controllers certified for safety
applications.
It should be recognised that this manual applies to all safety critical functions only. Where
functions apply to monitoring, indication only or non safety applications this manual does not
necessarily apply.
On all systems relating to safety it is first necessary to decide which I/O points are directly
related to the safety functions. These will normally include all inputs and outputs documented
on the "cause and effect charts" or "fault schedules", but may include other monitoring or control
points. It is the responsibility of the System Designer to enquire if any additional points are
safety related.
By following the guidance in this manual, the user will be assured that his Triguard SC300E
Safety System will be configured, installed, commissioned, operated and maintained with safety
first as the prime objective. This manual however can give no assurance that the basic safety
specifications (cause and effects/fault schedule) are correct.
This manual is restricted to safety aspects of the functions covered and does not remove the
requirements to follow the guidance in SC300E User Manual 008-5197.
2.2 Manual Organisation
The manual is structured following the introduction section to follow the safety aspects of the
Life Cycle model of the Triguard SC300E Programmable Safety Systems. Sections are
therefore provided on the safety aspects of Design and Configuration, Installation and
Commissioning, Operation, Maintenance and De-Commissioning.
2.3 Product Introduction and Overview
2.3.1 The Triguard SC300E
The SC300E has been designed as a cost effective, fault tolerant control system suitable for
use in industrial situations where the control system's reliability, availability and predictable
performance is of paramount importance. The Triguard SC300E is certified for use in safety
applications, such as process and emergency shutdown. For fire and gas applications refer
to the Safety Manual SS 0799.
The two key components of the Triguard SC300E, that permit system availability’s in excess of
99.999%, (about 1 hour downtime in 11 years) to be realised, are as follows. System
availability is calculated using MIL 217F failure rates and a given MTTR of typically 4 hours.
Lengthening or shortening the MTTR will decrease or increase the system availability
respectively.
•Triple Modular Redundant architecture - TMR
•Software Implemented Fault Tolerance - SIFT

Issue 5 - September 2006 Page 9 of 65
2.3.2 SC300E Functional Overview
ATriguard SC300E system has a fully triplicated architecture from input modules to output
modules. All Triguard SC300E input and output modules interface to three isolated I/O
communications buses, each being controlled by one of the three processor modules.
At the input modules, field signals are filtered and then split, via isolating circuitry, into three
identical, signal processing paths. Each path is controlled by a microcontroller that co-ordinates
signal path processing, testing and signal status reporting to its respective processor, via one of
the triplicated I/O communications buses.
Each of the processors communicates with its neighbours via read only, serial communications
links. The processors synchronise at least once per application logic execution cycle, and each
reads the input, output and diagnostic status of its neighbours. Each processor correlates and
corrects its memory image of the current state of the system using a 2-oo-3 software vote,
logging any discrepancies found in a local diagnostic history table.
Each processor then executes its programmed application logic and sets its respective outputs,
via the I/O communications bus, to the required state.
Commanded output states are received by an output module's microcontrollers which, using
2-oo-3 hardware voters, set the outputs to the field. Any discrepancy between a commanded
output state and the field output is detected by the microcontrollers and reported to the
appropriate processor.
All input and output modules can be configured to use a hot spare partner module. In the event
of a fault on the main I/O module its duty can be taken over by the hot spare partner, allowing
repairs to be effected.
In maximum configuration a single SC300E system can support a main chassis and 14
extension or remote chassis. Each chassis can be populated with 10 modules each containing
up to 32 I/O channels, however, for safety configurations all outputs are configured for dual slot
hot repair. Input modules may be configured for single slot hot repair only where the input
configuration or process safety time allows.

Issue 5 - September 2006 Page 10 of 65
Figure 1 System Overview
2.3.3 Operating System
The SC300E's Real Time Task Supervisor (RTTS) is a derivative of the CS300 series operating
system that has accrued over 10 million operational hours.
The RTTS is transparent to a user - an SC300E system is programmed like any standard
industrial PLC, and controls the offline/start-up and online/continuous diagnostics.
2.3.4 Off-Line/Start-up Diagnostics
When an SC300E's processors are first powered up, the following diagnostic routines are
executed: -
•initialisation of all RAM
•memory configuration and size checks
•RTTS and application logic copied to RAM
•all program checksums recalculated and checked
•configuration and checksums of neighbouring processors read and
confirmed
•initialisation of synchronisation registers
•synchronisation registers of neighbouring processors read and verified
Aprocessor will then pause, waiting for the other two processors to complete their start-up
diagnostics.
At power up an SC300E system must have three healthy processors, otherwise the start-up
diagnostics will prevent execution of the system application logic. The RTTS permits an SC300E
system to operate 3-2-0 i.e. a system will continue to operate with one failed processor. For
ESD safety configurations output modules are configured to de-energise their outputs when the
second processor fails.
Replacement processors can be brought online using a warm start command. Warm start
commands can be issued from a TriBuild workstation or by use of application logic. A newly
installed processor will execute its start-up diagnostics, monitor the running processors’
synchronisation registers and await a warm start command. At this point checksums will be
confirmed and the new processor acquires I/O data tables and the application program from its
neighbours and commences execution of its application logic.
VOTER
2oo 3
TERMINATION
INPUT
R/O
OUTPUT
TERMINATION
OUTPUT MODULEINPUT MODULE
R/O
MICRO
CONTROLLER
I/P PATH A
I/P PATH B
CONTROLLER
MICRO
I/P PATH C
CONTROLLER
MICRO
O/P PATH B
CONTROLLER
MICRO
CONTROLLER
O/P PATH A
MICRO
CONTROLLER
MICRO
HOT REPAIR MODULE HOT REPAIR MODULE
O/P PATH C
A
PROCESSOR
PROCESSOR
C
PROCESSOR
B
R/O
R/O
R/O
R/O
R/O=Read-Only Links

Issue 5 - September 2006 Page 11 of 65
2.3.5 On-Line/Continuous Diagnostics
All memory reads and writes are automatically checked for errors by the processors' error
checking and correcting circuitry. Single memory errors are detected and corrected, all multiple
errors are flagged.
SIFT votes the data tables between the processors 2oo3, any errors being logged and corrected
by the processors during their 'read neighbour's data' cycle.
Corrected memory errors are logged in diagnostic history tables. These tables can be accessed
by application logic functions and be used to generate system alarms. If multiple memory errors
on a single process are detected the processor will be halted and its watchdog tripped.
The I/O 'Hot Repair' task regularly scans all configured I/O slots to determine their status. All I/O
modules have identity type registers that allow the hot repair task to confirm the status of all
fitted modules: -
•correct module type fitted and online, healthy
•correct module type fitted and offline, healthy
•module type xxx missing
•incorrect module fitted xxx, should be yyy
For further information regarding the RTTS please refer to the 'TriBuild Software Manual 008-
5206'.
For a full description of Triguard SC300E modules refer to the Triguard SC300E Product and
Application Guide (008-5112) and the relevant Module User Manuals.
2.3.6 Verification
The proving of a part of the system that it meets its specification and only its specification.
Verification can be on a small part of the system such as a single application function, or up to
the complete system with only simulated field devices and other peripherals. For example at
‘The Factory Acceptance Test’.
2.3.7 Validation
The proving of the complete installed safety system includes all field devices and interfaces. For
example at ‘The Site Acceptance Test’.

Issue 5 - September 2006 Page 12 of 65
3Configuration Application Design
3.1 Introduction
This section provides the guidelines that must be followed if certification to DIN VDE 0801 AK 6 /
IEC 61508 SIL 3 is to be maintained. The guideline deals only with the Triguard SC300E Safety
PLC and its implementation into a Safety System. It does not remove the responsibility of the
Systems Designer to ensure that all other analysis and design processes have been completed
correctly.
This section covers the design and configuration of a Safety System based on the Triguard
SC300E Product up to and including the factory acceptance stage.
3.2 Assumptions
The following assumptions have been made in this section.
The system design/integration company is operating accredited quality procedures for the
design and manufacture of Software based Safety Systems to the standard of ISO 9001, TOPS
or equivalent or higher standard and has received training on Triguard SC300E system
integration.
That all earlier life cycle parts of the design phase have been completed correctly including
Hazops and Safety Loop Systems Integrity Level (Safety Classification) Requirements
That the specified plant input and output configuration fully meets the required Safety
Classification (Safety Integrity Level) Selections (eg for Safety Classification AK6 (Safety
Integrity Level 3) Loops at least 2 independent final element paths are established).
That the Cause and Effect, Fault Schedule, Function Block Diagrams or other primary design
information is correct.
That the process safety times have been defined.
That the process safety time constraint has been defined.
3.3 Safety Related Inputs and Outputs
The Safety Loops, Cause and Effect Charts or other design data will define which loops are to
be considered as Safety Loops. All inputs and outputs associated with Safety Loops must
follow the design guidelines laid out in this section.
All Modules must be configured for 320 fail safe operation.
All output modules associated with Safety Loops must be configured with adjacent hot repair
partner slots. The hot repair partners for output modules must not be fitted during normal
operation.
Output hot repair (HR) partners can be left installed if using RTTS 8.30-009 (or later versions)
and TriBuild 1.44 (or later versions). This combination supports an auto hot repair feature. The
system will swap the control duty of one HR partnership every 1 to 255 hours, set using a
TriBuild low level system parameter.

Issue 5 - September 2006 Page 13 of 65
Note that during the change-over period the outputs of a HR partnership could be frozen for up
to 2 seconds.
The frequency of a main to standby, auto hot repair cycle for a HR partnership is calculated by:
number of HR partners + 1 * swap time (hours)
This period should not exceed the admissible repair times, see Appendix 2.
If the process time constraint is less than 30 seconds, or only single sensors are provided for
process measurement, then all input modules associated with safety loops must also be
configured with adjacent hot repair partner slots.
3.3.1 Inputs
Safety inputs to a Safety System will be either Normally Energised Digital Inputs (De-Energise
to Trip) or Analogue Inputs.
3.3.1.1 Digital Inputs
De-energise to trip inputs (usually termed fail-safe) will be used for all safety digital inputs. The
number of safety monitoring signals required for each safety parameter will depend primarily on
the safety integrity level (safety classification) required to be achieved, the 100% proof test cycle
required and the level of diagnostics available from the field device.
All safety digital inputs will be wired to a Digital Input Termination Card. Where the safety
integrity level requires that more than one field sensor monitoring a safety parameter, each of
these sensors should be, where practical, wired to separate Termination Cards. The Simplex
part of the termination card (eg fuses) must be considered for reliability analysis as part of the
field loop.
The Termination Card will be connected to the Triguard SC300E Input Module via a standard
system cable which connects to the socket on the appropriate Hot Repair Adapter Card (THR)
or chassis slot.
Through the hot repair adapter card, where required, and the chassis backplane connector the
input signal is connected to the configured digital input slot position where a Digital Input Module
would be located.
All the chassis slots and, where required, its hot repair partner slots configured for the Digital
Input Module must also have the coding blocks fitted and configured for this type of module as
specified in the Module and Chassis Users Manuals.
Where the safety integrity level requires that separate sensors are used to monitor the same
safety parameters they should be configured to separate Digital Input Modules where practical.
3.3.1.2 Analogue Inputs
Analogue transmitters are used to monitor safety parameters and inherently provide an
increased level of diagnostics with respect to a simple fail-safe digital input. Analogue signals
always provide values within a set operating range. For safety related transmitters this should be
4-20mA or 1-5 volts allowing for fault indication below say 3mA (0.75V) and 20mA (5V). If over-
range detection is required a 0-10V input module must be used. All monitored faults from the
analogue signals must be used by the application software to produce fail-safe results (eg failed
transmitter demands a shutdown).
The number of analogue transmitters used to monitor a safety parameter will be dependent on
the system integrity level (safety classification) requirement of the loop, the 100% proof test
cycle of the loop and the level of diagnostics available from the transmitter.

Issue 5 - September 2006 Page 14 of 65
The field analogue signal is wired to the Analogue Input Termination Card. Where the safety
integrity levels require that more than one transmitter be used to monitor a safety parameter,
then the additional analogue input signals should be wired to separate Termination Cards where
practical. The Simplex circuitry on the termination card must be considered for reliability as part
ofthe transmitter loop (eg fuses and monitoring resistors where fitted). Refer to Figure 2.
The signal is connected from the termination card to the Triguard SC300E input module via a
standard system cable, which connects to the socket on the appropriate Hot Repair Adapter
Card (THR) or chassis connector.
Through the Hot Repair Adapter Card, where required, and the chassis backplane connector
the input signal is connected to the appropriate configured analogue input module slot position,
where an appropriate Analogue Input Module would be located.
All the chassis slot and, where required, their hot repair partner slots configured for the
Analogue module must also have the coding blocks fitted and configured for this type of module
as specified in the Module and Chassis User Manuals.
Figure 2 Current to Voltage Conversion
Where separate transmitters are used to monitor the same safety parameters to meet increased
integrity levels these should be configured to separate Analogue Input Modules where practical.
Switch inputs with end of line and series line-monitoring resisters fitted may be connected as
analogue inputs. These line-monitored inputs provide increased diagnostic information to the
safety system giving discrete analogue values (step changes) for open circuit, switch open,
switch closed and short circuit conditions.
3.3.1.3 Fail Safe Analogue Processing
For each Analogue Input variable received by the system three values are generated, one from
each channel. Under normal operation (transparent to the application) a mid-value selection
algorithm is used selecting the middle value (assuming all three values are within the health
window) to be passed on to the application. It is this mid-value that the user operates on within
the application, all three processing channels now using this selected mid-value.
When one of the three analogue channel values presented to the processors falls outside of the
health window the processors flag it as bad by converting it to a negative number. If now the
two remaining values diverge by more than the health window these are also flagged as bad by
converting them to negative numbers. The effect is to present to the application a negative
value when 2 or more channels are bad.

Issue 5 - September 2006 Page 15 of 65
The application, by use of either the analogue processing module (available in USR3) or simple
comparators, can provide a bad/safe discrete for each analogue value. An example network
using comparators is given in Network 7 of the example networks. Network 6 shows the same
functionality using USR3 (See Appendix 1).
When large numbers of Analogue Inputs are to be processed, USR3 should be used to
effectively monitor faults within the analogue loops. This is accomplished by configuring the
Analogue Test Database in the TriBuild System Configuration Special Function Configuration.
This configuration provides for each analogue variable an array of discretes for channel faults,
open and short circuit faults, as well as defining a global fault bit and the test parameters. Both
open and short circuit faults values should be configured.
3.3.2 Outputs
The standard configuration for ESD Safety System outputs is to provide digital outputs only,
which are configured for de-energise to trip (3-2-0 GTZ again fail to safe).
3.3.2.1 De-Energise to Trip Outputs
All safety related outputs will be from the Digital Output Module. Each module must be
configured with a hot repair partner slot to allow bump-less hot repair to be accomplished.
The Output Module provides a fully tested six-element switch voting circuit for each individual
output.
Where the safety integrity level (safety classification) requirements of a safety loop requires two
or more final elements to be available for shutdown purpose, then each final elements should be
driven from a separate Digital Output Module and Termination Card, where practical.
The shutdown signal is connected from the Output Module through the chassis backplane, the
hot repair adapter card and the system cable to the Termination Card where the field wiring is
connected.
The simplex part of the termination module (eg fuses) must be considered as part of the field
loop for reliability analysis.
3.3.2.2 Multiple Input / Output Safety Configuration
Where the safety integrity level requires multiple sensors and final elements from a safety loop,
then these configurations will be as follows.
3.3.2.3 Dual Sensors
These will be voted by the application logic in a 1oo2 manner such that either sensor providing
an alarm status requires a shutdown.
Where the sensor diagnostics provide fault status then the safety loop may revert to a 1oo1
voting on the good sensor for the time constraint of the sensor's safety loop. At the termination
of this time constraint the loop will demand a shutdown.
Asingle remaining sensor going into fault will demand an immediate shutdown.
3.3.2.4 Triplicated Sensors
These will be voted on a 2oo3 basis by the application logic, however, once a sensor has been
voted as bad, the voting logic will revert to a 1oo2 vote on the remaining two sensors following
the strategy determined for dual sensors.
3.3.2.5 Dual Final Elements
These are to be configured in a 1oo2 manner such that either output requires a shutdown.

Issue 5 - September 2006 Page 16 of 65
3.3.2.6 Hot Repair Adapters
Wherever dual slot hot repair facilities are required, the hot repair adapter boards must be fitted
on the chassis backplane.
3.4 Classification (SIL level) System Time Constraint
The Triguard SC300E Safety PLC is a fault tolerant system that inherently tolerates and reports
afirst major fault (for example a processor failure).
The system diagnostics of a digital output module are not fully available after a first fault is found
on the module. The time allowed to repair this module before a shutdown to the safe state is
required is the system time constraint.
The Triguard SC300E System may be configured with or without time constraint dependent on
the safety output configurations used.
In systems configured with single outputs and final elements, then a time constraint will apply.
The time constraint has been conservatively calculated by TUV dependent on the SIL level (low
demand) and based on worst case of all outputs used.
Time constraint for SIL 3 systems is 2353 hours
Time constraint for SIL 2 systems is 7440 hours
Time constraint for SIL 1 systems is 23528 hours
Time constraint may be extended if less than 32 outputs are safety related, for extended time
constraint values refer to the table Appendix 2.
3.4.1 Without System Time Constraint Dual Final Elements
In AK6 (SIL 3) classified safety loops it is probable that the safety loop final element has at least
two possible operational paths (Figure 3 shows a typical configuration).
Providing each final element is driven from a separate SC300E digital output on separate digital
output modules, the system will have no time constraint.
Dual
Solenoid
Valve
Dual Solenoid Example
MDO Card 1 TC
MDO Card 2 TC
SC300E TMR
System
MDO Card 1 TC ESD Valve 1
MDO Card 2 TC ESD Valve 2
SC300E TMR
System
Dual Valve Example

Issue 5 - September 2006 Page 17 of 65
Figure 3 Dual Final Elements

Issue 5 - September 2006 Page 18 of 65
3.4.2 Without Time Constraint Dual Outputs
In AK6 (SIL 3) classified safety loops with only one final element, then the final element must be
controlled from two digital output channels on separate digital output modules. (Figure 4 shows
atypical configuration).
Figure 4 Dual outputs to single final element
3.4.3 Interposing Devices
The use of interposing devices such as IS barriers and relays are not part of the certified PLC
system and must be considered for reliability as part of the field loop. However, the following is
recommended.
IS barriers should be certified (Germany PTB / BASEEFA / SEV) and compatible with both the
Triguard SC300E I/O module and the field device. Where barriers are mounted on
manufacturer’s barrier termination card, the PLC certification ends at the barrier termination card
safe area connection.
Simplex Interposing relays should be configured with 2-pole isolation in order to eliminate
simplex fail to danger modes.
Where interposing relays operation is only to be monitored by contact feedback from the relay
these should be safety type relays.
It is the responsibility of the system designer to advise the end user of all such devices that are
included within the safety systems scope of supply in order for the end user to evaluate there
configuration and suitability for the complete safety loop.
3.4.4 Systematic Software Faults
To provide further tolerance to systematic design and application software faults, for example
continuous loops, the application TMR watchdog is incorporated. An example of its application
is shown in the example networks.
3.4.5 Process Fault Tolerant Time
The configuration must ensure that the specified process fault tolerance time must be equal or
greater than twice the PLC cycle time plus the field equipment switching time. The PLC cycle
time can be estimated from the scan rate data estimator (Triguard SC300E Scan Rate Estimator
SS 0730) and may be confirmed by monitoring the three registers available for displaying: -
R1980 - Scan Rate Set in centiseconds
R1981 - Scan Rate Time in centiseconds
R1982 - Scan Rate Used in centiseconds
For full details refer to the TriBuild Help Facility.
Single
Safety
Valve
Dual Channel Control
MDO Card 1 TC
MDO Card 2 TC
SC300E TMR
System
Relay 1
Relay 2
Field Power
Supply

Issue 5 - September 2006 Page 19 of 65
3.5 Diagnostic Configuration
The Triguard SC300E Fault Tolerant Safety PLC provides an extremely high level of hardware
fault diagnostics. All diagnostic errors found initiate a change in state in the Fault Register. It is
therefore mandatory that the Fault Call Module be activated in one of the diagnostic networks to
provide access to system level diagnostics.
3.5.1 Diagnostic Message Generation
The activation of the Fault Call when an error is found must be used to provide a diagnostic
maintenance message to the operator, to allow repair actions to be taken. Diagnostic
messages can be provided in a number of acceptable formats, eg Printed Messages, Operator
Alarms, Diagnostic LED Alarms and Diagnostic Alarm Mimics on Operator Stations. A minimum
of one digital output must be configured to give a fail-safe output to ensure that the
operator/maintenance is made aware that there is a problem with the system that needs action.
Acombination of methods is usually utilised to provide the maintainer with diagnostic
information and the operator with alarm and status information.
For information on the Triguard error bits refer to the Triguard User Help facility.
3.5.2 Printed Messages
The triplicated database can contain a number of printed messages that can be triggered by
events such as diagnostic alarms and plant alarms. The printed messages database is
prepared by a Systems Designer linking the discrete, to which the event is to be referenced, to
the alarm diagnostic message to be printed. The message database is compiled and loaded as
part of the load module.
3.5.3 Diagnostic LED's
As all diagnostic information exists as discretes within the database, these can be utilised to
drive outputs directly to light panel mounted LED's for example. It is also practical to utilise the
Dual Serial Multiplexer System TM117DMX to drive LED's for alarms. The TM117DMX is not
approved for safety critical signals.
3.5.4 Display System Diagnostics
In systems that are provided with Operator Workstations for graphical alarm information (such
as TriCommand), diagnostic display mimics can be generated allowing VDU diagnostic alarm
displays of the diagnostic discretes. These operator stations are not normally fault tolerant and
as such are not considered as part of the safety system.
3.5.5 Maintenance Workstations
The Password Protected Maintenance Workstation is used to display the diagnostic and history
tables in a snapshot manner, it also provides detailed diagnostic information on I/O module and
I/O channel errors. During operation it is not necessary to have the maintenance workstation
continuously attached to an operating Triguard SC300E PLC. When maintenance actions have
been completed the TriBuild Workstation should be disconnected from the operating SC300E
PLC.
3.5.6 Error Flags and Automatic Diagnostic Actions
The diagnostics available through the TriBuild Workstation are extremely comprehensive and
detailed down to channel level. A summary of these diagnostics is made available to the user
by the use of the "Fault Call", which provides a voted set of diagnostic flags.

Issue 5 - September 2006 Page 20 of 65
The fault/error flags will be located in the Register specified by the user in the "Fault Call" and
are defined as follows (for RTTS 8.3-005/006 see appendix 4): -please use table for RTTS 8.3-
001 to 003