
- 7 -
Application Software Development
Programming Environment
The application software of the Safety 2600T has been
developed in ANSI C language using the IAR 1.31B compiler.
Emulation and system testing have been performed with the
support of Mitsubishi ICE development system.
Program Structure for Safety Applications
Thecompletesoftwarehasbeenseparatedinasafetyrelevant
andanon-safetyrelevantsections.Thesafetyrelevantareais
constituted by a set of modules and functions which are
rigorously separated and checked in their correct execution.
Safety Logic Programming
A specific document has been developed to define the basic
rulesforC-Programminginsafetyrelatedsystemapplications
in compliance with what defined by the IEC 61508-3. The
software development of the Safety 2600T has been carried
out following the restrictions and recommendation contained
in the above mentioned documents.
Program Compilation
Specialaccuracyhavebeenusedinthesoftwaredevelopment
in order to avoid any error and warnings.
Application Software Testing
A Safety 2600T transmitter functional test report document
has been issued after the operational and the safety related
program have gone through their initial check. It verifies that
the program will perform as desired and specified.
Application Software Safety Validation
The Safety 2600T Application Software testing has been
carried out and audited by TUV PS. A Test Report document
approved by TUV states that the system reacted in each test
as expected and that the safety related program fulfil the
Safety Requirement Specification
Installation
Environmental Requirements
The Safety 2600T pressure transmitter has been designed to
operate in a wide range of environmental conditions typical of
industrial field and in hazardous environments. The
environmentalconditionsunderwhichthemeasuringequipment
is designed to operate within its specified accuracy limits and
withoutimpairmentofitsoperatingcharacteristicsarespecified
in the "Specification Sheet" document.
Mechanical installation and System completion
All the necessary operations to correctly installing the device
in order to assure operator and plant safety are described in
the section "installation" of the present manual.
System Wiring
The procedures to safely make the electrical connections of
thedevicearedescribedinthesection"electricalconnections"
of the present manual. For installation in hazardous areas,
compliancewithsafetyinformationonthesafetymarkingplate
shall be ensured.
Commissioning
Field Instrument Functionality
All the necessary activities to assure that the process sensor
orfinalelementareoperatingtogetherandperformtherequired
function are described in the "Electrical connections" and
"Calibration" sections of the present document.
Overall System Functionality
Theactivitiestovalidatetherequired safetyfunctionalityofthe
system together with the target equipment according to the
SafetyRequirementSpecificationarePre-StartupAcceptance
test section of the present document.
Operation
System Operating Discipline
APlantpolicyguidelinedocumentcontainingthespecificplant
policyguidelineforthedailysafeoperationhastobeproduced
and periodically reviewed by representatives of the Process
Control Service.
Maintenance
Maintenance is defined as the routine activities which are
carried out to detect unrevealed faults.
Preventive and Routine Maintenance
Preventive and routine maintenance activities are defined in
the maintenance section of the present manual.
Function-unit Replacement
In case of hardware failure corrective actions may be carried
out. In case of transmitter replacement all the operations
described in "Electrical Connection", "Calibration" and "Pre-
Startup Acceptance tests" shall be conducted.
All maintenance activities shall be documented in the system
documentation.Possiblesafetycriticalfailuresshallbereported
using the Incident Report process.
Function-unit Repair
Thetransmitterisconstitutedoftwomainunits(transducerand
electronics). It can be repaired following the information
contained in the Dismantling and Reassembly section of the
present manual.
Central repair shall maintain a record of detected failures,
calculate actual failure rates and compare with the expected
failure rate. Extensive failure rates shall be communicated to
the supplier.
Modification Request
Request of modification due to possible safety critical failures
and performance deviations shall be reported to the factory.
Modificationsshallfollowthecompanymodificationprocedures.
Management of Change
All process changes or SIL category change shall follow the
procedures defined in the safety life-cycle of the system and
shall be reviewed and validated by the external competent
body for a new functional safety assessment.
Management of change Process Components and Roles
Each process component needs to be defined in details
accordingtotherequirementsandtherelevantdocumentation.
Each process component change shall follow the activities
defined in the overall safety life cycle.
Management of change Documentation and Training
Requirements
TheManagementofChangeprocessshallfollowdocumentation
andtrainingrequirementsdefinedinthesystemimplementation.
. . . . LIFE-CYCLE ACTIVITIES