
- 7 -
Application Software Development
Programming Environment
The application software of the Safety 2600T has been
developed in ANSI C language. Emulation and system testing
have been performed with the support of Mitsubishi ICE
development system.
Program Structure for Safety Applications
Thecomplete softwarehas beenseparated ina safetyrelevant
and a non-safety relevant sections. The safety relevant area is
constituted by a set of modules and functions which are
rigorously separated and checked in their correct execution.
Safety Logic Programming
A specific document has been developed to define the basic
rules for C-Programming in safety related system applications
in compliance with what defined by the IEC 61508-3. The
software development of the Safety 2600T has been carried
out following the restrictions and recommendation contained
in the above mentioned documents.
Program Compilation
Specialaccuracyhave beenused inthe softwaredevelopment
in order to avoid any error and warnings.
Application Software Testing
A Safety 2600T transmitter functional test report document
has been issued after the operational and the safety related
program have gone through their initial check. It verifies that
the program will perform as desired and specified.
Application Software Safety Validation
The Safety 2600T Application Software testing has been
carried out and audited by TUV. A Test Report document
approved by TUV states that the system reacted in each test
as expected and that the safety related program fulfil the
Safety Requirement Specification
Installation
Environmental Requirements
The Safety 2600T pressure transmitter has been designed to
operate in a wide range of environmental conditions typical of
industrial field and in hazardous environments. The
environmentalconditionsunder whichthemeasuringequipment
is designed to operate within its specified accuracy limits and
withoutimpairment ofits operatingcharacteristicsarespecified
in the "Specification Sheet" document.
Mechanical installation and System completion
All the necessary operations to correctly installing the device
in order to assure operator and plant safety are described in
the section "installation" of the present manual.
System Wiring
The procedures to safely make the electrical connections of
the device are described in the section "electrical connections"
of the present manual. For installation in hazardous areas,
compliance with safety information on the safety marking plate
shall be ensured.
Commissioning
Field Instrument Functionality
All the necessary activities to assure that the process sensor
orfinal elementare operatingtogetherandperformthe required
function are described in the "Electrical connections" and
"Calibration" sections of the present document.
Overall System Functionality
The activities to validate the required safety functionality of the
system together with the target equipment according to the
Safety Requirement Specification are Pre-Startup Acceptance
test section of the present document.
Operation
System Operating Discipline
A Plant policy guideline document containing the specific plant
policy guideline for the daily safe operation has to be produced
and periodically reviewed by representatives of the Process
Control Service.
Maintenance
Maintenance is defined as the routine activities which are
carried out to detect unrevealed faults.
Preventive and Routine Maintenance
Preventive and routine maintenance activities are defined in
the maintenance section of the present manual.
Function-unit Replacement
In case of hardware failure corrective actions may be carried
out. In case of transmitter replacement all the operations
described in "Electrical Connection", "Calibration" and "Pre-
Startup Acceptance tests" shall be conducted.
All maintenance activities shall be documented in the system
documentation.Possible safetycriticalfailures shallbereported
using the Incident Report process.
Function-unit Repair
The transmitter is constituted of two main units (transducer and
electronics). It can be repaired following the information
contained in the Dismantling and Reassembly section of the
present manual.
Central repair shall maintain a record of detected failures,
calculate actual failure rates and compare with the expected
failure rate. Extensive failure rates shall be communicated to
the supplier.
Modification Request
Request of modification due to possible safety critical failures
and performance deviations shall be reported to the factory.
Modificationsshall followthecompanymodificationprocedures.
Management of Change
All process changes or SIL category change shall follow the
procedures defined in the safety life-cycle of the system and
shall be reviewed and validated by the external competent
body for a new functional safety assessment.
Management of change Process Components and Roles
Each process component needs to be defined in details
accordingto therequirements andthe relevantdocumentation.
Each process component change shall follow the activities
defined in the overall safety life cycle.
Management of change Documentation and Training
Requirements
TheManagementof Changeprocessshallfollow documentation
andtrainingrequirementsdefinedinthe systemimplementation.
. . . . LIFE-CYCLE ACTIVITIES