Allen-Bradley FlexLogix 1794 User manual

FLEXI/OSystemwithControlLogixforSIL2
Catalog Number Bulletin 1794
Reference Manual
AB Drives

Important User Information
Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety Guidelines for the Application,
Installation and Maintenance of Solid State Controls (publication SGI-1.1 available from your local Rockwell Automation sales office or online at
http://literature.rockwellautomation.com) describes some important differences between solid state equipment and hard-wired electromechanical
devices. Because of this difference, and also because of the wide variety of uses for solid state equipment, all persons responsible for applying this
equipment must satisfy themselves that each intended application of this equipment is acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this
equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated
with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and
diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this
manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Allen-Bradley, Rockwell Automation, FLEX I/O, RSLinx, RSLogix 5000 and TechConnect are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
WARNING
Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may
lead to personal injury or death, property damage, or economic loss.
IMPORTANT
Identifies information that is critical for successful application and understanding of the product.
ATTENTION
Identifies information about practices or circumstances that can lead to: personal injury or death, property damage, or
economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
SHOCK HAZARD
Labels may be on or inside the equipment, such as a drive or motor, to alert people that dangerous voltage may be present.
BURN HAZARD
Labels may be on or inside the equipment, such as a drive or motor, to alert people that surfaces may reach dangerous
temperatures.

1Publication 1794-RM001G-EN-P - December 2011
Preface
Introduction
This application manual is intended to describe the FLEX I/O with ControlLogix
Control System components available from Rockwell Automation that are
suitable for use in SIL2 applications. Use this manual in conjunction with
publication 1756-RM001
Alternate architecture can be used in SIL2 applications if they are approved by
a certifying agency.
Manual Set-Up
This manual is designed to make clear how the FLEX I/O with ControlLogix
Control System can be SIL2-certified. Table Preface.1 lists the information
available in each section.
Understanding Terminology
The following table defines acronyms used in this manual.
Table Preface.1
Section: Title: Description:
Chapter 1 SIL Policy Introduction to the SIL policy and how that
policy relates to FLEX I/O with a ControlLogix
system.
Chapter 2 ControlLogix Communications Description of the ControlLogix communications
modules used in the SIL2-certified FLEX I/O
with ControlLogix system.
Chapter 3 FLEX I/O Modules Description of the FLEX I/O modules used in the
SIL2-certified FLEX I/O with ControlLogix
system.
Chapter 4 General Requirements for
Application Software Application software requirements for using ControlLogix and FLEX modules.
Chapter 5 Technical SIL2 Requirements
for the Application Program Guidelines for application development in RSLogix 5000 as they relate to SIL2.
Appendix A Failure Estimates Failure rates based on field returns.
Table Preface.2 List of Acronyms Used Throughout the Safety Application Manual
Acronym: Full Term: Definition:
CIP Control and
Information
Protocol
A messaging protocol used by Logix5000™
systems. It is a native communications protocol
used on ControlNet™ communications networks,
among others.
DC Diagnostic
Coverage The ratio of the detected failure rate to the total failure rate.
EN European Norm. The official European Standard
GSV Get System Value A ladder logic output instruction that retrieves
specified controller status information and places
it in a destination tag.
AB Drives

Publication 1794-RM001G-EN-P - December 2011
Preface 2
MTBF Mean Time
Between Failures Average time between failure occurrences.
MTTR Mean Time to
Restoration Average time needed to restore normal operation after a failure has occurred.
PADT Programmingand
Debugging Tool RSLogix 5000 software used to program and debug a SIL2-certified FLEX I/O with ControlLogix
application.
PC Personal
Computer Computer used to interface with, and control, a ControlLogix system via RSLogix 5000
programming software.
PFD Probability of
Failure on
Demand
The average probability of a system to fail to
perform its design function on demand.
PFH Probability of
Failure per Hour The probability of a system to have a dangerous failure occur per hour.
1oo1 One out of one A 1oo1 (one out of one) architecture consists of a
single channel where any dangerous failure leads
to a failure of the safety function.
1oo2 One out of two A 1oo2 (one out of two) architecture consists of
two channels connected in parallel such that
either channel can process the safety function.
Table Preface.2 List of Acronyms Used Throughout the Safety Application Manual
Acronym: Full Term: Definition:

1Publication 1794-RM001G-EN-P - December 2011
Chapter 1
SIL Policy
This chapter introduces you to the SIL policy and how the
ControlLogix/FLEX I/O system meets the requirements for SIL2
certification.
Introduction to SIL
Certain catalog numbers (listed in Table 1.1 on page 1-5) of the FLEX I/O with
ControlLogix system are type-approved and certified for use in SIL2
applications, according to IEC 61508. SIL requirements are based on the
standards current at the time of certification.
These requirements consist of mean time between failures (MTBF),
probability of failure, failure rates, diagnostic coverage and safe failure
fractions that fulfill SIL2 criteria. The results make the ControlLogix/FLEX
I/O system suitable up to, and including, SIL2. When the
ControlLogix/FLEX I/O system is in the maintenance or programming
mode, the user is responsible for maintaining a safe state.
For support in creation of programs, the PADT (Programming and
Debugging Tool) is required. The PADT for ControlLogix/FLEX I/O is
RSLogix 5000, per IEC 61131-3, and this Safety Reference Manual.
The TUV Rheinland has approved the ControlLogix/FLEX I/O system for
use in up to and including SIL 2 safety related applications in which the
de-energized state is considered to be the safe state. All of the examples related
to I/O included in this manual are based on achieving de-energization as the
safe state for typical Emergency Shutdown (ESD) Systems.
For information about: See page:
Introduction to SIL 1-1
SIL2 Certification 1-2
Proof Tests 1-3
SIL2-Certified FLEX I/O System Components 1-5
Hardware Designs and Firmware Functions 1-8
Hardware Designs and Firmware Functions 1-8
Difference Between PFD and PFH 1-8
SIL Compliance Distribution and Weight 1-13
Response Times 1-13
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-2 SIL Policy
SIL2 Certification
Figure 1.1 shows a typical SIL loop, including:
•the overall safety loop
•the ControlLogix/FLEX I/O portion of the overall safety loop
•how other devices (for example, HMI) connect to the loop, while
operating outside the loop
Figure 1.1
Plant-wide Ethernet/Serial
ControlNet
SIL2-certified ControlLogix components’ portion of the overall safety loop
Programming Software
For SIL applications, a programming
terminal is not normally connected.
HMI
For Diagnostics and Visualization (read-only access to controllers in the
safety loop). For more information, see publication 1756-RM001.
E
N
B
C
N
B
To other safety related
ControlLogix or FLEX I/O
remote I/O chassis
Overall Safety Loop
Actuator
Actuator
1794 FLEX I/O
Input
Device
DI1
DO2
DO1
DI2
ControlNet
Input
Device
To other safety related
ControlLogix or FLEX I/O
remote I/O chassis
See Figures 3.1 and 3.5 for details.
1
Note 1: Multiple 1756-CNB or -CNBR modules can be installed into the chassis as needed.
Other configurations are possible as long as they are SIL2 approved.
+V
Note 2: Two adapters are required for meeting SIL2 as shown in the figure.
The adapters can be either ControlNet or Ethernet and must be from the list of approved products.

Publication 1794-RM001G-EN-P - December 2011
SIL Policy 1-3
Proof Tests
IEC 61508 requires the user to perform various proof tests of the equipment
used in the system. Proof tests are performed at user-defined times (for
example, proof test intervals can be once a year, once every two years or
whatever timeframe is appropriate) and include some of the following tests:
•Testing of all fault routines to verify that process parameters are
monitored properly and the system reacts properly when a fault
condition arises.
•Testing of digital input or output channels to verify that they are not
stuck in the ON or OFF state.
IMPORTANT
Important Note related to published PFDs.
•The user must choose the appropriate PFD depending
on combinations and the appropriate 1oo1 or 1oo2
configuration.
•Descrete and analog inputs must be used in a 1oo2
configuration for SIL 2.
•Adapters must be used in a 1oo2.
•Outputs may be 1oo2 in series or 1oo1 monitored by
an input with an external relay as a secondary device to
remove power.
•Some specialized inputs can only be wired to a single
sensor such as thermocuples and two 1oo1 PFDs must
be used for each.
•The total PFD for two 1oo1s is the sum of both.
IMPORTANT
The system user is responsible for:
•the set-up, SIL rating and validation of any sensors or
actuators connected to the ControlLogix/FLEX I/O
control system.
•project management and functional testing.
programming the application software and the module
configuration according to the description in the
following chapters.
The SIL2 portion of the certified system excludes the
development tools and display/human machine interface
(HMI) devices; these tools and devices are not part of the
run time control loop.
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-4 SIL Policy
•Calibration of analog input and output modules to verify that accurate
data is obtained from and used on the modules.
For more information on system proof tests, see Publication 1756-RM001. For
more information on the necessary I/O module, see Table 1.1.
IMPORTANT
Users’ specific applications will determine the timeframe
for the proof test interval.
However, keep in mind that the Probability of Failure on
Demand (PFD) calculations listed in Table 1.2 on page 1-8
use a proof test interval of once per year. If the proof test
interval is changed, the information must be recalculated.

Publication 1794-RM001G-EN-P - December 2011
SIL Policy 1-5
SIL2-Certified FLEX I/O
System Components
Table 1.1 lists the components available for use in a SIL2-certified FLEX I/O
system. For a list of ControlLogix SIL2 certified products, see publication
1756-RM001.
Table 1.1 FLEX I/O Components For Use in the SIL 2 System
Device Type: Catalog Number: (1) Description:
Related Documentation(4)
with More Information on
Catalog Number:
Series(2)
Firmware
Revision:
(2) (3)
Installation
Instructions: User Manual:
Adapter 1794-ACN15 ControlNet Single Media
Adapter C4.3 5.1, 5.2, 5.3,
5.x
1794-IN101 NA
D 10.1, 10.2,
10.3, 10.x
1794-ACNR15 ControlNet Redundant Media
Adapter C4.3 5.1, 5.2, 5.3,
5.x
D 10.1, 10.2,
10.3, 10.x
1794-ACNR15XT C 5.1, 5.2, 5.3,
5.x 1794-IN128
D 10.1, 10.2,
10.3, 10.x
1794-AENT 10/100Mb Ethernet
Communication Adapter B4.1 4.2, 4.x 1794-IN082
1794-AENTR A 1.011, 1.x 1794-IN131 1794-UM066
1794-AENTRXT
I/O Modules -
Digital 1794-IB16 16 Sink Input Module A NA 1794-IN093 NA
1794-IB10XOB6 10 Input/6 Output Module A NA 1794-IN083
1794-OB16 16 Source Output Module A NA 1794-IN094
1794-OB16P 16 Protected Output Module A NA 1794-IN094
1794-OB8EP 8 Protected Output Module A NA 1794-IN094
1794-OW8 Isolated Relay Output Module A NA 1794-IN019
1794-OB8EPXT 8 Protected Output Module A NA 1794-IN124
1794-IB16XT 16 Sink Input Module A NA
1794-OB16PXT 16 Protected Output Module A NA
1794-IB10XOB6XT 10 Input/6 Output Combo
Module ANA
1794-OW8XT 8 Relay Output Module A NA 1794-IN019
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-6 SIL Policy
I/O Modules -
Analog 1794-IE8 8 Input Analog Module B NA 1794-IN100 1794-UM002
1794-IF4I 4 Isolated Input Analog
Module A F, G, H, I, I.x 1794-IN038 1794-UM008
1794-IF2XOF2I 2 In/2 Out Isolated Combo
Module A F, G, H, I, I.x 1794-IN039 1794-UM008
1794-OE4 4 Output Analog Module B NA 1794-IN100 1794-UM002
1794-OF4I 4 Isolated Output Analog
Module A F, G, H, I, I.x 1794-IN037 1794-UM008
1794-IT8 Thermocouple Input Module A K, K.x 1794-IN021 1794-UM007
1794-IR8 RTD Input Module A K, K.x 1794-IN021 1794-UM004
1794-IRT8 TC/RTD Input Module B B, D, E, E.1,
E.x 1794-IN050 1794-UM012
1794-IJ2 2 Ch. Frequency Counter
Module A D 1794-IN049 1794-UM011
1794-IP4 4 Ch. Pulse Counter Module B 4, 4.x 1794-IN064 1794-UM016
I/O Modules -
Analog 1794-IE4XOE2XT 4 Input/2 Output Analog Combo Module B NA 1794-IN125 NA
1794-IE8XT 8 Input analog Module B NA
1794-OE4XT 4 Output Analog Module B NA
1794-IF2XOF2IXT 2 Input/2 Output Isolated
Analog Combo Module A I, I.x 1794-IN129
1794-IF4IXT 4 Isolated Input Analog
Module A I, I.x
1794-OF4IXT 4 Isolated Output Analog
Module A I, I.x
1794-IF4ICFXT 4 Isolated Input Analog
Module A I, I.x 1794-IN130
1794-IJ2XT 2 Ch. Frequency Counter
Module A E, E.x 1794-IN049
1794-IRT8XT 8 TC/RTD Input Analog
Module B D, E, E.1, E.x 1794-IN050
Table 1.1 FLEX I/O Components For Use in the SIL 2 System
Device Type: Catalog Number: (1) Description:
Related Documentation(4)
with More Information on
Catalog Number:
Series(2)
Firmware
Revision:
(2) (3)
Installation
Instructions: User Manual:

Publication 1794-RM001G-EN-P - December 2011
SIL Policy 1-7
Terminal Base
Units 1794-TB3 3-Wire Terminal Base Unit A NA 1794-IN092 NA
1794-TB3S 3-Wire Terminal Base Unit A NA
1794-TB3T Temperature Terminal Base
Unit ANA
1794-TB3TS Spring-clamp Temperature
Base Unit ANA
1794-TB3G Cage-clamp Gen. Terminal
Base Unit ANA
1794-TB3GS Spring-clamp Gen. Terminal
Base Unit ANA
1794-TBN NEMA Terminal Base Unit A NA
1794-TBNF Fused NEMA Terminal Base
Unit ANA
(1) Certain catalog numbers have a K suffix. This indicates a conformally coated version of the product. These K versions have the same SIL2 certification as the non-K
versions.
(2) The FW versions marked with extension .x (x can be 0 ... 99) are constitute to minor changes for enhancements. The test institute will be informed on any change.
(3) Users must use these series and firmware revisions for their application to be SIL2 certified. Firmware revisions are available by visiting
http://support.rockwellautomation.com/ControlFlash/
(4) These publications are available from Rockwell Automation by visiting http://literature.rockwellautomation.com.
Table 1.1 FLEX I/O Components For Use in the SIL 2 System
Device Type: Catalog Number: (1) Description:
Related Documentation(4)
with More Information on
Catalog Number:
Series(2)
Firmware
Revision:
(2) (3)
Installation
Instructions: User Manual:
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-8 SIL Policy
Hardware Designs and
Firmware Functions
Diagnostic hardware designs and firmware functions designed into the
ControlLogix/FLEX I/O platform allow it to achieve at least SIL2
certification in a single-controller configuration. These diagnostic features are
incorporated into specific FLEX I/O components, such as the:
•adapter
•power supply
•I/O modules
•terminal base units
and are covered in subsequent sections. The ControlLogix/FLEX I/O
platform’s designs, features and characteristics make it one of the most
intelligent platforms.
Difference Between PFD
and PFH
Table 1.2 and Table 1.3 present values of the PFDs and PFHs for the specific
FLEX I/O products evaluated by TUV.
FLEX I/O uses the same PFD and PFH assumptions as stated in publication
1756-RM001.
Table 1.2 FLEX I/O Product Probability of Failure on Demand (PFD) Calculations (T1= 1 yr)
Catalog Number Description Mean Time
Between Failure
(MTBF)(1)
λ(3) Calculated PFD
1oo2 architecture
1794-ACN15 ControlNet Single Media Adapter 8,223,684 1.22E-07 2.15E-06
1794-ACNR15 ControlNet Redundant Media Adapter 8,223,684 1.22E-07 2.15E-06
1794-AENT 10/100Mb Ethernet Communication Adapter 691,134 1.45E-06 2.76E-05
1794-AENTR 10/100Mb Ethernet Redundant Communication Adapter 1,268,070 7.89E-07 1.45E-05
1794-IB10XOB6 10 Input/6 Output Module 4,943,442 2.02E-07 3.60E-06
1794-IB16 16 Sink Input Module 4,105,090 2.44E-07 4.34E-06
1794-IE8 Analog Input Module 37,952,679 2.63E-08 4.64E-07
1794-IF2XOF2I Isolated Analog Input/Output Module 25,296,960 3.95E-08 6.97E-07
1794-IF4I Isolated Analog Input Module 11,746,343 8.51E-08 1.50E-06
1794-IJ2 Frequency Counter Module 2,418,321 4.14E-07 7.45E-06
1794-IP4 Pulse Counter Module 2,375,360 4.21E-07 7.58E-06
1794-IR8 RTD Input Module 6,191,655 1.62E-07 2.87E-06
1794-IRT8 TC/RTD/mV Input Module 1,182,438 8.46E-07 1.56E-05
1794-IT8 Thermocouple Input Module 1,564,324 6.39E-07 1.17E-05
1794-OB16 16 Source Output Module 1,883,594 5.31E-07 9.62E-06
1794-OB16P Protected Output Module 2,135,280 4.68E-07 8.46E-06

Publication 1794-RM001G-EN-P - December 2011
SIL Policy 1-9
1794-OB8EP Protected Output Module 2,389,669(2) 4.18E-07 7.54E-06
1794-OE4 Analog Output Module 23,807,086 4.20E-08 7.41E-07
1794-OF4I Isolated Analog Output Module 7,191,128 1.39E-07 2.47E-06
1794-OW8 Relay Output Module 14,766,876 6.77E-08 1.20E-06
1794-TB3 Terminal Base Units 21,128,346(2) 4.73E-08 8.35E-07
1794-TB3G Generic Terminal Base Units 27,320,800 3.66E-08 6.45E-07
1794-TB3GS Generic Terminal Base Units 46,425,600 2.15E-08 3.79E-07
1794-TB3S Terminal Base Unit 71,433,747(2) 1.40E-08 2.46E-07
1794-TB3T Temperature Terminal Base Units 73,096,226(2) 1.37E-08 2.41E-07
1794-TB3TS Temperature Terminal Base Units 75,763,399(2) 1.32E-08 2.32E-07
1794-TBN Terminal Base Units 75,716,615 1.32E-08 2.32E-07
1794-TBNF Fused Terminal Base Units 4,812,320(2) 2.08E-07 3.70E-06
1794-ACNR15XT ControlNet Redundant Media Adapter 8,223,684 1.22E-07 2.15E-06
1794-AENTRXT 10/100Mb Ethernet Redundant Communication Adapter 1,268,070 7.89E-07 1.45E-05
1794-OB8EPXT 8 Protected Output Module 14,771,049 6.77E-08 1.20E-06
1794-IB16XT 16 Sink Input Module 35,587,189 2.81E-08 4.95E-07
1794-OB16PXT 16 Protected Output Module 26,709,401 3.74E-08 6.60E-07
1794-IB10XOB6XT 10 Input/6 Output Combo Module 22,202,487 4.50E-08 7.94E-07
1794-OW8XT 8 Relay Output Module 18,518,519 5.40E-08 9.53E-07
1794-IE4XOE2XT 4 Input/2 Output Analog Combo Module 11,800,802 8.47E-08 1.50E-06
1794-IE8XT 8 Input analog Module 14,041,000 7.12E-08 1.26E-06
1794-OE4XT 4 Output Analog Module 11,381,744 8.79E-08 1.55E-06
1794-IF2XOF2IXT 2 Input/2 Output Isolated Analog Combo Module 6,317,918 1.58E-07 2.81E-06
1794-IF4IXT 4 Isolated Input Analog Module 7,297,140 1.37E-07 2.43E-06
1794-IF4ICFXT 4 Isolated Input Analog Module 7,297,140 1.37E-07 2.43E-06
1794-OF4IXT 4 Isolated Output Analog Module 5,493,902 1.82E-07 3.24E-06
1794-IJ2XT 2 Ch. Frequency Counter Module 11,714,128 8.54E-08 1.51E-06
1794-IRT8XT 8 TC/RTD Input Analog Module 8,204,792 1.22E-07 2.16E-06
(1) MTBF measured in hours.
(2) Calculated using field-based values for components
(3) λ= Failure Rate = 1/MTBF
Table 1.2 FLEX I/O Product Probability of Failure on Demand (PFD) Calculations (T1= 1 yr)
Catalog Number Description Mean Time
Between Failure
(MTBF)(1)
λ(3) Calculated PFD
1oo2 architecture
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-10 SIL Policy
Table 1.3 FLEX I/O Product Probability of Undetected Dangerous Failure per Hour (PFH) Calculations (T1= 1 yr)
Catalog Number Description Mean Time
Between Failure
(MTBF)(1)
λ(3) Calculated PFH
1oo2 architecture
1794-ACN15 ControlNet Single Media Adapter 8,223,684 1.22E-07 8.64E-10
1794-ACNR15 ControlNet Redundant Media Adapter 8,223,684 1.22E-07 8.64E-10
1794-AENT 10/100Mb Ethernet Communication Adapter 691,134 1.45E-06 1.19E-08
1794-AENTR 10/100Mb Ethernet Redundant Communication Adapter 1,268,070(2) 7.89E-07 6.05E-09
1794-IB10XOB6 10 Input/6 Output Module 4,943,442 2.02E-07 1.45E-09
1794-IB16 16 Sink Input Module 4,105,090 2.44E-07 1.76E-09
1794-IE8 Analog Input Module 37,952,679 2.63E-08 1.85E-10
1794-IF2XOF2I Isolated Analog Input/Output Module 25,296,960 3.95E-08 2.78E-10
1794-IF4I Isolated Analog Input Module 11,746,343 8.51E-08 6.02E-10
1794-IJ2 Frequency Counter Module 2,418,321 4.14E-07 3.04E-09
1794-IP4 Pulse Counter Module 2,375,360 4.21E-07 3.10E-09
1794-IR8 RTD Input Module 6,191,655 1.62E-07 1.15E-09
1794-IRT8 TC/RTD/mV Input Module 1,182,438 8.46E-07 6.53E-09
1794-IT8 Thermocouple Input Module 1,564,324 6.39E-07 4.82E-09
1794-OB16 16 Source Output Module 1,883,594 5.31E-07 3.96E-09
1794-OB16P Protected Output Module 2,135,280 4.68E-07 3.47E-09
1794-OB8EP Protected Output Module 2,389,669(2) 4.18E-07 3.08E-09
1794-OE4 Analog Output Module 23,807,086 4.20E-08 2.96E-10
1794-OF4I Isolated Analog Output Module 7,191,128 1.39E-07 9.90E-10
1794-OW8 Relay Output Module 14,766,876 6.77E-08 4.78E-10
1794-TB3 Terminal Base Units 21,128,346(2) 4.73E-08 3.33E-10
1794-TB3G Generic Terminal Base Units 27,320,800 3.66E-08 2.57E-10
1794-TB3GS Generic Terminal Base Units 46,425,600 2.15E-08 1.51E-10
1794-TB3S Terminal Base Unit 71,433,747(2) 1.40E-08 9.82E-11
1794-TB3T Temperature Terminal Base Units 73,096,226(2) 1.37E-08 9.59E11
1794-TB3TS Temperature Terminal Base Units 75,763,399(2) 1.32E-08 9.25E-11
1794-TBN Terminal Base Units 75,716,615 1.32E-08 9.26E-11
1794-TBNF Fused Terminal Base Units 4,812,320(2) 2.08E-07 1.49E-09
1794-ACNR15XT ControlNet Redundant Media Adapte 8,223,684 1.22E-07 8.64E-10
1794-AENTRXT 10/100Mb Ethernet Redundant Communication Adapter 1,268,070(2) 7.89E-07 6.05E-09
1794-OB8EPXT 8 Protected Output Module 14,771,049 6.77E-08 4.78E-10
1794-IB16XT 16 Sink Input Module 35,587,189 2.81E-08 1.97E-10
1794-OB16PXT 16 Protected Output Module 26,709,401 3.74E-08 2.63E-10
1794-IB10XOB6XT 10 Input/6 Output Combo Module 22,202,487 4.50E-08 3.17E-10
1794-OW8XT 8 Relay Output Module 18,518,519 5.40E-08 3.80E-10

Publication 1794-RM001G-EN-P - December 2011
SIL Policy 1-11
Table 1.4 shows an example of a PFD calculation for a safety loop involving
two DC input modules used in a 1oo2 configuration and a DC output module.
1794-IE4XOE2XT 4 Input/2 Output Analog Combo Module 11,800,802 8.47E-08 5.99E-10
1794-IE8XT 8 Input analog Module 14,041,000 7.12E-08 5.03E-10
1794-OE4XT 4 Output Analog Module 11,381,744 8.79E-08 6.22E-10
1794-IF2XOF2IXT 2 Input/2 Output Isolated Analog Combo Module 6,317,918 1.58E-07 1.13E-09
1794-IF4IXT 4 Isolated Input Analog Module 7,297,140 1.37E-07 9.75E-10
1794-IF4ICFXT 4 Isolated Input Analog Module 7,297,140 1.37E-07 9.75E-10
1794-OF4IXT 4 Isolated Output Analog Module 5,493,902 1.82E-07 1.30E-09
1794-IJ2XT 2 Ch. Frequency Counter Module 11,714,128 8.54E-08 6.04E-10
1794-IRT8XT 8 TC/RTD Input Analog Module 8,204,792 1.22E-07 8.66E-10
(1) MTBF measured in hours.
(2) Calculated using field-based values for components
(3) λ= Failure Rate = 1/MTBF
Table 1.3 FLEX I/O Product Probability of Undetected Dangerous Failure per Hour (PFH) Calculations (T1= 1 yr)
Catalog Number Description Mean Time
Between Failure
(MTBF)(1)
λ(3) Calculated PFH
1oo2 architecture
Table 1.4
Catalog Number: Description: MTBF: Calculated
1oo2 PFD:
1794-ACNR15 ControlNet Dual Media
Adapter 1.5 3,259,605 1.56E-06
1794-IB16 24V DC Input Module 6,409,846 4.34E-06
1794-IB16 24V DC Input Module 6,409,846 4.34E-06
1794-OB16 24V DC Output Module 4,284,857 9.62E-06
1794-OW8 Relay Output Module 1,312,973 1.20E-06
1756-L63B1ControlLogix Controller 2,460,065 2.33E-04
1756-CNB ControlNet Bridge Module 3,596,087 1.15E-04
1756-CNB ControlNet Bridge Module 3,596,087 1.15E-04
Total PFD calculation for a safety loop consisting of these products: 3.70E-04
1 See Publication 1756-RM001 for more information.
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-12 SIL Policy
B
B
1794-OB16
1794-IB16
1794-TB3 (1)
1794-TB3 (2)
1794-ACNR15 (1)
1794-ACNR15 (2)
1794-IB16
1794-OW8
1756-CNB
1756-L63B
ControlNet
ControlNet
1756-CNB

Publication 1794-RM001G-EN-P - December 2011
SIL Policy 1-13
SIL Compliance
Distribution and Weight
The programmable controller may conservatively be assumed to contribute
10% of the reliability burden. A SIL 2 system may need to incorporate multiple
inputs for critical sensors and input devices, as well as dual outputs connected
in series to dual actuators dependent on SIL assessments for the safety related
system.
Response Times
The response time of the system is defined as the amount of time it takes for a
change in an input condition to be recognized and processed by the
controller’s ladder logic program, and then to initiate the appropriate output
signal to an actuator. The system response time is the sum of the following:
•input hardware delays
•input filtering
•I/O and communication module RPI settings
•controller program scan times
•output module propagation delays
See Table 1.1 for associated module information.
Each of the times listed above is variably dependent on factors such as the type
of I/O module and instructions used in the ladder program. For examples of
how to perform these calculations, see publication 1756-RM001.
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-14 SIL Policy
Notes:

1Publication 1794-RM001G-EN-P - December 2011
Chapter 2
ControlLogix Communications
This chapter discusses the communication modules used in a ControlLogix
SIL2 system.
ControlNet Bridge Module
The ControlNet bridge modules (1756-CNB & 1756-CNBR) provide for the
communications between ControlLogix and FLEX I/O system.
ControlNet Cabling
For remote racks, 802.3 compliant shielded or unshielded twisted pair cable is
required for EtherNet/IP. Although it is not a requirement to use redundant
media with the 1756-CNBR, it does provide higher system availability.
Redundant media is not required for SIL2 operation.
ControlNet Module Diagnostic Coverage
All communications over the passive ControlNet media occur via CIP, which
guarantees delivery of the data. All modules independently verify proper
transmission of the data.
EtherNet/IP Bridge Module
The EtherNet/IP bridge modules (1756-ENBT, 1756-EN2T, 1756-EN2TR,
and 1756-EN2TXT) provide for the communications between ControlLogix
and FLEX I/O system.
For information about: See page:
ControlNet Bridge Module 2-1
EtherNet/IP Bridge Module 2-1
Related Communications Modules
Documentation 2-3
AB Drives

Publication 1794-RM001G-EN-P - December 2011
2-2 ControlLogix Communications
EtherNet/IP Cabling
802.3 compliant shielded or unshielded twisted pair cable is required for
EtherNet/IP.
EtherNet/IP Module Diagnostic Coverage
Communications over 10/100 MbpsNet media occur via CIP, which
guarantees delivery of the data. All modules independently verify proper
transmission of the data.
Module Fault Reporting for
any FLEX I/O Module
To monitor the connection status for this type of connection, use a Get
System Value (GSV) and an examination of MODULE objects’ "Entry Status"
attribute for a running connection.
An example of how this might be done is shown in Figure 2.1. This method,
or something similiar, must be used to interrogate the health of each I/O
module in the system.
Figure 2.1 Example of Checking a Module’s Health in Ladder Logic
For more information on the GSV instruction, monitor the SlotStatusBits for
the Input tag of the associated adapter. The lower 8 bits of this tag correspond
to the associated slot. For example, the tag "Node3:I.SlotlStatusBits" is defined
as follows:
NODE3 - This is the name given to the associated 1794-AVNR15.
I = This indicates the Input file.
GSV
Obtain MODULE
Object’s Entry Status
AND
Mask Off Lower 12
Bits of Value
NEQ
Check Entry Status to
make sure module is
running Fault