Allen-Bradley FlexLogix 1794 User manual

FLEXI/OSystemwithControlLogixforSIL2
Catalog Number Bulletin 1794
Reference Manual
AB Drives

Important User Information
Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety Guidelines for the Application,
Installation and Maintenance of Solid State Controls (publication SGI-1.1 available from your local Rockwell Automation sales office or online at
http://literature.rockwellautomation.com) describes some important differences between solid state equipment and hard-wired electromechanical
devices. Because of this difference, and also because of the wide variety of uses for solid state equipment, all persons responsible for applying this
equipment must satisfy themselves that each intended application of this equipment is acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this
equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated
with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and
diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this
manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Allen-Bradley, Rockwell Automation, FLEX I/O, RSLinx, RSLogix 5000 and TechConnect are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
WARNING
Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may
lead to personal injury or death, property damage, or economic loss.
IMPORTANT
Identifies information that is critical for successful application and understanding of the product.
ATTENTION
Identifies information about practices or circumstances that can lead to: personal injury or death, property damage, or
economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
SHOCK HAZARD
Labels may be on or inside the equipment, such as a drive or motor, to alert people that dangerous voltage may be present.
BURN HAZARD
Labels may be on or inside the equipment, such as a drive or motor, to alert people that surfaces may reach dangerous
temperatures.

1Publication 1794-RM001G-EN-P - December 2011
Preface
Introduction
This application manual is intended to describe the FLEX I/O with ControlLogix
Control System components available from Rockwell Automation that are
suitable for use in SIL2 applications. Use this manual in conjunction with
publication 1756-RM001
Alternate architecture can be used in SIL2 applications if they are approved by
a certifying agency.
Manual Set-Up
This manual is designed to make clear how the FLEX I/O with ControlLogix
Control System can be SIL2-certified. Table Preface.1 lists the information
available in each section.
Understanding Terminology
The following table defines acronyms used in this manual.
Table Preface.1
Section: Title: Description:
Chapter 1 SIL Policy Introduction to the SIL policy and how that
policy relates to FLEX I/O with a ControlLogix
system.
Chapter 2 ControlLogix Communications Description of the ControlLogix communications
modules used in the SIL2-certified FLEX I/O
with ControlLogix system.
Chapter 3 FLEX I/O Modules Description of the FLEX I/O modules used in the
SIL2-certified FLEX I/O with ControlLogix
system.
Chapter 4 General Requirements for
Application Software Application software requirements for using ControlLogix and FLEX modules.
Chapter 5 Technical SIL2 Requirements
for the Application Program Guidelines for application development in RSLogix 5000 as they relate to SIL2.
Appendix A Failure Estimates Failure rates based on field returns.
Table Preface.2 List of Acronyms Used Throughout the Safety Application Manual
Acronym: Full Term: Definition:
CIP Control and
Information
Protocol
A messaging protocol used by Logix5000™
systems. It is a native communications protocol
used on ControlNet™ communications networks,
among others.
DC Diagnostic
Coverage The ratio of the detected failure rate to the total failure rate.
EN European Norm. The official European Standard
GSV Get System Value A ladder logic output instruction that retrieves
specified controller status information and places
it in a destination tag.
AB Drives

Publication 1794-RM001G-EN-P - December 2011
Preface 2
MTBF Mean Time
Between Failures Average time between failure occurrences.
MTTR Mean Time to
Restoration Average time needed to restore normal operation after a failure has occurred.
PADT Programmingand
Debugging Tool RSLogix 5000 software used to program and debug a SIL2-certified FLEX I/O with ControlLogix
application.
PC Personal
Computer Computer used to interface with, and control, a ControlLogix system via RSLogix 5000
programming software.
PFD Probability of
Failure on
Demand
The average probability of a system to fail to
perform its design function on demand.
PFH Probability of
Failure per Hour The probability of a system to have a dangerous failure occur per hour.
1oo1 One out of one A 1oo1 (one out of one) architecture consists of a
single channel where any dangerous failure leads
to a failure of the safety function.
1oo2 One out of two A 1oo2 (one out of two) architecture consists of
two channels connected in parallel such that
either channel can process the safety function.
Table Preface.2 List of Acronyms Used Throughout the Safety Application Manual
Acronym: Full Term: Definition:

1Publication 1794-RM001G-EN-P - December 2011
Chapter 1
SIL Policy
This chapter introduces you to the SIL policy and how the
ControlLogix/FLEX I/O system meets the requirements for SIL2
certification.
Introduction to SIL
Certain catalog numbers (listed in Table 1.1 on page 1-5) of the FLEX I/O with
ControlLogix system are type-approved and certified for use in SIL2
applications, according to IEC 61508. SIL requirements are based on the
standards current at the time of certification.
These requirements consist of mean time between failures (MTBF),
probability of failure, failure rates, diagnostic coverage and safe failure
fractions that fulfill SIL2 criteria. The results make the ControlLogix/FLEX
I/O system suitable up to, and including, SIL2. When the
ControlLogix/FLEX I/O system is in the maintenance or programming
mode, the user is responsible for maintaining a safe state.
For support in creation of programs, the PADT (Programming and
Debugging Tool) is required. The PADT for ControlLogix/FLEX I/O is
RSLogix 5000, per IEC 61131-3, and this Safety Reference Manual.
The TUV Rheinland has approved the ControlLogix/FLEX I/O system for
use in up to and including SIL 2 safety related applications in which the
de-energized state is considered to be the safe state. All of the examples related
to I/O included in this manual are based on achieving de-energization as the
safe state for typical Emergency Shutdown (ESD) Systems.
For information about: See page:
Introduction to SIL 1-1
SIL2 Certification 1-2
Proof Tests 1-3
SIL2-Certified FLEX I/O System Components 1-5
Hardware Designs and Firmware Functions 1-8
Hardware Designs and Firmware Functions 1-8
Difference Between PFD and PFH 1-8
SIL Compliance Distribution and Weight 1-13
Response Times 1-13
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-2 SIL Policy
SIL2 Certification
Figure 1.1 shows a typical SIL loop, including:
•the overall safety loop
•the ControlLogix/FLEX I/O portion of the overall safety loop
•how other devices (for example, HMI) connect to the loop, while
operating outside the loop
Figure 1.1
Plant-wide Ethernet/Serial
ControlNet
SIL2-certified ControlLogix components’ portion of the overall safety loop
Programming Software
For SIL applications, a programming
terminal is not normally connected.
HMI
For Diagnostics and Visualization (read-only access to controllers in the
safety loop). For more information, see publication 1756-RM001.
E
N
B
C
N
B
To other safety related
ControlLogix or FLEX I/O
remote I/O chassis
Overall Safety Loop
Actuator
Actuator
1794 FLEX I/O
Input
Device
DI1
DO2
DO1
DI2
ControlNet
Input
Device
To other safety related
ControlLogix or FLEX I/O
remote I/O chassis
See Figures 3.1 and 3.5 for details.
1
Note 1: Multiple 1756-CNB or -CNBR modules can be installed into the chassis as needed.
Other configurations are possible as long as they are SIL2 approved.
+V
Note 2: Two adapters are required for meeting SIL2 as shown in the figure.
The adapters can be either ControlNet or Ethernet and must be from the list of approved products.

Publication 1794-RM001G-EN-P - December 2011
SIL Policy 1-3
Proof Tests
IEC 61508 requires the user to perform various proof tests of the equipment
used in the system. Proof tests are performed at user-defined times (for
example, proof test intervals can be once a year, once every two years or
whatever timeframe is appropriate) and include some of the following tests:
•Testing of all fault routines to verify that process parameters are
monitored properly and the system reacts properly when a fault
condition arises.
•Testing of digital input or output channels to verify that they are not
stuck in the ON or OFF state.
IMPORTANT
Important Note related to published PFDs.
•The user must choose the appropriate PFD depending
on combinations and the appropriate 1oo1 or 1oo2
configuration.
•Descrete and analog inputs must be used in a 1oo2
configuration for SIL 2.
•Adapters must be used in a 1oo2.
•Outputs may be 1oo2 in series or 1oo1 monitored by
an input with an external relay as a secondary device to
remove power.
•Some specialized inputs can only be wired to a single
sensor such as thermocuples and two 1oo1 PFDs must
be used for each.
•The total PFD for two 1oo1s is the sum of both.
IMPORTANT
The system user is responsible for:
•the set-up, SIL rating and validation of any sensors or
actuators connected to the ControlLogix/FLEX I/O
control system.
•project management and functional testing.
programming the application software and the module
configuration according to the description in the
following chapters.
The SIL2 portion of the certified system excludes the
development tools and display/human machine interface
(HMI) devices; these tools and devices are not part of the
run time control loop.
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-4 SIL Policy
•Calibration of analog input and output modules to verify that accurate
data is obtained from and used on the modules.
For more information on system proof tests, see Publication 1756-RM001. For
more information on the necessary I/O module, see Table 1.1.
IMPORTANT
Users’ specific applications will determine the timeframe
for the proof test interval.
However, keep in mind that the Probability of Failure on
Demand (PFD) calculations listed in Table 1.2 on page 1-8
use a proof test interval of once per year. If the proof test
interval is changed, the information must be recalculated.

Publication 1794-RM001G-EN-P - December 2011
SIL Policy 1-5
SIL2-Certified FLEX I/O
System Components
Table 1.1 lists the components available for use in a SIL2-certified FLEX I/O
system. For a list of ControlLogix SIL2 certified products, see publication
1756-RM001.
Table 1.1 FLEX I/O Components For Use in the SIL 2 System
Device Type: Catalog Number: (1) Description:
Related Documentation(4)
with More Information on
Catalog Number:
Series(2)
Firmware
Revision:
(2) (3)
Installation
Instructions: User Manual:
Adapter 1794-ACN15 ControlNet Single Media
Adapter C4.3 5.1, 5.2, 5.3,
5.x
1794-IN101 NA
D 10.1, 10.2,
10.3, 10.x
1794-ACNR15 ControlNet Redundant Media
Adapter C4.3 5.1, 5.2, 5.3,
5.x
D 10.1, 10.2,
10.3, 10.x
1794-ACNR15XT C 5.1, 5.2, 5.3,
5.x 1794-IN128
D 10.1, 10.2,
10.3, 10.x
1794-AENT 10/100Mb Ethernet
Communication Adapter B4.1 4.2, 4.x 1794-IN082
1794-AENTR A 1.011, 1.x 1794-IN131 1794-UM066
1794-AENTRXT
I/O Modules -
Digital 1794-IB16 16 Sink Input Module A NA 1794-IN093 NA
1794-IB10XOB6 10 Input/6 Output Module A NA 1794-IN083
1794-OB16 16 Source Output Module A NA 1794-IN094
1794-OB16P 16 Protected Output Module A NA 1794-IN094
1794-OB8EP 8 Protected Output Module A NA 1794-IN094
1794-OW8 Isolated Relay Output Module A NA 1794-IN019
1794-OB8EPXT 8 Protected Output Module A NA 1794-IN124
1794-IB16XT 16 Sink Input Module A NA
1794-OB16PXT 16 Protected Output Module A NA
1794-IB10XOB6XT 10 Input/6 Output Combo
Module ANA
1794-OW8XT 8 Relay Output Module A NA 1794-IN019
AB Drives

Publication 1794-RM001G-EN-P - December 2011
1-6 SIL Policy
I/O Modules -
Analog 1794-IE8 8 Input Analog Module B NA 1794-IN100 1794-UM002
1794-IF4I 4 Isolated Input Analog
Module A F, G, H, I, I.x 1794-IN038 1794-UM008
1794-IF2XOF2I 2 In/2 Out Isolated Combo
Module A F, G, H, I, I.x 1794-IN039 1794-UM008
1794-OE4 4 Output Analog Module B NA 1794-IN100 1794-UM002
1794-OF4I 4 Isolated Output Analog
Module A F, G, H, I, I.x 1794-IN037 1794-UM008
1794-IT8 Thermocouple Input Module A K, K.x 1794-IN021 1794-UM007
1794-IR8 RTD Input Module A K, K.x 1794-IN021 1794-UM004
1794-IRT8 TC/RTD Input Module B B, D, E, E.1,
E.x 1794-IN050 1794-UM012
1794-IJ2 2 Ch. Frequency Counter
Module A D 1794-IN049 1794-UM011
1794-IP4 4 Ch. Pulse Counter Module B 4, 4.x 1794-IN064 1794-UM016
I/O Modules -
Analog 1794-IE4XOE2XT 4 Input/2 Output Analog Combo Module B NA 1794-IN125 NA
1794-IE8XT 8 Input analog Module B NA
1794-OE4XT 4 Output Analog Module B NA
1794-IF2XOF2IXT 2 Input/2 Output Isolated
Analog Combo Module A I, I.x 1794-IN129
1794-IF4IXT 4 Isolated Input Analog
Module A I, I.x
1794-OF4IXT 4 Isolated Output Analog
Module A I, I.x
1794-IF4ICFXT 4 Isolated Input Analog
Module A I, I.x 1794-IN130
1794-IJ2XT 2 Ch. Frequency Counter
Module A E, E.x 1794-IN049
1794-IRT8XT 8 TC/RTD Input Analog
Module B D, E, E.1, E.x 1794-IN050
Table 1.1 FLEX I/O Components For Use in the SIL 2 System
Device Type: Catalog Number: (1) Description:
Related Documentation(4)
with More Information on
Catalog Number:
Series(2)
Firmware
Revision:
(2) (3)
Installation
Instructions: User Manual: