Honeywell HC900 User guide

HC900 Process & Safety Controller
Safety Manual
Doc. No.: 51-52-25-153
Revision: 1.9
Date: January 2014

ii HC900 Process & Safety Controller Safety Manual Revision 1.9
01/14
Notices and Trademarks
Copyright 2014 by Honeywell
Revision 1.9 January 2014
Warranty/Remedy
Honeywell warrants goods of its manufacture as being free of defective materials and faulty workmanship. Contact
your local sales office for warranty information. If warranted goods are returned to Honeywell during the period of
coverage, Honeywell will repair or replace without charge those items it finds defective. The foregoing is Buyer's sole
remedy and is in lieu of all other warranties, expressed or implied, including those of merchantability and
fitness for a particular purpose. Specifications may change without notice. The information we supply is believed
to be accurate and reliable as of this printing. However, we assume no responsibility for its use.
While we provide application assistance personally, through our literature and the Honeywell web site, it is up to the
customer to determine the suitability of the product in the application.
Honeywell Process Solutions
512 Virginia Drive
Fort Washington, PA 19034
Honeywell is a U.S. registered trademark of Honeywell
Other brand or product names are trademarks of their respective owners.

Revision 1.9 HC900 Process & Safety Controller Safety Manual iii
01/14
About This Document
Abstract
The Safety Manual provides information about HC900 that is relevant for integration into a Safety Instrumented
System (SIS).
References
The following list identifies all documents that may be sources of reference for material discussed in this
publication.
Document Title ID #
HC900 Process & Safety Controller Installation and User guide 51-52-25-154
HC900 Process Controller Technical Overview Specification 51-52-03-31
HC900 Module Specification 51-52-03-41
Process Control Designer Specification 51-52-03-43
HC900 Process Control Designer User Guide 51-52-25-110
HC900 Process Control Utilities User Guide 51-52-25-126
HC900 Process Controller Function Block Reference Guide 51-52-25-109
HC900 Process Controller Communications User Guide 51-52-25-111
HC900 Controller Redundancy Overview & System Operation 51-52-25-133
900 Control Station For use with HC900 Process Controller 51-52-25-148
Station Designer Software manual 51-52-25-149
IEC 61508 (2010) - External document N/A
IEC 61511 (2004) External document N/A
Revision Information
Document Name Revision Number Publication Date
51-52-25-153 HC900 Process & Safety Controller Safety
Manual Revision 1.9 January 2014

iv HC900 Process & Safety Controller Safety Manual Revision 1.9
01/14
Support and Contact Information
For Europe, Asia Pacific, North and South America contact details, refer to the back page of this manual
or the appropriate Honeywell Solution Support web site:
Honeywell Organization WWW Address (URL)
Corporate
http://www.honeywell.com
Honeywell Process Solutions
www
.honeywellprocess.com
HPS Technical tips
https
://www.honeywellprocess.com/en-
US/explore/products/control
-monitoring-and-safety-
systems/scalable
-control-solutions/hc900-control-
system/Pages/hc900
-controller.aspx
Telephone and Email Contacts
Area Organization Phone Number
United States and
Canada Honeywell Inc.
1-800-343-0228 Customer Service
1-800-423-9883 Global Technical Support
Global Email Support Honeywell Process Solutions
Email: (Sales)
[e-mail]
or (TAC)
[e-mail]

Revision 1.9 HC900 Process & Safety Controller Safety Manual v
01/14
Symbol Definitions
The following table lists those symbols that may be used in this document and on the product to denote certain
conditions.
Symbol Definition
This DANGER symbol indicates an imminently hazardous situation, which,
if not avoided, will result in death or serious injury.
This WARNING symbol indicates a potentially hazardous situation, which, if
not avoided, could result in death or serious injury.
This CAUTION symbol may be present on Control Product instrumentation
and literature. If present on a product, the user must consult the
appropriate part of the accompanying product literature for more
information.
This CAUTION symbol indicates a potentially hazardous situation, which, if
not avoided, may result in property damage.
WARNING
PERSONAL INJURY: Risk of electrical shock. This symbol warns the user of a
potential shock hazard where HAZARDOUS LIVE voltages greater than 30 Vrms,
42.4 Vpeak, or 60 Vdc may be accessible. Failure to comply with these
instructions could result in death or serious injury.
ATTENTION, Electrostatic Discharge (ESD) hazards. Observe precautions for
handling electrostatic sensitive devices
CAUTION, HOT SURFACE: This symbol warns the user of potential hot surfaces
which should be handled with appropriate caution.
Protective Earth (PE) terminal. Provided for connection of the protective earth
(green or green/yellow) supply system conductor.
Functional earth terminal. Used for non-safety purposes such as noise immunity
improvement. NOTE: This connection shall be bonded to protective earth at the
source of supply in accordance with national and local electrical code requirements.
Earth Ground. Functional earth connection. NOTE: This connection shall be bonded
to Protective earth at the source of supply in accordance with national and local
electrical code requirements.
Chassis Ground. Identifies a connection to the chassis or frame of the equipment
shall be bonded to Protective Earth at the source of supply in accordance with
national and local electrical code requirements.

vi HC900 Process & Safety Controller Safety Manual Revision 1.9
01/14
Terms and Abbreviations
1oo1 One out of one
2oo3 Two out of three
Basic Safety The equipment must be designed and manufactured such that it protects against risk
of damage to persons by electrical shock and other hazards and against resulting fire
and explosion. The protection must be effective under all conditions of the nominal
operation and under single fault condition
DU Dangerous Undetected failures
FMEDA Failure Modes, Effects and Diagnostic Analysis
Functional Safety The ability of a system to carry out the actions necessary to achieve or to maintain a
defined safe state for the equipment / machinery / plant / apparatus under control of
the system
GTS Global Technical Support Center
HFT Hardware Fault Tolerance
Low demand mode Mode, where the frequency of demands for operation made on a safety-related system
is no greater than one per year and no greater than twice the proof test frequency.
PFD
AVG
Average Probability of Failure on Demand
Safety Freedom from unacceptable risk of harm
Safety Assessment The investigation to arrive at a judgment - based on evidence - of the safety achieved
by safety-related systems. Further definitions of terms used for safety techniques and
measures and the description of safety related systems are given in IEC 61508-4.
SFF Safe Failure Fraction, the fraction of the overall failure rate of a device that results in
either a safe fault or a diagnosed unsafe fault.
SIF Safety Instrumented Function, a set of equipment intended to reduce the risk due to a
specific hazard (a safety loop).
SIL Safety Integrity Level, discrete level (one out of a possible four) for specifying the
safety integrity requirements of the safety functions to be allocated to the E/E/PE
safety-related systems where Safety Integrity Level 4 has the highest level of safety
integrity and Safety Integrity Level 1 has the lowest.
SIS Safety Instrumented System – Implementation of one or more Safety Instrumented
Functions. A SIS is composed of any combination of sensor(s), logic solver(s), and
final element(s).

Revision 1.9 HC900 Process & Safety Controller Safety Manual vii
01/14
Contents
The Safety Manual .......................................................................................................... 1
Scope................................................................................................................................................. 1
Basic Skills and Knowledge ................................................................................................................ 1
Safety Standards for Process & Equipment Under Control (PUC, EUC) .............................................. 1
The IEC 61508 and IEC 61511 Standards .......................................................................................... 2
Introduction ..................................................................................................................... 5
System Overview................................................................................................................................ 5
HC900 Control System Architectures.............................................................................. 9
Introduction to the Hardware............................................................................................................... 9
Non-Redundant Controller and Non-Redundant IO ........................................................................... 13
Redundant Controllers and Non-Redundant IO ................................................................................. 13
HC900 controller Features................................................................................................................ 15
Scope of SIL Certification for HC900 Control System Architectures................................................... 16
Design and Implementation of HC900 Control System ................................................. 17
Allowable Function Blocks for Process and Safety Functions ............................................................ 17
HC900 Control System Operational Modes....................................................................................... 46
Hardware and wiring requirements for safety configuration................................................................ 46
HC900 Safety configurations............................................................................................................. 48
HC900 Control System Diagnostics .................................................................................................. 52
HC900 SIL Control System communications..................................................................................... 53
HC900 system Start-up test .............................................................................................................. 54
HC900 PFD................................................................................................................... 55
Probability of Failure on Demand (PFD) for Low Demand Mode........................................................ 55
HC900 Control System Fault Detection and Response................................................. 57
Principle of Fault Detection and Response........................................................................................ 57
Diagnostic Test Interval .................................................................................................................... 57
Fault Reaction and IO states............................................................................................................. 58
HC900 Controller Diagnostics........................................................................................................... 59
HC900 SIL Compatibility................................................................................................................... 59
Reliability data............................................................................................................... 62

viii HC900 Process & Safety Controller Safety Manual Revision 1.9
01/14
Tables
Table 1 – IEC 61508 versus IEC 61511 terminology............................................................................................2
Table 2 – Descriptions of Major Components ....................................................................................................10
Table 3 – Descriptions of Major Redundancy Components.................................................................................12
Table 4 – Function Blocks .................................................................................................................................17
Table 5 – Status Indicators.................................................................................................................................52
Table 6 – SIL Levels .........................................................................................................................................55
Table 7 – Diagnostic Test Intervals....................................................................................................................57
Figures
Figure 1 – Small HC900 Controller Configuration ...............................................................................................5
Figure 2 – Expanded HC900 Controller Configuration.........................................................................................6
Figure 3 – Single process with redundancies ........................................................................................................7
Figure 4 – Configuration with Multiple Controllers..............................................................................................9
Figure 5 – Redundant Configuration with multiple I/O racks..............................................................................11
Figure 6 – Two safety applications process with redundancies (C75 CPU only)..................................................14
Figure 7 – Analog Input Voting Block ...............................................................................................................42
Figure 8 – Analog Output Validation Block .......................................................................................................43
Figure 9 – Digital Input Voting Block................................................................................................................43
Figure 10 – Digital Output Validation Block ......................................................................................................43
Figure 11 – Fault Monitor Block........................................................................................................................44
Figure 12 – IO-V function block connections....................................................................................................46
Figure 13 – Individual Series DO connections....................................................................................................47
Figure 14 – Common Series DO connections.....................................................................................................47
Figure 15 – Series Relay for Analog Outputs .....................................................................................................48
Figure 16 – Safety Dataflow ..............................................................................................................................49
Figure 17 – Sample controlled start-up configuration .........................................................................................50
Figure 18 – Sample VFAIL qualification ...........................................................................................................50

Revision 1.9 HC900 Process & Safety Controller Safety Manual 1
01/14
The Safety Manual
This manual is intended for users who have Honeywell HC900 product with SIL certification and intend to
use it in SIF.
Scope
The Safety Manual provides information about HC900 that is relevant for integration into a Safety
Instrumented System (SIS). This manual is aimed at technical personnel responsible for such integration.
The Safety Manual is a reference guide providing detailed information regarding safety aspects in HC900.
A reference guide is a HC900 related guide and does not describe tasks in terms of how to perform the task
in terms of steps to follow. A reference guide can provide input to support decisions required to achieve a
certain objective.
Basic Skills and Knowledge
Before you start work on the HC900 SIS it is assumed that you are certified to do work on safety related
systems and devices, and that you have appropriate knowledge of:
• The concepts and functioning of the HC900
• The applicable process and equipment under control within the SIS,
• This Safety Manual,
• Site procedures,
• Applicable safety standards (e.g. IEC 61508 and IEC 61511)
This guide assumes that you have a basic familiarity with the process(es) connected to the equipment under
control and that you have a complete understanding of the hazard and risk analysis
Safety Standards for Process & Equipment Under Control (PUC, EUC)
Processes and Equipment Under Control (PUC/EUC) in the process industry require a high level of safety.
Safety Instrumented Systems (SIS) are used to perform Safety Instrumented Functions (SIF).
Instrumentation that is used for SIFs, must meet minimum standards and performance levels. Standards like
IEC 61508 and IEC 61511 have been developed for this purpose. One of the performance criteria that these
standards apply is the Safety Integrity Level (SIL). IEC 61508 details the design requirements for achieving
the required SIL. The safety integrity requirements for each individual safety function may differ. The
safety function and SIL requirements are derived from hazard analysis and risk assessments. The higher the
level of adapted safety integrity, the lower the likelihood of dangerous failure of the SIS, These standards
also address the safety-related sensors and final elements regardless of the technology used.
The HC900 can be used in a specific SIF that demands SIL 1 or SIL 2.
Only the HC900 portion of the EUC control system will be documented in this safety manual.
HC900 can be used only in applications for Demand mode operation.

The Safety Manual - The IEC 61508 and IEC 61511 Standards
2 HC900 Process & Safety Controller Safety Manual Revision 1.9
01/14
Safety Integrity Level (SIL)
The IEC 61508 standard specifies 4 levels of safety performance for safety functions. These are called
safety integrity levels. Safety integrity level 1 (SIL1) is the lowest level of safety integrity, and safety
integrity level 4 (SIL4) the highest level. If the level is below SIL1, the IEC 61508 and IEC 61511 do not
apply. HC900 can be used for processing multiple SIFs simultaneously demanding a SIL1 and SIL2.
The IEC 61508 and IEC 61511 Standards
SISs have been used for many years to perform safety instrumented functions e.g. in chemical,
petrochemical and gas plants. In order for instrumentation to be effectively used for safety instrumented
functions, it is essential that the instrumentation meets certain minimum standards and performance levels.
To define the characteristics, main concepts and required performance levels, standards IEC 61508 and IEC
61511 have been developed. The introduction of Safety Integrity level (SIL) is one of the results of these
standards.
This brief provides a short explanation of each standard. Detailed information regarding IEC 61508 and
61511 can be found on the IEC web site, http://www.iec.org.
What standard to use?
• If you are in the process sector and you are an owner/user, it is strongly recommended that you pay
attention to the IEC 61511 (ANSI/ISA 84.00.01).
• If you are in the process sector and you are a manufacturer, it is strongly recommended that you pay
attention to the IEC 61508.
• If you are in another sector, it is strongly recommended that you look for, and use, your sector specific
IEC standard for functional safety (if there is one). If none exists, you can use the IEC 61508 instead.
IEC 61508 and IEC 61511 terminology
This guide contains both IEC 61508 and IEC 61511 related terminology. As the IEC 61511 sits within the
framework of IEC 61508 most of the terminology used may be interchanged. Table 1 below provides an
overview of the most common interchangeable terminology.
Table 1 – IEC 61508 versus IEC 61511 terminology
IEC 61508 terminology IEC 61511 terminology
safety function safety instrumented function
electrical/electronic/programmable electronic
(E/E/PE) safety-related system
safety instrumented system (SIS)
IEC 61508, the standard for all E/E/PE safety-related systems
The IEC 61508 is called “Functional safety of electrical/electronic/programmable electronic safety-related
systems” IEC 61508 covers all safety-related systems that are electrotechnical in nature (i.e. Electrical,
Electronic and Programmable Electronic systems (E/E/PE) ).