Rockwell Automation Publication 1715-UM001J-EN-P - December 2020 209
Chapter 7 1715 Redundant I/O System in SIL 2 Safety Applications
Using 1715 I/O Modules in
SIL 2 Applications
I/O modules can be replaced or installed online without affecting controller
operation, provided at least one module is installed and is fully operational.
However, each module must be installed one at a time and allowed to start up
before the next module is installed.
Input Modules
The simplex and duplex termination assemblies are safety critical, that is, an
input or output that is attached to a field device, and provide termination for
16 channels. They connect the field signals to the input modules. Both digital
and analog input termination assembly circuits have fuse protection.
Input modules support high availability when configured for duplex operation
and using the appropriate termination assembly.
Input modules can be configured to operate in SIL 2 energize-to-action or de-
energize-to-trip applications.
Reactions to Faults
If an input channel is not capable of reporting a voltage within a safety
accuracy specification of 1% of the full scale measurement range, then the
module returns safe values to the processor. Signals transition to a safe state if
the module scan time exceeds the connection reaction time limit (CRTL).
All I/O modules feature status indicators and can also report faults via
application variables. All modules provide the following status information:
• Module presence
• Module health and status
• Channel health and status
•Field faults
• An echo of the front panel indicators for each module
For more information about status indicators, see Status Indicators on
page 283.
Safety Accuracy
The I/O input modules determine the channel state and the line fault state by
comparing the reported input values with user-programmed threshold values.
For each channel of a module, two independent measurements are made. The
discrepancy between these measurements is monitored to determine if it is
within the safety accuracy limit.
The channel is in fault and the last valid value is held until after the CRTL
period if the values are outside these limits:
• Digital input module = 4%
• Analog input module = 1%
After the CRTL period, the value changes to 0.
To Next Page
Loading...
