Rockwell Automation Publication ICSTT-RM447M-EN-P - July 2019 69
AADvance System Architectures Chapter 4
Table 9 - Modules for SIL 3 Fail-safe I/O, Fault Tolerant Processor
SIL 3 Fault Tolerant I/O Architectures
A SIL 3 fault tolerant I/O is achieved by dual input and output module
configurations with dual or triple processor modules. The processor modules
operate in 1oo2D under no fault conditions, degrade to 1oo1D on the
detection of the first fault in either module and fail-safe when there are faults
on both modules.
Input modules operate in 1oo2D under non faulted conditions and 1oo1D on
detection of the first fault in one module and fail-safe when there are faults on
both modules.
For high demand applications the processor must be repaired within the
MTTR assumed in the PFD calculations or SIL 3 safety instrumented
functions must be shut down.
For de-energize to action operation one digital output module is sufficient for
SIL 3 requirements. However, for energize to action operation, dual digital
output modules are required.
The single output module operates in 1oo1D under no fault conditions and
fail-safe when there are is a fault on the module. For energize to action
operation, the output modules operate in 1oo2D under no fault conditions,
degrade to 1oo1D on the detection of the first fault in either module and fail-
safe when there are faults on both modules.
Position Module Type
I/P A T9401/2 Digital Input Module, 24 Vdc, 8/16 Channel +
T9801 Digital Input TA, 16 Channel, Simplex or
T9431/2 Analogue Input Module, 8/16 channel +
T9831 Analogue Input TA, 16 Channel, Simplex
T9300 Base unit
CPU A & CPU B 2 x T9110 Processor Module, T9100 Base Unit
O/P A 1 x T9451 Digital Output Module, 24 Vdc, 8 Channel +
T9851 Digital Output TA, 24 Vdc, 8 Channel, Simplex or
1 x T9481/T9842 Analogue Output Module, 3/8 Ch, Isolated +
T9881 Analogue Output TA, 8 Ch, Simplex
WARNING: For SIL 3 applications you must use a minimum of a dual
processor configuration.
To Next Page
Loading...
Need help?
General
