How it Works
Honeywell
Loading...
Safety Manager
User Manual
60 pgs652.36 Kb9
Table of contents
Loading...

Honeywell Safety Manager User Manual

Release 131
Safety Manager
Safety Manual
EP-SM.MAN.6283
Issue 4
10 July 2008
Document Release Issue Date
EP-SM.MAN.6283 131 4 July 2008
Notice
While this information is presented in good faith and believed to be accurate, Honeywell disclaims the implied warranties of merchantability and fitness for a purpose and makes no express warranties except as may be stated in its written agreement with and for its customer.
In no event is Honeywell liable to anyone for any direct, special, or consequential damages. The information and specifications in this document are subject to change without notice.
Copyright 2008 – Honeywell Safety Management Systems, a division of Honeywell Aerospace B.V.
Honeywell trademarks
Experion PKS U.S. registered trademarks of Honeywell International Inc.
®
, PlantScape®, SafeBrowse®, TotalPlant® and TDC 3000® are
Conventions
ii
Other trademarks
Microsoft and SQL Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
Trademarks that appear in this document are used only to the benefit of the trademark owner, with no intention of trademark infringement.
Symbols
The following symbols are used in Safety Manager documentation:
Attention
This symbol is used for information that emphasizes or supplements important points of the main text.
Tip
This symbol is used for useful, but not essential, suggestions.
Note
This symbol is used to emphasize or supplement important points of the main text.
Caution
This symbol warns of potential damage, such as corruption of the database.
Warning
This symbol warns of potentially hazardous situations, which, if not avoided, could result in serious injury or death.
ESD
This symbol warns for danger of an electro-static discharge to which equipment may be sensitive.
iii
Fonts
The following fonts are used in Safety Manager documentation:
Emphasis
• “... inform the reader on how to perform the task in terms of...”
• “...see the Overview Guide”
Label
“The Advanced tab of the Properties window has..”
Steps
Take the following steps:
1. Create a plant and set its properties.
2. ....
User Variable
..create the My Projects folder and store the readme.txt file here.
..press the Tab key..
Next press Enter to..
Value
“Low is the fault reaction state for digital inputs and digital outputs.”
Variable
“The syntax is: filename [-s] [-p]“
http://www.honeywellsms.com This font is used to identify a URL, directing
Emphasised text is used to:
• emphasise important words in the text,
• identify document titles.
This font is used to identify labels and titles of (popup) windows.
Labels are used for Dialog box labels, menu items, names of properties, and so on.
This font is used to identify steps.
Steps indicate the course of action that must be adhered to, to achieve a certain goal.
This font is used to:
1. identify a user variable, a filename, an object or view.
2. highlight the keys the user should press on the keyboard.
User variable is a variable, an object or a view that the reader can call-up to view or to manipulate.
This font is used to indicate a value.
Value is a variable that the reader must resolve by choosing a pre-defined state.
This font is used to identify a variable.
Variables are used in syntax and code examples.
a reader to a website that can be referred to.
iv
Contents
1The Safety Manual 1
Content of Safety Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Basic skills and knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Prerequisite skills. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Safety standards for Process & Equipment Under Control (PUC, EUC) . . . . . . . . . . . . . . . . . . . 4
Safety Integrity level (SIL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Application design conform IEC 61131-3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
The IEC 61508 and IEC 61511 standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2 Architectural principle and standards of Safety Manager 9
Safety Manager basic architectures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Dual Modular Redundant (DMR) architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Quadruple Modular Redundant (QMR) architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Watchdog architecture in mixed IO configurations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Certification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Standards compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3 Safety Manager fault detection and response 19
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Diagnostic Test Interval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
FR state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Repair timer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Shutdown at assertion of Safety Manager alarm markers . . . . . . . . . . . . . . . . . . . . . . . . 21
SM Controller faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
QPP faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
BKM faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
PSU faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Communication faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
SM IO faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Digital input faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Analog input faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Digital output faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Analog output faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Calculation errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Safety Manager Safety Manual v
Contents
4 Safety Manager special functions 37
Unit shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Process units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Configuration of unit shutdown (watchdog grouping) . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Unit shutdown outputs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Process outputs (safety related). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Application programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
On-line modification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
SafeNet communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Protocol versus response time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
5 Special requirements for TUV-approved applications 47
General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
F&G applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
vi Release 131, Issue 4

The Safety Manual

Content of Safety Manual
The Safety Manual is a reference guide providing detailed information regarding safety aspects in Safety Manager.
A reference guide is a Safety Manager related guide and does not describe tasks in terms of how to perform the task in terms of steps to follow. A reference guide can provide input to support decisions required to achieve a certain objective.
Guide subjects
Safety Manual
• “Architectural principle and standards of Safety Manager” on page 9
• “Safety Manager fault detection and response” on page 19
• “Safety Manager special functions” on page 37
• “Special requirements for TUV-approved applications” on page 47
1
Safety Manager Safety Manual 1
1 – The Safety Manual

References

The following guides may be required as reference materials:
Guide Description
The Overview Guide This guide describes the general knowledge required, the
The Planning and Design
Guide
The Installation and Upgrade Guide
The Troubleshooting and Maintenance Guide
The System Administration Guide
The On-line Modification Guide
The Hardware Reference This guide specifies the hardware components that build a
The Software Reference This guide specifies the software functions that build a
basic functions of, and the tasks related to Safety Manager.
This guide describes the tasks related to planning and designing a Safety Manager project.
This guide describes the tasks related to installing, replacing and upgrading hardware and software as part of a Safety Manager project.
This guide describes the tasks related to troubleshooting and maintaining Safety Manager.
This guide describes the task related to administrating the computer systems used in a Safety Manager project.
This guide describes the theory, steps and tasks related to upgrading Safety Builder and embedded software and modifying an application online in a redundant Safety Manager.
Safety Manager project.
Safety Manager project and contains guidelines on how to operate them.
2 Release 131, Issue 4

Basic skills and knowledge

Before performing tasks related to Safety Manager you need to:
• Understand basic Safety Manager concepts as explained in the Overview Guide and the Glossary.
• Have a thorough understanding of the Safety Manual.
• Have had appropriate training related to Safety Manager that certifies you for your tasks (see the Planning and Design Guide).

Prerequisite skills

When you perform tasks related to Safety Manager, it is assumed that you have appropriate knowledge of:
• Site procedures
• The hardware and software you are working with. These may i.e. be: computers, printers, network components, Controller and Station software.
• Microsoft Windows operating systems.
• Programmable logic controllers (PLCs).
• Applicable safety standards for Process & Equipment Under Control.
• Application design conform IEC 61131-3.
• The IEC 61508 and IEC 61511 standards.
This guide assumes that you have a basic familiarity with the process(es) connected to the equipment under control and that you have a complete understanding of the hazard and risk analysis.
Basic skills and knowledge

Training

Most of the skills mentioned above can be achieved by appropriate training. For more information, contact your Honeywell SMS representative or see:
• http://www.automationcollege.com.
Safety Manager Safety Manual 3
1 – The Safety Manual

Safety standards for Process & Equipment Under Control (PUC, EUC)

Safety Integrity level (SIL)

The IEC 61508 standard specifies 4 levels of safety performance for safety functions. These are called safety integrity levels. Safety integrity level 1 (SIL1) is the lowest level of safety integrity, and safety integrity level 4 (SIL4) the highest level. If the level is below SIL1, the IEC 61508 and IEC 61511 do not apply.
Safety Manager can be used for processing multiple SIFs simultaneously demanding a SIL1 up to and including SIL3.
To achieve the required safety integrity level for the E/E/PE safety-related systems, an overall safety life cycle is adopted as the technical framework (as defined in IEC 61508).

Application design conform IEC 61131-3

The IEC 61131 standard defines, as a minimum set, the basic programming elements, syntactic and semantic rules for the most commonly used programming languages, including graphical languages of:
• Ladder Diagram,
• Functional Block Diagram and,
• Textual languages of Instruction List and structured Text;
For more information see the IEC web site.
Figure 1 on page 5 shows how Safety Manager uses the graphical programming method, based on Functional Block Diagram as defined by the IEC 61131-3.
4 Release 131, Issue 4
Safety standards for Process & Equipment Under Control (PUC, EUC)
Figure 1 Example FLD layout

The IEC 61508 and IEC 61511 standards

SISs have been used for many years to perform safety instrumented functions e.g. in chemical, petrochemical and gas plants. In order for instrumentation to be effectively used for safety instrumented functions, it is essential that the instrumentation meets certain minimum standards and performance levels.
To define the characteristics, main concepts and required performance levels, standards IEC 61508 and IEC 61511 have been developed. The introduction of Safety Integrity level (SIL) is one of the results of these standards.
This brief provides a short explanation of each standard. Detailed information regarding IEC 61508 and 61511 can be found on the IEC web site http://www.iec.org.
What standard to use?
Tip:
You can use the IEC 61508 as stand-alone standard for those sectors where a sector specific standard does not exist.
Safety Manager Safety Manual 5
1 – The Safety Manual
• If you are in the process sector and you are an owner/user, it is strongly recommended that you pay attention to the IEC 61511 (ANSI/ISA 84.00.01). For details see “IEC 61511, the standard for the process industry” on page 7.
• If you are in the process sector and you are a manufacturer, it is strongly recommended that you pay attention to the IEC 61508. For details see “IEC 61508, the standard for all E/E/PE safety-related systems” on page 6.
• If you are in another sector, it is strongly recommended that you look for, and use, your sector specific IEC standard for functional safety (if there is one). If none exists, you can use the IEC 61508 instead. For details see “IEC 61508, the standard for all E/E/PE safety-related systems” on page 6
IEC 61508 and IEC 61511 terminology
This guide contains both IEC 61508 and IEC 61511 related terminology.
As the IEC 61511 sits within the framework of IEC 61508 most of the terminology used may be interchanged. Table 1 on page 6 provides an overview of the most common interchangeable terminology.
IEC 61508 terminology IEC 61511 terminology
safety function safety instrumented function
electrical/electronic/programmable electronic (E/E/PE) safety-related system
Tab le 1 IEC 61508 versus IEC 61511 terminology
safety instrumented system (SIS)
IEC 61508, the standard for all E/E/PE safety-related systems
The IEC 61508 is called “Functional safety of electrical/electronic/programmable electronic safety-related systems”
IEC 61508 covers all safety-related systems that are electrotechnical in nature (i.e. electromechanical systems, solid-state electronic systems and computer-based systems).
Generic standard
The standard is generic and is intended to provide guidance on how to develop E/E/PE safety related devices as used in Safety Instrumented Systems (SIS).
The IEC 61508:
• serves as a basis for the development of sector standards (e.g. for the machinery sector, the process sector, the nuclear sector, etc.).
• can serve as stand-alone standard for those sectors where a sector specific standard does not exist.
6 Release 131, Issue 4
Safety standards for Process & Equipment Under Control (PUC, EUC)
SIL
IEC 61508 details the design requirements for achieving the required Safety Integrity Level (SIL).
The safety integrity requirements for each individual safety function may differ. The safety function and SIL requirements are derived from the hazard analysis and the risk assessment.
The higher the level of adapted safety integrity, the lower the likelihood of dangerous failure of the SIS.
This standard also addresses the safety-related sensors and final elements regardless of the technology used.
IEC 61511, the standard for the process industry
The IEC 61511 is called “Functional safety - Safety instrumented systems for the process industry sector”. It is also referred to as the ANSI/ISA 84.00.01.
This standard addresses the application of SISs for the process industries. It requires a process hazard and risk assessment to be carried out, to enable the specification for SISs to be derived. In this standard a SIS includes all components and subsystems necessary to carry out the safety instrumented function from sensor(s) to final element(s).
The standard is intended to lead to a high level of consistency in underlying principles, terminology and information within the process industries. This should have both safety and economic benefits.
The IEC 61511 sits within the framework of IEC 61508.
Need to know more?
For more information regarding, or help on, implementing or determining, the applied safety standards for your plant/process please contact your Honeywell affiliate. Our Safety Consultants can help you to e.g.:
• perform a hazard risk analysis
• determine the SIL requirements
• design the Safety Instrumented System
• validate and verify the design
• train your local safety staff
Safety Manager Safety Manual 7
1 – The Safety Manual
8 Release 131, Issue 4

Architectural principle and standards of Safety Manager

Safety Manager basic architectures
Safety Manager can be configured for a number of architectures, each with its own characteristics and typical Safety Instrumented Functions. Table 2 on page 9 provides an overview of the available architectures.
Tab le 2 Safety Manager architectures
Controller configuration
Non-redundant (DMR)
Redundant (QMR)
IO configuration Remarks
Non-redundant DMR architecture;
• Non-redundant
• Redundant
• Redundant and non-redundant
2
Supports SIF for SIL1, SIL2 and SIL3 applications.
QMR architecture; Supports SIF for SIL1, SIL2 and SIL3 applications.

Dual Modular Redundant (DMR) architecture

Typical applications of a DMR architecture are:
• Burner Management System
• Batch processing
• Machine protection
The Dual Modular Redundant (DMR) architecture provides 1oo2 voting in a non-redundant system. The DMR architecture with 1oo2 voting is based on dual-processor technology, and is characterized by a high level of self tests, diagnostics and fault tolerance.
Safety Manager Safety Manual 9
2 – Architectural principle and standards of Safety Manager
Processor
Processor
Watchdog
QPP Control Processor
SD
Input Interfaces Output Interfaces
Input
Module
Sensor
xx
yyy
Final Element
SMOD
Output
Module
The DMR architecture is realized with a non-redundant Controller. A non-redundant architecture contains only one QPP (see Figure 2 on page 10), which contains a redundant processor with 1oo2 voting between the processors and memory.
Figure 2 Functional diagram: DMR architecture
In IO configurations, each path is primarily controlled by the Control Processor and an independent switch (Secondary Means of De-energization, SMOD) which is controlled by an independent watchdog.

Quadruple Modular Redundant (QMR) architecture

Typical applications of a QMR architecture are:
• process safeguarding applications for which continues operation is essential.
The Quadruple Modular Redundant (QMR) architecture is based on 2oo4D voting, dual-processor technology in each QPP. This means that it is characterized by a ultimate level of self diagnostics and fault tolerance.
The QMR architecture is realized with a redundant Controller. This redundant architecture contains two QPPs (see Figure 3 on page 11), which results in quadruple redundancy making it dual fault tolerant for safety.
The 2oo4D voting is realized by combining 1oo2 voting of both CPUs and memory in each QPP, and 1oo2D voting between the two QPPs. Voting takes place on two levels: on a module level and between the QPPs.
10 Release 131, Issue 4
Figure 3 Functional diagram: QMR architecture
Input
Module
Input
Module
Processor
Processor
Watchdog
QPP Control Processor 1
QPP Control Processor 2
SD
Input Interfaces
SMOD
Output Module
Final Element
Output Interfaces
SMOD
Output Module
Quad
Vot er
Processor
Processor
Watchdog
Sensor
xx
yyy
In redundant IO configurations, each path is controlled by one of the Control Processors and an independent switch (Secondary Means of De-energization, SMOD), which is controlled by the diagnostic software and an independent watchdog.
Furthermore, each Control Processor is able to switch off the output channels of the other Control Processor.

Watchdog architecture in mixed IO configurations

In a system with combined redundant and non redundant IO 3 watchdog lines are active:
• WD1 This is the Watchdog line dedicated for Control Processor 1.
- De-energizes upon a safety related fault in Control Processor 1 or an
output module of Control Processor 1.
- When de-energized, Control Processor 1 and the related outputs are halted.
•WD2 This is the Watchdog line dedicated for Control Processor 2.
Safety Manager Safety Manual 11
2 – Architectural principle and standards of Safety Manager
Input
Module
Input
Module
Processor
Processor
Watchdog
QPP Control Processor 1
QPP Control Processor 2
SD
Input Interfaces
SMOD
Output
Module
Final Element
Output Interfaces
SMOD
Output Module
Quad
Vote r
Processor
Processor
Watchdog
Input
Module
Final Element
SMOD
Output
Module
Sensor
xx
yyy
Sensor
xx
yyy
- De-energizes upon a safety related fault in Control Processor 2 or an output module of Control Processor 2.
- When de-energized, Control Processor 2 and the related outputs are halted.
• WD3 This is the combined watchdog line, controlled by both Control Processors.
- De-energizes upon a safety related fault in a non redundant output.
- When de-energized, the non-redundant outputs are de-energized, but the
redundant outputs and the Control Processors remain operational.
Figure 4 Functional diagram: redundant Controller with redundant and non-redundant IO
12 Release 131, Issue 4
Loading...
+ 42 hidden pages
Buy Points How it Works FAQ Contact Us Questions and Suggestions Privacy Policy Cookie Policy Terms of Use