Report on certificate - Tuv-fs.com

More documents

Recommendations

Info

SystemSystem responsein the event offailure of fail-safeinput modules(Note 3)System responsein the event offailure of fail-safeoutput modules(Note 3)single CP -single I/O(DMR, 1oo2 voting)Defective digital inputsare read as “0 signal”and in the case ofanalog inputs, theconfigured minimumlimit is used."System shutdown,process group shutdownor alarm” shall beprogrammed.Depending on thelocality of the fault, thesystem responds asfollows: Group shutdown ofthe channelconcerned withcontinued operationfor a period of timedefined by themanufacturers PFDcalculation for aspecific system of thechannel concerned or System shutdownredundant CP -single I/O(QMR, 2oo4D voting)Defective digital inputsare read as “0 signal”and in the case ofanalog inputs, theconfigured minimumlimit is used."System shutdown,process group shutdownor alarm” shall beprogrammed.Depending on thelocality of the fault, thesystem responds asfollows: Group shutdown ofthe channelconcerned withcontinued operationfor a period of timedefined by themanufacturers PFDcalculation for aspecific system or System shutdownredundant CP -redundant I/O(QMR, 2oo4D voting)The input signalsrecognized as defective(set to "0" for digitalinputs and minimumlimit for analog inputs )are overwritten by thecorrect input signalsfrom the other centralpart and an alarm isgenerated."System shutdown,process group shutdownor alarm” shall beprogrammed.Depending on thelocality of the fault, thesystem responds asfollows: Group shutdown ofthe channelconcerned withcontinued operationfor a period of timedefined by themanufacturers PFDcalculation for aspecific system or Shutdown of theaffected central partContinued operation forunlimited period of timeusing intact central partTable 4: Quad processor module 10020/1/1 and 10020/1/2 (dual processor)Note 1: Faults in redundant central parts, which are detected and localised by self-tests result insingle-central part operation with an unlimited time period. The mode of operation; singleor redundant does not influence the coverage of self-tests. The self-test interval is notextended for single-central part operation. The self-test interval shall be less than thefault tolerance period of the process (PST).Note 2: Multiple VBD Bus systems may be used for expansion and I/O segregation.Note 3: For detailed Information see the current version of the FSC Safety ManualCentral processing unit 10002/1/2 and 10012/1/2 (single processor):TÜV SÜD Rail GmbH 717506225Generic Safety Systems HH84623C_Rev1.0.docx / Rev. 1.0Barthstraße 16 • D-80339 Munich • GermanyAuthor: Martin BraunPhone: +49 (89) 5190 -2899, Fax: -2933 05.02.2013E-Mail: martin.braun@tuev-sued.de Page 14 of 33
SystemSafety IntegrityLevelNumber of centralpartsMinimum numberof Bus Systems(Note 6)(VBD 10001/x/1)System responsein the event oflocalisable faults,i.e. internal faultconditionsattributable to acentral part(Note 5)System responsein the event of I/Ocomparison errors(non-localisable)Input comparisonsingle CP -single I/O (1oo1D)redundant CP -single I/O (1oo2D)SIL 1 - 3 SIL 1 - 2 SIL 1 - 31 2 21 1 2System shutdownredundant CP -redundant I/O (1oo2D)SIL 1 - 2:Shutdown of defective central part and continuedoperation for unlimited period using intact centralpart.SIL 3:Possible system response: Shutdown of defective central part and singlechanneloperation for a period of time defined bythe manufacturers PFD calculation for a specificsystem.(Note 4)System shutdown can be programmed bymeans of user program.In the event of input signals recognised asinconsistent by comparison, the system switchesto the safe condition of the affected input andindicates this by a system flag.The fault response "System shutdown, processgroup shutdown or alarm” shall be programmed.Or if the process is continuously monitored by anoperatorAND the process safety time is sufficiently long toinsure manual shutdownAND the operator has sufficient means to monitor andshutdown the process independent of the FSCsystemAND the fault is annunciated by fail-safe meansmanual reaction and shutdown is permissible.TÜV SÜD Rail GmbH 717506225Generic Safety Systems HH84623C_Rev1.0.docx / Rev. 1.0Barthstraße 16 • D-80339 Munich • GermanyAuthor: Martin BraunPhone: +49 (89) 5190 -2899, Fax: -2933 05.02.2013E-Mail: martin.braun@tuev-sued.de Page 15 of 33
Page 3 and 4: 5.1 Planning; Non-Product-Related C
Page 5 and 6: 2 System overview2.1 DescriptionThe
Page 8 and 9: The Quadruple Modular Redundant (QM
Page 12 and 13: 2.1.5 Mechanical and electrical par
Page 16 and 17: SystemSystem responsein the event o
Page 18 and 19: The calculated maximum duration for
Page 20 and 21: 2.6 CommunicationThe certified vers
Page 22 and 23: 2.6.4 Access to the FSC safety syst
Page 24 and 25: 3 Certification Requirements3.1 Bas
Page 26 and 27: 4 Results4.1 Functional SafetyThe t
Page 28 and 29: 4.2 Basic Safety and Electromagneti
Page 30 and 31: 5.1.9. The conditions of use specif
Page 32 and 33: 5.8 Fire Detection and Alarm Instal

Report on certificate - Tuv-fs.com

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?