Implementing Indirect Monitoring for Category 2

To reach category 2 requirements for diagnostic coverage (DC>60%), external monitoring of the group status should be implemented to trigger a secondary mechanism to stop the machine (breaker shunt trip, etc.) or to prevent access to dangerous areas (guard lock).

Each SILSafety Integrity Level according to standard IEC 61508.* group has five states associated with it to indicate the operational state. State 0 indicates there is not a SIL group present in this slot. TeSys island supports up to 10 SIL groups in the island.

SIL group status for SIL Stop function:

• 0 = SIL group not present in system configuration

• 1 = SIL group impacted by avatar Device Event

• 2 = Stop Command received, SIL starters not open yet

• 3 = Stop Command successfully issued, all SIL starters are open

• 4 = Stop Command issued to only one SIL interface module (SIM) input channel (jumper or SIM input wiring is causing an issue), but SIL starters did successfully open

• 5 = Normal operation, SIL starters can be open or closed

State 5 is the normal run state, and State 3 is the normal SIL Stop state. State 1 indicates a firmware or communication issue with a SIL starter. States 2 and 4 indicate SIL Stop related problems with the SIM, SIL Starters or SIL Stop wiring. Indirect monitoring should look for states 2 or 4 to persist for longer than the actuation time of a SIL Stop and use the status information to trigger a secondary mechanism to stop the machine (breaker shunt trip, etc.).

To read the SIL group status, the external monitoring must use the SystemDiagnostics function block. Each SIL group in the system has an output on this function block for its SIL group status, labeled on the function block as “SILStarterStopMsgGrp n,” where n is the SIL group number in the island. The SIL group status follows the enumeration shown above.