Certified Configurations - Allen-Bradley AADvance T9110 Safety Manual

Chapter 3 AADvance System Architectures

Certified Configurations

54
Table 10 - Modules for TMR Input and Processor, Fault Tolerant Output
Position Module Type
I/P A 3 × T9401/2 Digital Input Module, 24V dc, 8/16 Channel
+ T9803 Digital Input TA, 16 Channel, TMR
or
3 × T9431/2 Analogue Input Module, 8/16 Channel
+ T9833 Analogue Input TA, 16 Channel, TMR
2 × T9300 I/O Base Unit
CPU A & CPU B 3 × T9110 Processor Module, T9100 Processor Base Unit,
O/P A 2 × T9451 Digital Output Module, 24V dc, 8 Channel
+ 9852 Digital Output TA, 24V dc 8 Channel, Dual
or
2 x T9481/T9842 Analogue Output Module, 3/8 Ch, Isolated
+ T9882 Analogue Output TA, 8 Ch, Dual
NOTE All configurations that use dual or triplicate processor modules are suitable
for SIL 3 architectures with de-energize to trip outputs. Dual outputs are also
required for SIL 3 energize to action outputs.
Table 11 - Central Modules
Modules Certified
Configuration
Processor Module 1oo1D, 1oo2D, 2oo3D
T9110
Table 12 - Input Modules
Modules Certified
Configuration
Digital Inputs 1oo1D, 1oo2D, 2oo3D
T9401/2, 24V dc, 8/
16 Channel,
isolated.
+
T9801/2/3 Digital
Input TA, 16
channel, Simplex/
Dual/TMR
Analogue Inputs 1oo1D, 1oo2D, 2oo3D
T9431/2, 8/16
Channel, isolated
+
T9831/2/3
Analogue Input TA,
16 Channel,
Simplex/Dual/TMR
Rockwell Automation Publication ICSTT-RM446N-EN-P - April 2018
Conditions
Safety-related and can be used for safety-critical applications in
SIL 2 with 1 module fitted and SIL 3 applications with 2 or 3
modules fitted.
Note: For High Demand applications you must use a minimum of
two processors.
Conditions
De-energized to action (normally energized): SIL 3 with 1, 2 or 3
modules fitted.
Energize to action (normally de-energized): with 1, 2 or 3 modules
fitted
Note: when the integrity level is at 1oo1D then the faulty module
must be replaced to restore the integrity level back to 1oo2D.
Within the manufactures specified safety accuracy limits of 0.2mA.
The safety state of the analogue input has to be set to a safe value
which is a calculated value based on a count value of 0mA. (refer to
the AADvance Configuration Guide(s) Publication Nos:
ICSTT-RM405-EN-P & ICSTT-RM458-EN-P
SIL 3 with 1, 2 or 3 modules fitted.
Note: when the integrity level is at 1oo1D then the faulty module
must be replaced within the MTTR assumed for the PFD
calculations to restore the integrity level back to 1oo2D.
for more details)