Requirements For Using 1715 I/O Modules; Energize-To-Action Requirements - Rockwell Automation Allen-Bradley 1715-AENTR User Manual

Requirements for Using 1715
I/O Modules
You must follow these requirements when using 1715 I/O modules in a SIL 2
application.
IMPORTANT • In safety applications, channel discrepancy alarms must be
• Equipment must be installed and wired in accordance with the
• For energize-to-action systems, you must follow the additional
The maximum duration for single-channel operation of I/O modules depends
on the specific process and must be specified individually for each application.
For high availability, Rockwell Automation suggests you use two 1715-AENTR
adapters. If one of the modules faults, the adapters can operate in a simplex
arrangement up to the duration of the mean time to repair (MTTR) when used
in SIL 2 applications.

Energize-to-action Requirements

Certain applications can require energize-to-action for inputs or outputs or
both.
IMPORTANT Energize-to-action configurations can be used only if the
following apply:
• At least two independent power sources must be used for both
• Each power source must feature power integrity monitoring with
• Unless provided implicitly in the I/O modules, all safety-critical
• The application program must be designed to shut down
• For SIL 2 high demand, energize-to-action applications, you must
In cases where one or more outputs is used in an energize-to-
action configuration, all specific requirements that are listed
previously must be implemented for all associated inputs.
IMPORTANT SIL 1 applications must use the wiring and measures that are
defined for SIL 2 applications. Energize-to-action requires line
monitoring for any SIL application.
Rockwell Automation Publication 1715-UM001J-EN-P - December 2020
Chapter 7 1715 Redundant I/O System in SIL 2 Safety Applications
monitored by the application program and used to provide an
alarm to operations personnel.
product installation and wiring instructions in this manual.
requirements on page 207.
the system and field supplies. The system provides the power
supply monitoring, but this needs to be connected in the
application. These power sources must provide emergency power
for a safe process shutdown or a time span that is required by the
application.
safety-critical input read-back into the system controller or
implicit power monitoring that is provided by the I/O modules.
Any power failure must trigger an alarm.
inputs and outputs must be fitted with external line and load
integrity monitoring and safety-critical read-back of the line-
status signals. Any line or load failure must trigger an alarm.
energize-to-action SIL 2 safety instrumented functions if a faulty
simplex adapter or output module has not been replaced within
the mean time to repair (MTTR).
use two output modules.
207