1oo2D voting 3

[ward267]

What does the "D" in 1oo2D refer to ? When is it appriate to attach a "D" to the voting description for two analog inputs to a PLC used as a logic solver in an SIS.

 

[xnuke]

D refers to diagnostic capabilities. 1oo2D means that only a single input out of two needs to be satisfied to execute the safety action(s), and each channel of input runs self-tests on its electronics regularly to verify correct operation.

xnuke

Please see FAQ731-376 for tips on how to make the best use of Eng-Tips.

 

[jwilsonimp]

You can read the next document, remember this is a vendor document describing their system

http://www.honeywell.com.pl/pdf/automatyka_przemyslowa/sterowanie/Fsc2004d.pdf

jwilsonimp

 

[riskfree]

The terminology XooY (read X out of Y) refers to the voting and redundancy capacity of a safety system. A safety system carries out a safety function. The Y refers to how many times the safety system carries out the safety function, it refers to the redundancy within the safety system. For example if the pressure in a tank is measured by three sensors then the safety system would be triple redundant.

The X refers to the voting that is applied. For example, the safety system might decide that the pressure exceeds the pressure limit if two pressure sensors (out of the three) reach this limit. Hence the safety system would be classified as 2oo3. If only one pressure sensor needs to exceed the pressure limit then the safety system would be classified as 1oo3.

Thus, the Y refers to how many times the safety functions is carried out. The X refers to how many different paths actually need to be working correctly.

Concerning the D in 1oo1D or 1oo2D this refers to the use of diagnostics as an independent shutdown path. A 1oo1D system basically has two outputs that can be used to independently shutdown the process.

There are a few different definitions going around in the industry. Some say it the D of Diagnostics, others say its the D of degraded mode. Of course both are a litte bit true as you need a lot of Diagnostics capabilities in order to be able to go into degraded mode.

But just a system with a lot of diagnostics does not get the D behind it. You actually need to do and be able to do something with that diagnostic information. This can only be achieved with an indepedent path.

Risknowlogy
info@risknowlogy.com

http://www.risknowlogy.com

http://shop.risknology.com

for software tools, industry reports, books on risk, reliability & safety

 

[snafu51]

Every redundant technology PLC that I know of has "D" diagnostics built in. In 1oo2D systems if there is a disagreement how do you determine which one is bad? In 2oo3D systems you have a better chance of determining which channel/input is bad.