Rockwell Automation AADvance Controller Solutions Handbook - Manual (Page 68)

 

3-4 Document: 553631
(ICSTT-RM447J_EN_P) Issue: 09:
Solutions Handbook (AADvance Controller)
Adding a 2nd Processor for a Higher SIL Rating Configuration
A single processor module is rated SIL2, while two or three in a redundant
arrangement are rated SIL3. Returning to the first example and adding a second
processor module creates a controller suitable for high as well as low demand mode
applications at SIL3.
The T9401/2 digital input module (identical to the module for the SIL2 controller) is
rated SIL3 as it stands. The only constraint is that the simplex output stage will not
drive anenergize to action output for SIL3 - this requires a dual arrangement of output
modules. This output configuration is suitable for a de-energize to action output at
SIL3.
The second processor module provides the increased fault tolerance and gives the
configuration its SIL3 rating. If either processor module should fail, the controller
retains its SIL3 integrity but the module must be replaced within the MTTR.
This controller suits many applications needing a mixture of SIL3 de-energize to action
and SIL2 outputs which do not need the additional fault tolerance offered by dual and
triple modular redundant configurations. The possibilities for expansion are identical to
those for the SIL2 controller.