Rockwell Automation T8094 8000 Series TMR System Safety Manual - Manual (Page 69)

SAFETY MANUAL
D oc N umber T8094
I ssue 27 – June 2013
Page 48 of 103
The existing application program must be archived before any changes to the
application are carried out.
Where it is necessary to perform on-line modifications, caution shall be taken to
ensure that unsafe responses are not generated. Particular consideration shall be
given to the effects during the transition between the existing and the new programs
and configurations. This is particularly important where a number of interacting
systems provide the required safety functions.
Before any revised application program is downloaded to an on-line system:
• All changes shall be tested using the application simulator
• The cross-reference checkers (see para. 3.11.6.1) shall be used and programs
using data from modified programs shall be re-tested.
• The source code compare utility (see para. 3.11.6.2) shall be used; any
programs identified as having other than compiled variable addresses shall
be re-tested.
Once testing has been successfully completed, the application program may be
downloaded to the TMR Processor.
The download and application update may
only be performed with the TMR Processor keyswitch in the ‘Maintain’ position.
3.12.2 System Configuration
All modifications to the system configuration (system.ini file) shall be subject to the
same considerations as specified earlier in this Manual. The configuration file may be
up- or downloaded to the system when the TMR Processor keyswitch is in the Maintain
position. High Density I/O configuration changes then require that the application
program be stopped and re-started to bring the changes on-line.
Modification to the system configuration normally entails the addition or deletion of
input and output points. If these points previously did not exist within the application
program, it will be necessary to take the system off-line to perform the changes.
Basic system parameters, including the number of chassis, chassis mapping,
communications settings etc., require that the TMR Processor be removed and re-
installed, or the power cycled to the controller chassis to implement the configuration
changes.
The existing system configuration (system.ini) must be archived before any changes to
the system configuration are carried out.
Where changes to the system configuration are anticipated it is necessary to include
the “spare” module positions and chassis within the existing system.ini file.
3.13 ENVIRONMENTAL REQUIREMENTS
The system installation environment presents a potential source of common cause
failure.
It is necessary to ensure that the equipment is suitable for the intended
environment. Alternatively, methods of maintaining the equipment’s
environmental conditions within its capabilities should be provided. This is
applicable to all systems; the remainder of this section however gives the
specific environmental recommendations for a TMR system.
3.13.1 Climatic Conditions
The recommended and maximum climatic conditions for the equipment are shown in
the Table 9. These conditions apply for representative and typical system
configurations. Where high equipment densities are accommodated within a system
or large quantities of high-power equipment are closely packed, it is necessary to