GE 8724-CA-PS Intrinsically Safe module power supply carrier
Fault Tolerant RedundantLAN
The availability of Ethernet connections -
between SafetyNet and standard Controllers,
historian and asset management packages
and HMI stations - has a significant impact
on the effectiveness and availability of both
safety and control functions.
To maximise availability of the Ethernet LAN,
MOST SafetyNet Systems feature Fault
Tolerant Ethernet ports that monitor the
integrity of their local network and
automatically switch to an alternate path if
the existing path becomes unavailable. If
suitable Ethernet switches are used - such as
Moxa Industrial Ethernet Switches - they too
will monitor their local network and switch to
an alternative path when this is required.
Monitoring the local network paths - even
when they are not being used - allows the
system to report the loss of any failed paths
so that appropriate maintenance can be
carried out.
Moxa Industrial Ethernet
Switches
The Moxa Ethernet Switch range is
specifically designed for use in Industrial
applications that require high availability in
harsh environments, with a broad operating
temperature range (-40ºC to +75ºC, except
EDS-205: -10ºC to +60ºC) and hazardous
area mounting capability (Class 1, Div 2 or
Zone 2).
Two alternative topologies are shown in
figures 1 and 2. Which topology is preferred
will depend on the physical layout of the
entities on the LAN and local preferences.
Figure 1 shows a redundant Ethernet LAN,
with intra-LAN link whilst figure 2 shows a
single "Turbo Ring" that provides an alternate
means of ensuring Ethernet availability -
implemented in the Moxa EDS405 5-port
switch. If any part of the Turbo Ring fails,
communication is re-routed automatically
within 300ms. Further improvements to
availability can be achieved by putting in
place a second identical, "Turbo Ring" which
should be connected to the first ring by a
single intra-LAN link. This link would
normally be mounted in the control room.
The Moxa switches are available with either
all copper or a combination of copper and
fibre ports. For media conversion between
fibre and copper the MOXA IMC-101 can
be used. All the Moxa products (except the
EDS-205) have dual power supply inputs
and a relay output for user configurable
fault reporting.

Certification
The SafetyNet Controller is certified for use
in safety-related applications up to and
including SIL 2. The SafetyNet Controller
achieves this Safety Integrity Level with a
1oo1D architecture (i.e. it operates in
"simplex" mode, with correct operation
ensured by comprehensive internal
diagnostics). In such applications the
SafetyNet Controller is used in conjunction
with the 8811-IO-DC SafetyNet Digital
Input/Output Module and the 8810-HI-TX
SafetyNet Analog Input Module with HART*.
The SafetyNet Controller is mounted on its
dedicated Carrier 8751-CA-NS.
*First release of SafetyNet will not have full
HART capability.
Safe by design
The SafetyNet Controller has been designed
specifically for safety-related applications
and is certified on the basis of the excellence
of its design. It does not depend for its
certification on "proven in use" data.
Diagnostics
If the SafetyNet Controller's internal
diagnostics detect a fault that would prevent
the SafetyNet System from carrying out its
safety function, then it will initiate a
controlled shutdown. A controlled shutdown
has two objectives - firstly, to ensure that the
SafetyNet System enters its failsafe mode;
and secondly, to record sufficient data to
allow the reason for the shutdown to be
determined.
If a SafetyNet Controller enters a controlled
shutdown, then all communication with IO
Modules is stopped and - when the
programmed time delay for each IO module
has elapsed - they will enter their safe states.
System size
The SafetyNet Controller can interface with
up to 64 locally mounted, 8-channel IO
Modules - giving a total capacity of over 500
channels per node. The Ethernet LAN is
capable of supporting over 200 nodes,
giving a maximum theoretical capacity of
over 100 000 channels!
HART pass-through
SafetyNet Controllers can be configured to
allow transparent access to the process
variables and status information provided by
HART field instruments. HART data cannot
be used within the SafetyNet application (as
- for example - it does not employ
sufficiently rigorous data error detection
algorithms), but communication with such
devices can be achieved by using a "passthrough" command which does not involve,
nor interfere with, the safety application.
(The first release of SafetyNet will not have
full HART capability, contact MTL for further
information).