Safety I/O Replacement

Automatic configuration enables the safety controller to establish a connection with replacement safety I/O without online user interaction. Automatic configuration is enabled when there is no controller safety signature. Allowing automatic configuration with no safety signature facilitates commissioning and maintenance activities when the safety controller is not being used for SIL-rated functions. Following I/O replacement, you must validate proper operation before using SIL-rated functions.
Two options for I/O device replacement are available on the Safety tab of the Device properties of the Safety Controller Profile.
  • Only Allow When No Signature Exists: Select this option if you rely on a portion of the
    CIP Safety™
    system to maintain SIL 2 or SIL 3 behavior during device replacement and functional testing.
  • Always Allow: Select this option if you do not rely on the entire routable
    CIP Safety™
    system to maintain SIL 2 or SIL 3 behavior during device replacement and functional testing.
If you choose an automatic configuration setting, you must understand the safety network topology and the intended use of the safety system during I/O replacement.

Only Allow When No Signature Exists

This option instructs the safety controller to configure a safety device when the safety task does not have a safety signature, and the replacement device is in an out-of-box condition with no safety network number.
Use case scenarios include:
  • Multizone safety system where I/O replacement is required in one zone, while other zones maintain SIL functionality.
  • Multiple controllers with safety I/O on the same routable network.
If the controller has a safety signature, the safety controller automatically configures the replacement safety I/O device if the following are true:
  • The device already has the correct safety network number.
  • The device electronic keying is correct.
  • The node or IP address is correct.
To set the proper safety network number (SNN) when a controller safety signature exists, manual action is required to download the proper SNN.
  1. Go online with the safety controller.
  2. Open the Device properties.
  3. On the General tab, click Browse (…) next to the safety network number.
  4. Click Set to write the SNN to the module manually.
  5. Verify that the Network Status (NS) indicator is alternating red/green on the correct device.
  6. Click Yes on the confirmation dialog box to set the SNN and accept the replacement device.
Follow your company-prescribed procedures to test the functionality of the replacement I/O device and system.
For more information, follow the safety I/O device replacement procedure in the controller user manual.

Always Allow

The controller attempts to configure a replacement safety I/O device automatically if the device is in an out-of-box condition. When a safety network number does not exist in the replacement safety device, the node number and I/O device keying match the configuration of the controller.
Use case scenarios include:
  • The safety system provides no safety function during I/O replacement:
    • Use of energy isolation or other application-specific procedure
    • Other application-specific safeguards are in place
  • The network for safety I/O communication is isolated from external safety devices.
ATTENTION:
Select the Always Allow option only if the entire routable safety control system is not being relied on to maintain SIL 2 or SIL 3 behavior during the replacement and functional testing of a device. The routable safety control system includes any device that can have safety connections on it that the controller can open.
If other parts of the safety control system are being relied upon to maintain SIL 2 or SIL 3, make sure that the Always Allow Automatic Configuration option is not selected.
It is your responsibility to implement a process to make sure that proper safety functionality is maintained during device replacement.
ATTENTION: To place a device in the out-of-box condition on a safety network when the Always Allow Automatic Configuration option is selected, follow the device replacement procedure in the controller user manual.
Provide Feedback
Have questions or feedback about this documentation? Please submit your feedback here.
Normal