DeltaV SIS supports redundant CSLSs. A redundant CSLS consists of a pair of CSLSs mounted on a single CSLS Carrier. Each CSLS gets its power from each of the CSLS Carrier Power connections. The CSLSs contain the same configuration, run the safety logic in lock-step and read and write I/O. The CSLS that is active (as indicated by the Active LED) communicates with the SISCTLR on the LSN.
If a CSLS detects a problem, it initiates a reset of itself. The partner CSLS continues to drive outputs and communicates with the SISCTLR as the active CSLS.
You can initiate a manual switchover in Diagnostics from the CSLS Switchover context menu. The SIS_DIAGNOSTIC_SWITCHOVER security key is required by default.
In the event of a manual or automatic switchover, the system generates a CSLS hardware alarm indicating: Partner Not Available, and Card Not Communicating while the former active CSLS is powering-up and obtaining configuration. In addition, a switchover event is reported in the Event Chronicle along with the CSLS Maintenance alarms.
A CSLS switchover is not disruptive to the process. However, following a switchover, the formerly active CSLS may not be available for approximately two minutes. In other words, it is temporarily not available to take over as the active CSLS.
Redundant CSLSs allow proof testing to occur without affecting a running process. A proof test causes a CSLS to run its power-up test while the partner CSLS is active in order to validate that there are no dangerous, undetected faults present.
There are two types of proof test: manual and automatic. An automatic proof test occurs at user-specified intervals. Set the interval using the CSLS properties dialog in DeltaV Explorer. To initiate a manual proof test, use the appropriate Force Reset command on the CSLS context menu in Diagnostics.