Transcription

1 Wiring and Voting Architectures for failsafe Analog Input Modules (F AI) of the ET 200M SIMATIC Safety Integrated for process automation Siemens Industry Online Support

2 Siemens AG 2017 All rights reserved Warranty and liability Warranty and liability Note The Application Examples are not binding and do not claim to be complete regarding the circuits shown, equipping and any eventuality. The Application Examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible for ensuring that the described products are used correctly. These Application Examples do not relieve you of the responsibility to use safe practices in application, installation, operation and maintenance. When using these Application Examples, you recognize that we cannot be made liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to these Application Examples at any time without prior notice. If there are any deviations between the recommendations provided in these Application Examples and other Siemens publications e.g. Catalogs the contents of the other documents have priority. We do not accept any liability for the information contained in this document. Any claims against us based on whatever legal reason resulting from the use of the examples, information, programs, engineering and performance data etc., described in this Application Example shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act ( Produkthaftungsgesetz ), in case of intent, gross negligence, or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or breach of a condition which goes to the root of the contract ( wesentliche Vertragspflichten ). The damages for a breach of a substantial contractual obligation are, however, limited to the foreseeable damage, typical for the type of contract, except in the event of intent or gross negligence or injury to life, body or health. The above provisions do not imply a change of the burden of proof to your detriment. Any form of duplication or distribution of these Application Examples or excerpts hereof is prohibited without the expressed consent of the Siemens AG. Security information Siemens provides products and solutions with industrial security functions that support the secure operation of plants, systems, machines and networks. In order to protect plants, systems, machines and networks against cyber threats, it is necessary to implement and continuously maintain a holistic, state-of-the-art industrial security concept. Siemens products and solutions only form one element of such a concept. Customer is responsible to prevent unauthorized access to its plants, systems, machines and networks. Systems, machines and components should only be connected to the enterprise network or the internet if and to the extent necessary and with appropriate security measures (e.g. use of firewalls and network segmentation) in place. Additionally, Siemens guidance on appropriate security measures should be taken into account. For more information about industrial security, please visit Siemens products and solutions undergo continuous development to make them more secure. Siemens strongly recommends to apply product updates as soon as available and to always use the latest product versions. Use of product versions that are no longer supported, and failure to apply latest updates may increase customer s exposure to cyber threats. To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed under Entry ID: , V3.2, 09/2017 2

3 Siemens AG 2017 All rights reserved Table of contents Table of contents Warranty and liability Automation functions Functionality of the functional example Presented architectures Properties of the fail-safe analog input module Structure and wiring for one sensor (1oo1) Calculation of PFD Wiring Conventional wiring Wiring using Marshalled Termination Assemblies (MTAs) Parameters for hardware configuration Configuring the logic Configuring using Safety Matrix Configuring using CFC Logic without evaluation of the channel error (1oo1) Logic with evaluation of the channel error (1oo1D) Structure and wiring for a (1oo1) sensor with redundant I/O modules Calculation of PFD Wiring Conventional wiring Wiring using Marshalled Termination Assemblies (MTAs) Parameters for hardware configuration Creating the logic Configuring using Safety Matrix Configuring using CFC Logic without evaluation of the channel error (1oo1) Logic with evaluation of the channel error (1oo1D) Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Calculation of PFD Wiring Conventional wiring Wiring using Marshalled Termination Assemblies (MTAs) Parameters for hardware configuration Configuring the logic Configuring using Safety Matrix Configuring using CFC Logic without evaluation of the channel error (1oo2 on the F-AI) Logic with evaluation of the channel error (1oo2D) Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI Calculation of PFD Wiring Conventional wiring Wiring using Marshalled Termination Assemblies (MTAs) Parameters for hardware configuration Creating the logic Configuring using Safety Matrix Configuring using CFC Logic with evaluation of the channel error (1oo2D) Entry ID: , V3.2, 09/2017 3

4 Siemens AG 2017 All rights reserved Table of contents 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Option Calculation of PFD (option 1) Option Calculation of PFD (option 2) Wiring Conventional wiring Wiring using Marshalled Termination Assemblies (MTAs) Parameters for hardware configuration Configuring the logic Configuring using Safety Matrix Configuring using CFC Logic without evaluation of the channel error (1oo2) Logic with evaluation of the channel error (1oo2D) Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program Calculation of PFD Wiring Conventional wiring Wiring using Marshalled Termination Assemblies (MTAs) Parameters for hardware configuration Creating the logic Configuring using Safety Matrix Configuring using CFC Logic with evaluation of the channel error (1oo2D) Structure and wiring for three sensors (1oo3) Evaluation in the user program Calculation of PFD Wiring Conventional wiring Parameters for hardware configuration Creating the logic Configuring using Safety Matrix Configuring using CFC Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program Calculation of PFD Calculation formula for PFD Wiring Conventional wiring Parameters for hardware configuration Creating the logic Configuring using Safety Matrix Configuring using CFC Logic without evaluation of the channel error (2oo3) Logic with evaluation of the channel error (2oo3D) APPENDIX Calculation of the PFD value Recommendations for power supply and grounding measures Power supply Power input System power supply Entry ID: , V3.2, 09/2017 4

5 Siemens AG 2017 All rights reserved Table of contents 11.2 Grounding Objectives Implementation MTA (Marshalled Termination Assembly) References History Entry ID: , V3.2, 09/2017 5

6 Siemens AG 2017 All rights reserved 1 Automation functions 1 Automation functions 1.1 Functionality of the functional example Task It is intended to monitor several analog signals in a plant on a safety-related basis. Depending on the importance and risk of failure, there are several options for wiring and evaluating signals. This means that you can carry out evaluation in the analog input module and/or the user program, for example. Figure 1-1 shows an example of a plant section in which valves (BV-100A and BV-100B) must be closed on a fail-safe basis in dependence on the pressure the fill level and the temperature Figure 1-1: Example 1 - Overview 3 Pressure Transmitters Failsafe Analog Input Signals 2oo3 Voting in the CPU PT- 400A PT- 400B PT- 400C 1 Pair of S 7-400FH CPUs Redundant Failsafe 2 Block Valves Failsafe Discrete Output Signals Valves in Series (Normally-Open, Fail- Close) 1 oo2 Voting Arrangement 2 Temperature Transmitters Failsafe Analog Input Signals 1oo2 Voting in the CPU TT-200A TT-200B Safety Logic BV-100A BV-100B LSH - 100A 3 Level Switches Failsafe Discrete Input Signals 2oo3 Voting in the CPU LSH - 100B LSH - 100C The solution This functional example demonstrates the different options for wiring and evaluating safety-relevant signals. Figure 1-2 shows a possible implementation of this plant section in which different connection and evaluation architectures and analog signals are used. Entry ID: , V3.2, 09/2017 6

7 Siemens AG 2017 All rights reserved 1 Automation functions Figure 1-2: Example 1 System setup PT-100A 0 F-AI CPU TT-200A 1 PT-100 Voting Logic F_CH_AI PT-100B 0 F-AI 2oo3 TT-200B 1 0 F-DO BV-100A PT-100C 0 F-AI TT-200 Voting Logic F_CH_AI BV-100 Voting Logic F_CH_DO 1 1oo2 OR LSH-100A 0 F-DI LSH-100 Voting Logic F_CH_DI 0 1 F-DO BV-100B 2oo3 LSH-100B 0 F-DI LSH-100C 0 F-DI Note In all the functional examples, we use fail-safe analog input module SM 336; F-AI 6 x 0/4 20 ma HART with order number 6ES GE00-0AB0. This will be referred to from now on as F-AI. Entry ID: , V3.2, 09/2017 7

8 Siemens AG 2017 All rights reserved 1 Automation functions 1.2 Presented architectures Recommended architectures In this functional example, the following architectures will be presented: One sensor (1oo1) A typical application for cases in which an individual sensor has the necessary Safety Integrity Level and increased availability is not needed (explanation in chapter 2). Two sensors (1oo2) evaluation in the F-AI A typical application for cases in which an individual sensor does not have the necessary Safety Integrity Level and increased availability is not needed (explanation in chapter 3). Two sensors (1oo2) evaluation in the user program A typical application for cases in which an individual sensor does not have the necessary Safety Integrity Level and the data of both sensors must be visible in the automation system. This architecture can also be configured as 2oo2 for increased availability if an individual sensor has the necessary Safety Integrity Level (explanation in chapter 4). Three sensors (2oo3) evaluation in the user program A typical application for cases in which several sensors are necessary to achieve the required Safety Integrity Level and increased availability is needed (explanation in chapter 5). Entry ID: , V3.2, 09/2017 8

9 Siemens AG 2017 All rights reserved 1 Automation functions 1.3 Properties of the fail-safe analog input module Properties of the F-AI 6 analog inputs with electrical isolation between the channels and the backplane bus Input ranges: 0 to 20 ma 4 to 20 ma Shortcircuit-proof power supply of 2- or 4-wire transmitters via the module external encoder supply possible group fault display (SF) safety mode display (SAFE) display for channel-specific fault (Fx) Display for HART status (Hx) (If you have activated HART communication for one channel and HART communication is running, the green HART status display lights up.) configurable diagnostics configurable diagnostics in safety mode only SIL3/Cat.4/PLe can be achieved without safety protector HART communication Firmware update via HW config I&M identification data can be used with PROFIBUS DP and PROFINET IO Using inputs You can use the inputs as follows: Wiring diagrams of the F-AI Each of the six channels for current measurement 0 to 20 ma (without HART utilization) 4 to 20 ma (with/without HART utilization) Functional range of HART communication: 1.17 to typically 35 ma The figures below give you an overview of the address and connection diagrams of the F-AI (SM 336) considered here. Entry ID: , V3.2, 09/2017 9

10 Siemens AG 2017 All rights reserved 1 Automation functions Figure 1-3: Address assignment of SM 336; F-AI 6 x 0/4...mA HART Figure 1-4: Front view of SM 336; F-AI 6 x 0/4...mA HART Entry ID: , V3.2, 09/

11 Siemens AG 2017 All rights reserved 1 Automation functions Figure 1-5: Wiring and schematic diagram of SM 336; F-AI 6 x 0/4...mA HART Figure 1-6: Channel numbers of SM336; F-AI 6 x 0/4...20mA HART Recommendation You are strongly advised to use the shortcircuit-proof internal sensor supply of the module. This internal sensor supply is monitored and its status is indicated by the Fx LED (see Figure Front view of SM 336; F-AI 6 x 0/ ma HART). Entry ID: , V3.2, 09/

12 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) 2 Structure and wiring for one sensor (1oo1) The one-sensor evaluation schematic (or 1oo1) refers to the applications that do not need sensor redundancy. 1oo1 evaluation means that only one sensor is present. If the sensor displays a trigger condition, the safety logic will trip. Note The I/O module in this architecture is certified for Safety Integrity Level SIL3. However, to be SIL-compliant, the entire safety instrumented function including the field devices must be evaluated according to IEC / IEC In the 1oo1 basic architecture, a sensor is wired to one of the F-AI channels in Figure 2-1 to channel 0). Figure 2-1: Overview (1oo1) F-AI Ch 0..5 Sensor 1 0 CPU F_CH_AI 1oo1 Voting Logic Using the structure shown in Figure 2-1 it is possible to achieve a maximum of SIL3. The table below shows when the safety function trips. Table 2-1: Failure modes Sensor 1 Component failed? F-AI Tripping of safety function? No No No X Yes Yes Yes X Yes Entry ID: , V3.2, 09/

13 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) 2.1 Calculation of PFD The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(Ein) = PFD Sensor + PFD F-AI + PFD CPU 2.2 Wiring You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 1oo1 sensor using the following formula 1 : PFD 1oo1 T 2 I DU Conventional wiring In the 1oo1 evaluation schematic, the sensor can be supplied with voltage as follows: internally via the F-AI via an external power source Internal voltage supply Special features in the case of internal voltage supply of the F-AI: Wiring examples Short-circuiting is controlled between the sensor supply voltage Vsn and Mn+ Due to read back of the sensor voltage in the F-AI, undervoltage detection on the transmitter is possible. Figure 2-2 shows a wiring example for a 2-wire sensor. Figure 2-3 shows a wiring example for a 4-wire sensor. In both illustrations, the transmitter is wired to channel 0 (terminals 3, 4, 5) and is supplied by the F-AI 1 The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4 Entry ID: , V3.2, 09/

14 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) Example of wiring a 2-wire sensor Figure 2-2: Wiring for a 2-wire transmitter (internal sensor supply) 2-Wire Current Sensor Example of wiring a 4-wire sensor Figure 2-3: Wiring for a 4-wire transmitter (internal sensor supply) 4-Wire Current Sensor Entry ID: , V3.2, 09/

15 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) External power supply (2-wire sensor) Figure 2-4 shows an external voltage source on a 2-wire sensor. The sensor is wired to channel 0 (terminals 4, 5). You are advised to connect the M potentials to one another. CAUTION The F-AI cannot detect an undervoltage on the transmitter. This means that you should use a measuring transducer with undervoltage detection. Figure 2-4: External voltage for a 2-wire transmitter 2-Wire Current Sensor Entry ID: , V3.2, 09/

16 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) External power supply (4-wire sensor) Figure 2-5 shows an external voltage source with a 4-wire sensor. The sensor is wired to channel 0 (terminals 4, 5). You are advised to connect the M potentials to one another. CAUTION The F-AI cannot detect an undervoltage on the transmitter. This means that you should use a measuring transducer with undervoltage detection. Figure 2-5: External voltage for a 4-wire transmitter 4-Wire Current Sensor Entry ID: , V3.2, 09/

17 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) Wiring using Marshalled Termination Assemblies (MTAs) Siemens offers Marshalled Termination Assemblies (MTAs) Using an F-AI-MTA for this evaluation scheme makes wiring between the sensors and the ET 200M signal modules much easier, since it already includes the necessary diodes and Zener diodes You can find more information on this topic in the section entitled "Marshalled Termination Assembly (MTA)" Figure 2-6: MTA Entry ID: , V3.2, 09/

18 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) 2.3 Parameters for hardware configuration To carry out configuration, highlight the F-AI in the STEP 7 hardware catalog and insert it into an existing ET 200M station. To make configuration easier, choose meaningful symbol names for the analog channels. You can see an example of a hardware configuration using one F-AI in Figure 2-7 In this example, the sensor signal is wired to channel 0 of the F-AI. Note that the use of an F-AI MTA is not taken into account in the HW config. You can find more information about the HW configuration in the chapter entitled References under \4\. Figure 2-7: Symbol editing In the object properties of the inserted F-AI, you set the necessary parameters for operating the F-AI (see Figure 2-8). The parameters are grouped in Table 2-2. Entry ID: , V3.2, 09/

19 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) Figure 2-8: Hardware parameters Table 2-2: Hardware configuration parameters Parameters Description/recommendations Desired setting or permissible value range F_target_address F-parameter PROFIsafe address of the F-signal module (set using DIL switches) or F_monitoring_time (ms) Diagnostic interrupt Monitoring time for safety-related communication between the CPU and the F-AI. Comment: A table is available on the Siemens Support website to help users to calculate F-monitoring times (see the chapter entitled References under \10\). Module parameters Various error events trigger a diagnostic interrupt, which the module can detect. These events are then reported to the CPU. Comment: If the diagnostic interrupt is enabled at the module level, then individual diagnostics events must be activated at the channel level ms Default 2500ms Enable/disable Entry ID: , V3.2, 09/

20 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) Parameters Description/recommendations Desired setting or permissible value range Behavior after channel faults HART_Gate Interference frequency suppression (Hz) Evaluation of the sensors Measuring range F_Wire_break detection Smoothing Passivation of the entire module/passivation of the channel. Comment: Not relevant for F systems Works on a cross-module basis as a failsafe main switch. With OFF, HART communication is disabled. With ON, HART communication is enabled. With "selectable, the HART modem can be switched from the safety program for maintenance. Selection for balancing the integration time of the A/D converter to the network that is being used. The integration time is: 20 ms at 50 Hz ms at 60 Hz Activation of the channel by specifying the sensor evaluation. Disabled 1oo1 (1v1) 1oo2 (2v2) If 1oo1 is selected, the following parameters are not available: Discrepancy time Tolerance Standard value Selection of the measuring range for the channel. Selection of whether wire break monitoring is to be carried out for the channel or not. Number of measuring cycles for which smoothing is to be carried out. Module/ Channel off/ on/ Selectable 50/60 Hz 1oo1 (1v1) ma ma Enable/disable 1, 4, 16, 64 Note Depending on the versions of the module and the hardware configuration pack, the hardware parameters and the configuration window may differ from the information in this section. You can find further information in the documentation of the module. Entry ID: , V3.2, 09/

21 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) 2.4 Configuring the logic Configuring using Safety Matrix After you have configured the hardware, you can use the SIMATIC Safety Matrix Engineering Tool (for more information on this topic, see the chapter entitled References under \5\). Figure 2-9 shows how to configure a cause to monitor an input TAG in the Safety Matrix. Use the following settings: Type analog input 1 input Function type: Normal (1oo1 evaluation) Enter the signal name at Tag1 (e.g. F_TAG1001_X) or use the I/O pushbutton to choose the symbol from the symbol table. Figure 2-9: Safety Matrix configuring Entry ID: , V3.2, 09/

22 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) As Figure 2-10 shows, there are additional analog parameters that you must configure for the cause: Necessary parameters: Limit value type: MAX or MIN Limit value Optional parameters: Prealarm Hysteresis Units of measurement: Figure 2-10: Safety Matrix analog parameters If the input TAG is fallen short of or exceeded, the cause is activated and triggers the corresponding effect(s). Entry ID: , V3.2, 09/

23 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) Depending on the process application, you can activate additional options (e.g. time delay and bypass option). One of the configuration options that is highlighted in Figure 2-11 is switch off in the case of a channel error. If this option is activated, a channel error has the effect of a limit value violation and in the case of a 1oo1 (function type: Normal) triggers the corresponding effect(s). Figure 2-11: Safety Matrix options Entry ID: , V3.2, 09/

24 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) Configuring using CFC As an alternative to using the Safety Matrix Tool, you can also implement the CPU logic for reading the input signal using the STEP 7 CFC Editor. There are two options for implementing the CFC logic: Without evaluation of the channel error (1oo1) With evaluation of the channel error (1oo1D) Logic without evaluation of the channel error (1oo1) Figure 2-12 shows a sample logic that was created in the CFC Editor for reading an input signal that does not take into account a channel error. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Note In the configuration that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. Figure 2-12: CFC Logic Without channel error evaluation The sample logic in Figure 2-12 functions as follows: If the process value is in the normal range (in this case, less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the process value exceeds the limit value (in this case, greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. To create the logic, generate an F_CH_AI F channel driver for the analog input signal and link it to the symbol or address of the sensor that is linked to the F-AI (e.g. F_TAG1001_X). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Entry ID: , V3.2, 09/

25 Siemens AG 2017 All rights reserved 2 Structure and wiring for one sensor (1oo1) Logic with evaluation of the channel error (1oo1D) Figure 2-13 shows a sample logic that was created in the CFC Editor for reading an individual input signal that takes into account a channel error. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 2-13: CFC logic With channel error evaluation The sample logic in Figure 2-13 functions as follows: In the normal range (here: less than 90) and with an undisturbed process value, the output of the evaluation logic is 1 (i.e. no trigger command). If the limit value is exceeded (here: greater than or equal to 90) and with an undisturbed process value, the output of the evaluation logic is 0 (i.e. trigger command). If there is a channel error, the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. The necessary steps to generate the logic are described below: Create an F_CH_AI channel driver for the analog input signal and link it to the address of the sensor that is linked to the F-AI (e.g. F_TAG1001_X). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logically AND the following signals to generate the signal for the -trigger command: Negated value of the limit value block (QHN or QLN) Negated value of the channel error output (QBAD) of the channel driver block Entry ID: , V3.2, 09/

26 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules To increase the availability of the I/O modules, you implement the single-sensor evaluation scheme with a pair of redundant F-AIs. The sensor has a 1oo1 evaluation and the I/O modules have a 2oo2 one. Note The I/O modules of this architecture are certified to achieve Safety Integrity Level SIL3. However, to be SIL-compliant, the entire safety instrumented function including the field devices must be evaluated according to IEC / IEC In the redundant 1oo1 architecture, a single sensor is wired to a redundant F-AI. You can see a block diagram in Figure In Figure 3-1 the sensor is wired to channel 0 of both F-AIs. The F-AIs are configured as redundant in the HW Config. Only one analog F-channel driver is supported. The F-Channel driver selects from the incoming analog signals. Figure 3-1: Redundant F-AI 1oo1 overview F-AI Ch CPU F_CH_AI 1oo1 Voting Logic Sensor 1 F-AI Ch Using the structure shown in Figure 3-1 it is possible to achieve a maximum of SIL3. Entry ID: , V3.2, 09/

27 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules The table below shows when the safety function trips: Table 3-1: Failure modes Component failed? Sensor 1 F-AI 1 F-AI 2 Tripping of safety function? No No No No No No Yes No No Yes No No X Yes Yes Yes Yes X X Yes Note Redundancy does not increase the Safety Integrity Level. 3.1 Calculation of PFD The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(Ein) = PFD Sensor + 2 PFD F-AI + PFD CPU You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 1oo1 sensor using the following formula 2 PFD 1oo1 T 2 I DU 3.2 Wiring Conventional wiring An example of the 1oo1 evaluation scheme with redundant F-AI is shown in Figure 3-2 and Figure 3-3 The sensor is wired to channel 0 (terminals 3, 4, 5) of both F-AIs. 2 The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4 Entry ID: , V3.2, 09/

28 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules Special feature Short-circuiting is controlled between the sensor supply voltage Vsn and Mn+ Due to read back of the sensor voltage in the F-AI, undervoltage detection on the transmitter is possible. It is necessary to include the external elements considering application-specific safety issues, i.e.: you must include the external elements that are needed to implement redundancy (e.g. Zener diodes) in your safety considerations). Figure 3-2: Redundant F-AI modules 1oo1 wiring (2-wire transmitter) SM336; AI 6x 0/4...20mA HART L+ M Vs0 CH0 M0+ M L+ 1M + 2-Draht 2-Wire Current Messumformer - Sensor 1L+ 1M SM336; AI 6x 0/4...20mA HART L+ M Vs0 M0+ CH0 M0- Vs1 6 6 Vs1 CH1 M M1+ CH1 M1-8 8 M1- Vs2 9 9 Vs2 CH2 M M2+ CH2 M M2- Vs Vs3 CH3 M M3+ CH3 M M3- Vs Vs4 CH4 M M4+ CH4 M M4- Vs Vs5 CH5 M M5+ CH5 M M5- Entry ID: , V3.2, 09/

29 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules Figure 3-3: Redundant F-AI modules 1oo1 wiring (4-wire transmitter) SM336; AI 6x 0/4...20mA HART L+ M Vs L+ 1M 1L+ 1M SM336; AI 6x 0/4...20mA HART L+ M Vs0 CH0 M0+ M0- Vs Draht 4-Wire Current Messumformer - Sensor M0+ M0- Vs1 CH0 CH1 M M1+ CH1 M1-8 8 M1- Vs2 9 9 Vs2 CH2 M M2+ CH2 M M2- Vs Vs3 CH3 M M3+ CH3 M M3- Vs Vs4 CH4 M M4+ CH4 M M4- Vs Vs5 CH5 M M5+ CH5 M M5- Entry ID: , V3.2, 09/

30 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules External power supply (2-wire sensor) Figure 3-4 shows an external voltage source on a 2-wire sensor. The sensor signal is looped via channel 0 (terminals 4, 5) of both redundant assemblies. You are advised to connect the M potentials to one another. Figure 3-4: Redundant F-AI modules 1oo1 wiring (2-wire transmitter), supplied externally SM336; AI 6x 0/4...20mA HART L+ M Vs0 CH0 M0+ M0- Vs L+ 1M 2L+ + 2-Draht 2-Wire Current Messumformer - Sensor 2M 1L+ 1M SM336; AI 6x 0/4...20mA HART L+ M Vs0 M0+ CH0 M0- Vs1 CH1 M M1+ CH1 M1-8 8 M1- Vs2 9 9 Vs2 CH2 M M2+ CH2 M M2- Vs Vs3 CH3 M M3+ CH3 M M3- Vs Vs4 CH4 M M4+ CH4 M M4- Vs Vs5 CH5 M M5+ CH5 M M5- Entry ID: , V3.2, 09/

31 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules External power supply (4-wire sensor) Figure 3-5 shows an external voltage source with a 4-wire sensor. The sensor signal is looped via channel 0 (terminals 4, 5) of both redundant assemblies. You are advised to connect the M potentials to one another. You are advised to connect the M potentials to one another. Figure 3-5 Redundant F-AI modules 1oo1 wiring (4-wire transmitter), supplied externally SM336; AI 6x 0/4...20mA HART L+ M Vs L+ 1M 2L+ 1L+ 1M SM336; AI 6x 0/4...20mA HART L+ M Vs0 CH0 M0+ M0- Vs Draht 4-Wire Messumformer Current - Sensor M0+ M0- Vs1 CH0 CH1 M1+ 7 2M 7 M1+ CH1 M1-8 8 M1- Vs2 9 9 Vs2 CH2 M M2+ CH2 M M2- Vs Vs3 CH3 M M3+ CH3 M M3- Vs Vs4 CH4 M M4+ CH4 M M4- Vs Vs5 CH5 M M5+ CH5 M M5- Entry ID: , V3.2, 09/

32 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules Wiring using Marshalled Termination Assemblies (MTAs) Siemens offers Marshalled Termination Assemblies (MTAs) Using an F-AI-MTA for this evaluation scheme makes wiring between the sensors and the ET 200M signal modules much easier, since it already includes the necessary diodes and Zener diodes You can find more information on this topic in the section entitled "Marshalled Termination Assembly (MTA)" Figure 3-6: MTA Entry ID: , V3.2, 09/

33 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules 3.3 Parameters for hardware configuration For the 1oo1 evaluation scheme with redundant F-AI, the F-AIs are configured in STEP 7 HW Config. Figure 3-7 shows an example of a hardware configuration. In this example, there is one ET 200M rack (with interface module IM153-2 for PROFIBUS) with PROFIBUS address 3 and a second ET 200M rack with PROFIBUS address 4. Each ET 200M includes one F-AI in slot 4. You can find more information about the HW configuration in the chapter entitled References under \4\. Figure 3-7: Redundant F-AI 1oo1 layout In the HW Config, you must configure the two F-AIs as a redundant pair. You can access the F-AI redundancy settings via the object properties of one of the F-AIs. In the case of the hardware set-up example shown in Figure 3-7 the redundancy setting is made on the F-AI that is located in the ET 200M rack with PROFIBUS address 3. Figure 3-8 shows the interface for the redundancy settings with Table 3-2 grouping the settings. Entry ID: , V3.2, 09/

34 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules Figure 3-8: Redundant F-AI 1oo1 redundancy parameters Table 3-2: Redundant F-AI 1oo1 redundancy parameters Parameters Description/recommendations Desired setting or permissible value range Redundancy Redundant module Indication of whether or not the F-AI functions as part of a redundant pair. Comment: For redundancy, you must set the parameter on two modules/assemblies. This is used to choose the redundant partner module. Two modules/ assemblies Note Depending on the versions of the module and the hardware configuration pack, the hardware parameters and the configuration window may differ from the information in this section. You can find further information in the documentation of the module. When you have made the redundancy settings, you can set the other hardware parameters in one of the redundant F-AIs. The system automatically applies the settings on the redundant assembly. Entry ID: , V3.2, 09/

35 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules 3.4 Creating the logic Even though this evaluation scheme uses redundant F-AIs, only one F_CH_AI F channel driver is needed in the logic. It is possible to add and configure the F channel driver either automatically by means of the SIMATIC Safety Matrix or manually using the STEP 7 CFC Editor. In both cases, the F channel driver must be linked to the analog sensor signal of the F-AI with the lower I/O address. When you have configured the F channel driver and the logic is completely available, the system compiles the logic. If the option to generate module drivers is enabled at compilation, then the system automatically adds and configures the corresponding F_PS_12 module drivers to the logic at compilation. The F channel driver selects the valid signal and switches to the signal of the redundant module if there is a disturbance. The driver does not carry out delta monitoring of the redundant signals Configuring using Safety Matrix After you have added the sensor to the hardware configuration, you can implement the evaluation logic for the signal in the CPU. One of the methods for doing this is to use the SIMATIC Safety Matrix Engineering Tool (for more information on this topic, see the chapter entitled References under \5\). The actual evaluation logic for monitoring an individual sensor using redundant F-AIs is the same as is described in section (Configuring using Safety Matrix). Entry ID: , V3.2, 09/

36 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules Configuring using CFC As an alternative to using the Safety Matrix Tool, you can also implement the CPU logic for reading the input signal using the STEP 7 CFC Editor. There are two options for implementing the CFC logic: Without evaluation of the channel error (1oo1) With evaluation of the channel error (1oo1D) Logic without evaluation of the channel error (1oo1) Figure 3-9 shows a sample logic that was created in the CFC Editor for reading an input signal of redundant F modules that does not take into account a channel error. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Note In the logic that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. Figure 3-9: CFC Logic Without channel error evaluation The sample logic in Figure 3-9 functions as follows: The F_CH_AI F channel driver evaluates both sensor signals and returns a value to the logic for further-processing. If the process value is in the normal range (in this case, less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the process value exceeds the limit value (in this case, greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. To create the logic, generate an F_CH_AI F channel driver for the analog input signal and link it to the symbol on the F-AI with the lower address (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Entry ID: , V3.2, 09/

37 Siemens AG 2017 All rights reserved 3 Structure and wiring for a (1oo1) sensor with redundant I/O modules Logic with evaluation of the channel error (1oo1D) Figure 3-10 shows a sample logic that was created in the CFC Editor for reading an input signal of redundant F-AIs that takes into account a channel error. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 3-10: CFC logic With channel error evaluation The sample logic in Figure 3-10 functions as follows: With normal range (here: less than 90) and with an undisturbed process value, the output of the evaluation logic is 1 (i.e. no trigger command). If the limit value is exceeded (here: greater than or equal to 90) and with an undisturbed process value, the output of the evaluation logic is 0 (i.e. trigger command). If both F-AIs report a channel error, the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. The necessary steps to generate the logic are described below: Generate an F_CH_AI F channel driver for the analog input signal and link it to the symbol on the F-AI with the lower address (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logically AND the following signals to generate the signal for the -trigger command: Negated value of the limit value block (QHN or QLN) Negated value of the channel error output (QBAD) of the F channel driver Entry ID: , V3.2, 09/

38 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI The two-sensor or 1oo2 evaluation scheme refers to applications that need two sensors to achieve the necessary Safety Integrity Level. 1oo2 evaluation means only one of the sensors needs to trigger; i.e. if one of the sensors displays a trigger condition, the safety logic will trigger. In this evaluation scheme, 1oo2 evaluation is carried out in the F-AI. Note The I/O module in this architecture is certified for Safety Integrity Level SIL3. However, to be SIL-compliant, the entire safety instrumented function including the field devices must be evaluated according to IEC / IEC In the 1oo2 architecture with evaluation in the F-AI, two sensors are wired to one F-AI. Figure 4-1 shows a block diagram. If 1oo2 evaluation is activated for a channel pair (0/3, 1/4, 2/5), the F-AIs carry out discrepancy analysis of the two input signals. Depending on the parameterization, one of the process values (MIN / MAX) is transferred to the CPU. The system uses the address of the channel with the lower number. In Figure 4-1 the first sensor is wired to channel 0 of the F-AIs. The second sensor must then be wired to channel 3. Figure 4-1: 1oo2 evaluation in the F-AI overview F-AI CPU Sensor 1, CH 0 Sensor 2, CH Evalution F_CH_AI Voting Logic Using the structure shown in Figure 4-1 it is possible to achieve a maximum of SIL3. The table below shows when the safety function trips. Table 4-1: Failure modes Component failed? Sensor 1 Sensor 2 F-AI Tripping of safety function? No No No No X X Yes Yes X Yes X Yes Yes X X Yes Entry ID: , V3.2, 09/

39 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI 4.1 Calculation of PFD The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(Ein) = PFD Sensor + PFD F-AI + PFD CPU You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 1oo2 sensor using the following formula 3 : PFD 1oo2 2 2 T T DU I I DU The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4, see Appendix Entry ID: , V3.2, 09/

40 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI 4.2 Wiring Conventional wiring In the 1oo2 evaluation scheme, the F-AI or an external power supply can supply power to the sensors. Figure 4-2 shows a wiring example for 2-wire sensors. In the figure, the first sensor is wired to channel 0 (terminals 3 and 4) with the second one being wired to channel 3 (terminals 12 and 13). Figure 4-2: 1oo2 evaluation in the F-AI (wiring for two-wire sensors) SM336; AI 6x 0/4...20mA HART L+ 1 1L+ M 2 1M CH0 Vs0 M0+ M Draht 2-Wire Messumformer Current Sensor Vs1 6 CH1 M1+ 7 M1-8 Vs2 9 CH2 M2+ 10 M2-11 CH3 Vs3 M3+ M Draht 2-Wire Messumformer Current Sensor Vs4 15 CH4 M4+ 16 M4-17 Vs5 18 CH5 M5+ 19 M5-20 Figure 4-3 shows a wiring example for 4-wire sensors. In Figure 4-3 the first sensor is wired to channel 0 (terminals 4 and 5) with the second one being wired to channel 3 (terminals 13 and 14). Entry ID: , V3.2, 09/

41 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Figure 4-3: 1oo2 evaluation in the F-AI (wiring for 4-wire sensors) SM336; AI 6x 0/4...20mA HART L+ 1 1L+ M 2 1M Vs0 3 CH0 M0+ M0- Vs Draht 4-Wire Messumformer Current Sensor CH1 M1+ 7 M1-8 Vs2 9 CH2 M2+ 10 M2-11 Vs3 12 CH3 M3+ M3- Vs Draht 4-Wire Messumformer Current Sensor CH4 M4+ 16 M4-17 Vs5 18 CH5 M5+ 19 M5-20 Figure 4-4 shows a wiring example for 2-wire sensors with an external power supply with Figure 4-5 showing a wiring example for 4-wire sensors with an external power supply. In both figures, the first sensor is wired to channel 0 (terminals 4 and 5) with the second one being wired to channel 3 (terminals 13 and 14). You are advised to connect the M potentials to one another. Entry ID: , V3.2, 09/

42 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Figure 4-4: 1oo2 evaluation in the F-AI (external power supply for two-wire sensors) SM336; AI 6x 0/4...20mA HART L+ 1 1L+ M 2 1M CH0 Vs0 M0+ M Draht 2-Wire Messumformer Current - Sensor V Vs1 6 CH1 M1+ 7 M1-8 Vs2 9 CH2 M2+ 10 M2-11 CH3 Vs3 M3+ M Draht 2-Wire Messumformer Current Sensor V Vs4 15 CH4 CH5 M4+ M4- Vs5 M5+ M Entry ID: , V3.2, 09/

43 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Figure 4-5: 1oo2 evaluation in the F-AI (external power supply for 4-wire sensors) SM336; AI 6x 0/4...20mA HART L+ 1 1L+ M 2 1M Vs0 3 CH0 M0+ M0- Vs Draht 4-Wire Messumformer Current Sensor V CH1 M1+ 7 M1-8 Vs2 9 CH2 M2+ 10 M2-11 Vs3 12 CH3 M3+ M3- Vs Draht 4-Wire Messumformer Current Sensor V CH4 M4+ 16 M4-17 Vs5 18 CH5 M5+ 19 M5-20 Entry ID: , V3.2, 09/

44 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Wiring using Marshalled Termination Assemblies (MTAs) Siemens offers Marshalled Termination Assemblies (MTAs) Using an F-AI-MTA for this evaluation scheme makes wiring between the sensors and the ET 200M signal modules much easier, since it already includes the necessary diodes and Zener diodes You can find more information on this topic in the section entitled "Marshalled Termination Assembly (MTA)" Figure 4-6 MTA Entry ID: , V3.2, 09/

45 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI 4.3 Parameters for hardware configuration To carry out configuration, highlight the F-AI in the STEP 7 hardware catalog and insert it into an existing ET 200M station. To make configuration easier, choose a meaningful symbol name for the analog channel. Note that when selecting the 1oo2 signal for the F-AIs, only an analog sensor signal is made available to the CPU logic. You can see an example of a hardware set-up using one F-AI in Figure 4-7 The signal that consists of the two sensors (channels 0 and 3) is transferred to the CPU on the first symbol address (EW512). You can find more information about the HW configuration in the chapter entitled References under \4\. Figure 4-7: F-AI 1oo2 (evaluation in the F-AI) symbol editing In the object properties of the inserted F-AI, you set the necessary parameters for operating the F-AI (see Figure 4-8). The parameters are grouped in Table 4-2 Entry ID: , V3.2, 09/

46 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Figure 4-8: 1oo2 evaluation in the F-AI (hardware parameters) Table 4-2: 1oo2 evaluation in the F-AI (parameters for hardware configuration) Parameters Description/recommendations Desired setting or permissible value range F_target_address F_monitoring_ time (ms) F-parameter PROFIsafe address of the F-signal module (set using DIL switches). Monitoring time for safety-related communication between the CPU and the F-AI. Comment: A table is available on the Siemens Support website to help users to calculate F-monitoring times (see the chapter entitled References under \10\) or ms Default 2500ms Diagnostic interrupt Module parameters Various error events trigger a diagnostic interrupt, which the module can detect. These events are then reported to the CPU. Comment: If the diagnostic interrupt is enabled at the module level, then individual diagnostics events must be activated at the channel level. Enable/disable Entry ID: , V3.2, 09/

47 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Parameters Description/recommendations Desired setting or permissible value range Behavior after channel fault HART_Gate Interference frequency suppression (Hz) Evaluation of the sensors Measuring range F_opencircuit_detection Smoothing Discrepancy time (ms) Tolerance window % abs. Tolerance window % rel. Standard value Passivation of the entire module/passivation of the channel. Comment: Not relevant for F systems Works on a cross-module basis as a failsafe main switch. With OFF, HART communication is disabled. With ON, HART communication is enabled. With "selectable, the HART modem can be switched from the safety program for maintenance. Selection for balancing the integration time of the A/D converter to the network that is being used. The integration time is: 20 ms at 50 Hz ms at 60 Hz Activation of the channel by specifying the sensor evaluation. Disabled 1oo1 (1v1) 1oo2 (2v2) If 1oo1 is selected, the following parameters are not available: Discrepancy time Tolerance Standard value Selection of the measuring range for the channel. Selection of whether wire break monitoring is to be carried out for the channel or not. Number of measuring cycles for which smoothing is to be carried out. Selection of the discrepancy time Specification of the maximum difference between both signals Specification of the maximum difference between both signals Value that is passed to the CPU. Must be specified in dependence on the downstream limit value function. Module/ Channel off/ on/ Selectable 50/60 Hz 1oo2 (2v2) ma ma Enable/disable 1, 4, 16, ms % % MIN/MAX Note Depending on the versions of the module and the hardware configuration pack, the hardware parameters and the configuration window may differ from the information in this section. You can find further information in the documentation of the module. Entry ID: , V3.2, 09/

48 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI 4.4 Configuring the logic Configuring using Safety Matrix After 1oo2 evaluation has been configured in the F-AI, it is possible to implement the CPU logic to read an individual sensor. We have already stated that once the F-AI is handling 1oo2 signal selection and only one analog sensor signal of the CPU logic is available, 1oo1 evaluation takes place in the user program. One of the methods implementation is to use the SIMATIC Safety Matrix Engineering Tool (for more information on this topic, see the chapter entitled References under \5\). Figure 4-9 shows how to configure a cause to monitor an input TAG in the matrix. Use the following settings: Type analog input 1 input Function type: Normal (1oo1 evaluation) Enter the signal name at Tag1 (e.g. F_TAG1001_X) or use the I/O pushbutton to choose the symbol from the symbol table. The cause is configured with function type standard. Figure 4-9: Safety Matrix configuring Entry ID: , V3.2, 09/

49 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI As Figure 4-10 shows, there are additional analog parameters that you must configure for the cause: Necessary parameters: Limit value type: MAX or MIN Limit value Optional parameters: Prealarm Hysteresis Units of measurement: Figure 4-10: Safety Matrix analog parameters If the input TAG is fallen short of or exceeded, the cause is activated and triggers the corresponding effect(s). Entry ID: , V3.2, 09/

50 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Depending on the process application, you can activate additional options (e.g. time delay and bypass option). One of the configuration options that is highlighted in Figure 4-11 is switch off in the case of a channel error. If this option is activated, a channel error is evaluated at one of the sensor inputs as a trigger signal. Depending on the number of signals and the function type, the cause can be activated and trigger the effect(s). Figure 4-11: Safety Matrix options Entry ID: , V3.2, 09/

51 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI Configuring using CFC As an alternative to using the Safety Matrix Tool, you can implement the CPU logic for reading the input signal using the STEP 7 CFC Editor. After both the sensor signals have been added to the hardware configuration and the F-AI has carried out 1oo2 evaluation, you can generate the evaluation logic in the CFC Editor. There are two options for implementing the CFC logic: Without evaluation of the channel error (1oo1) With evaluation of the channel error (1oo1D) Logic without evaluation of the channel error (1oo2 on the F-AI) Figure 4-12 shows a sample logic for reading an individual input signal that in the CFC Editor that does not take into account a channel error. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 4-12: CFC Logic Without channel error evaluation Note In the logic that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. Entry ID: , V3.2, 09/

52 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI The sample logic in Figure 4-12 functions as follows: The F-AI evaluates both sensor signals and returns a value to the F channel driver for further-processing. Depending on the setting of the Standard value parameter in the hardware configuration, this value corresponds to the higher or lower sensor signal or &H7FFF in the case of a discrepancy. If the process value is in the normal range (in this case: less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the process value exceeds the limit value (in this case: greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic must be linked to the corresponding shutdown logic. To create the configuration, generate an F_CH_AI F channel driver for the analog input signal and link it to the symbol on the address with the lower address (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logic with evaluation of the channel error (1oo2D) Figure 4-13 shows a sample logic that was created in the CFC Editor for reading an individual input signal that takes into account a channel error. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 4-13: CFC logic With channel error evaluation Entry ID: , V3.2, 09/

53 Siemens AG 2017 All rights reserved 4 Structure and wiring for two sensors (1oo2) Evaluation in the F-AI The sample logic in Figure 4-13 functions as follows: The F-AI evaluates both sensor signals and returns a value to the F channel driver for further-processing. Depending on the setting of the Standard value parameter in the hardware configuration, this value corresponds to the higher or lower sensor signal or &H7FFF in the case of a discrepancy. If the process value is in the normal range (in this case, less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the undisturbed process value exceeds the limit value (in this case: greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). If the F-AI reports a channel error, the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic must be linked to the corresponding shutdown logic. The necessary steps to generate the logic are described below: Generate an F_CH_AI F channel driver for the analog input signal and link it to the symbol on the address with the lower channel number (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logically AND the following signals to generate the signal for the -trigger command: Negated value of the limit value block (QHN or QLN) Negated value of the channel error output (QBAD) of the F channel driver Entry ID: , V3.2, 09/

54 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI To increase the availability of the I/O modules, you can implement the 2-sensor evaluation scheme with two sensors and a pair of redundant F-AIs. The sensors have a 1oo2 evaluation and the I/O modules have a 2oo2 evaluation. Note The I/O modules of this architecture are certified to achieve Safety Integrity Level SIL3. However, to be SIL-compliant, the entire safety instrumented function including the field devices must be evaluated according to IEC / IEC In the redundant 1oo2 architecture, two sensors are wired to a redundant pair of F-AIs. Figure 5-1 shows a block diagram. In the figure, the first sensor is wired to channel 0 with the second one being wired to channel 3 of both modules. The modules are configured as redundant in the HW Config. Each F-AI carries out 1oo2 1oo2 evaluation of both sensors. Only one analog F-channel driver is supported. The F-Channel driver selects from the incoming analog signals. Figure 5-1: F-AI redundant module 1oo2 (evaluation in the F-AI) overview Sensor 1, CH 0 F-AI Sensor 2, CH 3 Ch Evalution F_CH_AI CPU Voting Logic F-AI Ch Evalution The set-up shown in Figure 5-1 is suitable for achieving SIL3. The table below shows when the safety function trips. Entry ID: , V3.2, 09/

55 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI Table 5-1: Failure modes Component failed? Sensor 1 Sensor 2 F-AI 1 F-AI 2 Tripping of safety function? No No No X No No No X No No X Yes X X Yes Yes X X X Yes X X Yes Yes Yes Note Redundancy does not increase the Safety Integrity Level. 5.1 Calculation of PFD The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(Ein) = PFD Sensor + 2 PFD F-AI + PFD CPU You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 1oo2 sensor using the following formula 4 : PFD 1oo2 2 2 T T DU I I DU The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4, see Appendix Entry ID: , V3.2, 09/

56 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI 5.2 Wiring Conventional wiring An example of the 1oo1 evaluation scheme with redundant F-AI is shown in Figure 5-2 The first sensor is wired to channel 0 (terminals 3, 4, 5) with the second one being wired to channel 3 (terminals 12, 13, 14) of both F-AIs. Note that this architecture additionally needs two Zener diodes for each sensor. The first Zener diode has a breakdown voltage of 6.2 V and the second one has a breakdown voltage of 5.6 V. Apart from this, two diodes each are used to decouple the power supply. The diodes and Zener diodes are needed for cases in which an F-AI is out of service (e.g. in the case of a module failure, routine maintenance, etc.) Figure 5-2: F-AI redundant module 1oo2 (evaluation in the F-AI) wiring SM336; AI 6x 0/4...20mA HART L+ M Vs0 CH0 M0+ M L+ 1M + 2-Draht 2-Wire Messumformer Current - Sensor 1L+ 1M SM336; AI 6x 0/4...20mA HART L+ M Vs0 M0+ CH0 M0- Vs1 6 6 Vs1 CH1 M M1+ CH1 M1-8 8 M1- Vs2 9 9 Vs2 CH2 M M2+ CH2 M M2- CH3 Vs3 M3+ M Draht 2-Wire Messumformer Current - Sensor Vs3 M3+ M3- CH3 Vs Vs4 CH4 M M4+ CH4 M M4- Vs Vs5 CH5 M M5+ CH5 M M5- Entry ID: , V3.2, 09/

57 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI Wiring using Marshalled Termination Assemblies (MTAs) Siemens offers Marshalled Termination Assemblies (MTAs) Using an F-AI-MTA for this evaluation scheme makes wiring between the sensors and the ET 200M signal modules much easier, since it already includes the necessary diodes and Zener diodes You can find more information on this topic in the section entitled "Marshalled Termination Assembly (MTA)" Figure 5-3: MTA Entry ID: , V3.2, 09/

58 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI 5.3 Parameters for hardware configuration For the 1oo2 evaluation scheme with evaluation in the redundant F-AIs, the F-AIs are configured in STEP 7 HW Config. Figure 5-4 shows an example of a hardware configuration. An ET 200M with PROFIBUS address 3 and a second ET 200M with PROFIBUS address 4 are used. Each ET 200M includes one F-AI in slot 4. You can find more information about the HW configuration in the chapter entitled References under \4\. Figure 5-4: Redundant F-AI 1oo2 (evaluation in the F-AI) design diagram In the HW Config, you must configure the two F-AIs as a redundant pair. You can access the F-AI redundancy settings via the object properties of one of the F-AIs in each case. In the example of the hardware set-up shown in Figure 5-4 the redundancy setting is made using the F-AI that is in the ET 200M with PROFIBUS address 3. Figure 5-5 shows the interface for the redundancy settings with Table 5-2 grouping the settings. Entry ID: , V3.2, 09/

59 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI Figure 5-5: Redundant F-AI 1oo2 evaluation in the F-AI (redundancy parameters) Table 5-2: Redundant module 1oo2 evaluation in the F-AI (redundancy parameters)) Parameters Description/recommendations Desired setting or permissible value range Redundancy Redundant module Indication of whether or not the F-AI functions as part of a redundant pair. Comment: For redundancy, you must set the parameter on two modules/assemblies. This is used to choose the redundant partner module. Two modules/ assemblies Note Depending on the versions of the module and the hardware configuration pack, the names of the parameters and the configuration window may differ from the information in this section. You can find further information in the documentation of the module. After making the redundancy settings, you can set the rest of the hardware parameters for the redundant F-AI as described at the end of Section 4.3 The settings are applied automatically on the redundant partner. Entry ID: , V3.2, 09/

60 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI 5.4 Creating the logic Even though this evaluation scheme uses redundant F-AIs, only one F_CH_AI F channel driver is needed in the logic configuration. It is possible to add and configure the F channel driver either automatically by means of the SIMATIC Safety Matrix or manually using the STEP 7 CFC Editor. In both cases, the F channel driver must be linked to the analog sensor signal of the F-AI with the lower I/O address. When you have configured the F channel driver and the evaluation logic is complete, the system compiles the logic. If the option to generate module drivers is activated at compilation, then the system automatically adds and configures the corresponding F_PS_12 module drivers to the logic at compilation. The F channel driver selects the valid signal and switches to the signal of the redundant module if there is a disturbance. The driver does not carry out delta monitoring of the redundant signals Configuring using Safety Matrix After 1oo2 evaluation has been configured in the F-AI, it is possible to implement the CPU logic to read an individual sensor. One of the methods implementation is to use the SIMATIC Safety Matrix Engineering Tool (for more information on this topic, see the chapter entitled References under \5\). The actual evaluation logic for the 1oo2 evaluation scheme using redundant F-AIs is the same as is described in section (Configuring using Safety Matrix). Entry ID: , V3.2, 09/

61 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI Configuring using CFC As an alternative to using the Safety Matrix Tool, you can implement the CPU logic for reading the input signal using the STEP 7 CFC Editor. After the F-AI has carried out 1oo2 evaluation, you can generate the evaluation logic in the CFC Editor. There are two options for implementing the CFC logic: Without evaluation of the channel error (1oo1) With evaluation of the channel error (1oo1D) Logic without evaluation of the channel error (1oo2 on the F-AI)Figure 5-6 shows a sample logic for reading an individual input signal that in the CFC Editor that does not take into account a channel error. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Note In the logic that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. Figure 5-6: CFC Logic Without channel error evaluation Entry ID: , V3.2, 09/

62 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI The sample logic in Figure 5-6 functions as follows: The redundant F-AI evaluates both sensor signals and returns a value to the CPU for further-processing. Depending on the setting of the Standard value parameter in the hardware configuration, this value corresponds to the higher or lower value of one of the sensors or &H7FFF in the case of a discrepancy. The F_CH_AI F channel driver evaluates both sensor signals and returns a value to the logic for further-processing. If the process value is in the normal range (in this case: less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the process value exceeds the limit value (in this case: greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic must be linked to the corresponding shutdown logic. To create the configuration, generate an F_CH_AI F channel driver for the analog input signal and link it to the symbol on the F-AI with the lower channel number (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logic with evaluation of the channel error (1oo2D) Figure 5-7 shows a sample logic that was created in the CFC Editor for reading an input signal that takes into account a channel error. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 5-7: CFC logic Channel error evaluation Entry ID: , V3.2, 09/

63 Siemens AG 2017 All rights reserved 5 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the F-AI The sample logic in Figure 5-7 functions as follows: The F-AI evaluates both sensor signals and returns a value to the CPU for further-processing. Depending on the setting of the Standard value parameter in the hardware configuration, this value corresponds to the higher or lower value of one of the sensors or &H7FFF in the case of a discrepancy. If the process value is in the normal range (in this case: less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the undisturbed process value exceeds the limit value (in this case: greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). If both F_AIs report a channel error, the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic must be linked to the corresponding shutdown logic. The necessary steps to generate the logic are described below: Generate an F_CH_AI F channel driver for the analog input signal and link it to the symbol on the F-AI with the lower channel number (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logically AND the following signals to generate the signal for the -trigger command: Negated value of the limit value block (QHN or QLN) Negated value of the channel error output (QBAD) of the F channel driver Entry ID: , V3.2, 09/

64 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program The 2-sensor or 1oo2 evaluation scheme refers to applications that need two sensors to achieve the required Safety Integrity Level. 1oo2 evaluation means that only one of the two sensors must fail for the safety function to be triggered. By contrast with evaluation in the F-AI, evaluation in the user program is carried out to have available the visibility of both signals and their quality in the application logic. This makes possible more flexible evaluation schemes (e.g. 1oo2D or 2oo2). Note This architecture can achieve Safety Integrity Level SIL3. However, to be SILcompliant, the entire safety instrumented function including the field devices must be evaluated according to IEC / IEC We recommend two fundamentally different 1oo2 architectures as options: Option 1: As shown in Figure 6-1 both sensors are wired to one F-AI. In this figure, one sensor is wired to channel 0 of the F-AI with the second one being wired to its channel 3. Option 2: As shown in Figure 6-2 both sensors are wired to two F-AIs. In this figure, one sensor is wired to channel 0 of the first F-AI with the second one being wired to channel 0 of the second F-AI. Entry ID: , V3.2, 09/

65 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program 6.1 Option 1 Figure 6-1: 1oo2 evaluation in the user program Sensor 1 Sensor F-AI Ch 0..5 F_ CH _AI CPU 1oo2 Voting Logic The set-up shown in Figure 6-1 is suitable for achieving SIL3. The table below shows when the safety function trips. Table 6-1: Failure modes Component failed? Sensor 1 Sensor 2 F-AI Tripping of safety function? No No No No X Yes X Yes Yes X X Yes X X Yes Yes Entry ID: , V3.2, 09/

66 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Calculation of PFD (option 1) The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(Ein) = PFD Sensor + PFD F-AI + PFD CPU You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 1oo2 sensor using the following formula 5 : PFD 1oo2 6.2 Option T T DU I I DU 3 2 Figure 6-2: 1oo2 evaluation in the user program F-AI Ch 0..5 Sensor 1 0 CPU F_CH_AI 1oo2 Voting Logic Sensor 2 0 F-AI Ch 0..5 The set-up shown in Figure 4-2 is suitable for achieving SIL3. 5 The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4, see Appendix Entry ID: , V3.2, 09/

67 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program The table below shows when the safety function trips. Table 6-2: Failure modes Component failed? Sensor 1 Sensor 2 F-AI 1 F-AI 2 Tripping of safety function? No No No No No X X X Yes Yes X X Yes X Yes X Yes X X Yes Yes X X X Yes Calculation of PFD (option 2) The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(Ein) = PFD Sensor + 2 PFD F-AI + PFD CPU You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 1oo2 sensor using the following formula 6 : PFD 1oo2 2 2 T T DU I I DU The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4, see Appendix Entry ID: , V3.2, 09/

68 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program 6.3 Wiring Conventional wiring In the 1oo2 evaluation scheme, the F-AI or an external power supply can supply power to the sensors. The illustrations below show the wiring for 2-wire and 4-wire transmitters that supplied via the F-AI or an external power supply. In the illustrations below, the transmitters are wired to two channels of one F-AI. The first sensor is wired to channel 0 (terminals 3, 4, 5 bridge to 1M) with the second one being wired to channel 3 (terminals 12, 13, 14 bridge to 1M). Power is supplied to the F-AI via 1L+/1M (terminals 1 and 2); depending on the channel, the power of the sensors is supplied via V s0... V s5 (terminals 3, 6, 9, 12, 15, 18) or by an external power supply. Figure 6-3: 2-wire transmitter (with own power supply) 2-Wire Current Sensor 2-Wire Current Sensor Entry ID: , V3.2, 09/

69 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program SM336; AI 6x 0/4...20mA HART L+ 1 1L+ M 2 1M CH0 Vs0 M0+ M Draht 2-Wire Messumformer Current Sensor Vs1 6 CH1 M1+ 7 M1-8 CH2 Vs2 M Draht 2-Wire Messumformer Current Sensor M2-11 Vs3 12 CH3 M3+ 13 M3-14 Vs4 15 CH4 CH5 M4+ M4- Vs5 M5+ M Entry ID: , V3.2, 09/

70 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Figure 6-4: 4-wire transmitter (with own power supply) SM336; AI 6x 0/4...20mA HART L+ 1 1L+ M 2 1M Vs0 3 CH0 M0+ M0- Vs Draht 4-Wire Messumformer Current Sensor CH1 M1+ 7 M1-8 Vs2 9 CH2 M2+ 10 M Draht 4-Wire Messumformer Current Sensor Vs3 12 CH3 M3+ 13 M3-14 Vs4 15 CH4 CH5 M4+ M4- Vs5 M5+ M Entry ID: , V3.2, 09/

71 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program 4-Wire Current Sensor 4-Wire Current Sensor Entry ID: , V3.2, 09/

72 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Figure 6-5 shows an example in which an external power supply is used with 2-wire sensors: M3+ M3- Vs4 M4+ M4- Vs5 M5+ M5- Figure 6-5: 2-wire transmitter supplied externally SM336; AI 6x 0/4...20mA HART L+ 1 1L+ M 2 1M Vs Draht 2-Wire CH0 M0+ 4 Messumformer Sensor Current - M V Vs1 6 CH1 M1+ 7 M1-8 CH2 Vs2 M Draht 2-Wire Messumformer Current Sensor V Vs CH3 CH4 CH5 M Entry ID: , V3.2, 09/

73 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program 2-Wire Current Sensor 2-Wire Current Sensor Entry ID: , V3.2, 09/

74 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Figure 6-6 shows an external voltage source with 4-wire sensors. M4+ M4- Vs5 M5+ M5- Figure 6-6: 4-wire transmitter (supplied externally) SM336; AI 6x 0/4...20mA HART L+ 1 1L+ M 2 1M Vs0 3 CH0 M Draht 4-Wire M0-5 - Messumformer Sensor Current Vs V CH1 CH2 M1+ M1- Vs2 M M2- Vs Draht 4-Wire Messumformer Current Sensor V CH3 M3+ 13 Vs CH4 CH5 M Entry ID: , V3.2, 09/

75 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program 4-Wire Current Sensor 4-Wire Current Sensor Entry ID: , V3.2, 09/

76 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Wiring using Marshalled Termination Assemblies (MTAs) Siemens offers Marshalled Termination Assemblies (MTAs) Using an F-AI-MTA for this evaluation scheme makes wiring between the sensors and the ET 200M signal modules much easier, since it already includes the necessary diodes and Zener diodes You can find more information on this topic in the section entitled "Marshalled Termination Assembly (MTA)" Figure 6-7: MTA Entry ID: , V3.2, 09/

77 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program 6.4 Parameters for hardware configuration To carry out configuration, highlight the F-AI in the HW Config hardware catalog and insert it into an existing ET 200M station. To make configuration easier, choose meaningful symbol names for the channels. You can see an example of a hardware set-up using one F-AI in Figure 6-8 In this example, the two sensor signals are wired to the first two channels of the F-AI. You can find more information about the HW configuration in the chapter entitled References under \4\. Note that the use of an F-AI MTA does not need special consideration of the software configuration. Figure 6-8 In the object properties of the inserted F-AI, you set the necessary parameters for operating the F-AI (see Figure 6-9 and Figure 6-10). Entry ID: , V3.2, 09/

78 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program The parameters are grouped in Table 6-3 Figure 6-9: Parameters part 1 Figure 6-10: Parameters part 2 Entry ID: , V3.2, 09/

79 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Table 6-3: 1oo2 evaluation in the user program (parameters for hardware configuration) Parameters Description/recommendations Desired setting or permissible value range F_target_address F_monitoring_ time (ms) Diagnostic interrupt Behavior after channel faults HART_Gate Interference frequency suppression (Hz) Evaluation of the sensors F-parameter PROFIsafe address of the F-signal module (set using DIL switches). Monitoring time for safety-related communication between the CPU and the F-AI. Comment: A table is available on the Siemens Support website to help users to calculate F-monitoring times (see the chapter entitled References under \10\). Module parameters Various error events trigger a diagnostic interrupt, which the module can detect. These events are then reported to the CPU. Comment: If the diagnostic interrupt is enabled at the module level, then individual diagnostics events must be activated at the channel level. Passivation of the entire module/passivation of the channel. Comment: Not relevant for F systems Works on a cross-module basis as a failsafe main switch. With OFF, HART communication is disabled. With ON, HART communication is enabled. With "selectable, the HART modem can be switched from the safety program for maintenance. Selection for balancing the integration time of the A/D converter to the network that is being used. The integration time is: 20 ms at 50 Hz ms at 60 Hz Activation of the channel by specifying the sensor evaluation. Disabled 1oo1 (1v1) 1oo21 (2v2) If 1oo1 is selected, the following parameters are not available: Discrepancy time Tolerance Standard value or ms Default 2500ms Enable/disable Module/ Channel off/ on/ Selectable 50/60 Hz 1oo1 (1v1) Entry ID: , V3.2, 09/

80 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Parameters Description/recommendations Desired setting or permissible value range Measuring range F_opencircuit_detection Smoothing Selection of the measuring range for the channel. Selection of whether wire break monitoring is to be carried out for the channel or not. Number of measuring cycles for which smoothing is to be carried out ma ma Enable/disable 1, 4, 16, 64 Note Depending on the versions of the module and the hardware configuration pack, the hardware parameters and the configuration window may differ from the information in this section. You can find further information in the documentation of the module. Entry ID: , V3.2, 09/

81 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program 6.5 Configuring the logic Configuring using Safety Matrix After the sensor signals for hardware configuration have been added, you can implement the 1oo2 evaluation logic in the user program. One of the options for doing this is to use the SIMATIC Safety Matrix Engineering Tool (for more information on this topic, see the chapter entitled References under \5\). Figure 6-11 shows how to configure a cause for 1oo2 evaluation in the matrix. Use the following settings: Type analog input 2 inputs Function type: OR (1oo2) You must enter Tag1 and Tag2 and they should match the symbolic I/O name of the encoder (e.g. F_TAG1001_X and F_TAG1002_X). You can make the input by selecting the signal from the symbol table. To do this, use the I/O key. The cause is configured with function type OR (1oo2). If at least one encoder matches for triggering, the cause is activated and triggers the corresponding effect(s). Figure 6-11: 1oo2 evaluation in the user program (Safety Matrix configuration) Entry ID: , V3.2, 09/

82 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program As Figure 6-12 shows, there are additional analog parameters that you must configure for the cause: Necessary parameters: Limit value type: MAX or MIN Limit value Optional parameters: Prealarm Hysteresis Delta Units of measurement: Figure 6-12: 1oo2 evaluation in the user program (Safety Matrix analog parameters) Depending on the process application, there are additional available attributes (e.g. time delay and bypass option). One of the configuration options that is highlighted in Figure 6-13 is switch-off behavior in the case of a channel error. If this option is activated, a channel error on a sensor input has the effect of a limit value violation. In the case of an OR (1oo2), with a channel error and the option activated, then the system activates the cause and it triggers the corresponding effect(s). Entry ID: , V3.2, 09/

83 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Figure 6-13: 1oo2 evaluation in the user program (Safety Matrix options) Configuring using CFC As an alternative to using the Safety Matrix Tool, you can implement the 1oo2 evaluation logic for the input signals using the STEP 7 CFC Editor. After the sensor signals for hardware configuration have been added, you can generate the 1oo2 evaluation logic using the CFC Editor. There are two options for implementing the CFC logic: Without evaluation of the channel error (1oo2) With evaluation of the channel error (1oo2D) Note that by using the corresponding logic blocks, you can also implement 2oo2 evaluation in the user program. Entry ID: , V3.2, 09/

84 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program Logic without evaluation of the channel error (1oo2) Figure 6-14 shows a sample logic that was created in the CFC Editor for 1oo2 evaluation that does not take into account the channel errors. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 6-14: CFC Logic Without channel error evaluation Note In the logic that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. The sample logic in Figure 6-14 functions as follows: If both analog sensors return a process value in the normal range (in this case a process value of less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the process value of one or both analog sensors exceeds the limit value (in this case, a process value greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. Entry ID: , V3.2, 09/

85 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program The necessary steps to generate the logic are described below: Create an F_CH_AI channel driver for the first analog sensor and link it to the address of the sensor that is linked to the F-AI (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Create an F_CH_AI channel driver for the second analog sensor and link it to the address of the sensor that is linked to the F-AI (e.g. F_TAG1002_X on EW518). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logically AND the negated output values of the limit value blocks (QHN or QLN). Logic with evaluation of the channel error (1oo2D) Figure 6-15 shows a sample logic that was created in the CFC Editor for 1oo2D evaluation that takes into account the channel errors. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 6-15: CFC logic With channel error evaluation The sample logic in Figure 6-15 functions as follows: If both analog sensors return a process value in the normal range without channel errors (in this case a process value of less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). Entry ID: , V3.2, 09/

86 Siemens AG 2017 All rights reserved 6 Structure and wiring for two sensors (1oo2) Evaluation in the user program If the process value of one or both analog sensors exceeds the limit value (in this case, a process value greater than or equal to 90) and the sensor does not report a channel error, the output of the evaluation logic is 0 (i.e. trigger command). If at least one of the two analog sensors reports a channel error, the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. The necessary steps to generate the logic are described below: Create an F_CH_AI F channel driver for the first analog sensor and link it to the address of the sensor that is linked to the F-AI (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Create an F_CH_AI F channel driver for the second analog sensor and link it to the address of the sensor that is linked to the F-AI (e.g. F_TAG1002_X on EW518). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logically AND the three outputs of the subsequent logic to generate the signal for the -trigger command: Use the negated output of the limit value block (QHN or QLM) of the first F channel driver. Use the negated output of the limit value block (QHN or QLM) of the second F channel driver. Use an OR block to link outputs QBAD of both F channel drivers and use the output signal (OUTN) of the OR block. Entry ID: , V3.2, 09/

87 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program To increase the availability of the I/O modules, you can implement the 2-sensor evaluation scheme using two sensors and a pair of redundant F-AIs. Note The I/O modules of this architecture are certified to achieve Safety Integrity Level SIL3. However, to be SIL-compliant, the entire safety instrumented function including the field devices must be evaluated according to IEC / IEC In the redundant 2(1oo2) architecture, two sensors are wired to a redundant pair of F-AIs. Figure 7-1 shows a block diagram. In the Figure, the first sensor is wired to channel 0 of both F-AIs. The second sensor is wired to channel 1 of both F-AIs. The F-AIs are configured as redundant modules in the HW Config. Only one analog input channel driver block is needed per sensor. The driver block selects one signal from the incoming signals of the redundant F-AI. Figure 7-1: 2(1oo2) evaluation in the user program (redundant module) F-AI Ch0...5 Sensor 1, CH CPU F_CH_AI 1oo2 Voting Logic F-AI 0 Ch0...5 Sensor 2, CH 1 1 The set-up shown in Figure 7-1 is suitable for achieving SIL3. The table below shows when the safety function trips. Entry ID: , V3.2, 09/

88 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program Table 7-1: Failure modes Component failed? Sensor 1 Sensor 2 F-AI 1 F-AI 2 Tripping of safety function? No No No X No No No X No No Yes X X X Yes X Yes X X Yes X X Yes Yes Yes Note Redundancy does not increase the Safety Integrity Level 7.1 Calculation of PFD The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(Ein) = PFD Sensor + 2 PFD F-AI + PFD CPU You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 1oo2 sensor using the following formula 7 : PFD 1oo2 2 2 T T DU I I DU The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4, see Appendix Entry ID: , V3.2, 09/

89 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program 7.2 Wiring Conventional wiring A simplified example of the 2(1oo2) evaluation scheme with evaluation in the user program and redundant F-AI is shown in Figure 7-2 The first sensor is wired to channel 0 (terminals 3, 4, 5) of both F-AIs with the second one being wired to channel 1 (terminals 6, 7, 8) of both F-AIs. Note that this architecture additionally needs two Zener diodes for each sensor. The first Zener diode has a breakdown voltage of 6.2 V and the second one has a breakdown voltage of 5.6 V. Apart from this, two diodes each are used to decouple the power supply. The diodes and Zener diodes are needed for cases in which one of the F-AIs is out of service (e.g. in the case of a module failure, routine maintenance, etc.) Figure 7-2: 2(1oo2) evaluation in the user program (redundant F-AI) SM336; AI 6x 0/4...20mA HART L+ M Vs0 CH0 M0+ M L+ 1M + 2-Wire 2-Draht Current Messumformer - Sensor 1L+ 1M SM336; AI 6x 0/4...20mA HART L+ M Vs0 M0+ CH0 M0- Vs1 6 6 Vs1 CH1 M M1+ CH1 CH2 M1- Vs2 M Draht 2-Wire Current Messumformer - Sensor M1- Vs2 M2+ CH2 M M2- Vs Vs3 CH3 M M3+ CH3 M M3- Vs Vs4 CH4 M M4+ CH4 M M4- Vs Vs5 CH5 M M5+ CH5 M M Wiring using Marshalled Termination Assemblies (MTAs) Siemens offers Marshalled Termination Assemblies (MTAs) Using an F-AI-MTA for this evaluation scheme makes wiring between the sensors and the ET 200M signal modules much easier, since it already includes the necessary diodes and Zener diodes You can find more information on this topic in the section entitled "Marshalled Termination Assembly (MTA)" Entry ID: , V3.2, 09/

90 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program Figure 7-3: MTA 7.3 Parameters for hardware configuration For the 2(1oo2) evaluation scheme with evaluation in the user program and redundant F-AIs, the F-AIs themselves are configured in STEP 7 HW Config. You can find more information about the HW configuration in the chapter entitled References under \4\. Figure 7-4 shows an example of a hardware set-up. In this example, there is an ET 200M (with IM153-2 PROFIBUS interface module) with PROFIBUS address 3 and a second ET 200M with PROFIBUS address 4. Each ET 200M includes one F-AI in slot 4. You can find more information about the HW configuration in the chapter entitled References under \4\. Entry ID: , V3.2, 09/

91 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program Figure 7-4: 2(1oo2) evaluation in the user program (redundant module) Installation plan In the HW Config, you must configure the two F-AIs as a redundant pair. You can access the F-AI redundancy settings via the object properties of one of the F-AIs in each case. You can find more information about HW in the chapter entitled References under \4\. In Figure 7-4 the redundancy setting is made using the F-AI that is in the ET 200M with PROFIBUS address 3. The settings are grouped in Table 7-2 Entry ID: , V3.2, 09/

92 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program Figure 7-5: 2(1oo2) evaluation in the user program (redundant F-AI) redundancy parameters Table 7-2: 2(1oo2) evaluation in the user program (redundant F-AI) redundancy parameters Parameters Description/recommendations Desired setting or permissible value range Redundancy Redundant module Indication of whether or not the F-AI functions as part of a redundant pair. Comment: For redundancy, you must set the parameter on two modules/assemblies. This is used to choose the redundant partner module 2 modules/ assemblies Note Depending on the versions of the module and the hardware configuration pack, the names of the parameters and the configuration window may differ from the information in this section. You can find further information in the documentation of the module. When you have made the redundancy settings, you can set the other hardware parameters in one of the redundant F-AIs. The system automatically applies the settings on the redundant assembly. Entry ID: , V3.2, 09/

93 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program 7.4 Creating the logic Even though this evaluation scheme uses redundant F-AIs, only one F_CH_AI F channel driver is needed in the logic configuration (one F channel driver for each of the two sensors). It is possible to add and configure the F channel drivers either automatically by means of the SIMATIC Safety Matrix or manually using the STEP 7 CFC Editor. In both cases, the drivers must be linked to the analog sensor signal of the F-AI with the lower I/O address. When you have configured the F channel drivers and the evaluation logic is complete, the system compiles the logic. If the option to generate module drivers is activated at compilation, then the system automatically adds and configures the corresponding F_PS_12 module drivers to the logic at compilation. The F channel driver selects the valid signal and switches to the signal of the redundant module if there is a disturbance. The driver does not carry out delta monitoring of the redundant signals Configuring using Safety Matrix After the sensor signals for hardware configuration have been added, you can implement the 1oo2 evaluation logic in the user program. One of the options for doing this is to use the SIMATIC Safety Matrix Engineering Tool (for more information on this topic, see the chapter entitled References under \5\). The actual evaluation logic for the 2(1oo2) evaluation scheme with evaluation in the user program and redundant F-AIs is the same as described in Section (Configuring using Safety Matrix). Entry ID: , V3.2, 09/

94 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program Configuring using CFC As an alternative to using the Safety Matrix Tool, you can implement the 1oo2 evaluation logic for the input signals using the STEP 7 CFC Editor. After the sensor signals for hardware configuration have been added, you can generate the 1oo2 evaluation logic using the CFC Editor. There are two options for implementing the CFC logic: Without evaluation of the channel error (1oo2) With evaluation of the channel error (1oo2D) Note that by using the corresponding logic blocks, you can also implement 2oo2 evaluation in the user program. Logic without evaluation of the channel error (1oo2) Figure 6-14 shows a sample logic that was created in the CFC Editor for 1oo2 evaluation that does not take into account the channel errors. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 7-6: CFC Logic Without channel error evaluation Note In the logic that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. Entry ID: , V3.2, 09/

95 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program The sample logic in Figure 7-6 functions as follows: If both analog sensors return a process value in the normal range (in this case a process value of less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the process value of one or both analog sensors exceeds the limit value (in this case, a process value greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. The necessary steps to generate the logic are described below: Generate an F_CH_AI channel driver for the first analog sensor and link it to the symbol on the F-AI with the lower address (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Generate an F_CH_AI channel driver for the second analog sensor and link it to the symbol on the F-AI with the lower address (e.g. F_TAG1002_X on EW514). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logically AND the negated output values of the limit value blocks (QHN or QLN). Logic with evaluation of the channel error (1oo2D) Figure 7-7 shows a sample logic that was created in the CFC Editor for 1oo2D evaluation that takes into account the channel errors. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Entry ID: , V3.2, 09/

96 Siemens AG 2017 All rights reserved 7 Structure and wiring for two sensors (1oo2) with redundant I/O modules: Evaluation in the user program Figure 7-7: CFC logic With channel error evaluation The sample logic in Figure 7-7 functions as follows: If both analog sensors return a process value in the normal range without channel errors (in this case a process value of less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If the process value of one or both analog sensors exceeds the limit value (in this case, a process value greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). If at least one of the two analog sensors reports a channel error, the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. The necessary steps to generate the logic are described below: Create an F_CH_AI F channel driver for the first analog sensor and link it to the symbol on the F-AI with the lower address (e.g. F_TAG1001_X on EW512). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Generate an F_CH_AI channel driver for the second analog sensor and link it to the symbol on the F-AI with the lower address (e.g. F_TAG1002_X on EW514). Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Logically AND the three outputs of the subsequent logic to generate the signal for the -trigger command: Use the negated output of the limit value block (QHN or QLM) of the first channel driver block. Use the negated output of the limit value block (QHN or QLM) of the second channel driver block. Use an OR block to link outputs QBAD of both channel driver blocks and use the output signal (OUTN) of the OR block. Entry ID: , V3.2, 09/

97 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program The three-sensor (or 2oo3 evaluation scheme) refers to applications that need two sensors to achieve the required Safety Integrity Level and a third one for higher availability. 2oo3 evaluation means that two of the three sensors must trigger. Note The I/O modules in this architecture are certified for Safety Integrity Level SIL3. However, to be SIL-compliant, the entire safety instrumented function including the field devices must be evaluated according to IEC / IEC The 2oo3 basic architecture with evaluation in the user program uses three sensors and three F-AIs. Figure 8-1 shows a block diagram. In the Figure, each sensor is wired to channel 0 of one F-AI. In this example, the F-AIs are installed in one ET 200M. Please note that, due to the system flexibility, other architectures are possible, which differ from the described variants with regard to the availability of the modules and the ET 200M racks, e.g.: Lower availability: All three sensors are connected to one assembly. Similar availability of the assemblies: All three sensors are connected to two assemblies that are redundant from one another. The two assemblies are installed in the same ET 200M Rack (see chapter 9). Higher availability of the assemblies and ET 200M Racks: All three sensors are connected to two assemblies that are redundant from one another. The two assemblies are installed in different ET 200M Racks. Higher availability of the assemblies and ET 200M Racks: Each sensor is connected to one assembly. The assemblies are installed in different ET 200M Racks. Entry ID: , V3.2, 09/

98 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-1: 2oo3 Overview F-AI Ch 0..5 Sensor 1 0 Sensor 2 0 F-AI Ch 0..5 F_CH_AI CPU 2oo3 Voting Logic Sensor 3 0 F-AI Ch 0..5 Entry ID: , V3.2, 09/

99 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program The set-up shown in Figure 8-1 is suitable for achieving SIL3. The table below shows when the safety function trips. Sensor 1 Sensor 2 Component failed? Sensor 3 F-AI 1 F-AI 2 F-AI 3 Tripping of safety function? Yes No No Yes No No No No Yes No Yes No No Yes Yes No Yes No Yes No No Yes No Yes No No No No Yes Yes No No Yes Yes No No Yes No Yes No Yes No No Yes No X Yes Yes X X X Yes Yes X Yes Yes Yes X X X X X Yes Yes Yes X Yes Yes Yes X 8.1 Calculation of PFD The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(Ein) = PFD Sensor + 3 PFD F-AI + PFD CPU You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 2oo3 sensor using the following formula 8 : PFD T I 2oo3 DUTI DU 8 The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4, see Appendix Entry ID: , V3.2, 09/

100 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program 8.2 Wiring Conventional wiring In the 2oo3 evaluation scheme, the F-AI or an external power supply can supply power to the sensors. Figure 8-2 shows a wiring example for 2-wire sensors and Figure 8-3 shows a wiring example for 4-wire sensors. In both Figures, each transmitter is wired to channel 0 of one F-AI. Figure 8-2: 2oo3 wiring for 2-wire sensors. 2-Wire 2-Draht- Current Mess- Sensor Umformer Wire 2-Draht- Current Mess- Sensor Umformer Wire 2-Draht- Current Mess- Sensor Umformer + - SM336; AI 6x 0/4...20mA HART L+ M 1 2 SM336; 1L+ AI 6x 0/4...20mA HART L+ 1 1L+ M M 2 M SM336; AI 6x 0/4...20mA HART L+ M 1 2 1L+ M Vs0 3 Vs0 3 Vs0 3 CH0 M0+ 4 CH0 M0+ 4 CH0 M0+ 4 M0-5 M0-5 M0-5 Vs1 6 Vs1 6 Vs1 6 CH1 M1+ 7 CH1 M1+ 7 CH1 M1+ 7 M1-8 M1-8 M1-8 Vs2 9 Vs2 9 Vs2 9 CH2 M2+ 10 CH2 M2+ 10 CH2 M2+ 10 M2-11 M2-11 M2-11 Vs3 12 Vs3 12 Vs3 12 CH3 M3+ 13 CH3 M3+ 13 CH3 M3+ 13 M3-14 M3-14 M3-14 Vs4 15 Vs4 15 Vs4 15 CH4 M4+ 16 CH4 M4+ 16 CH4 M4+ 16 M4-17 M4-17 M4-17 Vs5 18 Vs5 18 Vs5 18 CH5 M5+ 19 CH5 M5+ 19 CH5 M5+ 19 M5-20 M5-20 M5-20 Entry ID: , V3.2, 09/

101 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-3: 2oo3 wiring for 4-wire sensors. SM336; AI 6x 0/4...20mA HART L+ M 1 2 1L+ M Vs0 3 CH0 M0+ M Wire 4-Draht- + Current Mess- - umformer Sensor Vs1 6 CH1 CH2 M1+ M1- Vs2 M SM336; AI 6x 0/4...20mA HART L+ M Vs L+ M M2- Vs CH0 M0+ M Wire 4-Draht- + Current Mess- - umformer Sensor CH3 M3+ 13 Vs1 6 CH4 CH5 M3- Vs4 M4+ M4- Vs5 M5+ M CH1 CH2 CH3 M1+ Vs2 M2+ M1- M2- Vs3 M SM336; AI 6x 0/4...20mA HART L+ CH0 M Vs0 M0+ M0- Vs L+ M 4-Wire 4-Draht- + Current Mess- - umformer Sensor M3-14 CH1 M1+ 7 Vs4 15 M1-8 CH4 M4+ 16 Vs2 9 M4-17 CH2 M2+ 10 CH5 Vs5 M5+ M M2- Vs CH3 M3+ 13 M3-14 Vs4 15 CH4 M4+ 16 M4-17 Vs5 18 CH5 M5+ 19 M5-20 Entry ID: , V3.2, 09/

102 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-4 shows a wiring example for 2-wire sensors with an external power supply with Figure 8-5 showing a wiring example for 4-wire sensors with an external power supply. In both Figures, each transmitter is wired to channel 0 of one F-AI. Figure 8-4: 2oo3 wiring for 2-wire sensors (external power supply) M 2L+ M 2L+ M 2L+ 2-Wire 2-Draht- Current Mess- Umformer Sensor Wire 2-Draht- Current Mess- Umformer Sensor Wire 2-Draht- Current Mess- Umformer Sensor + - SM336; AI 6x 0/4...20mA HART L+ M 1 2 SM336; AI 6x 0/4...20mA HART 1L+ L+ 1 1L+ M M 2 M SM336; AI 6x 0/4...20mA HART L+ M 1 2 1L+ M Vs0 3 Vs0 3 Vs0 3 CH0 M0+ 4 CH0 M0+ 4 CH0 M0+ 4 M0-5 M0-5 M0-5 Vs1 6 Vs1 6 Vs1 6 CH1 M1+ 7 CH1 M1+ 7 CH1 M1+ 7 M1-8 M1-8 M1-8 Vs2 9 Vs2 9 Vs2 9 CH2 M2+ 10 CH2 M2+ 10 CH2 M2+ 10 M2-11 M2-11 M2-11 Vs3 12 Vs3 12 Vs3 12 CH3 M3+ 13 CH3 M3+ 13 CH3 M3+ 13 M3-14 M3-14 M3-14 Vs4 15 Vs4 15 Vs4 15 CH4 M4+ 16 CH4 M4+ 16 CH4 M4+ 16 M4-17 M4-17 M4-17 Vs5 18 Vs5 18 Vs5 18 CH5 M5+ 19 CH5 M5+ 19 CH5 M5+ 19 M5-20 M5-20 M5-20 Entry ID: , V3.2, 09/

103 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-5: 2oo3 wiring for 4-wire sensors (external power supply) SM336; AI 6x 0/4...20mA HART L+ M 1 2 1L+ M Vs0 3 CH0 M0+ M Draht- 4-Wire Messumformer Current Sensor 2L+ M Vs1 6 CH1 CH2 M1+ M1- Vs2 M SM336; AI 6x 0/4...20mA HART L+ M 1 2 1L+ M Vs0 3 CH3 M2- Vs3 M CH0 M0+ M0- Vs Draht- 4-Wire Messumformer Current Sensor 2L+ M CH4 M3- Vs4 M4+ M CH1 CH2 M1+ M1- Vs2 M SM336; AI 6x 0/4...20mA HART L+ M Vs L+ M 2L+ CH5 Vs5 M5+ M CH3 M2- Vs3 M3+ M CH0 CH1 M0+ M0- Vs1 M Draht- 4-Wire Messumformer Sensor Current M Vs4 15 M1-8 CH4 M4+ 16 Vs2 9 M4-17 CH2 M2+ 10 Vs5 18 CH5 M5+ 19 M2-11 M5-20 Vs3 12 CH3 M3+ 13 M3-14 Vs4 15 CH4 M4+ 16 M4-17 Vs5 18 CH5 M5+ 19 M5-20 Entry ID: , V3.2, 09/

104 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program 8.3 Parameters for hardware configuration The three F-AIs that are needed for the 2oo3 evaluation scheme are configured in STEP 7 HW Config. To carry out configuration, highlight the F-AI in the STEP 7 hardware catalog. Add it i times to the existing hardware configuration. Configure the channels that are used and assign meaningful symbol names. Figure 8-6: Symbol editing You can see an example of a hardware set-up using three F-AIs in Figure 8-6 In this example, the ET 200M (IM153-2) contains one F-AI in slots 4, 5 and 6. One of the three sensor signals is wired to the first channel of an F-AI. You can find more information about the HW configuration in the chapter entitled References under \4\. In the object properties of the inserted F-AI, you set the necessary parameters for operating the F-AI (see Figure 8-7). The parameters themselves are grouped in Table 8-1 Entry ID: , V3.2, 09/

105 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-7: F-AI hardware parameters Table 8-1: F-AI hardware configuration parameters Parameters Description/recommendations Desired setting or permissible value range F_target_address F-parameter PROFIsafe address of the F-signal module (set using DIL switches) F_monitoring_time (ms) Monitoring time for safety-related communication between the CPU and the F-AI. Comment: A table is available on the Siemens Support website to help users to calculate F-monitoring times (see the chapter entitled References under \10\) ms Default 2500 ms Entry ID: , V3.2, 09/

106 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Parameters Description/recommendations Desired setting or permissible value range Module parameters Diagnostic interrupt Various error events trigger a diagnostic interrupt, which the module can detect. These events are then reported to the CPU. Comment: If the diagnostic interrupt is enabled at the module level, then individual diagnostics events must be activated at the channel level. Enable/disable Behavior after channel faults Passivation of the entire module/passivation of the channel. Comment: Not relevant for F systems Module/ Channel HART_Gate Works on a cross-module basis as a failsafe main switch. With OFF, HART communication is disabled. With ON, HART communication is enabled. With "selectable, the HART modem can be switched from the safety program for maintenance. off/ on/ Selectable Interference frequency suppression (Hz) Selection for balancing the integration time of the A/D converter to the network that is being used. The integration time is: 20 ms at 50 Hz ms at 60 Hz 50/60 Hz Evaluation of the sensors Activation of the channel by specifying the sensor evaluation. Disabled 1oo1 (1v1) 1oo2 (2v2) If 1oo1 is selected, the following parameters are not available: Discrepancy time Tolerance Standard value 1oo1 (1v1) Measuring range Selection of the measuring range for the channel ma ma F_Wire_break detection Selection of whether wire break monitoring is to be carried out for the channel or not. Enable/disable Smoothing Number of measuring cycles for which smoothing is to be carried out. 1, 4, 16, 64 Note Depending on the versions of the module and the hardware configuration pack, the hardware parameters and the configuration window may differ from the information in this section. You can find further information in the documentation of the module. Entry ID: , V3.2, 09/

107 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program 8.4 Creating the logic Configuring using Safety Matrix After the three sensor signals for hardware configuration have been added, you can implement the 2oo3 evaluation logic in the user program. One of the options for doing this is to use the SIMATIC Safety Matrix Engineering Tool (for more information on this topic, see the chapter entitled References under \5\). Figure 8-8 shows how to configure a cause for 2oo3 monitoring in the matrix. Use the following settings: Type analog input 3 inputs Function type: Majority evaluation (2oo3 evaluation) You must enter Tag1, Tag2, and Tag2 and they should match the symbolic I/O name of the encoder (e.g. F_TAG1001_X, F_TAG1002_X, and F_TAG 1003_X). You can make the input by selecting the signal from the symbol table. To do this, use the I/O key. The cause is configured with a majority evaluation (2oo3 evaluation). If at least two of the three encoders match for triggering, the cause is activated and triggers the corresponding effect(s). Note that you can also configure different evaluation architectures, i.e. 1oo3 (OR) or 3oo3 (AND). Figure 8-8: Safety Matrix configuring Entry ID: , V3.2, 09/

108 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program As Figure 8-9 shows, there are additional analog parameters that you must set for the cause: Necessary parameters: Limit value type: MAX or MIN Limit value Optional parameters: Prealarm Hysteresis Delta Unit of measurement The system reports exceeding of the delta value. It is not evaluated as a shutdown criterion. Figure 8-9: Safety Matrix analog parameters Depending on the process application, there are additional available attributes (e.g. time delay and bypass option). Entry ID: , V3.2, 09/

109 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program One of the configuration options that is highlighted in Figure 8-10 is switch-off behavior in the case of a channel error. If this option is activated, a channel error is evaluated at one of the sensor inputs as a trigger signal. In a majority evaluation (2oo3) with the option activated, two channel errors or one channel error and one limit value violation of another channel lead to the activation of the cause and triggering of the corresponding effect(s). Figure 8-10: Safety Matrix options Entry ID: , V3.2, 09/

110 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Configuring using CFC As an alternative to using the Safety Matrix Tool, you can implement the 2oo3 evaluation logic for the CPU using the STEP 7 CFC Editor. After the three sensor signals for hardware configuration have been added, you can generate the 2oo3 evaluation logic using the CFC Editor. There are two options for implementing the CFC logic: Without evaluation of the channel error (2oo3) With evaluation of the channel error (2oo3D) Logic without evaluation of the channel error (2oo3) The logic corresponds to the Safety Matrix configuration in which the Trip on bad quality function is not activated. The input signals are not monitored for a maximum delta. Entry ID: , V3.2, 09/

111 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-11 shows a sample logic for 2oo3 evaluation in the CFC Editor that does not take into account channel errors. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). The logic corresponds to the Safety Matrix configuration in which the Trip on bad quality function is not activated. The input signals are not monitored for a maximum delta. Entry ID: , V3.2, 09/

112 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-11: CFC Logic Without channel error evaluation The logic corresponds to the Safety Matrix configuration in which the Trip on bad quality function is not activated. The input signals are not monitored for a maximum delta. Entry ID: , V3.2, 09/

113 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-11 functions as follows: If at least two of the three analog sensors report a normal value (in this case a process value of less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If at least two analog sensors report a limit value violation (in this case a process value greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. The necessary steps to generate the logic are described below: Generate an F_CH_AI F channel driver for the first analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Generate an F_CH_AI F channel driver for the second analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Generate an F_CH_AI F channel driver for the third analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Link the negated outputs of the limit value blocks (QHN or QLN) to the inputs of an F_2OUT3 block to generate the signal for the trigger command. Logic with evaluation of the channel error (2oo3D) Entry ID: , V3.2, 09/

114 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-12 shows a sample logic for 2oo3D evaluation in the CFC Editor that takes into account channel errors. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). The logic corresponds to the Safety Matrix configuration in which the Trip on bad quality function is activated. The input signals are not monitored for a maximum delta. Entry ID: , V3.2, 09/

115 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-12: CFC logic With channel error evaluation The logic corresponds to the Safety Matrix configuraion in which the Trip on bad quality function is activated. The input signals are not monitored or a maximum delta. The logic corresponds to the Safety Matrix configuration in which the Trip on bad quality function is activated. The input signals are not monitored for a maximum delta. Entry ID: , V3.2, 09/

116 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program Figure 8-12 functions as follows: If at least two of the three analog sensors report a normal value without channel errors (in this case a process value of less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If two or more of the analog sensors report a limit value violation without channel errors (in this case a process value greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). If two or more of the analog sensors report a channel error, the output of the evaluation logic is 0 (i.e. trigger command). If one sensor reports a channel error and the other two do not, the system only uses the values of the sensors without a channel error for the evaluation logic. The output of the logic should be linked to the corresponding shutdown logic. Entry ID: , V3.2, 09/

117 Siemens AG 2017 All rights reserved 8 Structure and wiring for three sensors (1oo3) Evaluation in the user program The necessary steps to generate the logic are described below: Generate an F_CH_AI channel driver for the first analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Generate an F_CH_AI channel driver for the second analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Generate an F_CH_AI channel driver for the third analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Implement the evaluation logic by interconnecting the inputs of an F_2OUT3 block with the outputs of the following AND logic operations: The negated output QBAD (F_NOT) of the first channel driver with the negated value of the first limit value block output (QHN or QLN). The negated output QBAD (F_NOT) of the second channel driver with the negated value of the second limit value block output (QHN or QLN). The negated output QBAD (F_NOT) of the third channel driver with the negated value of the third limit value block output (QHN or QLN). Entry ID: , V3.2, 09/

118 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program There are additional 2oo3 evaluation architectures in which the three sensors are wired to redundant F-AIs. As with the previous architectures, this 2oo3 evaluation scheme refers to applications that need two sensors to achieve the necessary Safety Integrity Level. In this architecture, the third sensor increases availability. Two of the three sensors must function. If at least two sensors display a trigger condition, the safety logic is tripped. Note These architectures are in a position to achieve Safety Integrity Level SIL3, since the three signals are evaluated in the user program. However, to be SILcompliant, the entire safety instrumented function including the field devices must be evaluated according to IEC / IEC Figure 9-1 shows a block diagram with redundant F-AIs. This optional 2oo3 architecture uses three sensors and two F-AIs. In the Figure, the three sensors are wired to channels 0, 1, and 2 of both F-AIs. Entry ID: , V3.2, 09/

119 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program Figure 9-1: Optional architecture overview Sensor 1 0 F-AI Ch Sensor 2 1 Sensor 3 2 F_ CH_ AI CPU 2 oo3 Voting Logic F-AI Ch The set-up shown in Figure 9-1 is suitable for achieving SIL3. This redundant 2oo3 architecture is one possible variant. Even though this architecture uses one less F-AI than the one that we described before, it has similar availability. If you only need a few failsafe analog inputs, this variant is more favorably priced. The non-redundant version is also a possible option if you only have available one F-AI. It makes possible higher availability of the sensors; however, it forfeits the higher availability on the F-AI. Entry ID: , V3.2, 09/

120 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program The table below shows the status that occurs if one or two components fail Table 9-1: Failure modes Component failed? Sensor 1 Sensor 2 Sensor 3 F-AI 1 F-AI 2 Tripping of safety function? X No No X No No No X No No No X X No No No X No X No No No X X X X Yes Yes Yes X Yes Yes X X Yes X Yes Yes Yes X Note Redundancy does not increase the Safety Integrity Level. 9.1 Calculation of PFD The Probability of Failure on Demand (PFD) value describes the probability of failure of the safety function Calculation formula for PFD You calculate the PFD value for this architecture of wiring and evaluation using this formula: PFD(2oo3) = PFD Sensor + 2 PFD F-AI + PFD CPU You can find the PFD F-AI and PFD CPU values in Section 10. You calculate the PFD Sensor value for a 2oo3 sensor using the following formula 9 : PFD T I 2oo3 DUTI DU 9 The formula was taken from IEC61508, IEC and VDI 2180 Sheet 4, see Appendix Entry ID: , V3.2, 09/

121 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program 9.2 Wiring Conventional wiring A simplified example of the 2(2oo3) evaluation scheme with evaluation in the user program and redundant F-AI is shown in Figure 9-2 The first sensor is wired to channel 0 (terminals 3, 4, 5) of both F-AIs, the second one is wired to channel 1 (terminals 6, 7, 8) and the third one wired to channel 2 (terminals 9, 10, 11) of both F-AIs. Note that this architecture additionally needs two Zener diodes for each sensor. The first Zener diode has a breakdown voltage of 6.2 V and the second one has a breakdown voltage of 5.6 V. Apart from this, two diodes each are used to decouple the power supply. The diodes and Zener diodes are needed for cases in which one of the F-AIs is out of service (e.g. in the case of a module failure). Figure 9-2: 2oo3(2v3) evaluation, redundant F-AI, three-channel transmitter SM336; AI 6x 0/4...20mA HART L+ M Vs0 CH0 M0+ M L+ 1M + 2-Draht 2-Wire Messumformer - Current Sensor 1L+ 1M SM336; AI 6x 0/4...20mA HART L+ M Vs0 M0+ CH0 M0- CH1 Vs1 M1+ M Draht 2-Wire Messumformer Current - Sensor Vs1 M1+ M1- CH1 CH2 Vs2 M Draht 2-Wire Messumformer Current - Sensor 9 10 Vs2 M2+ CH2 M M2- Vs Vs3 CH3 M M3+ CH3 M M3- Vs Vs4 CH4 M M4+ CH4 M M4- Vs Vs5 CH5 M M5+ CH5 M M5- Entry ID: , V3.2, 09/

122 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program 9.3 Parameters for hardware configuration For the 2(2oo3) evaluation scheme with evaluation in the user program and redundant F-AIs, the F-AIs themselves are configured in STEP 7 HW Config. Figure 9-3 shows an example of a hardware set-up. In this example, there is an ET 200M (IM153-2) with PROFIBUS address 3 and a second ET 200M with PROFIBUS address 4. Each ET 200M includes one F-AI in slot 4. You can find more information about the HW configuration in the chapter entitled References under \4\. Figure 9-3: 2(2oo3) evaluation in the user program (redundant module) installation plan In the HW Config, you must configure the two F-AIs as a redundant pair. You can access the F-AI redundancy settings via the object properties of one of the F-AIs in each case. In the example of the hardware set-up shown in Figure 9-4 the redundancy setting is made using the F-AI of the ET 200M with PROFIBUS address 3. The settings are grouped in Table 9-2 Entry ID: , V3.2, 09/

123 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program Figure 9-4: 2(2oo3) evaluation in the user program (redundant module) redundancy parameters Table 9-2: 2(2oo3) evaluation in the user program (redundant module) redundancy parameters Parameters Description/recommendations Desired setting or permissible value range Redundancy Redundant module Indication of whether or not the F-AI functions as part of a redundant pair. Comment: For redundancy, you must set the parameter on two modules/assemblies. This is used to choose the redundant partner module 2 modules/ assemblies Note Depending on the versions of the module and the hardware configuration pack, the names of the parameters and the configuration window may differ from the information in this section. You can find further information in the documentation of the module. When you have made the redundancy settings, you can set the other hardware parameters in one of the redundant F-AIs. The system automatically applies the settings on the redundant assembly. You will find a description of the hardware parameters at the end of section 0. Entry ID: , V3.2, 09/

124 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program 9.4 Creating the logic Even though this evaluation scheme uses redundant F-AIs, only three F_CH_AI F channel drivers are needed in the logic. It is possible to add and configure the F channel drivers either automatically by means of the SIMATIC Safety Matrix or manually using the STEP 7 CFC Editor. In both cases, the F channel drivers must be linked to the analog sensor signal of the F-AI with the lower I/O address. When you have configured the F channel drivers and the evaluation logic is complete, the system compiles the logic. If the option to generate module drivers is activated at compilation, then the system automatically adds and configures the corresponding F_PS_12 module drivers to the logic at compilation. The F channel driver selects the valid signal and switches to the signal of the redundant module if there is a disturbance. The driver does not carry out delta monitoring of the redundant signals Configuring using Safety Matrix After the three sensor signals for hardware configuration have been added, you can implement the 2oo3 evaluation logic in the user program. One of the options for doing this is to use the SIMATIC Safety Matrix Engineering Tool (for more information on this topic, see the chapter entitled References under \5\). The actual evaluation logic for the 2(2oo3) evaluation scheme with evaluation in the user program and redundant F-AIs is the same as described in Section (Configuring using Safety Matrix). Entry ID: , V3.2, 09/

125 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program Configuring using CFC As an alternative to using the Safety Matrix Tool, you can implement the 2oo3 evaluation logic for the CPU using the STEP 7 CFC Editor. There are two options for implementing the CFC logic: Without evaluation of the channel error (2oo3) With evaluation of the channel error (2oo3D) The logic for both options corresponds to the solutions that are described in Chapter Logic without evaluation of the channel error (2oo3) The logic corresponds to the Safety Matrix configuration in which the Trip on bad quality function is not activated. The input signals are not monitored for a maximum delta. Note In the logic that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. Figure 9-5 shows a sample logic for 2oo3 evaluation in the CFC Editor that does not take into account channel errors. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Entry ID: , V3.2, 09/

126 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program Figure 9-5: CFC Logic Without channel error evaluation The logic corresponds to the Safety Matrix configuration in which the Trip on bad quality function is not activated. The input signals are not monitored for a maximum delta. Note In the logic that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. The sample logic in Figure 9-5 functions as follows: If at least two of the three analog sensors report a normal value (in this case a process value of less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If at least two analog sensors report a limit value violation (in this case a process value greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). The output of the logic should be linked to the corresponding shutdown logic. Entry ID: , V3.2, 09/

127 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program The necessary steps to generate the logic are described below: Generate an F_CH_AI F channel driver for the first analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Generate an F_CH_AI F channel driver for the second analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Generate an F_CH_AI F channel driver for the third analog sensor and link the corresponding I/O signal to the block. Use a limit value block (F_LIM_HL or F_LIM_LL) to compare the signal to the triggering limit value. Link the negated outputs of the limit value blocks (QHN or QLN) to the inputs of an F_2OUT3 block to generate the signal for the trigger command. Entry ID: , V3.2, 09/

128 Siemens AG 2017 All rights reserved 9 Structure and wiring for three sensors (1oo3) with redundant I/O modules: Evaluation in the user program Logic with evaluation of the channel error (2oo3D) The logic corresponds to the Safety Matrix configuration in which the Trip on bad quality function is activated. The input signals are not monitored for a maximum delta. Note In the logic that is shown (SUBS_ON = 0 on the F channel driver), the last valid value is used if there is an error. It is not possible to predict whether this value is above or below the limit value. Figure 9-6 shows a sample logic for 2oo3D evaluation in the CFC Editor that takes into account channel errors. Please note that this example assumes a MAX limit value and that the evaluation logic output for reaching the safe state is switched off (normal state = 1, safe state = 0). Figure 9-6: CFC logic With channel error evaluation The sample logic in Figure 9-6 functions as follows: If at least two of the three analog sensors report a normal value without channel errors (in this case a process value of less than 90), the output of the evaluation logic is 1 (i.e. no trigger command). If two or more of the analog sensors report a limit value violation without channel errors (in this case a process value greater than or equal to 90), the output of the evaluation logic is 0 (i.e. trigger command). If two or more of the analog sensors report a channel error, the output of the evaluation logic is 0 (i.e. trigger command). Entry ID: , V3.2, 09/