Applications & Tools. Calculation examples for safety functions according to EN ISO SINUMERIK 840D sl

Transcription

1 lcover sheet Calculation examples for safety functions according to EN ISO SINUMERIK 840D sl Calculation examples for safety functions at horizontal axes October 2013 Applications & Tools Answers for industry.

2 Siemens Industry Online Support This article is taken from the Siemens Industry Online Support. The following link takes you directly to the download page of this document: Caution The functions and solutions described in this article are predominantly confined to the realization of the automation task. Please also take into account that appropriate protective measures have to be taken with regard to industrial security when connecting your equipment to other parts of the plant, the company network or the Internet. Further information can be found under the item ID V1.0, Entry ID:

3 s Task 1 Solution 2 Terminology/Abbreviations 3 SINUMERIK 840D sl Calculation example for safety functions according to EN ISO Contact person 4 History 5 Calculation examples for safety functions at horizontal axes V1.0, Entry ID

4 Warranty and liability Warranty and liability Note The application examples are not binding and do not claim to be complete regarding the circuits shown, equipment and any other eventuality. The application examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible for ensuring that the described products are used correctly. These application examples do not relieve you of the responsibility to use safe practices in application, installation, operation and maintenance. When using these application examples, you recognize that we cannot be made liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to these application examples at any time without prior notice. If there are any deviations between the recommendations provided in these application examples and other Siemens publications e.g. catalogs the contents of the other documents have priority. We do not accept any liability for the information contained in this document. Any claims against us based on whatever legal reason resulting from the use of the examples, information, programs, engineering and performance data, etc. described in this application example, shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act ( Produkthaftungsgesetz ), in case of intent, gross negligence or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or breach of a condition which goes to the root of the contract ( wesentliche Vertragspflichten ). The damages for a breach of a substantial contractual obligation are, however, limited to the foreseeable damage, typical for the type of contract, except in the event of intent or gross negligence or injury to life, body or health. The above provisions do not imply a change in the burden of proof to your detriment. Any form of duplication or distribution of these application examples or excerpts thereof is prohibited without the express consent of Siemens Industry Sector. 4 V1.0, Entry ID:

5 Table of contents Table of contents Warranty and liability Task Note Introduction Brief description of the examples Solution Example of a component overview Stopping in an emergency (Emergency Stop) When the Emergency Stop pushbutton is pressed, the axis is stopped with a Stop A When the Emergency Stop pushbutton is pressed, the axis is stopped with a Stop C/D Safely stopping external components for Emergency Stop Safe Operating Stop Safe operating stop with the protective door open Safely shutting down external components when the protective door is open Safely reduced speed Traversing the axis with acknowledgment button Safely switching off or switching on external components when an agreement button is pressed Operating mode selection Example of an operating mode selection using an access system Example of a two-channel operating mode selection without access system Start and restart function Evaluating safe feedback signals A safe output cam of one axis results in SBH being selected for the other axis A safe output cam of one axis results in SBH being selected for two other axes A safe output cam of two axes results in SBH being selected for another axis A safe output cam of an axis results in the safe shutdown via contactor relays Evaluating "non-safety relevant" signals Entering data via a human machine interface (HMI) Shutting down drives based on a standard sensor signal Terminology/Abbreviations Contacts History V1.0, Entry ID

6 1 Task 1 Task 1.1 Note The following application examples are intended to serve as basis as to how a Performance Level could be calculated according to EN ISO for an axis subject to the force of gravity. A risk assessment is always the basis for configuring safety functions. The manufacturer of a machine or an authorized representative must carry out this risk assessment in order to determine the applicable safety and health protection requirements for the machine. The machine must be designed and constructed taking into account the results of the risk assessment. 1.2 Introduction Since the December 29, 2009 in the European Community, the requirements of the new Machinery Directive 2006/42/EC apply for functional safety and therefore the protection of people, machines and production materials. This means that all machines that are marketed in the European Community must meet the requirements of this Machinery Directive. You can achieve conformity with the new Machinery Directive and therefore the ability to export and liability security, among other things by applying the EN ISO or EN standard. The proof of safety specified in both standards must prove that the PL (Performance Level) or SIL (Safety Integrity Level) value determined in the risk assessment was reached with the safety solutions applied. A clearly structured risk assessment is the basis for proof of safety! This risk assessment is the first step on the way to achieving a safe machine and this already in the planning phase. Protective measures are derived from the risk assessment to reduce the risk by applying the appropriate safety functions. The safety function solution is then checked and evaluated, as to whether the Performance Level or Safety Integrity, required as a result of the risk assessment, is achieved. 6 V1.0, Entry ID:

7 1 Task 1.3 Brief description of the examples This application example explains how to calculate the Performance Level for safety functions based on the EN ISO standard. The following cases are taken into consideration: Stopping a horizontal axis for an Emergency Stop (safe standstill) Preventing a horizontal axis from unexpectedly starting when the protective doors are open (safe operating stop) Traversing a horizontal axis with acknowledgment button and safe velocity Safely shutting down modules for an Emergency Stop, open protective doors and actuating the acknowledgment button Operating mode selection Start and restart function after an interruption (e.g. NC start) Re-establishing the power feed after an interruption (e.g. machine "on") Evaluation of safety-relevant feedback signals (e.g. safe output cams) Evaluation of "non-safety relevant (standard) signals For all of the examples, it is assumed that a SINUMERIK 840D sl is used with Safety Integrated. Only one drive is assumed when calculating the safety functions. If more than one drive is involved in the safety function, then these additional drives must also be appropriately incorporated in the calculation. You can find detailed calculations for the individual safety functions in the SET and SISTEMA files. You can find calculations for safety functions for axes subject to the force of gravity under: Note The components used in the following examples depend on the particular application. Depending on the particular machine type and application, other components can be used or some components omitted. The user is responsible for selecting the components and for calculating the safety function. V1.0, Entry ID

8 2 Solution 2.1 Example of a component overview Designation Component Order number PFH value MTBF value (Years) B 10 value I1 Protective door switch 3SE5 -..V ,000,000 I2 I3 I4 I5 Emergency Stop button of the HT8 handheld unit Acknowledgment button of the HT8 of the handheld terminal Standard pushbutton (single-channel) Mode selector switch (two channel) x x ,000 2) ,000 2) I6 Standard sensor ,000 2) L1 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB0 L2 NCU PN 6FC5373-0AA30-0AA1 L3 L4 Safety input/output module (4 F-DI/3 F-) ET 200S Safe input module (4/8 F-DI) Et 200S 6ES7138-4FC01-0AB0 6ES7138-4FA04-0AB0 L5 NX SL3040-1NC00-0AA0 L6 Standard input module 6ES7131-4BD01-0AA0 L7 OP 12 6FC5203-0AF02-0AA1 L8 PCU50.5 6FC5250-0DF52-2AA1 RS1 RS2 Drive-CLiQ Interface (integrated SMI interface) Use of a 2-encoder system RS3 Third-party encoder x x x x (single channel) 1.00 x (two channel) x x x ) Manufactu rer's data RS4 Motor including encoder 1FK CC1 Motor Module 6SL E..-.A x K1 Contactor relay 3RH 3RH ,000,000 K2 Contactor relay 3RH 3RH ,000,000-1) 2) In conjunction with Safety Integrated, the encoders are not included in the investigation because all faults that occur in the encoder are detected. Assumed value 8 V1.0, Entry ID:

9 2.2 Stopping in an emergency (Emergency Stop) When the Emergency Stop pushbutton is pressed, the axis is stopped with a Stop A When the Emergency Stop pushbutton is pressed, a Stop A is initiated, and the axis pulses are safely canceled. An axis that is moving coasts down, and is only braked as a result of the friction. The Emergency Stop pushbutton of the HT8 handheld device is connected to a safety input/output module (mixed I/O) of the SIMATIC ET 200S. The Emergency Stop pushbutton is evaluated in the safe programmable logic of the SINUMERIK 840D sl. The PFH value for the electronics of the Drive-CLiQ interface or an SMC/SME (for a 1-encoder system) or the PFH value for a 2-encoder system does not have to be taken into account in this case. This is because the axis only coasts down and is not braked in a controlled fashion. For this example, only safety-relevant components are used. This means that the PFH value of the safety function is obtained by adding the individual PFH values. Example of a block diagram: I2 L1 L2 L5 CC1 Emergency stop button Fig. 2-1 ET 200S; Mixed I/O NCU 7x0.x NX 10 Motor module Calculating the safety function Designation Component Order number PFH value I2 L1 Emergency Stop button of the HT8 handheld unit Safety input/output module (4 F-DI/3 F-) ET 200S x ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x CC1 Motor Module 6SL E..-.A x Result 1.97 x Performance Level achieved: PL d V1.0, Entry ID

10 2.2.2 When the Emergency Stop pushbutton is pressed, the axis is stopped with a Stop C/D When the Emergency Stop pushbutton is pressed, the axis is stopped with a stop C or stop D. For a stop C, the axes are braked as quickly as possible along the ramp (speed setpoint input=0). For a stop D, all of the axes involved brake along the contour. After a parameterized time, a stop A is initiated, the pulses are safely canceled and the axis is in the safe stop condition (SH, STO). The Emergency Stop pushbutton of the HT8 handheld device is connected to a safety input/output module (mixed I/O) of the SIMATIC ET 200S. The Emergency Stop pushbutton is evaluated in the safe programmable logic of the SINUMERIK 840D sl. For a stop C or stop D the axes are braked in a controlled fashion. This means that when calculating the safety function, the Drive CliQ interface or a SMC/SME (for a 1-encoder system) or the PFH value for a 2-encoder system must also be taken into consideration. For this example, only safety-relevant components are used. This means that the PFH value of the safety function is obtained by adding the individual PFH values. 10 V1.0, Entry ID:

11 One encoder system Example of the block diagram with one encoder: I2 L1 L2 L5 RS1 CC1 Emergency stop button ET 200S; Mixed I/O NCU 7x0.x NX 10 DQ Interface 1 encoder system Motor module Fig. 2-2 Calculating the safety function Designation Component Order number PFH value I2 L1 Emergency Stop button of the HT8 handheld unit Safety input/output module (4 F-DI/3 F-) ET 200S x ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS1 Drive-CLiQ Interface (integrated SMI interface) x CC1 Motor Module 6SL E..-.A x Result 2.23 x Performance Level achieved: PL d V1.0, Entry ID

12 Two-encoder system Example of the block diagram with two encoders. I2 L1 L2 L5 RS2 RS3 CC1 Fig. 2-3 Emergency stop button ET 200S; Mixed I/O NCU 7x0.x NX 10 2 encoder system Direct measuring system (Fault exclusion) Motor module Calculating the safety function Designation Component Order number PFH value I2 Emergency Stop button of the HT8 handheld unit x L1 Safety input/output module (4 F- DI/3 F-) ET 200S 6ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS2 Use of a 2-encoder system x CC1 Motor Module 6SL E..-.A x Result 2.04 x Performance Level achieved: PL d 12 V1.0, Entry ID:

13 2.2.3 Safely stopping external components for Emergency Stop Power supply > 2 A In this example, when the Emergency Stop pushbutton is pressed, using two contactor relays (K1, K2) a power supply > 2A for a power module is shut down through two channels. All of the standard modules, which are connected to the power supply of this power module, as well as all of the actuators connected to the standard output modules (), are also in a no-voltage state. The Emergency Stop pushbutton of the HT8 handheld device is connected to a safety input/output module (mixed I/O) of the SIMATIC ET 200S. The Emergency Stop pushbutton is evaluated in the safe programmable logic of the SINUMERIK 840D sl. When actuating the Emergency Stop pushbutton, two contactor relays (K1, K2) are de-energized via a safe output module (P/M switching). The mixed I/O of the ET 200S is duplicated (L1, L3) in the block diagram; this is because it is assumed that the Emergency Stop pushbutton and contactor relays (K1, K2) are connected to different modules ("worst-case" scenario). The blocks for the power module (PM) and the output module (L6) shown in the block diagram are not included in the calculation. The diagram is only intended to make it easy to understand the approach. For this example, safety-relevant components were used for I2, L1, L2 and L3, for which there are PFH values. For the two contactor relays (K1, K2), the PFH value was calculated based on the B 10d value (73% dangerous failures), a diagnostics coverage of 90% (they are controlled via safe programmable logic, the relay is tested by reading back the signals from the auxiliary contacts) and the actuation cycle. IM 151 HF Powermodul F-DI F-DI F- Powermodul Power supply Power supply K1 K2 24 V Fig. 2-4 V1.0, Entry ID

14 Example for the block diagram: I2 L1 L2 L3 PM Emergency stop button ET 200S; Mixed I/O NCU 7x0.x Power module (Fault exclusion) Relay K1 Standard Standard L6 ET 200S; Mixed I/O K2 Relay Output module (Fault exclusion) The Power Module (PM) and the output module (L6) are not considered for calculation. These two components have only been marked for clarification. Fig. 2-5 Calculating the safety function Designation Component Order number PFH value B 10 value I2 Emergency Stop button of the HT8 handheld unit x L1 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L3 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB x K1 Contactor relay 3RH 3RH2 1,000, x K2 Contactor relay 3RH 3RH2 1,000,000 Result 2.29 x Performance Level achieved: PL d 14 V1.0, Entry ID:

15 Power supply < 2 A In this example, when the Emergency Stop pushbutton is pressed, a power supply < 2A for a power module is shut down using a safe output (F-). All of the standard modules, which are connected to the power supply of this power module, as well as all of the actuators connected to the standard output modules (), are also in a no-voltage state. The Emergency Stop pushbutton of the HT8 handheld device is connected to a safety input/output module (mixed I/O) of the SIMATIC ET 200S. The Emergency Stop pushbutton is evaluated in the safe programmable logic of the SINUMERIK 840D sl. When the Emergency Stop pushbutton is pressed, the power supply for the power module is shut down via a safe output module (P/M-switching). The mixed I/O of the ET 200S is duplicated (L1, L3) in the block diagram; this is because it is assumed that the Emergency Stop pushbutton is not connected to the same module which shuts down the supply voltage ("worst-case" scenario). The blocks for the power module (PM) and the output module (L6) shown in the block diagram are not included in the calculation. The diagram is only intended to make it easy to understand the approach. For this example, only safety-relevant components are used. This means that the PFH value of the safety function is obtained by adding the individual PFH values. IM 151 HF Powermodul F-DI F-DI Power supply F- Powermodul Power supply 24 V Fig. 2-6 V1.0, Entry ID

16 Example for the block diagram Standard I2 L1 L2 L3 PM Standard L6 Emergency stop button ET 200S; Mixed I/O NCU 7x0.x ET 200S; Mixed I/O Power module (Fault exclusion) Output module (Fault exclusion) The Power Module (PM) and the output module (L6) are not considered for calculation. These two components have only been marked for clarification.. Fig. 2-7 Calculating the safety function Designation Component Order number PFH value I2 L1 Emergency Stop button of the HT8 handheld unit Safety input/output module (4 F-DI/3 F-) ET 200S x ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L3 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB x Result 1.87 x Performance Level achieved: PL d 16 V1.0, Entry ID:

17 2.3 Safe Operating Stop Safe operating stop with the protective door open For the safe operating stop (SBH, SOS), the axes are in closed-loop position control and their position is monitored. When SBH is active, operating personnel can, for example, enter protected machine areas in the setting-up mode without first having to power-down the machine/drives. If the protective doors are opened, the axes and the spindle are switched into the safe operating stop condition. The protective door switch is connected to a safety input/output module (mixed I/O) of the SIMATIC ET 200S through two channels. The protective door switch is evaluated in the safe programmable logic of the SINUMERIK 840D sl. A fault exclusion can be assumed for the mechanics of the protective door switch. For this example, safety-relevant components were used for I1, L1, L2, L5, RS1, RS2 and CC1, for which there are PFH values. For the protective door switch, the PFH value was calculated based on the B 10d value (20% dangerous failures), a diagnostics coverage of 90% (it is controlled via safe programmable logic) and the actuation cycle. V1.0, Entry ID

18 One encoder system Example for the block diagram I1 L1 L2 L5 RS1 CC1 Protective door switch ET 200S; Mixed I/O NCU 7x0.x NX 10 DQ Interface 1 encoder system Motor module Fig. 2-8 Designation Component Order number PFH value B 10 value I1 L1 Protective door switch Safety input/output module (4 F-DI/3 F- ) ET 200S 3SE5 -..V x ,000,000 6ES7138-4FC01-0AB x L2 NCU FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS1 Drive-CLiQ Interface (integrated SMI interface) x CC1 Motor Module 6SL E..-.A x Result Performance Level achieved: PL d 18 V1.0, Entry ID:

19 Two-encoder system Example for the block diagram I1 L1 L2 L5 RS2 RS3 CC1 Protective door switch ET 200S; Mixed I/O NCU 7x0.x NX 10 2 encoder system Direct measuring system (Fault exclusion) Motor module Fig. 2-9 Calculating the safety function Designation Component Order number PFH value B 10 value I1 L1 Protective door switch Safety input/output module (4 F-DI/3 F- ) ET 200S 3SE5 -..V x ,000,000 6ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS2 Use of a 2-encoder system x CC1 Motor Module 6SL E..-.A x Result 1.46 x Performance Level achieved: PL d V1.0, Entry ID

20 2.3.2 Safely shutting down external components when the protective door is open Power supply > 2 A In this example, when the protective door is opened, a power supply > 2A for a power module is shut down using two contactor relays (K1, K2). All of the standard modules, which are connected to the power supply of this power module, as well as all of the actuators connected to the standard output modules (), are also in a no-voltage state. The protective door switch is connected to a safety input/output module (mixed I/O) of the SIMATIC ET 200S through two channels. The protective door switch is evaluated in the safe programmable logic of the SINUMERIK 840D sl. A fault exclusion can be assumed for the mechanics of the protective door switch. When the protective door is opened, two contactor relays (K1, K2) are deenergized via a safe output module (P/M switching). The mixed I/O of the ET 200S is duplicated (L1, L3) in the block diagram; this is because it is assumed that the Emergency Stop pushbutton and contactor relays (K1, K2) are connected to different modules ("worst-case" scenario). The blocks for the power module (PM) and the output module (L6) shown in the block diagram are not included in the calculation. The diagram is only intended to make it easy to understand the approach. For this example, safety-relevant components were used for L1, L2 and L3, for which there are PFH values. For the protective door switch and the two contactor relays (K1, K2), the PFH value was calculated based on the B 10d value (20% dangerous failures for the protective door switch and 73% dangerous failures for the contactor relays), a diagnostics coverage of 90% (they are controlled via safe programmable logic, the relay is tested by reading back the signals from the auxiliary contacts) and the actuation cycle. IM 151 HF Powermodul F-DI F-DI F- Powermodul Power supply Power supply K1 K2 24 V Fig V1.0, Entry ID:

21 Example for the block diagram I1 L1 L2 L3 PM Protective door switch ET 200S; Mixed I/O NCU 7x0.x Power module (Fault exclusion) Relay K1 Standard Standard L6 ET 200S; Mixed I/O K2 Relay Output module (Fault exclusion) The Power Module (PM) and the output module (L6) are not considered for calculation. These two components have only been marked for clarification. Fig Calculating the safety function Designation Component Order number PFH value B 10 value I1 L1 Protective door switch Safety input/output module (4 F-DI/3 F- ) ET 200S 3SE5 -..V x ,000,000 6ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L3 Safety input/output module (4 F-DI/3 F- ) ET 200S 6ES7138-4FC01-0AB x K1 Contactor relay 3RH 3RH2 1,000, x K2 Contactor relay 3RH 3RH2 1,000,000 Result 1.72 x Performance Level achieved: PL d V1.0, Entry ID

22 Power supply < 2 A In this example, when the protective door is opened, a power supply < 2A for a power module is shut down using a safe output (F-). All of the standard modules, which are connected to the power supply of this power module, as well as all of the actuators connected to the standard output modules (), are also in a no-voltage state. The protective door switch is connected to a safe input module (mixed I/O) of the SIMATIC ET 200S through two channels. The protective door switch is evaluated in the safe programmable logic of the SINUMERIK 840D sl. A fault exclusion can be assumed for the mechanics of the protective door switch. When the protective door is opened, the power supply for the power module is shut down via a safe output module (P/M switching). The mixed I/O of the ET 200S is duplicated (L1, L3) in the block diagram; this is because it is assumed that the protective door switch is not connected to the same module which shuts down the supply voltage ("worst-case" scenario). The blocks for the power module (PM) and the output module (L6) shown in the block diagram are not included in the calculation. The diagram is only intended to make it easy to understand the approach. For this example, safety-relevant components were used for L1, L2 and L3, for which there are PFH values. For the protective door switch, the PFH value was calculated based on the B10d value (20% dangerous failures), a diagnostics coverage of 90% (it is controlled via safe programmable logic) and the actuation cycle. IM 151 HF Powermodul F-DI F-DI F- Powermodul Power supply Power supply 24 V Fig V1.0, Entry ID:

23 Example for the block diagram Standard I1 L1 L2 L3 PM Standard L6 Protective door switch ET 200S; Mixed I/O NCU 7x0.x ET 200S; Mixed I/O Power module (Fault exclusion) Output module (Fault exclusion) The Power Module (PM) and the output module (L6) are not considered for calculation. These two components have only been marked for clarification. Fig Calculating the safety function Designation Component Order number PFH value B 10 value I1 L1 Protective door switch Safety input/output module (4 F-DI/3 F- ) ET 200S 3SE5 -..V x ,000,000 6ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L3 Safety input/output module (4 F-DI/3 F- ) ET 200S 6ES7138-4FC01-0AB x Result 1.29 x Performance Level achieved: PL d V1.0, Entry ID

24 2.4 Safely reduced speed Traversing the axis with acknowledgment button The purpose of the safely reduced speed (SG, SLS) function is to safely monitor the load-side speed of an axis/spindle. The actual speed of the axis/spindle is cyclically compared in the monitoring clock cycle with the selected speed limit value. The speed limit values for SG1, SG2, SG3 or SG4 allow various applications/operating states on the machine to be monitored. The safely reduced speed function can therefore be used to implement protective measures for the operating personnel and machine in the setting-up mode or also in automatic operation. The protective door is open. The axes and the spindle are in safe operating stop If the acknowledgment button is pressed, for the selected axis, the safe operating stop is withdrawn and the safely reduced speed becomes active. The acknowledgment button is connected to a safety input/output module (mixed I/O) of the SIMATIC ET 200S through two channels. The acknowledgment button is evaluated in the safe programmable logic of the SINUMERIK 840D sl. For this example, only safety-relevant components are used. This means that the PFH value of the safety function is obtained by adding the individual PFH values. 24 V1.0, Entry ID:

25 One encoder system Example for the block diagram I3 L1 L2 L5 RS1 CC1 Enabling button ET 200S; Mixed I/O NCU 7x0.x NX 10 DQ Interface 1 encoder system Motor module Fig Calculating the safety function Designation Component Order number PFH value I3 L1 Acknowledgment button of the HT8 of the handheld terminal Safety input/output module (4 F-DI/3 F-) ET 200S x ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS1 Drive-CLiQ Interface (integrated SMI interface) x CC1 Motor Module 6SL E..-.A x Result 2.57 x Performance Level achieved: PL d V1.0, Entry ID

26 Two-encoder system Example for the block diagram I3 L1 L2 L5 RS2 RS3 CC1 Enabling button ET 200S; Mixed I/O NCU 7x0.x NX 10 2 encoder system Direct measuring system (Fault exclusion) Motor module Fig Calculating the safety function Designation Component Order number PFH value I3 Acknowledgment button of the HT8 of the handheld terminal x L1 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS2 Use of a 2-encoder system x CC1 Motor Module 6SL E..-.A x Result 2.38 x Performance Level achieved: PL d 26 V1.0, Entry ID:

27 2.4.2 Safely switching off or switching on external components when an agreement button is pressed Power supply > 2 A In this example, when the agreement button is pressed, a power supply > 2A for a power module is switched-in or switched-out using two contactor relays (K1, K2). All of the standard modules, which are connected to the power supply of this power module, as well as all of the actuators connected to the standard output modules (), are also safely switched-in or switched-out. The acknowledgment button is connected to a safe input module (mixed I/O) of the SIMATIC ET 200S through two channels. The acknowledgment button is evaluated in the safe programmable logic of the SINUMERIK 840D sl. When the agreement button is pressed, two contactor relays (K1, K2) are deenergized via a safe output module (P/M switching). The mixed I/O of the ET 200S is duplicated (L1, L3) in the block diagram; this is because it is assumed that the Emergency Stop pushbutton and contactor relays (K1, K2) are connected to different modules ("worst-case" scenario). The blocks for the power module (PM) and the output module (L6) shown in the block diagram are not included in the calculation. The diagram is only intended to make it easy to understand the approach. For this example, safety-relevant components were used for I3, L1, L2 and L3, for which there are PFH values. For the two contactor relays (K1, K2), the PFH value was calculated based on the B 10d value (73% dangerous failures), a diagnostics coverage of 90% (they are controlled via safe programmable logic, the relay is tested by reading back the signals from the auxiliary contacts) and the actuation cycle. IM 151 HF Powermodul F-DI F-DI F- Powermodul Power supply Power supply K1 K2 24 V Fig V1.0, Entry ID

28 Example for the block diagram I3 L1 L2 L3 PM Enabling button ET 200S; Mixed I/O NCU 7x0.x Power module (Fault exclusion) Relay K1 Standard Standard L7 ET 200S; Mixed I/O K2 Relay Output module (Fault exclusion) The Power Module (PM) and the output module (L6) are not considered for calculation. These two components have only been marked for clarification. Fig Calculating the safety function Designation Component Order number PFH value B 10 value I3 Acknowledgment button of the HT8 of the handheld terminal x L1 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x L3 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB x K1 Contactor relay 3RH 3RH2 1,000, x K2 Contactor relay 3RH 3RH2 1,000,000 Result 2.64 x Performance Level achieved: PL d 28 V1.0, Entry ID:

29 Power supply < 2 A In this example, when the agreement button is pressed, a power supply < 2A for a power module is shut down using a safe output (F-). All of the standard modules, which are connected to the power supply of this power module, as well as all of the actuators connected to the standard output modules (), are also safely switched-in or switched-out. The acknowledgment button is connected to a safe input module (mixed I/O) of the SIMATIC ET 200S through two channels. The protective door switch is evaluated in the safe programmable logic of the SINUMERIK 840D sl. When actuating the acknowledgment button, the power supply for the power module is switched-in or switched-out via a safe output module (P/M switching). The mixed I/O of the ET 200S is duplicated (L1, L3) in the block diagram; this is because it is assumed that the acknowledgment button is not connected to the same module which shuts down the supply voltage ("worst-case" scenario). The blocks for the power module (PM) and the output module (L6) shown in the block diagram are not included in the calculation. The diagram is only intended to make it easy to understand the approach. For this example, only safety-relevant components are used. This means that the PFH value of the safety function is obtained by adding the individual PFH values. IM 151 HF Powermodul F-DI F-DI Power supply F- Powermodul Power supply 24 V Fig V1.0, Entry ID

30 Example for the block diagram Standard I3 L1 L2 L3 PM Standard L7 Enabling button ET 200S; Mixed I/O NCU 7x0.x ET 200S; Mixed I/O Power module (Fault exclusion) Output module (Fault exclusion) The Power Module (PM) and the output module (L6) are not considered for calculation. These two components have only been marked for clarification. Fig Calculating the safety function Designation Component Order number PFH value I3 L1 Acknowledgment button of the HT8 of the handheld terminal Safety input/output module (4 F-DI/3 F-) ET 200S x ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA00-0AA x L3 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB x Result 2.21 x Performance Level achieved: PL d 30 V1.0, Entry ID:

31 2.5 Operating mode selection Example of an operating mode selection using an access system In a working group, in which there were representatives from several machine manufacturers as well as representatives from the automotive industry, the following operating modes were defined: Safety operating mode 1: Automatic operation Safety operating mode 2: Setting-up operation Safety operating mode 3: Automatic operation with manual interventions Safety operating mode SE: Service operating mode These operating modes are selected using an access system (EKS; Electronic Key System or key-operated switch) and via a selection system (e.g. single-channel pushbuttons of an MCP 483 (machine control panel 483) or MPP 483 (machine pushbutton panel 483)). It is only possible to switch over the operating mode, if the operator has clearly identified himself via an access system. It is not possible to switch over the operating modes without first identifying yourself at an access system. After the control system has powered up, safety operating mode 1 (automatic operation) is always selected. The access system is read into a standard PLC using a standard input module (e.g. ET 200S). Both the access stage as well as also the validity of the data (for EKS), are provided to the safe programmable logic through mirroring. The access system itself is not included in the calculation of the operating mode selection. The calculation of such an operating mode selection is described in Chapters and V1.0, Entry ID

32 Standard I/Os Failsafe I/Os IM 151 HF Power Module DI DI F-DI F-DI F-DI F- F- Power supply Reading in the signals at the standard DI Access system (EKS or keyswitch) Single-channel probe at the standard DI Single-channel probe at the F-DI Selection system, e.g.: MPP 483 MCP 483 Operat. mode 1 Operat. mode 2 Operat. mode 3 Operat. mode SE Fig V1.0, Entry ID:

33 Selecting operating mode 1 (automatic operation) using standard inputs In operating mode 1 (automatic operation), with the protective doors closed, the machine can be operated without any restriction regarding the functional scope. When the protective door is opened or the hazardous area is possibly accessed all potentially hazardous motion is safely stopped, and unexpected starting is safely prevented (stop according to IEC :2009, 9.2.2, depending on the technology used). The button for safety operating mode 1 is read into the standard PLC using a standard input module, and is then mirrored in the safe programmable logic. Safety operating modes 2, 3 and SE are directly wired through one channel to a safe input module (F-DI) and made available to the safe programmable logic. A cyclic 1 from n evaluation of the button for the operating mode selection is realized in the safe programmable logic of the SINUMERIK 840D sl; further, a plausibility check is made with respect to the access system authorization. Components I4, L6 and L2* involve single-channel standard components. A Category 2 system (single-channel system with testing) can be employed for these components as a result of the 1 from n evaluation of the buttons for the operating mode selection and the plausibility check in the safe programmable logic. For this constellation, a diagnostics coverage (DC) of at least 60% can be assumed (conservative analysis). For I4, the MTTF d value was determined based on the B 10d value (50% dangerous failures) and the average number of annual actuations (n op ). For components L2 and L6, the MTTF d value was determined from the MTBF value (50% dangerous failures). The total MTTF d value of components I4, L2* and L6 was calculated using the Parts Count method (see EN ISO 13849, Attachment D). With a DC = 60%, the PFH value was able to be determined based on the table in Appendix K of EN ISO V1.0, Entry ID

34 Example for the block diagram: Standard Standard NCU 7x0.x Standard I4 L6 L2* L2 Button Input module Test chanel L2 NCU 7x0.x NCU 7x0.x Fig Calculating the safety function: Designation Component Order number PFH value MTBF value I4 Standard pushbutton (single-channel) (Years) B 10 value - 50,000 2) L2 L2* = Standard NCU PN 6FC5373-0AA30-0AA x L6 Standard input module 6ES7131-4BD01-0AA L2 NCU PN 6FC5373-0AA30-0AA x Result 2.29 x Performance Level achieved: PL c 2) Assumed value 34 V1.0, Entry ID:

35 Selecting operating modes 2, 3 and SE via safe inputs Operating modes 2, 3 and SE are selected via single-channel buttons. These single-channel buttons are wired to a safe input module, and are therefore provided to both parts (PLC and NCK) of the safe programmable logic. A 1v1 evaluation takes place in the ET 200S input module. This means that for this module, for calculating the PFH value, a single-channel connection must be used as basis. In addition, in the safe programmable logic, a 1 from n evaluation of the button is executed for the operating mode selection, as well as an additional plausibility check of the access authorization. For this constellation, a diagnostics coverage (DC) of at least 60% can be assumed (conservative analysis). The PFH value of the single-channel button I4 was calculated from the B 10d value (50% dangerous failures), the average number of annual actuations (nop) and the diagnostics coverage (60%, as a result of the 1 from n evaluation and plausibility check). Components L2 and L4 are safety components, for which PFH values are available. Example for the block diagram Standard I4 L4 L2 Button ET 200S; Safe input module NCU 7x0.x Fig Calculating the safety function Designation Component Order number PFH value B 10 value I4 Standard pushbutton (single-channel) 2.00 x ,000 2) L4 Safe input module (4/8 F-DI) ET 200S 6ES7138-4FA04-0AB x L2 NCU FC5373-0AA30-0AA x Result 2.07 x Performance Level achieved: PL c 2) Assumed value V1.0, Entry ID

36 2.5.2 Example of a two-channel operating mode selection without access system There are a series of applications, where the access system and the selection system (e.g. illuminated pushbutton) of the operating mode selection equipment is replaced by a two-channel operating mode selector switch (key-operated switch; the key can be withdrawn in any position). This is generally the case, if there are only two operating modes. An example of such an application is subsequently described. The operating mode selector switch is wired to a safe input module through two channels. The switching states are evaluated in the safe programmable logic. The PFH value of the single-channel button I4 was calculated from the B10d value (50% dangerous failures), the average number of annual actuations (nop) and the diagnostics coverage. As the operating mode selector switch is connected to a safe input module through two channels, and the evaluation is made in the safe programmable logic, a DC = 90% is assumed. Components L1 and L2 are safety components, for which PFH values are available. Example for the block diagram I5 L1 L2 Operating mode switch ET 200S; Mixed I/O NCU 7x0.x Fig Calculating the safety function Designation Component Order number PFH value B 10 value I5 Mode selector switch (two channel) 1.00 x ,000 2) L1 Safety input/output module (4 F-DI/3 F- ) ET 200S 6ES7138-4FC01-0AB x L2 NCU PN 6FC5373-0AA30-0AA x Result 1.76 x Performance Level achieved: PL d 2) Assumed value 36 V1.0, Entry ID:

37 2.6 Start and restart function In some instances, for a start and restart function, a Performance Level is specified in C standards. A start and restart function such as this can involve, for example an "NC start" or a "Restoration of the power feed after an interruption". Generally, a start and restart functions such as this is realized using standard components. This is assumed in the following example. The pushbutton is wired to a standard input module through one channel. The pushbutton is evaluated in a standard PLC. For the pushbutton, a proven component can be assumed, so that in this case Category 1 can be applied. The PFH value of the single-channel button I4 was calculated from the B10d value (50% dangerous failures), the average number of annual actuations (nop). As this is a Category 1 system, the DC = 0, resp. a DC need not be considered, as is the case with a CCF. For the standard input module and the standard PLC, in this case, Category B must be applied for the calculation. Comment from EN ISO 13849: "Complex electronic components (e.g. PLCs, microprocessors, application-specific integrated circuits) cannot be considered to be similarly proven." As a consequence, components L2 and L6 are not classified as a Category 1 system. As a result of the Category B, as a maximum, PL b can be achieved. When calculating the PFH value for components L2 and L6, as a maximum, an MTTF d value of 29 years can be applied. V1.0, Entry ID

38 Example for the block diagram Standard Standard Standard I4 L6 L2 Button Input module NCU 7x0.x Fig Calculating the "safety function" Designation Component Order number PFH value MTBF value I4 L6 Standard pushbutton (single-channel) Standard input module 6ES7131-4BD01-0AA0 L2 NCU PN 6FC5373-0AA30-0AA1 (Years) B 10 value 1.14 x ,000 2) 4.23 x ) x ) - Result 9.60 x Performance Level achieved: PL b 1) For the calculation, for 100% dangerous failures, a maximum of 29 years can be assumed 2) Assumed value The calculation indicates that in this case only Performance Level b was able to be achieved even though only three components are being used. If more components are involved in the safety function or different components than those listed here then in most cases, without any significant supplementary measures (e.g. diagnostics), only Performance Level a can be achieved. 38 V1.0, Entry ID:

39 2.7 Evaluating safe feedback signals In many applications, e.g. as a result of safe output cam signals of an axis, other axes are influenced or external components must be shut down. In the following examples, it has been assumed that the two axes mutually influence one another, controlled from the same NCU/NX. As a consequence, the NCU or NX were only used once in the calculation. For this example, with the exception of the two contactor relays K1 and K2, only safety-relevant components are used. This means that the PFH value of the safety function is obtained by adding the individual PFH values. For the two contactor relays (K1, K2), the PFH value was calculated based on the B 10d value (50% dangerous failures), a diagnostics coverage of 90% (they are controlled via safe programmable logic, the relay is tested by reading back the signals from the auxiliary contacts) and the actuation cycle. V1.0, Entry ID

40 2.7.1 A safe output cam of one axis results in SBH being selected for the other axis If the X axis passes the safe output cam, then the Z axis is switched into the safe operating stop condition. Example of a block diagram Evaluation safe cam RS1 CC1 L2 L5 RS1 CC1 DQ Interface 1 encoder system X-axis Motor module X-axis NCU 7x0.x NX 10 DQ Interface 1 encoder system Z-axis Motor module Z-axis Fig Calculating the safety function Safe operating stop Designation Component Order number PFH value RS1 (X axis) Drive-CLiQ Interface (integrated SMI interface) x CC1 (X axis) Motor Module 6SL E..-.A x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS1 (Z axis Drive-CLiQ Interface (integrated SMI interface) x CC1 (Z axis) Motor Module 6SL E..-.A x Result 1.48 x Performance Level achieved: PL d 40 V1.0, Entry ID:

41 2.7.2 A safe output cam of one axis results in SBH being selected for two other axes If the X axis passes the safe output cam, then the Z axis and the A axis are switched into the safe operating stop condition. Example for the block diagram Evaluation safe cam RS1 CC1 L2 L5 RS1 CC1 RS1 CC1 DQ Interface 1 encoder system X-Achse Motor module X-axis NCU 7x0.x NX 10 DQ Interface 1 encoder system Z-axis Motor module Z-axis DQ Interface 1 encoder system A-axis Motor modul A-axis Fig Calculating the safety function Designation Component Order number PFH value RS1 (X axis) Drive-CLiQ Interface (integrated SMI interface) Safe operating stop x CC1 (X axis) Motor Module 6SL E..-.A x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS1 (Z axis) Drive-CLiQ Interface (integrated SMI interface) x CC1 (Z axis) Motor Module 6SL E..-.A x RS1 (A axis) Drive-CLiQ Interface (integrated SMI interface) x CC1 (A axis) Motor Module 6SL E..-.A x Result 1.84 x Performance Level achieved: PL d V1.0, Entry ID

42 2.7.3 A safe output cam of two axes results in SBH being selected for another axis If the X axis and the A axis pass the safe output cam, then the Z axis is switched into the safe operating stop condition. Example for the block diagram Evaluation safe cams RS1 CC1 RS1 CC1 L2 L5 RS1 CC1 DQ Interface 1 encoder system X-axis Motor module X-axis DQ Interface 1 encoder system A-axis Motor module A-axis NCU 7x0.x NX 10 DQ Interface 1 encoder system Z-axis Motor module Z-axis Fig Calculating the safety function Designation Component Order number PFH value RS1 (X axis) Drive-CLiQ Interface (integrated SMI interface) Safe operating stop x CC1 (X axis) Motor Module 6SL E..-.A x RS1 (A axis) Drive-CLiQ Interface (integrated SMI interface) x CC1 (A axis) Motor Module 6SL E..-.A x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x RS1 (Z axis) Drive-CLiQ Interface (integrated SMI interface) x CC1 (Z axis) Motor Module 6SL E..-.A x Result 1.84 x Performance Level achieved: PL d 42 V1.0, Entry ID:

43 2.7.4 A safe output cam of an axis results in the safe shutdown via contactor relays If the X axis passes the safe output cam, the power supply of a power module is safely shut down via two contactor relays (see Chapter ) Example for the block diagram Evaluation safe cam Relay K1 Standard Standard RS1 CC1 L2 L5 L1 PM L7 DQ Interface 1 encoder system X-Achse Fig Motor module X-axis NCU 7x0.x NX 10 ET 200S; Mixed I/O Shut off of K1 and K2 via safe programmable logic K2 Relay Power module (Fault exclusion) Output module (Fault exclusion) The Power Module (PM) and the output module (L6) are not considered for calculation. These two components have only been marked for clarification. Calculating the safety function Designation Component Order number PFH value B 10 value RS1 Drive-CLiQ Interface (integrated SMI interface) x CC1 Motor Module 6SL312.-2TE21-8A x L2 NCU PN 6FC5373-0AA30-0AA x L5 NX SL3040-1NC00-0AA x L1 Safety input/output module (4 F-DI/3 F-) ET 200S 6ES7138-4FC01-0AB x K1 Contactor relay 3RH 3RH2 1,000, x K2 Contactor relay 3RH 3RH2 1,000,000 Result 1.65 x Performance Level achieved: PL d V1.0, Entry ID