Applications & Tools. Technology CPU 317TF-2 DP: Example for determining the Safety Integrity Level (SIL) according to IEC

Transcription

1 Cover Technology CPU 317TF-2 DP: Example for determining the Safety Integrity Level (SIL) according to IEC Technology CPU Application Description January 2013 Applications & Tools Answers for industry.

2 Siemens Industry Online Support This article is taken from the Siemens Industry Online Support. The following link takes you directly to the download page of this document: Caution The functions and solutions described in this article confine themselves to the realization of the automation task predominantly. Please take into account furthermore that corresponding protective measures have to be taken up in the context of Industrial Security when connecting your equipment to other parts of the plant, the enterprise network or the Internet. Further information can be found under the Item-ID If you have any questions concerning this document please us to the following address: You can also actively use our Technical Forum from the Service & Support Portal regarding this subject. Add your questions, suggestions and problems and discuss them together in our strong forum community: 2 V1.1, Entry ID:

3 s Application Example 1 Application of the SET 2 Risk Analysis and Risk Assessment 3 SIMATIC Determination of SIL according to IEC Technology CPU 317TF-2 DP Specification and Realization 4 Determination of the SIL achieved by SRECS 5 User Information and Validation 6 Project File for the Application Example 7 Links & Literature 8 History 9 V1.1, Entry ID:

4 Warranty and Liability Warranty and Liability Note The application examples are not binding and do not claim to be complete regarding configuration, equipment and any eventuality. The application examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible for ensuring that the described products are used correctly. These application examples do not relieve you of the responsibility to use sound practices in application, installation, operation and maintenance. When using these application examples, you recognize that we will not be liable for any damage/claims beyond the liability clause described. We reserve the right to make changes to these application examples at any time without prior notice. If there are any deviations between the recommendations provided in this application example and other Siemens publications (e.g. catalogs), the contents of the other documents shall have priority. We accept no liability for information contained in this document. Any claims against us based on whatever legal reason resulting from the use of the examples, information, programs, engineering and performance data etc., described in this Application Example shall be excluded. Such an exclusion shall not apply in the case of mandatory liability, e.g. under the German Product Liability Act ( Produkthaftungsgesetz ), in case of intent, gross negligence, or injury of life, body or health, guarantee for the quality of a product, fraudulent concealment of a deficiency or violation of fundamental contractual obligations. The damages for a breach of a substantial contractual obligation are, however, limited to the foreseeable damage, typical for the type of contract, except in the event of intent or gross negligence or injury to life, body or health. The above provisions do not imply a change in the burden of proof to your detriment. It is not permissible to transfer or copy these Application Examples or excerpts thereof without express authorization from Siemens Industry Sector. 4 V1.1, Entry ID:

5 Preface Preface Objective of this application Using an example, this documentation introduces the determination of the safety integrated level (SIL) of an application with the Technology CPU 317TF-2 DP according to IEC by means of the Safety Evaluation Tool (SET) _CPU317TF-2DP_Safety-Level_IEC62061_DOKU_en _10-57.doc Core topics of this application The following main topics are discussed in this application: Introduction of the application example via the determination of the Safety Integrity Level (SIL). Identification of the safety functions (SRCFs) required for the application example. Determination of the required Safety Integrity Level (SIL) using the Safety Evaluation Tool (SET). Design and realization of the derived safety functions (SRCFs). Determination of the reached Safety Integrity Level (SIL) using the Safety Evaluation Tool (SET). Note Validity The determination of the Safety Integrity Level is performed on the basis of the following documentation for using the IEC standard: Application example Practical application of the IEC 62061, illustrated using an application example with SIMATIC S7 Distributed Safety Internet link: The procedure introduced here is aimed at using the Technology CPU 317TF-2 DP, however, it applies to fail-safe SIMATIC-CPUs in general. Representation of the screen masks of the Safety Evaluation Tool (SET) The screen masks of the Safety Evaluation Tool (SET) are contained in the PDF version of this document in high resolution. For a detailed viewing of the screen masks please use the zoom function of your PDF reader. For the printed version of this document the project file of the Safety Evaluation Tool (SET) is available as a download on the download page of this application example. You can also use this project file to directly view the screen masks in the Safety Evaluation Tool (SET). V1.1, Entry ID:

6 Table of Contents Table of Contents Warranty and Liability... 4 Preface Application Example Problem definition of the application example Overview of solution in the application example Safety-related control function 1 (SRCF 1) Safety-related control function 2 (SRCF 2) Safety-related control function 3 (SRCF 3) Safety system (SRECS) Application of the SET Basics Safety Evaluation Tool (SET) Support by the Safety Evaluation Tool (SET) Creating a SET project Creating a Project Creating a safety area Creating the safety function Risk Analysis and Risk Assessment Performing a risk analysis Performing the risk assessment Risk assessment for hazard Risk assessment for hazard Classification of the safety-related control function Summary of the risk assessment Specification and Realization Developing the SRCF specification Specification of SRCF Specification of SRCF Specification of SRCF Designing the SRECS architecture Dividing the SRCF into function blocks Details of the requirements for the function blocks Specification of the hardware components Assigning function blocks to subsystems Function block subsystem 1: position of the protective door Function block subsystem 2: position of the protective cover Function block subsystem 3: emergency stop Function block subsystem Function block subsystem Summary Realizing the sub-systems Determination of the SIL achieved by SRECS Evaluation via the Safety Evaluation Tool (SET) Conditions for the required SIL Results report of the Safety Evaluation Tool (SET) Safety-related control function 1 (SRCF 1) Safety-related control function 2 (SRCF 2) Safety-related control function 3 (SRCF 3) Implementing SRECS V1.1, Entry ID:

7 Table of Contents 6 User Information and Validation Generating user information Performing a validation Project File for the Application Example Downloading the project file Content of the project file Variant 1 of the safety system (SRECS) Variant 2 of the safety system (SRECS) Links & Literature Further literature Internet links History V1.1, Entry ID:

8 1 Application Example 1.1 Problem definition of the application example 1 Application Example 1.1 Problem definition of the application example A machine contains two axes which are independent of each other. The axes are controlled via Technology CPU 317TF-2 DP. An encapsulated axis is located under the protective cover in the machine. The other axis is freely accessible for the operator. A paling fence must be set up around this hazardous area of the machine, which can be accessed through a protective door (slide door) secured with a door contact switch. The protective cover of the encapsulated axis is monitored by a protective cover hinge switch and a protective cover contact switch. Both axes of the machine can be safely stopped via an emergency stop control unit attached on the outside of the paling fence. Protective cover hinge switch Figure 1-1 Example machine for the application example Door Türkontaktschalter switch contact (Positionsschalter) (position switch) Encapsulated axis Protective cover contact switch (position switch with separate actuator) Freely accessible axis Emergencystop control unit Protective door (slide door) The following safety functions shall be realized at this machine: Safety function 1 (SF 1): safely limited speed If the protective door is opened while the machine is running, the freely accessible axis of the machine must be brought to a safely limited speed. The Safely-Limited Speed (SLS) safety function of the SINAMICS S120 shall be used for this. Safety function 2 (SF 2): safe stopping of all axes If the protective cover of the encapsulated axis at the machine is opened, both axes of the machine shall be stopped. The Safe Stop 1 (SS1) safety function of the SINAMICS S120 shall be used for this. Safety function 3 (SF 3): emergency stop for all axes If the emergency stop button is pressed, both axes of the machine shall be stopped. The Safe Torque Off (STO) safety function of the SINAMICS S120 shall be used for this. 8 V1.1, Entry ID:

9 1 Application Example 1.2 Overview of solution in the application example Note The function of the emergency stop control unit is a supplemented safety function which, according to the 2006/42/EG machine guideline chapter , is generally demanded at a machine and normally needs not be included into the discussion of the safety related control functions illustrated here. In order to explain the procedure for determining the safety level, the function of the emergency stop control unit is included in the calculation here. 1.2 Overview of solution in the application example For the solution of the task in this application example the following assumption is made: The safety functions (SF 1 / SF 2 / SF 3) are realized by a safety-related control function (SRCF 1 / SRCF 2 / SRCF 3) Safety-related control function 1 (SRCF 1) Safe speed reduction of the freely accessible machine axes. Designation of the SRCF: Safe reduction of the axis speed Function of the SRCF: When the protective door is opened, the speed of the freely accessible axes of the machine is reduced to a given safe speed and monitored via the Safely- Limited Speed (SLS) safety function of the SINAMICS S120. Safety Integrity Level (SIL) of the SRCF required according to the risk analysis (see chapter 3.2.1): SIL 2 Figure 1-2 Possible realization of SRCF 1 Safety-related Control Function (SRCF) Information Detection Evaluation Reaction Actions Safety-related control function 2 (SRCF 2) Switching off both machine axes when opening the protective cover of the encapsulated axis at the machine: Designation of the SRCF: Safe stopping of the machine axes V1.1, Entry ID:

10 1 Application Example 1.2 Overview of solution in the application example Function of the SRCF: When the protective cover is opened, both machine axes are stopped using the Safe Stop 1 (SS1) safety function of SINAMICS S120. Safety Integrity Level (SIL) of the SRCF required according to the risk analysis (see chapter 3.2.2): SIL 2 Figure 1-3 Possible realization of SRCF 2 Safety-related Control Function (SRCF) Information Detection Evaluation Reaction Actions Safety-related control function 3 (SRCF 3) Emergency stop of both machine axes when pressing the emergency stop control unit at the machine: Designation of the SRCF: Emergency stop of machine axes Function of the SRCF: When the emergency stop control unit is operated, both machine axes are stopped using the Safe Torque Off (STO) safety function of SINAMICS S120. Safety Integrity Level (SIL) of the SRCF required according to the rating of the safety-related control function (see chapter 3.2.3): SIL 2 Figure 1-4 Possible realization of SRCF 3 Safety-related Control Function (SRCF) Information Detection Evaluation Reaction Actions 10 V1.1, Entry ID:

11 1 Application Example 1.2 Overview of solution in the application example Safety system (SRECS) The safety system (SRECS) for executing the safety-related control functions (SRCF 1, SRCF 2 and SRCF 3) consists of five subsystems: Table 1-1 Subsystems of the safety system (SRECS) Subsystem Function to be executed Components Subsystem 1 Subsystem 2 Subsystem 3 Subsystem 4 Subsystem 5 Figure 1-5 Safety system (SRECS) SRCF 1: Detection Monitoring the protective door using two position switches. SRCF 2: Detection Monitoring the protective cover using a hinge switch and a position switch with separate actuator. SRCF 3: Detection Monitoring the state of the emergency stop control unit for stopping all of the machine axes SRCF 1 / SRCF 2 / SRCF 3: Evaluation Processing the signals in a fail-safe controller (F-PLC) SRCF 1 / SRCF 2 / SRCF 3: Reaction Executing the internal Safely-Limited Speed (SLS) safety function of the drive. Executing the internal Safe Stop 1 (SS1) safety function of the drive. Executing the internal Safe Torque Off (STO) safety function of the drive. Safety System (SRECS) SIRIUS SIRIUS SIRIUS SIMATIC S7 Distributed Safety SINAMICS Information Detection Evaluation Reaction Actions Subsystem 1 Subsystem 4 Subsystem 5 Subsystem 2 Subsystem 3 Subsystems 1, 2 and 3 are designed subsystems; subsystems 4 and 5 are prefabricated subsystems. V1.1, Entry ID:

12 2 Application of the SET 2.1 Basics 2 Application of the SET 2.1 Basics Safety Evaluation Tool (SET) The Safety Evaluation Tool (SET) is a TÜV-certified online tool by the Siemens Industry sector for the IEC and ISO standards which aids the evaluation of the safety functions at your machine. The result is output in a standards-compliant report which can be integrated into the documentation of your machine as a safety proof. The Safety Evaluation Tool (SET) can be accessed online at the following link: where a SET Getting Started and a SET Tutorial (video) is also available Support by the Safety Evaluation Tool (SET) Note The Safety Evaluation Tool (SET) supports the following activities when determining the safety integrated level (SIL) according to IEC 62061: Design of the safety system (SRECS) architecture Realization of the safety system (SRECS) subsystem Determining the achieved Safety Integrity Level (SIL) A complete application of the IEC additionally requires further activities which exceed the application of the Safety Evaluation Tool (SET). These activities include, for example, generating additional documentations and validation documents. Further information is given in the standards document on the respective standard. 2.2 Creating a SET project Creating a Project When creating a new project in the Safety Evaluation Tool (SET), you already must decide the standard to be applied to the project. In this application example, the application of the IEC standard is explained in greater detail. Figure 2-1 Creating a SET project Selecting the standard to be applied 12 V1.1, Entry ID:

13 2 Application of the SET 2.2 Creating a SET project In subsequent screen mask you can specify a name for the project and enter further details on the project. Figure 2-2 Creating an SET project Note In order to receive a standards-compliant report on the Safety Evaluation Tool (SET) as a safety proof, all relevant fields of the screen masks of the Safety Evaluation Tool (SET) must be filled in. Since the displays in this document originate from an application example, the screen masks are not filled in completely to provide a better overview Creating a safety area You can divide your entire machine into different safety areas to which individual safety functions or the safety-related control functions (SRCF) are then assigned. In the application example on hand, a substitutional safety area is created in which the safety functions to be represented are integrated. Figure 2-3 Creating a safety area V1.1, Entry ID:

14 2 Application of the SET 2.2 Creating a SET project Creating the safety function Within the safety area, the individual safety-related control functions (SRCF) can now be created. The respective setup of the safety-related control functions (SRCF) or the safety function must be selected here. In the application example on hand, the classic setup of the safety-related control function (SRCF) is selected with three function blocks: Figure 2-4 Function blocks of the safety-related control function (SRCF) Safety-related Control Function (SRCF) Information Function block 1: Detection Function block 2: Evaluation Function block 3: Reaction Actions The setup of the safety function in the Safety Evaluation Tool (SET) is selected via the following screen mask. Figure 2-5 Creating a safety function Selecting a subfunction This creates three subfunctions in the Safety Evaluation Tool (SET). The risk evaluation can then be performed in the screen mask on the safety function, as illustrated in chapter 3.2. Figure 2-6 Creating a safety function 14 V1.1, Entry ID:

15 2 Application of the SET 2.2 Creating a SET project Create the following three safety-related control functions (SRCF) or safety functions (SF) with three respective function blocks: Safety function 1 (SF 1): Safely limited speed Figure 2-7 Possible realization of SRCF 1 Safety-related Control Function (SRCF) Information Detection Evaluation Reaction Actions Safety function 2 (SF 2): Safe stopping of all axes Figure 2-8 Possible realization of SRCF 2 Safety-related Control Function (SRCF) Information Detection Evaluation Reaction Safety function 3 (SF 3): Emergency stop of all axes Actions Figure 2-9 Possible realization of SRCF 3 Safety-related Control Function (SRCF) Information Detection Evaluation Reaction Actions V1.1, Entry ID:

16 3 Risk Analysis and Risk Assessment 3.1 Performing a risk analysis 3 Risk Analysis and Risk Assessment 3.1 Performing a risk analysis A risk analysis for the machine must be performed before the actual application of IEC standard. The risk analysis is not contained in the IEC The risk analysis examines the hazards posed by the machine. which safety-related control functions are required to reduce the risk of the hazards. The risk of a hazard depends on the following two factors: severity of the possible harm that may be caused by the hazard probability of occurrence of the harm Applied in the application example The risk analysis for the application example yields the following result: Table 3-1 Hazard 1 When accessing the hazardous area through the safety door, the operator may suffer severe damage at the freely accessible axis. 2 When opening the protective cover of the machine, the operator may suffer severe injury at the gear wheels rotating in the machine which are connected with both machine axes. Required SRCFs SRCF 1: reducing the speed of the freely accessible machine axes to a safe upper limit. SRCF 2: immediate stopping of both axes at the machine. Note For realizing the SRCF 3 emergency stop no risk analysis needs to be performed, since the classification of the emergency stop can generally be selected by the user, unless there is a type C standard which dictates the classification. Note The SRCF 3 emergency stop is a supplementary safety function which must not replace an independent safety function. 16 V1.1, Entry ID:

17 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment 3.2 Performing the risk assessment After the analysis the risk assessment is performed for each hazard identified at the machine. The risk assessment is, like the risk analysis as well as, not contained in the IEC Figure 3-1 Performing the risk assessment Risk assessment SIL determination 1. Assessment: Severity of the harm 2. Assessment: Frequency and duration of the exposure of persons in the danger zone Se 6. Determination of the SIL from Se and Cl 5. Determination Fr of the class : Cl = Fr + Pr + Av SIL 3. Assessment: Probability of occurrence of the hazardous event Pr Cl 4. Assessment: Possibility of avoiding or limiting the harm Av In the risk assessment it is examined for each hazard which measure must be taken for reducing the risk. If the measure is an SRCF, then the required Safety Integrity Level (SIL) must be established for this SRCF. The SIL is defined in such a way that the remaining risk (residual risk) of the hazard is acceptably low. The Safety Evaluation Tool (SET) supports you in the risk assessment through the guided determination of the required safety integrated level (SIL) for the individual safety functions, or safety-related control functions (SRCF). Figure 3-2 Guided determination of the required Safety Integrity Level (SIL) V1.1, Entry ID:

18 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment Pressing the Evaluate button takes you to the guided determination of the required Safety Integrity Level (SIL), as described in the following chapters Risk assessment for hazard 1 Performing the risk assessment for hazard 1 determined in the risk analysis in chapter 3.1 (see Table 3-1). Hazard Severely injured operator due to the freely accessible axes. Figure 3-3 Hazard 1 Hazard 1: Freely accessible axes Evaluation 1: severity of the harm Table 3-2 Risk assessment Severity of the harm Severity of the harm Se Irreversible: death, or loss of an eye or an arm 4 Irreversible: broken limbs, loss of one or several fingers B Reversible: treatment by a medic required 2 Reversible: first aid required 1 Applied to the application example There may be broken limbs due to flying parts ejected form the machine V1.1, Entry ID:

19 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment Evaluation 2: frequency and duration of the exposure of persons to the hazard Table 3-3 Risk assessment Exposure Exposure Fr Frequency Duration 1h longer than 10min 5 up to 10min 5 > 1h up to 1 day longer than 10min 5 up to 10min 4 > 1 day up to 2 weeks longer than 10min 4 up to 10min 3 > 2 weeks up to 1 year longer than 10min 3 up to 10min 2 > 1 year longer than 10min 2 up to 10min 1 Applied to the application example Within one hour the operator needs to access the hazardous area several 5 times for a maximum of 10 minutes. Evaluation 3: probability of occurrence of the hazardous event Table 3-4 Risk assessment Probability of the harm Probability of occurrence Very high 5 Probable 4 Possible 3 Rare 2 Negligible 1 Applied to the application example When standing within the hazardous area the operator is likely to be hit by 4 flying parts ejected from the machine. Pr Evaluation 4: possibility of avoiding or limiting the harm Table 3-5 Risk assessment Avoiding or limiting the harm Possibility of avoidance or limiting the harm Av Impossible 5 Rare 3 Probable 1 Applied to the application example The operator can only rarely avoid a flying part ejected from the machine. 3 V1.1, Entry ID:

20 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment Evaluation of the risk assessment: determination of class Cl Table 3-6 Evaluation Determination of class Cl Evaluation of the risk assessment Cl Determination of class Cl Fr + Pr + Av Applied to the application example Class Cl = Fr + Pr + Av, with Fr=5, Pr=4, Av=3 12 Evaluation of the risk assessment: determination of the required SIL from Se and Cl Table 3-7 Evaluation Determination of the required SIL from Se and Cl Severity of the harm Se Class Cl = Fr + Pr + Av 3 to 4 5 to 7 8 to to to 15 4 SIL 2 SIL 2 SIL 2 SIL 3 SIL 3 3 SIL 1 SIL 2 SIL 3 2 SIL 1 SIL 2 1 SIL 1 Applied to the application example Determination of the SIL from Se and Cl, with Se=3; Cl=12 SIL 2 Figure 3-4 Evaluation Determination of the required SIL using the SET After selecting the respective evaluations the required Safety Integrity Level (SIL) is output in the screen mask of the Safety Evaluation Tool (SET). 20 V1.1, Entry ID:

21 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment Risk assessment for hazard 2 Performing the risk assessment for hazard 2 determined in the risk analysis in chapter 3.1 (see Table 3-1). Hazard Severe harm to the operator due to rotating gear wheels connected to both machine axes. Figure 3-5 Hazard 2 Hazard 2: rotating gear wheels Evaluation 1: severity of the harm Table 3-8 Risk assessment Severity of the harm Severity of the harm Se Irreversible: death, or loss of an eye or an arm 4 Irreversible: broken limbs, loss of one or several fingers 3 Reversible: treatment by a medic required 2 Reversible: first aid required 1 Applied to the application example If the operator makes contact with the rotating gear wheels of the 4 machine, loss of an arm may result. V1.1, Entry ID:

22 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment Evaluation 2: frequency and duration of the exposure of persons to the hazard Table 3-9 Risk assessment Exposure Exposure Fr Frequency Duration 1h longer than 10min 5 up to 10min 5 > 1h up to 1 day longer than 10min 5 up to 10min 4 > 1 day up to 2 weeks longer than 10min 4 up to 10min 3 > 2 weeks up to 1 year longer than 10min 3 up to 10min 2 > 1 year longer than 10min 2 up to 10min 1 Applied to the application example The operator must open the protective cover for the gear wheels of the 4 machine once every three days for a 15 minutes maintenance procedure. Evaluation 3: probability of occurrence of the hazardous event Table 3-10 Risk assessment Probability of the harm Probability of occurrence Very high 5 Probable 4 Possible 3 Rare 2 Negligible 1 Applied to the application example When performing maintenance works at the gear wheels of the machine, it 3 is possible, when slipping, that the operator makes contact with the gear wheels. Pr Evaluation 4: possibility of avoiding or limiting the harm Table 3-11 Risk assessment Avoiding or limiting the harm Possibility of avoiding or limiting the harm Av Impossible 5 Rare 3 Probable 1 Applied to the application example If the operator slips during the maintenance works, contact with the gear 3 wheels can only rarely be avoided. 22 V1.1, Entry ID:

23 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment Evaluation of the risk assessment: determination of class Cl Table 3-12 Evaluation Determination of class Cl Evaluation of the risk assessment Cl Determination of class Cl Fr + Pr + Av Applied to the application example Class Cl = Fr + Pr + Av, with Fr=4, Pr=3, Av=3 10 Evaluation of the risk assessment: determination of the SIL from Se and Cl Table 3-13 Evaluation Determination of the SIL from Se and Cl Severity of the harm Se Class Cl = Fr + Pr + Av 3 to 4 5 to 7 8 to to to 15 4 SIL 2 SIL 2 SIL 2 SIL 3 SIL 3 3 SIL 1 SIL 2 SIL 3 2 SIL 1 SIL 2 1 SIL 1 Applied to the application example Determination of the SIL from Se and Cl, with Se=4; Cl=10 SIL 2 Figure 3-6 Evaluation Determination of the SIL from Se and Cl using the SET After selecting the respective evaluations the required Safety Integrity Level (SIL) is output in the screen mask of the Safety Evaluation Tool (SET). V1.1, Entry ID:

24 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment Classification of the safety-related control function 3 The safety-related Emergency stop of machine axes control function (SRCF 3) is a supplementary safety function generally demanded at a machine according to machine guideline 2006/42/EG, chapter A risk assessment is therefore not performed for SRCF 3. Figure 3-7 Safety-related control function 3 Emergency stop Safety-related control function Emergency-stop In the example on hand a Safety Integrity Level (SIL) of SIL 2 is required following the example of the risk assessment performed for the two other safety-related control functions (SRCF 1 and SRCF 2). Table 3-14 Risk assessment Summary Safety-related control function (SRCF) Required SIL SRCF 3 Emergency stop of machine axes SIL 2 This required SIL is set directly in the Safety Evaluation Tool (SET) via the screen mask of the safety function. 24 V1.1, Entry ID:

25 3 Risk Analysis and Risk Assessment Figure 3-8 Specifying the required SIL using the performed classification 3.2 Performing the risk assessment Note In practice, the highest Safety Integrity Level (SIL) (determined by risk assessment) of the other safety-related control function (SRCF) at the machine is used for the classification of the Emergency stop Summary of the risk assessment Independently of each other, the respective Safety Integrity Level (SIL) was determined or specified for each hazard, and the respectively required safetyrelated control function (SRCF), determined in the risk analysis. Table 3-15 Risk assessment Summary SRCF 1 Required safety-related control function (SRCF) Safe reduction of the axis speed Required SIL SIL 2 Safety-related Control Function (SRCF) Information Detection Evaluation Reaction Actions V1.1, Entry ID:

26 3 Risk Analysis and Risk Assessment 3.2 Performing the risk assessment SRCF 2 Required safety-related control function (SRCF) Safe stopping of the machine axes Required SIL SIL 2 Safety-related Control Function (SRCF) Information Detection Evaluation Reaction Actions SRCF 3 Emergency stop of machine axes SIL 2 Safety-related Control Functions (SRCF) Information Detection Evaluation Reaction Actions Now the safety-related control functions SRCF 1, SRCF 2 and SRCF 3 must be specified and realized. Each safety-related control function (SRCF) must meet the Safety Integrity Level (SIL) determined for it. 26 V1.1, Entry ID:

27 4 Specification and Realization 4.1 Developing the SRCF specification 4 Specification and Realization 4.1 Developing the SRCF specification The specification of a safety-related control function (SRCF) basically consists of the following parts: Information on the SRCF Requirements for the SRCF functionality Requirements for the safety integrity of the SRCF The specification must be made separately for each safety-related control function (SRCF) Specification of SRCF 1 Table 4-1 SRCF Specified SRCF Information on the SRCF Table Reducing the axis speed of the freely accessible machine axes to a safe upper speed limit. Topic Hazard at the machine which the SRCF should prevent. Persons at the machine Mode of the machine in which the SRCF is to be active. Information When accessing the safety area, the operator may suffer severe damage due to flying parts ejected from the machine. Operating staff, maintenance staff In each operating mode of the machine Requirements for the SRCF functionality Table 4-3 Topic Function of the SRCF Conditions under which the SRFC must be active or disabled. Required reaction time Requirement When opening the protective door of the protection zone the axis speed of the freely accessible axis must be reduced to a safe upper speed limit. The SRCF must always be active at the machine. When the door of the protection zone is opened, the axis speed must be reduced to a safe upper speed limit within 200ms at the latest. V1.1, Entry ID:

28 4 Specification and Realization 4.1 Developing the SRCF specification Topic Reaction to a fault Rate of operating cycles for the electro-mechanical components. Requirement When a fault occurs, the reaction must be as follows: immediate stopping of the axes switching the Disturbance indicator light on Switching the axis back on must only be possible if the following requirements have been met: the fault has been corrected the protective door is closed the operator has acknowledged the fault via a button at the machine Position switch of the protective door of the protection zone: the operator needs to access the hazardous area several times within the hour for approximately 10 minutes. Maximal 6 times per hour Note The required reaction time depends on the conditions at the machine. There must not be any hazard for the operator. Note For determining the reaction time, the S7FCOTIA.XLS table or the S7FCOTIB.XLS table (see \E\) can be used. The sequence of the conditions for switching the axis back on after a reaction to a fault ensures that the operator has exited the hazardous area. Requirements for the safety integrity of the SRCF Table 4-4 Topic Safety Integrity Level (SIL) of the SRCF PFH D value (PFH D ) of the SRCF Requirement The risk assessment (chapter 3.2.1) yields the following Safety Integrity Level: SIL 2 Using the required Safety Integrity Level yields the following PFH D value: PFH D < Specification of SRCF 2 Table 4-5 SRCF Specified SRCF 2 Immediate stopping of both axes at the machine. 28 V1.1, Entry ID:

29 4 Specification and Realization 4.1 Developing the SRCF specification Information on the SRCF Table 4-6 Topic Hazard at the machine which the SRCF should prevent. Persons at the machine Mode of the machine in which the SRCF is to be active. Information When opening the protective cover of the machine, the operator may suffer severe injury at the gear wheels rotating in the machine which are connected with both machine axes. Operating staff, maintenance staff In each operating mode of the machine Requirements for the SRCF functionality Table 4-7 Topic Requirement Function of the SRCF Conditions under which the SRFC must be active or disabled. Required reaction time Reaction to a fault Rate of operating cycles for the electromechanical components. After opening the protective cover of the machine, all axes of the machine must be stopped immediately. The SRCF must always be active at the machine. When the protective cover is opened, the blade has to be stopped after 150ms at the latest. When a fault occurs, the reaction must be as follows: immediate stopping of all machine axes switching the Disturbance indicator light on Switching the machine axes back on must only be possible if the following requirements have been met: the fault has been corrected the protective cover is closed the operator has acknowledged the fault via a button at the machine Hinge switch and position switch of the protective cover: the operator must open the protective cover for the gear wheels of the machine once every three days for a 15 minutes maintenance procedure. 10 times per month Note The required reaction time depends on the conditions at the machine. There must not be any hazard for the operator. For determining the reaction time, the S7FCOTIA.XLS table or the S7FCOTIB.XLS table (see \E\) can be used. Note The sequence of the conditions for switching the axis back on after a reaction to a fault ensures that the operator has exited the hazardous area. V1.1, Entry ID:

30 4 Specification and Realization 4.1 Developing the SRCF specification Requirements for the safety integrity of the SRCF Table 4-8 Topic Safety Integrity Level (SIL) of the SRCF PFH D value (PFH D ) of the SRCF Requirement The risk assessment (chapter 3.2.2) yields the following Safety Integrity Level: SIL 2 Using the required Safety Integrity Level yields the following PFH D value: PFH D < Specification of SRCF 3 Table 4-9 SRCF Specified SRCF 3 Emergency stop for all axes at the machine. Information on the SRCF Table 4-10 Topic Hazard at the machine which the SRCF should prevent. Persons at the machine Mode of the machine in which the SRCF is to be active. None. Information The SRCF 3 emergency stop is a supplementary safety function which must not replace an independent safety function. Therefore, a hazard cannot be specified for this SRCF. All In each operating mode of the machine Requirements for the SRCF functionality Table 4-11 Topic Function of the SRCF Conditions under which the SRFC must be active or disabled. Required reaction time Requirement After the emergency stop control unit is actuated, the all axes of the machine must be stopped immediately. The SRCF must always be active at the machine. After the emergency stop control unit has been actuated, the blade must stop after 150ms at the latest. 30 V1.1, Entry ID:

31 4 Specification and Realization 4.1 Developing the SRCF specification Topic Reaction to a fault Rate of operating cycles for the electromechanical components. Requirement When a fault occurs, the reaction must be as follows: immediate stopping of all machine axes switching the Disturbance indicator light on Switching the machine axes back on must only be possible if the following requirements have been met: the fault has been corrected emergency stop button unlocked the operator has acknowledged the fault via a button at the machine Emergency stop control unit: the operator must actuate the emergency stop control unit at least once per day. 1 times per week Note The required reaction time depends on the conditions at the machine. There must not be any hazard for the operator. Note For determining the reaction time, the S7FCOTIA.XLS table or the S7FCOTIB.XLS table (see \E\) can be used. The sequence of the conditions for switching the axis back on after a reaction to a fault ensures, that the axis cannot start up automatically after an error. Requirements for the safety integrity of the SRCF Table 4-12 Topic Requirement Safety Integrity Level (SIL) of the SRCF PFH D value (PFH D ) of the SRCF The risk assessment (chapter 3.2.3) yields the following Safety Integrity Level: SIL 2 Using the required Safety Integrity Level yields the following PFH D value: PFH D < 10-6 V1.1, Entry ID:

32 4 Specification and Realization 4.2 Designing the SRECS architecture 4.2 Designing the SRECS architecture Dividing the SRCF into function blocks Dividing the SRCF into function blocks has already been performed in chapter when creating the safety functions in the Safety Evaluation Tool (SET). Dividing the SRCF into function blocks was performed so that each individual function of the SRCF is performed in a separate function block, and a failure of one function block of the SRCF causes the failure of the entire SRCF ( series connection of the function blocks ). Figure 4-1 Dividing the SRCF into function blocks Safety-related Control Functions (SRCF) Information Function block 1: Detection Function block 2: Evaluation Function block 3: Reaction Actions Safety-related control function 1 (SRCF 1) Figure 4-2 Safety-related control function 1 (SRCF 1) Information Function block 1: Detection Safety-related Control Function (SRCF) Function block 2: Evaluation Function block 3: Reaction Actions Table 4-13 Function of the function blocks SRCF 1 Function block Function 1: Detection Detecting the position of the protective door of the protection zone 2: Evaluation Evaluation of the detected position of the protective door of the protection zone, and triggering an appropriate action (controlling the SINAMICS S120 drive) 3: Reaction Triggering the safety function in the SINAMICS S120 drive 32 V1.1, Entry ID:

33 4 Specification and Realization 4.2 Designing the SRECS architecture Safety-related control function 2 (SRCF 2) Figure 4-3 Safety-related control function 2 (SRCF 2) Safety-related Control Function (SRCF) Information Function block 1: Detection Function block 2: Evaluation Function block 3: Reaction Actions Table 4-14 Function of the function blocks SRCF 2 Function block Function 1: Detection Detecting the protective cover position 2: Evaluation Evaluation of the detected position of the protective cover of the protection zone, and triggering an appropriate action (controlling the SINAMICS S120 drive) 3: Reaction Triggering the safety function in the SINAMICS S120 drive Safety-related control function 3 (SRCF 3) Figure 4-4 Safety-related control function 3 (SRCF 3) Information Function block 1: Detection Safety-related Control Function (SRCF) Function block 2: Evaluation Function block 3: Reaction Actions Table 4-15 Function of the function blocks SRCF 3 Function block Function 1: Detection Detecting the state of the emergency stop control unit 2: Evaluation Evaluation of the detected state of the emergency stop control unit and triggering an appropriate action (controlling the SINAMICS S120 drive) 3: Reaction Triggering the safety function in the SINAMICS S120 drive Details of the requirements for the function blocks The requirements for the individual function blocks of the SRCF are now described in detail using uniform tables. V1.1, Entry ID:

34 4 Specification and Realization 4.2 Designing the SRECS architecture Safety-related control function 1 (SRCF 1) Table 4-16 Detailed function of the function blocks SRCF 1 Function block Function 1: Detection Input Output Function 2: Evaluation Input Output Function 3: Reaction Input Position of the protective door of the protection zone: open or closed Information on the position of the protective door of the protection zone: protective door of the protection zone is open protective door of the protection zone is closed Detecting the position of the protective door of the protection zone in all operating modes of the machine. Information on the position of the protective door of the protection zone (output of function block 1) Command for controlling the SINAMICS S120 drive: triggering the reduction of the axis speed in the integrated technology of the fail-safe Technology CPU by triggering a PLCopen function. triggering the Safely-Limited Speed (SLS) safety function in the SINAMICS S120 drive for monitoring the reduction of the axis speed. In terms of safety, both actions are combined in a command for controlling the SINAMICS S120. Evaluating the detection of the position of the protective door of the protection zone, and appropriate control of the integrated technology of the fail-safe Technology CPU and the SINAMICS S120 drive in all operating modes of the machine. Command for controlling the SINAMICS S120 drive (output of function block 2) Output --- Function Reducing the axis speed to a safe upper speed limit: reducing the axis speed monitoring the reduction of the axis speed within a defined delay time via the Safely-Limited Speed (SLS) safety function of the SINAMICS S120. In terms of safety, both actions are combined in a function of the SINAMICS S120. Safety-related control function 2 (SRCF 2) Table 4-17 Detailed function of the function blocks SRCF 2 Function block 1: Detection Input Output Function Position of the protective cover: open or closed Information on the position of the protective cover: protective cover is open protective cover is closed 34 V1.1, Entry ID:

35 4 Specification and Realization 4.2 Designing the SRECS architecture Function block Function Function 2: Evaluation Input Output Function 3: Reaction Input Detecting the position of the protective cover in all operating modes of the machine. Information on the protective cover position (output of function block 1) Command for controlling the SINAMICS S120 drive: triggering the Safe Stop 1 (SS1) safety function in the SINAMICS S120 drive. Evaluating the detection of the position of the protective cover, and appropriate control of the SINAMICS S120 drive in all operating modes of the machine. Command for controlling the SINAMICS S120 drive (output of function block 2) Output --- Function Safe stopping of all axes of the drive: activating the Safe Stop 1 (SS1) safety function for all axes of the SINAMICS S120. Safety-related control function 3 (SRCF 3) Table 4-18 Detailed function of the function blocks SRCF 2 Function block 1: Detection Input Output Function 2: Evaluation Input Output Function 3: Reaction Input Function State of the emergency stop control unit: triggered or not triggered Information on the state of the emergency stop control unit: emergency stop control unit triggered (actuated): emergency stop control unit not triggered (not actuated): Detecting the state of the emergency stop control unit in all operating modes of the machine. Information on the state of the emergency stop control unit (output of function block 1) Command for controlling the SINAMICS S120 drive: triggering the Safe Stop 1 (SS1) safety function in the SINAMICS S120 drive. Evaluating the state of the emergency stop control unit, and appropriate control of the SINAMICS S120 drive in all operating modes of the machine. Command for controlling the SINAMICS S120 drive (output of function block 2) Output --- Function Safe stopping of all axes of the drive: activating the Safe Stop 1 (SS1) safety function for all axes of the SINAMICS S120. V1.1, Entry ID:

36 4 Specification and Realization 4.2 Designing the SRECS architecture Specification of the hardware components In order to verify the possibility for realizing the individual function blocks with the Safety Evaluation Tool (SET) and to calculate the SIL claim limit (SIL CL), hardware components must be specified for the individual function blocks which can be used for the verification. Should the specified hardware components not meet the desired SIL claim limit (SIL CL), the list of the hardware components can be adjusted accordingly in a further iteration step. Table 4-19 List of the hardware components SRCF HW component Order number Manufacturer Function block: Detection 1 Position switch Contacts: 1 NO + 1 NC 3SE HE10 Siemens AG 1 Position switch Contacts: 1 NO + 1 NC 3SE HE10 2 Hinge switch Contacts: 1 NO + 1 NC Switching angle: 10 2 Position switch with separate actuator, Contacts: 1 NO + 2 NC Standard actuator 3 Emergency stop control unit casing with actuator Contacts: 2 NC Function block: Evaluation 1/2/3 CPU 317TF-2 DP 3SE HU22 3SE QV40 3SE AV01 3SB3801-0EG3 6ES7317-6TF14-0AB0 Siemens AG SM 326 DI 24xDC24V 6ES7326-1BK02-0AB0 Function block: Reaction 1/2/3 SINAMICS S120 Depending on the version Siemens AG Control unit CU 320 6SL3040-0MA00-0AA1 Rectifier/regenerative unit smart line module 6SL3430-6TE21-6AA0 Power unit double motor module 6SL3420-2TE11-7AA0 Servo-motor 1FK7 motor 1FK7022-5AK71-1DG0 36 V1.1, Entry ID:

37 4.2.4 Assigning function blocks to subsystems 4 Specification and Realization 4.2 Designing the SRECS architecture Subsequently, the function blocks of the safety-related control functions (SRCF 1, SRCF 2 and SRCF 3) are assigned to subsystems of the safety-related electrical, electronic and programmable electronic control system (SRECS). The assignment or realization of the subsystems is explained in greater detail in the subsequent chapters of this documentation. The realization options are determined by means of the table for determining the SIL claim limit (SIL CL). Table 4-20 Evaluation of the SIL claim limit (SIL Cl) Hardware fault tolerance (HFT) Safe failure fraction (SFF) < 60% Not allowed SIL CL 1 SIL CL 2 60% to < 90% SIL CL 1 SIL CL 2 SIL CL 3 90% to < 99% SIL CL 2 SIL CL 3 SIL CL 3 99% SIL CL 3 SIL CL 3 SIL CL Function block subsystem 1: position of the protective door For the subsystem for monitoring the protective door to the protection zone, there are, according to the table, three options for achieving an SIL CL 2 claim limit. However, the option with HFT = 2 is not further taken into consideration here for economical reasons. Table 4-21 Realization options for subsystem 1 Realization option 1 Realization option 2 Realization option 3 The subsystem consists of one subsystem element. The subsystem consists of one subsystem element. The subsystem consists of two subsystem elements. Single channel structure hardware fault tolerance HFT = 0 Required safe failure fraction: 90% SFF < 99% Mechanical single channel structure / electrical two channel structure hardware fault tolerance HFT = 0 Required safe failure fraction: 90% SFF < 99% Two channel structure hardware fault tolerance HFT = 1 Required safe failure fraction: 60% SFF < 90% Distinctive features of realization option 2: Due to the mechanical structure of the drive head of the position switch, which cannot be appropriately protected from damage, no so-called fault exclusion can be applied to this position switch. The hardware fault tolerance can therefore not be increased to HFT = 1 and remains at HFT = 0. Both contacts of the position switch can therefore not be viewed independent of each other, therefore, a failure for the drive head might not V1.1, Entry ID:

38 4 Specification and Realization 4.2 Designing the SRECS architecture be detected. Despite of the two evaluated contacts, the subsystem element behaves like a single channel structure. This yields a diagnostic coverage (DC) of < 60% (none). The requirements for the safety-related control function 1 (SRCF 1) mentioned in chapter result in the following number of actuations or the resulting test interval: Table 4-22 Requirements for the SRCF The operator needs to access the hazardous area several times within the hour for approximately 10 minutes. Maximal 6 times per hour Actuations / Test interval 6.0 per hour With the information on hand the achievable Safety Integrity Level (SIL) for the various realization options can be now determined using the Safety Evaluation Tool (SET). Realization option 1 Single channel structure with one subsystem element. Due to the single channel structure a diagnosis of the subsystem is not possible. Therefore a diagnostic coverage (DC) of < 60% (none) results, which is directly entered into the screen mask of the Safety Evaluation Tool (SET). Figure 4-5 Viewing realization option 1 in the SET Entering all required values and parameters, immediately yields the resulting SIL claim limit (SIL CL) and the respective PFH D value via the Safety Evaluation Tool (SET). 38 V1.1, Entry ID:

39 4 Specification and Realization 4.2 Designing the SRECS architecture Realization option 2 Two channel structure with one subsystem element. Due to the missing fault exclusion single the structure behaves like a single channel structure. Therefore a diagnosis of the subsystem is not possible and a diagnostic coverage (DC) of < 60% (none) results, which is directly entered. Figure 4-6 Viewing realization option 2 (channel 1) in the SET Figure 4-7 Viewing realization option 2 (channel 2) in the SET V1.1, Entry ID:

40 4 Specification and Realization 4.2 Designing the SRECS architecture Realization option 3 Two channel structure with two subsystem elements. A cross comparison of the input signals in the logic is possible (principle of the SIMATIC F CPUs), which yields a diagnostic coverage (DC) of 99% (high). Figure 4-8 Determining the diagnostic coverage DC in the SET Figure 4-9 Viewing realization option 2 (channel 1) in the SET 40 V1.1, Entry ID:

41 4 Specification and Realization 4.2 Designing the SRECS architecture Figure 4-10 Viewing realization option 2 (channel 2) in the SET Entering all required values and parameters here also immediately enables reading the resulting SIL claim limit (SIL CL) and the respective PFH D value via the Safety Evaluation Tool (SET). Evaluation of the realization options Since for realization options 1 and 2 a maximum Safety Integrity Level of SIL CL 1 can be achieved, these realizations are not considered for the application. With realization option 3 a Safety Integrity Level SIL CL 3 can be reached without problems. Therefore, a two channel structure with these position switch types is necessary for subsystem 1 of the safety-related control function (SRCF). Note If in the Safety Evaluation Tool (SET) the S7 connection is selected via ET 200 M, i.e. directly via the fail-safe I/O-modules of the S7-300 controller family, the S7 sensor group is automatically inserted in the Safety Evaluation Tool (SET) in the Evaluate subsystem, and there it can be supplied with the required parameters for the calculation. If the connection is not specified, the S7 sensor group can in the Evaluation subsystem also be inserted manually in order to connect the sensor group. V1.1, Entry ID:

42 4 Specification and Realization 4.2 Designing the SRECS architecture Function block subsystem 2: position of the protective cover For the subsystem for monitoring the protective door there are, according to the table, three options for achieving an SIL CL 2 claim limit. However, the option with HFT = 2 is not further taken into consideration here for economical reasons. Table 4-23 Realization options for subsystem 2 Realization option 1 Realization option 2 Realization option 3 The subsystem consists of one subsystem element. The subsystem consists of one subsystem element. The subsystem consists of two subsystem elements. Note Single channel structure hardware fault tolerance HFT = 0 Required safe failure fraction: 90% SFF < 99% Mechanical single channel structure / electrical two channel structure hardware fault tolerance HFT = 0 Required safe failure fraction: 90% SFF < 99% Two channel structure hardware fault tolerance HFT = 1 Required safe failure fraction: 60% SFF < 90% Wire break and short-circuit are in this consideration not included for the diagnostic capability, since these faults are mere systematic errors. Distinctive features of realization option 2: The mechanical single channel structure of this solution can be compensated by a so-called fault exclusion: The protection of the separated actuator excludes a breakage of the actuator of this position switch. Therefore, this setup can be considered a two channel structure. The subsystem reaches a hardware fault tolerance of HFT = 1. This reduces the required safe failure fraction for reaching SIL CL 2 is to 60% SFF < 90%. The diagnosis is possible via the two channel electrical structure. In this case, the realization option 2 behaves similar to the realization option 3 of this subsystem. Note According to IEC 62061, when using fault exclusion, a maximal SIL claim limit of SIL CL 2 can be reached for a system with a hardware fault tolerance of HFT = V1.1, Entry ID:

43 4 Specification and Realization 4.2 Designing the SRECS architecture The requirements for the safety-related control function 2 (SRCF 2) mentioned in chapter result in the following number of actuations or the resulting test interval: Table 4-24 Requirements for the SRCF The operator must open the protective cover for the gear wheels of the machine once every three days for a 15 minutes maintenance procedure. 10 times per month Actuations / Test interval 10.0 per month Corresponding to: per hour (= 10/(30 24) = h -1 ) With the information on hand the achievable Safety Integrity Level (SIL) for the various realization options can be now determined using the Safety Evaluation Tool (SET). Realization option 1 Single channel structure with one subsystem element. Due to the single channel structure a diagnosis of the subsystem is not possible. Therefore a diagnostic coverage (DC) of < 60% (none) results, which is directly entered into the screen mask of the Safety Evaluation Tool (SET). Figure 4-11 Viewing realization option 1 in the SET Entering all required values and parameters, immediately yields the resulting SIL claim limit (SIL CL) and the respective PFH D value via the Safety Evaluation Tool (SET). V1.1, Entry ID:

44 4 Specification and Realization 4.2 Designing the SRECS architecture Realization option 2 Two channel structure with one subsystem element. A cross comparison of the input signals in the logic is possible which yields a diagnostic coverage (DC) of 99% (high). Figure 4-12 Viewing realization option 2 (channel 1) in the SET Figure 4-13 Viewing realization option 2 (channel 2) in the SET 44 V1.1, Entry ID:

45 4 Specification and Realization 4.2 Designing the SRECS architecture Realization option 3 Two channel structure with two subsystem elements. A cross comparison of the input signals in the logic is possible which yields a diagnostic coverage (DC) of 99% (high). Figure 4-14 Viewing realization option 3 (channel 1) in the SET Figure 4-15 Viewing realization option 3 (channel 2) in the SET V1.1, Entry ID:

46 4 Specification and Realization 4.2 Designing the SRECS architecture Entering all required values and parameters at realization option 2 and 3 also immediately enables reading the resulting SIL claim limit (SIL CL) and the respective PFH D value via the Safety Evaluation Tool (SET). Evaluation of the realization options Since for realization option 1 a maximum Safety Integrity Level of SIL CL 1 can be achieved, this realization is not considered for the application. With realization option 2 and realization option 3 a Safety Integrity Level SIL CL 2 can be reached without problems. Therefore, subsystem 2 of the safetyrelated control function (SRCF) requires a two channel structure, or a mechanical single channel and electrical two channel structure with fault exclusion with these position switch types. Note In order to reach the required SIL claim limit, an applied fault exclusion must always be sufficiently documented. Note In order to further illustrate the calculation of the Safety Integrity Level (SIL), this example, for didactical reasons, uses realization option 3 for monitoring the protective cover. The calculation of the Safety Integrity Level (SIL) for the realization option 2 can be performed analog to this Function block subsystem 3: emergency stop For the subsystem for monitoring the state of the emergency stop control unit there are, according to the table, two options for determining the SIL claim limit to reach SIL CL 2. Table 4-25 Realization options for subsystem 1 Realization option 1 Realization option 2 The subsystem consists of one subsystem element. The subsystem consists of one subsystem element. Single channel structure hardware fault tolerance HFT = 0 Required safe failure fraction: 90% SFF < 99% Two channel structure hardware fault tolerance HFT = 0 Required safe failure fraction: 90% SFF < 99% Note With the two channel structure of realization option 2 only a hardware fault tolerance HFT = 0 can be achieved, since this is only one emergency stop control unit for actuating both contacts. 46 V1.1, Entry ID:

47 4 Specification and Realization 4.2 Designing the SRECS architecture The requirements for the safety-related control function 1 (SRCF 1) mentioned in chapter result in the following number of actuations or the resulting test interval: Table 4-26 Requirements for the SRCF The operator must actuate the emergency stop control unit at least once per week. 1 times per week Actuations / Test interval 1 times per week With the information on hand the achievable Safety Integrity Level (SIL) for the various realization options can be now determined using the Safety Evaluation Tool (SET). Realization option 1 Single channel structure with one subsystem element. Due to the single channel structure a diagnosis of the subsystem is not possible. Therefore a diagnostic coverage (DC) of < 60% (none) results, which is directly entered into the screen mask of the Safety Evaluation Tool (SET). Figure 4-16 Viewing realization option 1 in the SET V1.1, Entry ID:

48 4 Specification and Realization 4.2 Designing the SRECS architecture Realization option 2 Two channel structure with one subsystem element. A cross comparison of the input signals in the logic is possible which yields a diagnostic coverage (DC) of 99% (high). Figure 4-17 Viewing realization option 2 (channel 1) in the SET Figure 4-18 Viewing realization option 2 (channel 2) in the SET 48 V1.1, Entry ID:

49 4 Specification and Realization 4.2 Designing the SRECS architecture Evaluation of the realization options Since for realization option 1 a maximum Safety Integrity Level of SIL CL 1 can be achieved, this realization is not considered for the application. With realization option 2 a Safety Integrity Level SIL CL 2 can be reached without problems. Therefore, a two channel structure with these position switch types is necessary for subsystem 3 of the safety-related control function (SRCF) Function block subsystem 4 For subsystem 4 the fail-safe Technology CPU 317TF-2 DP is used in conjunction with a fail-safe input module SM 326 DI 24xDC24V. According to the manufacturer, SIL CL 3 can be achieved with both modules. In the Safety Evaluation Tool (SET) both modules must be entered an evaluated independently of each other: the Technology CPU 317T-2 DP is created as a Logic group the fail-safe input module SM 326 DI 24xDC24V is created as an S7 sensor group. Note If in the Detection function block of the Safety Evaluation Tool (SET) the ET200M setting has been selected respectively for the S7 connection of the sensors, the S7 sensor group is automatically inserted in the Evaluate subsystem of the Safety Evaluation Tool (SET). Figure 4-19 Viewing the logic group in the SET V1.1, Entry ID:

50 4 Specification and Realization 4.2 Designing the SRECS architecture Figure 4-20 Viewing the S7 sensor group in the SET Selecting the employed hardware components directly yields the resulting SIL claim limit (SIL CL) and the respective PFH D value from the Safety Evaluation Tool (SET) for subsystem Function block subsystem 5 For subsystem 5 the fail-safe SINAMICS S120 drive is used, which, according to the manufacturer, can achieve a maximum of SIL CL 2. In the Safety Evaluation Tool (SET) the drive must be entered via the individual components of the SINAMICS S120 including the employed motors or encoders This can be performed in two different ways: using the wizard for entering the components of the SINAMICS S120 manual input of the individual components of the SINAMICS S120 Using the wizard for entering the components of the SINAMICS S120 For using the wizard for the input of the components of the SINAMICS S120 an actuator group must be created as a new subsystem in the Reaction function block. In the accordingly created actuator group the SIL/PL exists type must be selected and entered as SINAMICS S120 modular product group. Then, the wizard for entering the components of the SINAMICS S120 can be accessed via the screwdriver icon in the Safety Evaluation Tool (SET). 50 V1.1, Entry ID:

51 4 Specification and Realization 4.2 Designing the SRECS architecture Figure 4-21 Calling the Wizard in the SET Creating the components of the SINAMICS S120 via the wizard. Now, the individual screen masks of the wizard can be filled in, which then creates the individual components of the SINAMICS S120 in the Safety Evaluation Tool (SET). Figure 4-22 Wizard for selecting the sub-structure of subsystem 5 (SINAMICS S120) Note The Smart Line Module rectifier/regenerative unit of the SINAMICS S120 needs, in the selected structure of the drive system, not be viewed in the Safety Evaluation Tool (SET), since it is not relevant for the calculation in this configuration. V1.1, Entry ID:

52 4 Specification and Realization 4.2 Designing the SRECS architecture Then the data of the individual components in the Safety Evaluation Tool (SET) need to be completed, as illustrated in the following block. Manual input of the individual components of the SINAMICS S120 Figure 4-23 Viewing the control unit in the SET Figure 4-24 Viewing the double motor module in the SET 52 V1.1, Entry ID:

53 Figure 4-25 Viewing motor 1 (freely accessible axis) in the SET 4 Specification and Realization 4.2 Designing the SRECS architecture Figure 4-26 Viewing motor 2 (encapsulated axis) in the SET Selecting the employed hardware components and specifying the sub-structure of the SINAMICS S120 directly yields the resulting SIL claim limit (SIL CL) and the respective PFH D value from the Safety Evaluation Tool (SET) for subsystem 5. V1.1, Entry ID:

54 4 Specification and Realization 4.3 Realizing the sub-systems Summary The table shows the assignment of the function blocks of the safety-related control functions (SRECS) to the subsystems of the safety system (SRECS). Table 4-27 Subsystems of the safety system (SRECS) Subsystem Function Components Subsystem 1 Subsystem 2 Subsystem 3 Subsystem 4 Subsystem 5 Detecting the position of the protective door. (SRCF 1) Detecting the protective cover position. (SRCF 2) Detecting the emergency stop control unit. (SRCF 3) Evaluation of the signals. (SRCF 1 / SRCF 2 / SRCF 3) Reacting to the evaluated signals. (SRCF 1 / SRCF 2 / SRCF 3) SIRIUS SIRIUS SIRIUS SIMATIC S7 Distributed Safety SINAMICS Figure 4-27 Safety system (SRECS) Information Safety System (SRECS) Detection Evaluation Reaction SILCL 3 Subsystem 1 Subsystem 4 Subsystem 5 Subsystem 2 SILCL 3 SILCL 3 SILCL 2 Actions Subsystem 3 SILCL Realizing the sub-systems After designing the architecture of the safety system (SRECS), the subsystems of the SRECS are now finally realized. A SRECS safety system must be realized in such a way that it meets all requirements according to the required SIL. The objective is to sufficiently reduce the probability of faults which cause a dangerous state on the machine. The following considerations apply for realizing the subsystems: Consideration of the structural restriction The structure (architecture) of the subsystem must be realized in such a way that the SIL claim limit (SILCL) of the subsystem is at least equal to the Safety Integrity Level (SIL) of the safety-related control function (SRCF). 54 V1.1, Entry ID:

55 4 Specification and Realization 4.3 Realizing the sub-systems Consideration of the PFH D value (PFH D ) The PFH D value (PFH D ) of the safety-related control function (SRCF) is equal to the sum of the PFH D value (PFH D ) of the subsystems. The subsystems must thus be realized in such a way that the total PFH D value (PFH D ) of the SRCF is not exceeded. Consideration of the diagnosis Additional diagnostic functions enable designing a subsystem in such a way that the SIL claim limit (SILCL) is improved: increased diagnostics improves the safe failure fraction (SFF) (improved fault detection) increased diagnostics improves the PFH D value (PFH D ) (reduction of the PFH D ) The diagnostic functions do not have to be performed in the considered subsystems themselves. For example, diagnosis of subsystem 1 can be performed in subsystem 4. Consideration of the systematic Safety Integrity Level In the subsystems, measures have to be taken to achieve the systematic safety integrity. The following respective measures can be taken (according to \5\): avoidance of systematic faults control of systematic faults (e.g. through diagnostics) An overview of the realization of the subsystems in this application example is provided by the graphic below. Figure 4-28 Overview of the structure of the safety system (SRECS) V1.1, Entry ID:

56 4 Specification and Realization 4.3 Realizing the sub-systems The hardware components finally used for the realization of the safety system (SRECS) are listed in the subsequent table. Table 4-28 List of the hardware components HW component Order number Manufacturer 1.1 Position switch Contacts: 1 NO + 1 NC 3SE HE10 Siemens AG 1.2 Position switch Contacts: 1 NO + 1 NC 3SE HE Hinge switch Contacts: 1 NO + 1 NC Switching angle: 10 3SE HU Position switch with separate actuator Contacts: 1 NO + 2 NC 3SE QV40 Standard actuator 3SE AV01 3 Emergency stop control unit casing with actuator Contacts: 2 NC 3SB3801-0EG3 4 5 CPU 317TF-2 DP SM 326 DI 24xDC24V SINAMICS S120 Control unit CU 320 Rectifier/regenerative unit smart line module 6ES7317-6TF14-0AB0 6ES7326-1BK02-0AB0 Depending on the version 6SL3040-0MA00-0AA1 6SL3430-6TE21-6AA0 Siemens AG Siemens AG Power unit double motor module 6SL3420-2TE11-7AA0 Servo-motor 1FK7 motor 1FK7022-5AK71-1DG0 56 V1.1, Entry ID:

57 5 Determination of the SIL achieved by SRECS 5.1 Evaluation via the Safety Evaluation Tool (SET) 5 Determination of the SIL achieved by SRECS 5.1 Evaluation via the Safety Evaluation Tool (SET) Conditions for the required SIL Here, it is checked whether the required Safety Integrity Level (SIL) is achieved for each safety-related control function (SRCF) with the realized safety system (SRECS). The following conditions must be fulfilled: The SIL claim limit (SILCL) of each SRCF subsystem must at least correspond to the Safety Integrity Level (SIL) of the SRCF. The sum of the PFH D values (PFH D ) of all SRCF subsystems must not exceed the PFH D value (PFH D ) specified by the Safety Integrity Level (SIL) of the SRCF. If a subsystem is used by different SRCFs, the SIL claim limit (SILCL) of the subsystem must comply with the highest Safety Integrity Level (SIL) of the SRCF Results report of the Safety Evaluation Tool (SET) The evaluation and application of the above mentioned conditions is in the Safety Evaluation Tool (SET) given via the results report. Figure 5-1 Creating a report in SET To create a report in the Safety Evaluation Tool (SET) you first select the desired project in the project tree and then press the Create report button in the toolbar. The report is then offered as a PDF file for download. V1.1, Entry ID:

58 5 Determination of the SIL achieved by SRECS 5.2 Safety-related control function 1 (SRCF 1) Figure 5-2 Report as PDF file 5.2 Safety-related control function 1 (SRCF 1) Table 5-1 SRCF Specified SRCF 1 Reducing the axis speed of the freely accessible machine axes to a safe upper speed limit. Figure 5-3 Safety-related control function 1 (SRCF 1) of the SRECS Safety System (SRECS) Information Detection Evaluation Reaction Actions Subsystem 1 Subsystem 4 Subsystem 5 Subsystem 2 Subsystem 3 SRCF 1 58 V1.1, Entry ID:

59 5 Determination of the SIL achieved by SRECS 5.3 Safety-related control function 2 (SRCF 2) Figure 5-4 Result report of the safety-related control function 1 (SRCF 1) Result The safety-related control function 1 (SRCF 1) reaches the required Safety Integrity Level (SIL) of 2. Note The PFH D value of the safety-related control function 1 (SRCF 1) would allow a Safety Integrity Level (SIL) of 3. Since however, subsystem 5 only achieves a Safety Integrity Level (SIL) of 2, the maximal achievable performance level of the safety-related control function 1 (SRCF 1) is limited to SIL of Safety-related control function 2 (SRCF 2) Table 5-2 SRCF Specified SRCF 2 Immediate stopping of both axes at the machine. Figure 5-5 Safety-related control function 2 (SRCF 2) of the SRECS Safety System (SRECS) Information Detection Evaluation Reaction Actions Subsystem 1 Subsystem 4 Subsystem 5 Subsystem 2 Subsystem 3 SRCF 2 V1.1, Entry ID:

60 5 Determination of the SIL achieved by SRECS 5.4 Safety-related control function 3 (SRCF 3) Figure 5-6 Result report of the safety-related control function 2 (SRCF 2) Result The safety-related control function 2 (SRCF 2) reaches the required Safety Integrity Level (SIL) of 2. Note The PFH D value of the safety-related control function 2 (SRCF 2) would allow a Safety Integrity Level (SIL) of 3. Since however, subsystem 5 only achieves a Safety Integrity Level (SIL) of 2, the maximal achievable performance level of the safety-related control function 2 (SRCF 2) is limited to SIL of Safety-related control function 3 (SRCF 3) Table 5-3 SRCF Specified SRCF 3 Emergency stop for all axes at the machine. Figure 5-7 Safety-related control function 3 (SRCF 3) of the SRECS Safety System (SRECS) Information Detection Evaluation Reaction Actions Subsystem 1 Subsystem 4 Subsystem 5 Subsystem 2 Subsystem 3 SRCF 3 60 V1.1, Entry ID:

61 5 Determination of the SIL achieved by SRECS Figure 5-8 Result report of the safety-related control function 3 (SRCF 3) 5.5 Implementing SRECS Result The safety-related control function 3 (SRCF 3) reaches the required Safety Integrity Level (SIL) of 2. Note The PFH D value of the safety-related control function 3 (SRCF 3) would allow a Safety Integrity Level (SIL) of 3. Since however, subsystem 5 only achieves a Safety Integrity Level (SIL) of 2, the maximal achievable performance level of the safety-related control function 3 (SRCF 3) is limited to SIL of Implementing SRECS The implementation of the safety system (SRECS) occurs according to the following steps: Implementing the hardware The safety system (SRECS) must be implemented in accordance with the documented design of the SRECS. Specifying the software In our application, the safety-related control function (SRCF) requires application software. The application software is executed by the fail-safe CPU of subsystem 4. According to IEC 62061, a specification has to be developed for this application software. Designing and developing software The application software specified according to IEC 62061, chapter 6.10 has to be realized according to the requirements of IEC These requirements are based on IEC V1.1, Entry ID:

62 5 Determination of the SIL achieved by SRECS 5.5 Implementing SRECS Integrating and testing The integration of the safety system (SRECS) must occur in accordance with the requirements of IEC Tests must be performed, which review the correct interaction of all subsystems and subsystem elements, including the application software. The tests have to be defined in the safety plan (test cases) and performed accordingly. Installing Upon installation, the safety system (SRECS) is ready for the validation. 62 V1.1, Entry ID:

63 6 User Information and Validation 6.1 Generating user information 6 User Information and Validation 6.1 Generating user information To ensure the functional safety of the SRECS during usage and maintenance, a user information must be created which contains the following elements, for example: Description of the equipment, installation and mounting Circuit diagram Proof Test Interval or lifetime Description of the interaction of SRECS and machine Description of the maintenance requirements of the SRECS 6.2 Performing a validation During the validation it is checked, on the basis of the safety plan, whether the safety system (SRECS) meets the requirements described in the Specification of the safety function (SRCF). The following is required for the validation: All tests must be documented Each SRCF must be validated by a test and/or analysis. The systematic safety integrity of the SRECS must be validated. After validation has been performed the generation of a safety system (SRECS) according to IEC has been completed. V1.1, Entry ID:

64 7 Project File for the Application Example 7.1 Downloading the project file 7 Project File for the Application Example 7.1 Downloading the project file For the application example on hand, a project file for the Safety Evaluation Tool (SET) is also available as a download. Figure 7-1 Loading the project file With File > Load projects the project file on the application example can be downloaded into the Safety Evaluation Tool (SET). 7.2 Content of the project file The project file contains the calculation of the Safety Integrity Level (SIL) according to IEC or the performance level (PL) according to ISO for two respective variants of the safety system (SRECS) illustrated in this documentation Variant 1 of the safety system (SRECS) Variant 1 of the safety system (SRECS) contained in the project file is represented as follows: Figure 7-2 Variant 1 of the safety system (SRECS) Safety System (SRECS) Information Detection Evaluation Reaction Actions Subsystem 1 Subsystem 4 Subsystem 5 SF 1 Subsystem 2 SF 2 Subsystem 3 SF 3 64 V1.1, Entry ID:

65 7 Project File for the Application Example 7.2 Content of the project file Subsystem 2 of the safety system (SRECS) is realized according to realization option 2 illustrated in this documentation. All other subsystems are contained according to the realization options selected in the documentation Variant 2 of the safety system (SRECS) Variant 2 of the safety system (SRECS) contained in the project file is represented as follows: Figure 7-3 Variant 2 of the safety system (SRECS) Safety System (SRECS) Information Detection Evaluation Reaction Actions Subsystem 1 Subsystem 4 Subsystem 5 SF 1 Subsystem 2 SF 2 SF 3 Subsystem 3 Subsystem 2 of the safety system (SRECS) is realized according to realization option 3 illustrated in this documentation. All other subsystems are contained according to the realization options selected in the documentation. V1.1, Entry ID: