Report to the Certificate Z

Transcription

1 Report to the Certificate Z Safety Related Programmable Electronic System PROFIsafe-Driver Manufacturer: Siemens AG Gleiwitzer Straße Nürnberg Germany Revision 1.1 dated Testing Body: D Munich Certification Body: TÜV SÜD Product Service GmbH Ridlerstraße 65 D Munich Page 1 of 15 Dissemination, distribution, copying or any other use of any information in this report in part is strictly prohibited.

2 Revision Log Version Name Date Changes/History Initial Updated test basis to IEC : AMD1:2017 Table 1 Revision History Content Page 1 PURPOSE AND SCOPE CERTIFICATION SYSTEM OVERVIEW GENERAL DESCRIPTION CHANGES CERTIFICATION REQUIREMENTS STANDARDS, GUIDELINES AND COMMUNICATION PROFILES SAFETY PARAMETERS IMPLEMENTATION IDENTIFICATION BASIS OF CERTIFICATION SCOPE OF TESTING CUSTOMER DOCUMENTATION RESULTS CONDITIONS AND RESTRICTIONS OVERALL RESULT AND CERTIFICATE NUMBER Tel.: ; Fax: Page 2 of 15

3 List of Tables Table 1 Revision History 2 Table 2 Functional Safety Standards 7 Table 3 Communication Standards 7 Table 4 PROFIsafe Profile 7 Table 5 Implemented Safety measures 8 Table 6 supported communication modes 9 Table 7 - Main characteristics of the protocol versions 9 Table 8 F-Host/F-Device conformance matrix 9 Table 9 Identification of PROFIsafe-Driver V2.2.1 (PSD_V2_T2_2_45) 10 Table 10 Identification of PROFIsafe-Driver V2.2.1, Label PSD_V221_ET200MP_08 and PSD_V221_S7-1200_03 11 Table 11: Clarifications and conditions of use 14 Tel.: ; Fax: Page 3 of 15

4 1 Purpose and Scope 1.1 Certification In June 2014, Siemens AG contracted to perform a functional safety assessment of the safety-related PROFIsafe-Driver Version for SIL 3 according to IEC series. The related project number was In May 2017, Siemens AG assigned to update the testing basis to the officially released 3 rd edition of IEC During initial testing, the CD version had been used. This report on the certificate documents the user-related results of verification and certification of the PROFIsafe-Driver. It is based on the standards and guidelines listed in chapter 3. The detailed assessement and testing results are documented in the Technical Report SN 88712T. This Report to the Certificate is a mandatory part belonging to the Certificate no. Z System Overview 2.1 General Description The PROFIsafe-Driver is a safety related communication software driver for failsafe point-to-point communication via PROFIBUS or PROFINET. PROFIsafe-Driver implements the communication protocol PROFIsafe Profile V1-mode and V2- mode, depending on code generation, and will be delivered as set of signature - protected C- Code files Error detection mechanisms in the PSD A variety of measures are implemented in the PSD to detect errors. In the single-channel PSD, a high-quality flow-control is fitted in all interface functions to detect falsifications in the program flow. The functions are processed logically in dualchannel, where in the second channel the data is stored inversely. In the dual-channel PSD, a synchronization function serves to implement a flow-control in cyclical operation Tel.: ; Fax: Page 4 of 15

5 2.1.2 PSD Integration in F-Slaves The following diagrams show the FW blocks integrated in F communication and the integration of the PSD. Figure 1: Integration of the (dual-channel) PSD Figure 2: Integration of the PSD (single-channel) Slave-Stack: controls communication via PROFIBUS or PROFINET. Stack-Interface: for adapting the PSD to different Slave-Stacks. F-Application: specific device application that uses the PSD for communication via the PROFIBUS or PROFINET with cyclic F-telegrams. Synchronization-Interface: for temporal synchronization and data exchange. Tel.: ; Fax: Page 5 of 15

6 2.2 Changes PROFIsafe-Driver V2.2.1 comprises the following changes compared to the previous release V2.1.1: Support extensions that result from the PROFIsafe profile V2.6.1 CRC seed: Advanced protection against addressing and sequence errors WD2: Extended timeout monitoring mechanism for configuration changes in runtime Support of "RIOforFA" mode Additional source code file for the emulation of 64-bit arithmetic Additional and modified interface functions Tel.: ; Fax: Page 6 of 15

7 3 Certification Requirements 3.1 Standards, Guidelines and Communication Profiles Functional Safety IEC :2010 (ed. 2) IEC :2010 (ed. 2) Functional Safety of electrical/electronic/programmable electronic safety-related systems - Part 1: General requirements Functional Safety of electrical/electronic/programmable electronic safety-related systems - Part 3: Software requirements SIL 3 SIL 3 Table 2 Functional Safety Standards Communication Standards IEC :2016 (ed.3) IEC AMD1: 2017 Industrial communication networks Profiles Part 3: Functional safety fieldbuses - General rules and profile definitions Amendment 1 - Industrial communication networks - Profiles Part 3: Functional safety fieldbuses - General rules and profile definitions Table 3 Communication Standards Communication Profiles The description of the PROFIsafe-Profile V2.6.1 is given in the application standard: IEC :2016 (ed. 3) Industrial communication networks Profiles Part 3-3: Functional safety fieldbuses - Additional specifications for CPF 3 Basis: PROFIsafe Profile for Safety Technology on PROFIBUS and PROFINET IO - Version 2.6.1, August 2014 Table 4 PROFIsafe Profile Tel.: ; Fax: Page 7 of 15

8 3.2 Safety Parameters According to PROFIsafe Profile version V2.6.1, the PROFIsafe-Driver V2.2.1 has the following safety properties: Code Generation variant single channel dual channel Diagnostic measures X X CRC protection X Double and inverted program flow Double and inverted application interface Program flow control between normal and inverse path X Program flow control by synchronization between redundant hardware channels X X Support of extensions according to the PROFIsafe Profile V2.6.1 Protection against loopback error CRC seed: Protection against addressing and sequence errors Table 5 Implemented Safety measures Tel.: ; Fax: Page 8 of 15

9 3.3 Implementation The PROFIsafe-Driver V2.2.1 supports the following communication modes Mode supported by PROFIsafe-Profile Versions V1 V1.30 V2 V2.4, V2.6.1 Table 6 supported communication modes PROFIsafe-Driver V2.2.1 has been developed in accordance with IEC :2016 (3rd edition) (see section 3.1.2). The expanded protocol functions in IEC :2016 require conformance considerations to three F-Host protocol versions (BP, LP, XP) and F-Devices/F- Modules according to IEC Edition 2 and Edition 3. Protocol type Characteristics Profile Version Basic protocol (BP) Loop-back extension (LP) - F_CRC_Seed = 0 - Loop-back Bit 7 Restriction to be included in Safety manual: See IEC :2016, Table 30 "Communication relationships per safety function" IEC Ed.2 IEC Ed.2 Expanded protocol (XP) - F_CRC_Seed = 1 IEC Ed.3 Table 7 - Main characteristics of the protocol versions F-Host F-Device/Module according previous PROFIsafe Protocol Versions acc. IEC ed.1 and 2 Basic protocol (BP) - No change for F-Device and GSD (no F_CRC_Seed) acc. IEC ed.3 Basic protocol (BP) - F_CRC_Seed = 0 according PROFIsafe Protocol Table 8 F-Host/F-Device conformance matrix Loop-back extension (LP) - No change for F-Device and GSD Expanded protocol (XP) - New GSD file - Qualifier for F-I/O data, see [68] Tel.: ; Fax: Page 9 of 15

10 4 Identification Due to the requirement to support V1- and V2-Mode, the PROFIsafe-Driver V2.2.1 supports the following PROFIsafe Profile versions, depending on the generation variant: Supported PROFIsafe-Profiles V1.3, V2.4, V The release of PROFIsafe-Driver V2.2.1 provided in the PROFIsafe-Starter Kit is identified by the source control management system label PSD_V2_T2_2_45. The following table lists the source file identification parameters: Module single channel dual channel CRC Date p_64bit.c X X 0BD3 6C p_crc.c X X 112F 9B p_init.c X X EA02 4CF p_input.c X X F0CC 731E p_invers.c X - 04A1 32C p_output.c X X 044E 367C p_param.c X X 5D37 AC1F p_state.c X X D6D3 4DBE p_time.c X X 0D55 083B p_api.h X X 2671 D p_global.h X X BB8B 91A p_local.h X X 0611 DE6F p_types.h X X 859D C4F Summary-CRC 142A BEB3 Table 9 Identification of PROFIsafe-Driver V2.2.1 (PSD_V2_T2_2_45) Tel.: ; Fax: Page 10 of 15

11 In addition, the certification comprises two previous versions of PROFIsafe-Driver V2.2.1 identified by the source control management system labels PSD_V221_ET200MP_08 and PSD_V221_S7-1200_03. The following table documents the checksums of the respective source files: Source File ET200MP PSD_V221_ET200MP_08 S71200R1 PSD_V221_S7-1200_03 p_64bit.c 0BD36C78 1E7938FF p_crc.c 112F9B66 E38F12FE p_init.c F7C00ADF 0DD645C9 p_input.c F0CC731E DED8AB8E p_output.c FB6BC110 D0A20C65 p_param.c 5D37AC1F 8664C165 p_state.c 4292EC90 099A638F p_time.c 0D55083B DFBB2017 p_api.h 41E361A p_global.h 12CE12F5 1F079EAE p_local.h 99B7CD8C 4B24A68A p_types.h 859DC4F7 D228ACDC Overall 2947AB87 7EB43BB1 Table 10 Identification of PROFIsafe-Driver V2.2.1, Label PSD_V221_ET200MP_08 and PSD_V221_S7-1200_03 Tel.: ; Fax: Page 11 of 15

12 5 Basis of Certification 5.1 Scope of testing The certification of the PROFIsafe-Driver V2.2.1 was done according to the regulations and standards listed in clause 3.1 of this document. It comprised the successful completion of the following test segments: I. Functional Safety a. Software analysis for the safety-related software modules (FMEA / SWCA) b. Communication c. Fault simulations and software tests II. Product-related Quality Management in manufacturing and product care d. Functional Safety Management e. Evaluation of applied development and modification processes f. Verification and Validation activities III. Safety information in the product documentation (safety manual, operating instructions) The testing followed the basic certification scheme for Safety Components of TÜV SÜD Rail GmbH. 5.2 Customer documentation Safety related information is contained in the programming manual: Siemens PROFIsafe-Treiber V2.2.1 für FSlaves, Programmierhandbuch, A5E AA, Ausgabe 04/2016 Siemens PROFIsafe Driver V2.2.1 for FSlaves, Programming Manual, A5E AA, Edition 04/2016 Tel.: ; Fax: Page 12 of 15

13 6 Results The assessment showed that the quality assurance measures implemented by the manufacturer have shown that the PROFIsafe-Driver complies with the testing criteria specified in clause 3 in applications up to SIL 3 according IEC The Safety Manual contains the necessary information with regard to installation and operation and provides suitable user support. 7 Conditions and restrictions The PROFIsafe-Driver shall be used according to the programming manuals, see section 5.2. The application shall observe the following conditions and restrictions: The validation of the communication profiles shall be performed by an accredited laboratory according to the PROFIsafe conformance test 1. For dual channel implementations the synchronisation of the Dual Channel PROFIsafe- Driver generation is mandatory. It is not allowed to run this generation on single channel systems. For single channel implementations, the diagnostic measures of the Single Channel PROFIsafe-Driver generation are effective for PROFIsafe-Driver modules only. Additional measures may be necessary depending on the relevant standards to protect the system against random hardware faults. Implementation specific considerations are documented in Table 11 Additional conditions of use related to the PROFIsafe-Profile are defined in the Profile (see section 6.2 in PROFIsafe dv2.6.1 PNO:2014). 1 Information about test laboratories which test and validate the conformance of FSCP 3/1 products with IEC can be obtained from the National Committees of the IEC or from PROFIBUS Nutzerorganisation e.v. (PNO) Tel.: ; Fax: Page 13 of 15

14 Clarifications and conditions of use related to the certified PROFIsafe-Driver implementing PROFIsafe-Profile versions 1.3 Profile Citation 1 [PROFIsafe dv2.6.1 PNO:2014: Page 38, Chap. 6.2]: activate_fv_dc This safety-related variable indicates the F-Output data are failsafe values (FV = 0). It can be used to force the outputs of an F-Device to configured or built-in fail-safe values. Design implication The F-Device application shall always interpret all three return values F_OUTPUT_PASSIVATED, F_OUTPUT_WD_TIMEOUT, and F_OUTPUT_COMM_ERROR of psd_recvfouttele() in order to determine the signal state of "activate_fv_dc". Profile Citation 2 [PROFIsafe dv2.6.1 PNO:2014 Page 39, Chap. 6.2]: Driver_Fault is set in case of an internal fault of the driver (Figure 19). Design implication Return value F_OUTPUT_PASSIVATED is not set in case of a driver fault. Here, the safe state is guaranteed through the implemented error_routine measures of the driver. Profile Citation 3 [PROFIsafe dv2.6.1 PNO:2014 Page 45, Chap. 6.2]: The following variables are available to the specific device application. The variables are carrying similar names - normally extended by an index "DC" (device control) or "DS" (device status) - like the corresponding Bits within the Status and Control Bytes. Design implication A device application shall always evaluate all three return values F_OUTPUT_PASSIVATED, F_OUTPUT_WD_TIMEOUT, and F_OUTPUT_COMM_ERROR of psd_recvfouttele(). Reason: Whenever the driver discovers a communication error, the Control Byte may be disturbed also and its Bits not trustable (NOTE). Table 11: Clarifications and conditions of use Tel.: ; Fax: Page 14 of 15

15