ASIsafe Solution PROFIsafe

Transcription

1 Functional Example CD-FE-I-049-V20-EN ASIsafe Solution PROFIsafe EMERGENCY STOP with Protective Door Monitoring according to Category 4 of EN 954-1, (with evaluation according to EN 62061, and EN ISO : 2006) with DP/AS-i F-Link

2 Comments "Safety Integrated" Functional Examples are functional, tested automation configurations based on A&D standard products intended for simple, quick and economical implementation of automation tasks involving safety technology. Each of these Functional Examples covers one frequently occurring aspect of a typical customer problem in the field of safety technology. In addition to a list of all of the necessary software and hardware components, and a description of their interconnection, the Functional Examples also contain tested and commented codes. This enables the functions described here to be adapted quickly and thus used as a basis for individual extensions. Important information Safety Functional Examples are non-binding and do not claim to be complete with regard to configuration, equipment or to any contingency. The Safety Functional Examples are not customerspecific solutions. They are merely intended to assist in dealing with typical problems. You are solely responsible for the correct operation of the described products. These Safety Functional Examples do not relieve you of your responsibility for safe usage, installation, operation and maintenance. By using these Safety Functional Examples, you accept that Siemens is not liable for any damage beyond the liability described above. We reserve the right to make changes to these Safety Functional Examples at any time, without prior notice. If the suggestions in these Safety Functional Examples deviate from other Siemens publications (e.g. catalogs), the contents of the other document have priority. A&D Safety Integrated 2 / 29 CD-FE-I-049-V20-EN

3 Table of Contents 1 Guarantee, Liability and Support Function Description of Functionality Advantages / Customer Benefits Required Components Assembly and Wiring Overview of Hardware Assembly Hardware Component Wiring Important Hardware Component Settings Sample Code Comments Safety Program Execution Evaluation according to IEC and EN ISO : Safety function Evaluation of Safety Function Evaluation according to EN Evaluation according to EN ISO : Summary of Safety Function Evaluation of Safety Function Evaluation according to EN Evaluation according to EN ISO : Summary of Safety Function Contacts History A&D Safety Integrated 3 / 29 CD-FE-I-049-V20-EN

4 1 Guarantee, Liability and Support We are not liable for any of the information contained in this document. We are not liable for any damage caused by the use of the examples, information, programs, configuration and performance data, etc. described in this Safety Functional Example, independent of the legal ground this is based upon, unless we are imperatively liable according to the product liability law due to, e.g., cases of premeditation, an act of gross negligence, injury to life, body or health, or unless the quality of a product has been guaranteed, or due to fraudulent concealment of a defect or serious breach of contract. Damages due to serious breach of contract are, however, restricted to prevalent and foreseeable contractual damages, in as much as there is no premeditation or gross negligence nor imperative liability due to injury to life, body or health. This does not constitute a change in the burden of proof to your disadvantage. Copyright 2008 Siemens A&D. Propagation or reproduction of these application examples or parts thereof is not permitted unless expressly allowed by Siemens A&D. A&D Safety Integrated 4 / 29 CD-FE-I-049-V20-EN

5 2 Function 2.1 Description of Functionality Persons near machines (e.g. in production engineering) must be suitably protected by technical equipment. This Safety Functional Example describes the monitoring of an EMERGENCY STOP control unit and a separating protective device in the form of a protective door. The EMERGENCY STOP control unit is a widely used component for the protection of persons, machines and the environment. Another solution is to provide danger zones with mechanically separating protective devices or access panels. The aim here is to monitor unauthorized entry into these areas and also to prevent hazardous machine function when the protective device is opened. In this Safety Functional Example, the EMERGENCY STOP command device is monitored using positive opening contacts via the F-Link by means of the S7-416F. If the EMERGENY STOP is activated, the downstream contactors Q1 and Q2 are switched off by means of a positively driven operation. Before renewed switch-on or acknowledgement of the EMERGENCY STOP device via the start button, a check is carried out to monitor whether the contact of the EMERGENCY STOP control unit is closed and both contactors are switched off. The protective door is also monitored using two SIRIUS position switches with positive opening contacts via the F-Link by means of the S7-416F. If the protective door is opened, the downstream contactors Q1 and Q2 are switched off by means of a positively driven operation. If the protective door is closed, an automatic start takes place after the position switches and the downstream contactors have been checked. Note Equipment, functional aspects and design guidelines for EMERGENCY STOP command devices can be found in ISO Advantages / Customer Benefits Fast and simple wiring Easily expandable, e.g. with additional AS-i slaves Flexible range of uses Programming of the safety-related program using STEP7 engineering tools. Compact, safety-oriented gateway between PROFIBUS (DP slave) and AS-Interface Monitoring of the inputs of safety-oriented binary AS-i slaves (ASIsafe slaves) and forwarding of data via PROFIsafe. No additional safetyoriented components are required for the AS-Interface (e.g. safety monitor) A&D Safety Integrated 5 / 29 CD-FE-I-049-V20-EN

6 3 Required Components This chapter contains an overview of the hardware and software components required for the Functional Example. Hardware components Table 3-1 Component Type Order No. / Order Information Qty. Power supply PS307 5A 6ES73071EA00-0AA mm pushbutton with 2NC and 3SF5811-0AA10 EMERGENCY STOP yellow top, without protective collar, 1 with AS-i SIRIUS position switch Position switch with separate actuator 3SE RV40 1 SIRIUS position switch Position switch with separate actuator 3SF1124-1QV10-1BA2 and ASIsafe 1 Actuator for position switch Radius actuator 3SE AV05 2 Empty enclosure for one command 3SB AA3 point 1 Acknowledgement button 1NO contact block for base mounting 3SB3 420-OB 1 Black pushbutton with flat button, 3SB AA11 22 mm nominal diameter 1 Empty enclosure for one command 3SB AA3 1 point ON/OFF switch 1NO contact block for base mounting 3SB3 420-OB 1 Black handle, 2 switching positions 3SB KA11 1 K45 K45 compact module 3RK2400-1BQ20-0AA3 1 Mounting plate for wall mounting 3RK1901-2EA00 1 DP/AS-i-F-Link DP/AS-i-F-Link; screw-type terminals 3RK CD10 1 S7-CPU, can be used for safety applications S7-416F, V4.1 6ES7416-2FK04-0AB0 1 Memory card RAM card for S7-400, long design, 2 6ES AL00-0AA0 MB 1 Rack UR2 6ES7400-1JA01-0AA0 1 S7-400 power supply PS A 6ES7407-0KA02-0AA0 1 ET200S interface module IM 151 High Feature 6ES7151-1BA02-0AB0 1 Power module PM-E 24-48V DC 6ES7138-4CB11-0AB0 1 Electronic module 4DI Standard 24V DC 6ES7131-4BD01-0AA0 1 Electronic module 4F-DO 24V DC/2A 6ES7138-4FB03-0AB0 1 Terminal module Terminal module for AUX1 infeed 6ES7193-4CD30-0AA0 Terminal module Terminal module for electronic 6ES7193-4CA40-0AA0 module 15 mm 1 Terminal module Terminal module for electronic 6ES7193-4CF40-0AA0 module 30 mm 1 Termination module Termination module for ET200S 6ES7193-4JA00-0AA0 1 Contactor, AC-3, 3KW/400V, 1 NC, 3RT1015-1BB42 Contactor Q1, Q2 24V DC, 3-pole, frame size S00, 2 screw-type terminal AS-i power supply unit 3A power supply 3RX BA00 1 Manufacturer Siemens AG A&D Safety Integrated 6 / 29 CD-FE-I-049-V20-EN

7 Note The functionality was tested with the hardware components listed above. Similar products not found in this list may also be used. If this is the case, please note that it may be necessary to change the sample code (e.g. using different position switches). Software components Table 3-2 Component Type Order No. / Order Information Qty. Manufacturer SIMATIC STEP7 V5.4 + SP3 6ES7810-4CC07-0YA5 1 Siemens AG SIMATIC Distributed Safety V5.4 + SP4 6ES7833-1FC01-0YA5 1 F-Config Pack V5.5 + SP A&D Safety Integrated 7 / 29 CD-FE-I-049-V20-EN

8 4 Assembly and Wiring This chapter describes the hardware assembly and wiring of the Functional Example. 4.1 Overview of Hardware Assembly Evaluate Detect 2 SIMATIC S7-416F-2 Protective door DP/AS-i F-Link SIMATIC ET200S Respond Q1 L1 L2 L3 K45 Modul Q2 Detect 1 M1 ON/OFF ACK A&D Safety Integrated 8 / 29 CD-FE-I-049-V20-EN

9 4.2 Hardware Component Wiring Prerequisite: the power supply units are supplied with 230V AC. Check beforehand the addresses set on the hardware components listed below: Hardware component IM 151 HF Address to be set 4 (PROFIBUS address) Note Can be changed. The address on the IM 151 HF is set by means of a DIP switch. F-DO F-Link EMERGENCY STOP Position switch with integrated AS-i connection Switch position: (PROFIBUS address) 1 (F_Dest_Add) The PROFIsafe addresses are assigned automatically during the configuration of the failsafe modules in STEP7. The PROFIsafe addresses 1 to 1022 are permissible. Please ensure that the setting on the address switch (DIP switch) on the module side matches the PROFIsafe address in the hardware configuration of STEP7. Can be changed. The addresses are set using the buttons and the display on the F-Link. 1 (AS-i address) Can be changed. The address can be set using the AS-i addressing unit. 2 (AS-i address) Can be changed. The address can be set using the AS-i addressing unit. K45 3A (AS-i address) Can be changed. The address can be set using the AS-i addressing unit. Note The DP interface on the CPU 416F-2 must be connected to the DP interface on the IM 151 HF and to the DP interface on the DP/AS-i F-Link. A&D Safety Integrated 9 / 29 CD-FE-I-049-V20-EN

10 Note The wiring of the hardware is shown below. The numbers indicate the sequence of setting up the modules of the ET200S. PS 400/CPU 416F PM-E PS 307 AUX L1 A 4 A 8 2 N L P L1 N 2 DI PROFIBUS DP N PE L1 N L+ M L+ M L+ M IM 151 HF L L M M F-DO Q1 Q A 4 A A 8 A 7 Contactor Q1 A1+ A2- A2- Contactor Q2 A A 4 A A A A&D Safety Integrated 10 / 29 CD-FE-I-049-V20-EN

11 L1 N PE open closed 230V/110V ASi Power supply ASi 3SE RV40 Actuator GND ASi- DP/ AS-i F-Link ASi+ DP/ASi-F-Link DEVICE ASi BF The actuator must be protected against external impacts IN 1 IN 2 Fault Actuator 22 SF L+ M RESET 3RK3141-1CD10 SET MODE L+ M PROFIBUS-DP PE PROFIBUS DP ON/OFF Acknowledgement K45 IN1 3 IN PIN1=ASI+ PIN2=n.c. PIN3=ASI- PIN4=n.c. 4 AS-Interface 3SF1124-1QV10-1BA PIN1=Terminal 11 PIN2=Terminal 12 PIN3=n.c. PIN4=n.c. EMERGENCY STOP ADDR AS-i FAULT SIEMENS 3RK2400-1BQ20-0AA3 AS-Interface E-Stop ASI M12 FEEDER (3RK NR12) 3SF5811-0AA10 A&D Safety Integrated 11 / 29 CD-FE-I-049-V20-EN

12 4.3 Important Hardware Component Settings The STEP7 project supplied together with this Safety Functional Example contains the hardware configuration and the sample code. Some important settings from the hardware configuration of STEP7 are shown below. Changes to these settings (e.g. due to individual presettings) are possible, but the following note should be considered: NOTE The settings shown below help to ensure that Category 4/PL e/sil 3 is fulfilled. Changes to these settings can lead to the loss of the safety function. If changes are made to the hardware configuration of STEP7 (e.g. a further module is added), the sample code of the supplied STEP7 project must be adapted accordingly. HW-Config overview screens Configuration DP/AS-i F-Link Configuration DP/AS-i F-Link Configuration ET200S A&D Safety Integrated 12 / 29 CD-FE-I-049-V20-EN

13 CPU 416F-2 Settings Can be accessed by double-clicking on "CPU 416F-2" (see overview screen). Figure 50 ms were set for OB35 (the default value is 100 ms). Note It must be considered that the F monitoring time must be greater than the call-up time of OB 35 (see "Settings of the DP/AS-i-F-Link" or "Settings of the safety-oriented DO"). In order to be able to set the parameter "CPU contains safety program", a password must be specified. Only then will all required F-blocks be generated for the safe operation of the F-modules when compiling the hardware configuration from STEP7. Password used here: siemens A&D Safety Integrated 13 / 29 CD-FE-I-049-V20-EN

14 Settings of the failsafe DO (F-DO) Can be accessed by double-clicking on "4 F-DO DC 24V/2A" (in the overview screen). Figure Note Parameters/F-parameters: DIP switch setting (9 0) This value must be set on the F-module (F- DO). F-monitoring time (ms) The F-monitoring time must be greater than the call time of OB 35. Parameters/Module parameters: Assignment of the channels: DO channel 0 Channel 0 switches the two contactors K1 and K2 Parameterization of the channels: Response to channel faults In case of a channel fault, the entire F- module is passivated. Activated Used channels are activated, unused channels are deactivated Read-back time The read-back time defines the duration of the switch-off process for the channel. You should set a sufficiently long read-back time if the channel switches large capacitive loads. We recommend using a process of trial and error to set the read-back time as short as possible, but still sufficiently long that the channel is not passivated. A&D Safety Integrated 14 / 29 CD-FE-I-049-V20-EN

15 Settings for the read-back signals Can be accessed by double-clicking on "4DI DC 24V ST" (see overview screen). Figure Standard Input module Note The read-back signal ("Q1_Q2_Feedback" is shown in the figure) is read in via a standard input module of the ET 200S. The read-back signal does not have to be read in via a safety-oriented input module of the ET 200S. Readback signal A&D Safety Integrated 15 / 29 CD-FE-I-049-V20-EN

16 5 Sample Code 5.1 Comments The STEP7 project supplied together with this Safety Functional Example contains the hardware configuration and the sample code. The sample code is described below. The sample code is always assigned to the components used in the Safety Functional Example, and implements the required functionality. Problem definitions beyond this scope must be implemented by the user. The sample code can be used as a basis. Fault detection measures (diagnostics) are implemented in the sample code. This information must be evaluated by the user, and a fault reaction must take place (second disconnection path, ). Note You will need a connection between the MPI interface of your PG/PC and the multi-point interface of the CPU 416F-2 (MPI cable) in order to download the STEP7 project to the CPU 416F-2. Password Passwords used for the safety-related part of the sample code are always: siemens Functionality of the STEP7 project The following functionality is implemented with the STEP7 project: Start and stop of an AC asynchronous motor, taking account of the signals read back from the actuator. EMERGENCY STOP for shutting down in the event of a fault. Shut down if the protective door is opened. Download The following file with the STEP7 project can be found on the HTML page of the Safety Functional Example under "Downloads": cd_fe_i_049_v10_code_f-link.zip A&D Safety Integrated 16 / 29 CD-FE-I-049-V20-EN

17 Save this file to any directory on your PC/PG. Start STEP7 and unzip the file to any directory. In STEP7, you must then proceed as follows to load the STEP7 project into the S7 CPU: First load the hardware configuration into the S7 CPU Switch to the SIMATIC Manager Select the S7 CPU In the menu "Tools", select: "Edit safety program" Click on the button "Load" to load the sample code into the S7 CPU. 5.2 Safety Program Execution Structure The safety program has the following structure: F-CALL (FC1) FB "F_PRG" (FB1, DB1) FB "F_ESTOP1" (FB215, DB215) FB "F_FDBACK" (FB216, DB216) FB "F_ACK_GL" (FB219, DB219) From the Distributed Safety library F-CALL (FC1) F-CALL (FC1) is the F-runtime group and is called up from the alarm OB (OB35). F-CALL (FC1) calls up the F-program block (here: FB1). A&D Safety Integrated 17 / 29 CD-FE-I-049-V20-EN

18 FB F_PRG (FB1, DB1) Network 1 FB F_ESTOP1 (FB215, DB215) is called up here. The FB215 is a certified block from the library of Distributed Safety (F-application block).! WARNING At the input ACK of the FB215, the following event is acknowledged: Acknowledgement after triggering and enabling the EMERGENCY STOP pushbutton With the "1" signal at the input ACK_NEC of FB215, it is indicated that a manual acknowledgement is required to set output Q of the FB215 to "1". The bit "F_GLODB".VKE1 at the input ACK_NEC of the FB215 is a static variable with the pre-assignment "1". Thus ACK_NEC="1" and an acknowledgement at the input ACK of the FB215 is required after triggering the EMERGENCY STOP. Parameterization of the variable ACK_NEC="0" is only permissible if an automatic restart of the respective process after triggering the EMERGENCY STOP is otherwise impossible. Output Q (#EStop_OK) of the FB215 is set to "1" as soon as the input E_STOP is "1" and the acknowledgement key has been pressed in response to the last activation of the EMERGENCY STOP pushbutton. Via the output ACK_REQ (#ACK_REQ_EStop), it is signaled that a user acknowledgement is required at the input ACK (after pressing the EMERGENCY STOP pushbutton). A&D Safety Integrated 18 / 29 CD-FE-I-049-V20-EN

19 Network 2 The FB F_FDBACK (FB216, DB216) is called up here. The FB216 is a certified block from the library of Distributed Safety (F-application block).! WARNING At the input ACK of the FB216, the following event is acknowledged: Acknowledgement after exceeding the read-back time FDB_TIME (read-back error). The read-back error is indicated by ERROR="1". With the "1" signal at the input ACK_NEC of FB216, it is indicated that a manual acknowledgement is required to set the output Q of the FB216 to "1". The bit "F_GLOBDB".VKE1 at the input ACK_NEC of the FB216 is a static variable with the pre-assignment "1". Thus ACK_NEC="1" and an acknowledgement at the input ACK of the FB216 is required in the case of a fault (ERROR="1"). Parameterization of the variable ACK_NEC="0" is only permissible if an automatic restart of the respective process after a read-back error is otherwise impossible. The output Q ("Q1_Q2") of the FB216 is set to "1" as soon as the input ON is "1". For this purpose, the following must be fulfilled at the same time: Input FEEDBACK="1" (read-back input) No read-back error is stored #EStop_OK =1 Toggle switch ON/OFF =1 (normal switching duty) "Protective Door" =1 (protective door closed) A&D Safety Integrated 19 / 29 CD-FE-I-049-V20-EN

20 ! WARNING The contactors automatically pick up again after the protective door has been opened and closed (protective door with automatic start). Check if this is permissible for your application. In the Safety Functional Example, Q="1" causes the two contactors Q1 and Q2 to pick up. "Q1_Q2" is the output of the safety-related output module that controls the two contactors Q1 and Q2. A read-back error is detected (ERROR="1") if the signal status of the input FEEDBACK (read-back input) does not follow the signal status of output Q ("Q1_Q2") within the maximum tolerable read-back time FBD_TIME. To ensure that no read-back error, which would require an acknowledgement, is detected when passivating the failsafe I/O ("Q1_Q2") controlled by output Q of the FB216, the input QBAD_FIO of the FB216 is provided with the variable QBAD of the associated failsafe I/O data block. Via the output ACK_REQ (#ACK_REQ_FDBACK), it is signaled that a user acknowledgement is required at the input ACK (after a feedback circuit error). Network 3 Here, the requests for acknowledgement of the FB F_ESTOP1 and FB F_FDBACK are linked and placed at OUT1 of the AS-i compact module, where a lamp can optionally be connected. A&D Safety Integrated 20 / 29 CD-FE-I-049-V20-EN

21 Network 4 FB F_ACK_GL (FB219, DB219) is called up here. The FB219 is a certified block from the library of Distributed Safety (F-application block) This F-application block generates an acknowledgement for the simultaneous reintegration of all failsafe I/Os / channels of the failsafe I/Os of an F-runtime group after communication errors or failsafe I/O errors / channel faults. A&D Safety Integrated 21 / 29 CD-FE-I-049-V20-EN

22 6 Evaluation according to IEC and EN ISO : Safety function Comments EMERGENCY STOP is not a means of risk mitigation. EMERGENCY STOP is not a "Safety Function". EMERGENCY STOP is a "Supplementary Safety Function". Further considerations are based on the following safety functions: Supplementary safety function SF 1 Safety function SF 2 The motor must be switched off when "EMERGENCY STOP" is activated. The motor must be switched off when the "protective door" is opened. The safety functions listed above are evaluated below according to the two standards EN and EN ISO : Determination of the PFH D value for the subsystem or SRP/CS evaluation PFH D - value Definition DP/AS-i-F-Link 2.77 * Siemens CPU 416F * F-DO 1.00 * PROFIBUS 1.00 * Total evaluation 2.47 * A&D Safety Integrated 22 / 29 CD-FE-I-049-V20-EN

23 6.2 Evaluation of Safety Function Evaluation according to EN Parameters for the calculation of PFH D for "Detect 1" (EMERGENCY STOP) and "Respond" (Contactor) Parameters Value Reason Definition B10 EMERGENCY STOP Contactor Proportion of hazardous failures EMERGENCY STOP Contactor T1 Service life C Number of EMERGENCY STOP operations Number of operations of contactors T2 Diagnostics test interval EMERGENCY STOP Diagnostics test interval contactor β (CCF factor) Susceptibility to failures as a result of common cause DC Degree of diagnostic coverage 1 * 10 5 Manufacturer specifications 1 * 10 6 Manufacturer specifications ,200 h (20 years) 6 * 10-3 / h 0.125/hrs (20%) (75%) Manufacturer specifications Assumptions: Actuated once per week (7 * 24 hours) (Test EMERGENCY STOP). Actuated once per shift, i.e. every 8 hours. Actuation takes place every day of the year (365 days). 168 hrs When EMERGENCY STOP is activated, a defective contact is detected in the safety monitor. An actuation takes place every week (7 * 24 hours) (see "C"). 8 hrs When actuated, a defective contactor is detected in the safety monitor. An actuation takes place once per shift, i.e. every 8 hours (see "C"). 0.1 If installed according to EN 62061, a CCF factor of 0.1 (10%) can be assumed. With this value, the user errs on the side of caution 0.99 (99%) ("conservative value"). Discrepancy evaluation at EMERGENCY STOP; evaluation of read-back signals (positively driven contacts) of both contactors Siemens User Evaluation Parameter Parameters Component Value Definition PFH D F-Link+F-CPU+F-DO+PROFIBUS 2.47 * (see chapter 6.1) Results EN SIL CL Detect 3 Hardware error tolerance: HFT = 1 Proportion of safe failures: SFF 0.99 (99%) PFHD 1.2 * Architecture: Basic subsystem architecture D Evaluate 3 Manufacturer specifications 2.47 * Manufacturer specifications Respond 3 Hardware error tolerance: HFT = * Architecture: Basic subsystem architecture D Proportion of safe failures: SFF 0.99 (99%) Results 3 SIL CL of all tasks of the supplementary safety function is at least 3. PFH D (= 3.53*10-09 ) of the entire supplementary safety function fulfills SIL 3. A&D Safety Integrated 23 / 29 CD-FE-I-049-V20-EN

24 6.2.2 Evaluation according to EN ISO :2006 Parameters for the calculation of MTTF d for "Detect 1" (EMERGENCY STOP) and "Respond" (Contactor) Parameters Value Reason Definition B10 EMERGENCY STOP Contactor Proportion of hazardous failures EMERGENCY STOP Contactor d op Mean operating time in days per year h op Mean operating time in hours per day t Cycle Mean time between the start of two consecutive cycles of the component EMERGENCY STOP Contactor 1 * * days per year 24 hours per day 168 hrs/cycle 8 hrs/cycle Manufacturer specifications Manufacturer specifications (20%) (75%) Assumption: Actuation takes place every day of the year Assumption: There is an interval of one week (7 * 24 hours) between actuations of the EMERGENCY STOP (EMERGENCY STOP test) There is an interval of 8 hours between actuations of the contactors (one shift) Siemens Interim results (are identical in this example for EMERGENCY STOP and contactor): Interim results Reason MTTF d High MTTF d 30 years DC High DC=99% Discrepancy evaluation for EMERGENCY STOP; evaluation of read-back signals (positively driven contacts) of both contactors Measures Fulfilled It is assumed that the necessary measures are taken by the user. against CCF Category 4 System behavior: A single fault does not result in the loss of the safety function. The single fault is detected. MTTF d : high, DC: high, measures against CCF: fulfilled User Evaluation Parameter Parameters Component Value Definition PFH D F-Link+F-CPU+F-DO+PROFIBUS 2.47 * (see chapter 6.1) Results EN ISO :2006 PL Average probability of a hazardous failure per hour Detect e 2.47*10-08 (from Annex K; see note) Evaluate e 2.47*10-09 Respond e 2.47*10-08 (from Annex K; see note) Results e PL of all tasks of the supplemental safety function is at least e. Number of tasks is less than or equal to 3. Note: The MTTF d for each channel is limited to max. 100 years! A&D Safety Integrated 24 / 29 CD-FE-I-049-V20-EN

25 6.2.3 Summary of Safety Function 1 EN EN ISO :2006 SIL CL PFH D PL Average probability of a hazardous failure per hour Detect * e 2.47 * Evaluate * e 2.47 * Respond * e 2.47 * Results SIL3 PL e A&D Safety Integrated 25 / 29 CD-FE-I-049-V20-EN

26 6.3 Evaluation of Safety Function Evaluation according to EN Parameters for the calculation of PFHD for "Detect 2" (position switch) and "Respond" (contactor) Parameters Value Reason Definition B10 Position switches Contactor Proportion of hazardous failures Position switches Contactor T1 Service life C Number of actuations of position switches Number of operations of contactors T2 Diagnostics test interval Position switches Diagnostics test interval contactor β (CCF factor) Susceptibility to failures as a result of common cause DC Degree of diagnostic coverage 1 * * 10 6 Manufacturer specifications ,200 h (20 years) 0.125/hrs 0.125/hrs Manufacturer specifications (20%) (75%) Manufacturer specifications Assumptions: Actuated once per shift, i.e. every 8 hours. Actuation takes place every day of the year (365 days) 8 hrs When the protective door is opened, a defective contact is detected in the safety monitor. An actuation takes place once per shift, i.e. every 8 hours (see "C"). 8 hrs When actuated, a defective contactor is detected in the safety monitor. An actuation takes place once per shift, i.e. every 8 hours (see "C"). 0.1 If installed according to EN 62061, a CCF factor of 0.1 (10%) can be assumed. With this value, the user errs on the side of caution ("conservative value") (99%) Discrepancy evaluation for position switches; Evaluation of read-back signals (positively driven contacts) of both contactors Siemens User Evaluation parameter Parameters Component Value Definition PFH D F-Link+F-CPU+F-DO+PROFIBUS 2.47 * (see chapter 6.1) Results EN SIL CL Detect 3 Hardware error tolerance: HFT = 1 Proportion of safe failures: SFF 0.99 (99%) PFH D 2.5 * Architecture: Basic subsystem architecture D Evaluate 3 Manufacturer specifications 2.47 * Manufacturer specifications Respond 3 Hardware error tolerance: HFT = 1 Proportion of safe failures: SFF 0.99 (99%) 9.4 * Architecture: Basic subsystem architecture D Results 3 SIL CL of all tasks of the safety function is at least 3. PFH D (= 3.66*10-09 ) of the entire supplementary safety function fulfills SIL 3. A&D Safety Integrated 26 / 29 CD-FE-I-049-V20-EN

27 6.3.2 Evaluation according to EN ISO :2006 Parameters for the calculation of MTTF d for "Detection 2" (position switch) and "Responding" (contactor) Parameters Value Reason Definition B10 Manufacturer specifications Position switch 1 * 10 6 Siemens Contactor 1 * 10 6 Proportion of hazardous failures Manufacturer specifications Position switch 0.2 (20%) Contactor 0.75 (75%) d op Mean operating time in days per year h op Mean operating time in hours per day t Cycle Mean time between the start of two consecutive cycles of the component position switch Contactor 365 days per year 24 hours per day 8 hrs/cycle 8 hrs/cycle Assumption: Actuation takes place every day of the year Assumption: There is an interval of 8 hours between each protective door opening and contactor actuation (one shift) Interim results (are identical in this example for the position switch and the contactor): Interim results Reason MTTF d High MTTF d 30 years DC High DC=99% Discrepancy evaluation for the position switches; evaluation of User read-back signals (positively driven contacts) of both contactors It is assumed that the necessary measures are taken by the user. Measures fulfilled against CCF Category 4 System behavior: A single fault does not result in the loss of the safety function. The single fault is detected. MTTF d : high, DC: high, measures against CCF: fulfilled Evaluation parameter Parameters Component Value Definition PFH D F-Link+F-CPU+F-DO+PROFIBUS 2.47 * (see chapter 6.1) Results EN ISO :2006 PL Average probability of a hazardous failure per hour Detect e 2.47*10-08 (from Annex K; see note) Evaluate e 2.47*10-09 Respond e 2.47*10-08 (from Annex K; see note) Results e PL of all tasks of the safety function is at least e. Number of tasks is less than or equal to 3. Note: The MTTF d for each channel is limited to max. 100 years! A&D Safety Integrated 27 / 29 CD-FE-I-049-V20-EN

28 6.3.3 Summary of Safety Function 2 EN EN ISO :2006 SIL CL PFH D PL Average probability of a hazardous failure per hour Detect * e 2.47 * Evaluate * e 2.47 * Respond * e 2.47 * Results SIL3 PL e A&D Safety Integrated 28 / 29 CD-FE-I-049-V20-EN

29 7 Contacts Technical Assistance for Low-Voltage Controls and Distribution In person from Mon. - Fri. 8 a.m. to 5 p.m. (CET) Phone: +49 (911) technical-assistance@siemens.com Internet: 2http:// By fax around the clock Fax: +49 (911) History Table 8-1 History Version Date Change V First issue V Table 3-1, Emergency Stop 1NC 2NC A&D Safety Integrated 29 / 29 CD-FE-I-049-V20-EN