Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
Comments "Safety Integrated" Functional Examples are functional, tested automation configurations based on A&D standard products for the simple, quick and low-cost performance of automation tasks involving safety technology. Each of these Functional Examples covers one frequently occurring aspect of a typical customer problem in the field of safety technology. In addition to containing a list of all of the necessary software and hardware components, and a description of their interwiring, the Functional Examples also contain tested and commented code. This enables the functions described here to be adapted quickly and thus used as a basis for individual extensions.
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Important note Safety Functional Examples are non-binding and do not claim to be complete with regard to configuration, equipment or any contingency. The Safety Functional Examples are not customer-specific solutions. They are merely intended to assist in dealing with typical problems. You yourself are solely responsible for the correct operation of the products described. These Safety Functional Examples do not relieve you of your safety obligations relating to usage, installation, operation and maintenance. By using these Safety Functional Examples you accept that Siemens cannot be held liable for any damage beyond the liability described above. We reserve the right to make changes to these Safety Functional Examples at any time, without prior notice. If the suggestions in these Safety Functional Examples deviate from other Siemens publications (e.g. catalogs), the contents of the other document take precedence.
Page 2/27
CD-FE-I-048-V10-EN
Table of Contents
Guarantee, Liability and Support .................................................................. 4 Function........................................................................................................... 5 Description of Functionality............................................................................... 5 Advantages / Customer Benefits ...................................................................... 6 Components Required ................................................................................... 7 Assembly and Wiring ..................................................................................... 8 Overview of Hardware Setup............................................................................ 8 Hardware Component Wiring ........................................................................... 9 Sample code.................................................................................................. 10 Description of the MSS Program .................................................................... 10 Start-up ........................................................................................................... 16 Evaluation according to IEC 62061 and EN ISO13849-1:2006 .................. 20 Safety functions .............................................................................................. 20 Evaluation of Safety Function 1 ...................................................................... 21 Evaluation according to EN 62061 ................................................................. 21 Evaluation acc. to ISO 13849-1:2006 ............................................................. 22 Summary of Safety Function 1 ....................................................................... 23 Evaluation of Safety Function 2 ...................................................................... 24 Evaluation according to EN 62061 ................................................................. 24 Evaluation acc. to ISO 13849-1:2006 ............................................................. 25 Summary of Safety Function 2 ....................................................................... 26 Contacts ........................................................................................................ 27 History ........................................................................................................... 27
5 5.1 5.2 6 6.1 6.2 6.2.1 6.2.2 6.2.3 6.3 6.3.1 6.3.2 6.3.3 7 8
Page 3/27
CD-FE-I-048-V10-EN
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Page 4/27
CD-FE-I-048-V10-EN
2
2.1
Function
Description of Functionality
Persons in the vicinity of machinery (e.g. in production facilities) must be suitably protected by technical devices. This Safety Functional Example describes the monitoring of an emergency stop control unit and a separating protective device in the form of a protective door. The EMERGENCY STOP control unit is a widely used component for the protection of persons, machines and the environment. Another solution in the area of equipment and machines is to provide the danger zones with mechanically separating protective devices or access panels. The aim here is to monitor unauthorized entry into these areas and also to prevent hazardous machine function when the protective device is opened.
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
In this Safety Function Example, the emergency stop command unit is monitored through the modular safety system 3RK3. When the emergency stop is actuated, the safety switching device switches off the positively driven downstream contactors Q1 and Q2 via the safe outputs according to stop category 0 as defined in EN 60204-1. Before renewed switch-on or acknowledgement of the emergency stop device via the start button, a check is carried out to monitor whether the contacts of the emergency stop control unit are closed and both contactors are switched off. The protective door is also monitored by a SIRIUS position switch through the MSS. When this protective door is opened, the safety switching device switches off the positively driven downstream contactors Q1 and Q2 via the safety-oriented outputs according to stop category 0 as defined in EN 60204-1. When the protective door is closed, an automatic start takes place after the position switch and the downstream contactors have been checked. When an emergency stop is actuated, the modular safety system then switches off the downstream contactors with positively-driven contacts via safe relay outputs according to stop category 0 in EN 60204-1. One and two drives respectively are shut down in this example. Before renewed switch-on via the start button, a check is carried out to monitor whether the contacts of the emergency stop control unit are closed and the contactors have switched off.
Note Equipment, functional aspects and design guidelines for EMERGENCY STOP command devices can be found in EN 418 (ISO 13850).
Page 5/27
CD-FE-I-048-V10-EN
2.2
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Page 6/27
CD-FE-I-048-V10-EN
Components Required
This chapter contains an overview of the hardware and software components required for the Functional Example.
Hardware components
Table 3-1
Component Power supply EMERGENCY STOP Type PS307 5A 2NC 40mm mushroom pushbutton with yellow top, without protective collar Position switch with separate actuator Radius actuator Empty enclosure one command point 1NO contact block for base mounting Black pushbutton with flat button, 22 mm nominal diameter 3RK3-Basic Contactor, AC-3, 3KW/400V, 1NC, 24 V DC, 3-pole, size S00 Screw terminal Order No. / Order Information 6ES73071EA00-0AA0 3SB3 801-0EG3 Qty. 1 Siemens AG 1 3SE5 232-0RV40 3SE5 000-0AV05 3SB3 801-0EG3 3SB3 420-OB 3SB3 000-0AA11 1 3RK3111-0AA10 3RT1015-1BB42 1 2 Manufacturer
Position switches
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
2 2 1 1
Start button
Note Functionality was tested with the hardware components listed above. Similar products not found in this list may also be used. If this is the case, please note that it may be necessary to change the sample code (e.g. using other inputs or outputs).
Page 7/27
CD-FE-I-048-V10-EN
4.1
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Protective door
"Detect 1"
Start "Evaluate"
L1 L2 L3
Q1 "Respond" Q2
M1
Page 8/27
CD-FE-I-048-V10-EN
4.2
Q1
EMERGENCY STOP
Q1 Q2
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
3RK3111-*AA10
Logic
=
M1
FK1.1 FK1.2 FK2 24V M
Q1.1
Q1.2
Q2
L+
M L+(24V DC)
Q1
Q2
Page 9/27
MSS Basic
CD-FE-I-048-V10-EN
Sample code
This chapter describes which functions are implemented and how the MSS ES program is structured.
Download Among the downloads under "Application & Tools" on the HTML page of the Safety Function Example, you will find the following file with the Modular Safety System ES Project: http://support.automation.siemens.com/WW/view/de/28997990
5.1
Description
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Component information is displayed after the start of the MSS ES software. Confirm the window with OK. A start wizard now opens. This start wizard will help you to: create a new project open an existing project open a project online if a connection with the switching device has been established. Select New. Confirm the dialog now displayed with OK.
Select the subdirectory "Project" in the "Identification" directory at the left in the navigation window. Fill in the following lines in the work area: Project name Name of configuration engineer Configuration engineer company name
Page 10/27
CD-FE-I-048-V10-EN
Description
Parameters
Select the subdirectory "Central system" in the "Configuration" directory at the left in the navigation window. Use drag & drop to drag the basic device MSS Basic from the hardware list to the green, illuminated column of the work area for the hardware configuration. Confirm with OK (SLOT 3) if the object properties dialog box is shown.
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Drag the "EMERGENCY STOP" monitoring function from the list (at the right side) to the work area. You can position the module as desired.
Page 11/27
CD-FE-I-048-V10-EN
Description
Parameters
Open the dialog "Object properties" by double-clicking on the module. Define the following parameters in the "Object properties" dialog: Select the following in the "Parameter > Input" directory: parameter "Type" and define it as two channels (NCNC). parameter "IN1" and set it to "SLOT3_F-IN1". The parameter "IN2" is assigned automatically. Activate cross-circuit detection. Select the following in the "Start" directory: The parameter "Type of start" and set it to "Monitored". Close the window with OK.
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Drag the cell function "Input cell" from the list to the work area and link it as follows:
Page 12/27
CD-FE-I-048-V10-EN
Description
Parameters
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Open the dialog "Object properties" by doubleclicking on the module. Select the following in the "Parameter" directory: parameter "Connection Input" and position it to "SLOT3_FIN5". Close the window with OK.
Drag the "Protective door" monitoring function from the list (at the right side) to the work area. You can position the module as desired.
Page 13/27
CD-FE-I-048-V10-EN
Description
Parameters
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Open the dialog "Object properties" by double-clicking on the module. Define the following parameters in the "Object properties" dialog: Select the following in the "Parameter > Input" directory: parameter "Type" and define it as two channels (NCNC). The parameter "IN1" and position it to "SLOT3_F-IN3". The parameter "IN2" is assigned automatically. Close the window with OK.
Drag the logic function "AND" from the list to the work area and link the outputs Q of the monitoring modules with the inputs of the AND module.
Drag the output function "F output" from the list to the work area and link the output "Q" of the AND function with the input "IN" of the F output.
Page 14/27
CD-FE-I-048-V10-EN
Description
Parameters
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Open the dialog "Object properties" by double-clicking on the module. Select the following in the "Parameter > Type of output" directory: "Redundant F output" Select the following in the "Parameter > Feedback circuit" directory: The parameter "Monitoring" and set it to "OFF and ON status". Select the following in the "Parameter > Output circuit" directory: The parameter "Q1" and position it to "SLOT3_F-Q1R". The parameter "Q1" and position it at "SLOT3_F-Q2". Close the window with OK. Now drag an input cell from the list to the work area and link it with the RF1 input of the F output module. Open the "Object properties" dialog by double-clicking on the module. Define the parameter "Connection input" as "SLOT3_F-IN6". You have now obtained the following plan.
Page 15/27
CD-FE-I-048-V10-EN
5.2
Description
Start-up
Parameters
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Activate the menu command "Target system > Load to switching device". For this, the device must be connected to the supply voltage, connected with the PC and be in configuring mode.
Set the interface through which you have access to the device (e.g. COM1) and confirm with OK.
Page 16/27
CD-FE-I-048-V10-EN
Description
Parameters
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Activate the menu command "Target system > Prepare configuration test". Confirm the window that opens with OK. The printout on the project is generated.
Page 17/27
CD-FE-I-048-V10-EN
Description
Parameters
Activate the menu command "Target system > Approve configuration" and confirm the window that opens with OK.
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Enter the name of the person giving approval and the company name of the person approving in order to release the configuration and confirm with OK.
It is confirmed that configuration has been successfully released. After confirming with OK, the printout with the release information is generated.
Establish an online connection with MSS via "Switching device > Open online", "Target system > Load to PC" or clicking on the button "Open online". The dialog "Set interface" is displayed. Set the interface and confirm with OK.
Page 18/27
CD-FE-I-048-V10-EN
Description
Parameters
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
If a password has been assigned for device access, the dialog window "Enter password" is displayed. If no password has been assigned for device access yet, the dialog window "Activate safety mode" is displayed. Confirm the dialog window with OK.
Note A new configuration can only be loaded in configuring mode. A new configuration cannot be loaded in safety mode. You can switch from safety mode to configuring mode by establishing an online connection with the device and activating the menu command "Target system > Configuring mode".
Page 19/27
CD-FE-I-048-V10-EN
6
6.1
Comments Emergency stop is not a means of risk mitigation. Emergency stop is a "supplementary safety function" Safety functions Further considerations are based on the following safety functions:
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Safety function SF 2
The motor must be switched off when the "Protective door" is opened.
The safety functions listed above are evaluated below according to the two standards EN 62061 and EN ISO 13849-1: 2006.
Page 20/27
CD-FE-I-048-V10-EN
6.2
6.2.1
Parameters for the calculation of PFHD for "Detect 1" (Emergency Stop) and "Respond" (Contactor) Parameters Value Reason Definition B10
EMERGENCY STOP Contactor 1 * 10 6 1 * 10
5
T1
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Service life
(20%) (75%) Manufacturer specifications Assumptions: Actuated once per week (7 * 24 hours) (Test Emergency Stop). Actuated once per shift, i.e. every 8 hours. Actuation takes place every day of the year (365 days) A defective contact is detected in MSS when actuating the Emergency Stop. Actuated every week (7 * 24 hours) (see "C") A defective contactor is detected in MSS during actuation. Actuated once per shift, i.e. every 8 hours (see "C") In cases of installation acc. to EN 62061, a CCF factor of 0.1 (10%) may be assumed. This is a safe value ("conservative value"). Discrepancy evaluation for emergency stop; Evaluation of read-back signals (positively driven contacts) of both contactors
C
Number of emergency stop operations Number of operations of contactors
T2
Diagnostics test interval EMERGENCY STOP Diagnostics test interval contactor 168h
8h 0.1
User
(CCF Factor)
DC
Degree of diagnostic coverage
0.99 (99%)
Evaluation parameter
Parameter PFHD (MSS) Component Modular safety system Value 5,14 * 10-9 Definition Siemens
Results
1.2 * 10
-10
5,14 * 10-09
9.4 * 10-10
PFHD Architecture: Basic subsystem architecture D Manufacturer specifications Architecture: Basic subsystem architecture D
SIL CL of all tasks of the supplementary safety function is at least 3. PFHD (=6,2*10-09) of the entire supplementary safety function fulfils SIL 3.
Page 21/27
CD-FE-I-048-V10-EN
6.2.2
Parameters for the calculation of MTTFd for "Detect 1" (Emergency stop) and "Respond" (Contactor) Parameters Value Reason Definition Manufacturer specifications B10 5
EMERGENCY STOP Contactor EMERGENCY STOP Contactor 1 * 10 1 * 106
Mean operating time in days per year Mean operating time in hours per day
Manufacturer specifications (20%) (75%) Assumption: Actuation takes place every day of the year Assumption: There is an interval of one week between actuations of the Emergency Stop (Emergency Stop test) (7 * 24 hours) There is an interval of 8 hours between actuations of the contactors (one shift)
Siemens
TCycle
Mean time between the start of two consecutive cycles of the component EMERGENCY STOP
168 h/cycle
User
Contactor
8 h/cycle
Interim results (are identical in this example for Emergency Stop and Contactor):
Interim results MTTFd DC Measures against CCF Category High High Fulfilled 4 Reason MTTFd 30 years DC=99% Discrepancy evaluation for Emergency Stop; evaluation of read-back signals (positively driven contacts) of both contactors It is assumed that the necessary measures are taken by the user. System behavior: A single fault does not cause the loss of the safety function. The single fault is detected. MTTFd: High, DC: High, measures against CCF: Fulfilled Component Modular safety system Value 5,14 * 10-9 Definition Siemens
Evaluation parameter
Parameter PFHD (MSS)
Results
PL of all tasks of the supplementary safety function is at least e. Number of tasks is smaller than /equal to 3. Note: The MTTFd for each channel is limited to max. 100 years!
PL e e e e
ISO 13849-1:2006 Average probability of a hazardous failure per hour 2.47*10-08 (from Annex K; see note) 5,14*10-09 2.47*10-08 (from Annex K; see note)
Page 22/27
CD-FE-I-048-V10-EN
6.2.3
PL e e e
ISO 13849-1:2006 Average probability of a hazardous failure per hour 2.47 * 10-08 5,14 * 10-09 2.47 * 10-08 PL e
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Page 23/27
CD-FE-I-048-V10-EN
6.3
6.3.1
Parameters for the calculation of PFHD for "Detect2" (Position switch) and "Respond" Contactor)
Parameters B10
Position switches Contactor
Value
1 * 106 1 * 106 0.2 0.75 175,200h (20 years) 0.125 / h 0.125/h
Reason
Manufacturer specifications Manufacturer specifications
Definition
Siemens (20%) (75%) Manufacturer specifications Assumptions: Actuated once per shift, i.e. every 8 hours. Actuation takes place every day of the year (365 days)
T1
Service life
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
C
Number of actuations of position switches Number of operations of contactors
T2
Diagnostics test interval Position switches Diagnostics test interval contactor 8h A defective contact is detected in MSS when opening the protective door. Actuated once per shift, i.e. every 8 hours (see "C") A defective contactor is detected in MSS during actuation. Actuated once per shift, i.e. every 8 hours (see "C") In cases of installation acc. to EN 62061, a CCF factor of 0.1 (10%) may be assumed. This is a safe value ("conservative value"). Discrepancy evaluation at emergency stop; Evaluation of read-back signals (positively driven contacts) of both contactors
User
8h 0.1
(CCF Factor)
DC
Degree of diagnostic coverage
0.99 (99%)
Evaluation parameter
Parameter PFHD (MSS) Component Modular safety system Value 5,14 * 10-9 Definition Siemens
Results
2.5 * 10
-10
5,14 * 10-09
9.4 * 10-10
PFHD Architecture: Basic subsystem architecture D Manufacturer specifications Architecture: Basic subsystem architecture D
SIL CL of all tasks of the safety function is at least 3. PFHD (=6,33*10-09) of the entire supplementary safety function fulfils SIL 3.
Page 24/27
CD-FE-I-048-V10-EN
6.3.2
Parameters for the calculation of MTTFd for "Detect2" (Position switch) and "Respond" (Contactor) Parameters Value Reason Manufacturer specifications B10
Position switches Contactor 1 * 106 1 * 106
Definition
dop hop
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Mean operating time in days per year Mean operating time in hours per day
Manufacturer specifications (20%) (75%) Assumption: Actuation takes place every day of the year
Siemens
TCycle
Mean time between the start of two consecutive cycles of the component Position switches
Assumption: 8 h/Cycle There is an interval of 8 hours between opening the protective door and actuating the contactors (one shift)
User
Contactor
8 h/Cycle
Interim results (are identical in this example for Position Switch and Contactor):
Interim results MTTFd DC Measures against CCF Category High High Fulfilled 4 Reason MTTFd 30 years DC=99% Discrepancy evaluation for position switches; evaluation of read-back signals (positively driven contacts) of both contactors It is assumed that the necessary measures are taken by the user. System behavior: A single fault does not cause the loss of the safety function. The single fault is detected. MTTFd: High, DC: High, measures against CCF: Fulfilled Component Modular safety system Value 5,14 * 10-9 Definition Siemens
Evaluation parameter
Parameter PFHD (MSS)
Results
PL of all tasks of the safety function is at least e. Number of tasks is smaller than /equal to 3. Note: The MTTFd for each channel is limited to max. 100 years!
PL e e e e
ISO 13849-1:2006 Average probability of a hazardous failure per hour 2.47*10-08 (from Annex K; see note) 5,14*10-09 2.47*10-08 (from Annex K; see note)
Page 25/27
CD-FE-I-048-V10-EN
6.3.3
PL e e e
ISO 13849-1:2006 Average probability of a hazardous failure per hour 2.47 * 10-08 5,14 * 10-09 2.47 * 10-08 PL e
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
Page 26/27
CD-FE-I-048-V10-EN
Contacts
Technical Assistance for Low-Voltage Controls and Distribution In person from Mon. - Fri. 8 a.m. to 5 p.m. (CET) Phone: +49 (911) -895-5907 e-mail: technical-assistance@siemens.com Internet: http://www.siemens.de/lowvoltage
2
8
Copyright Siemens AG 2008 All rights reserved CD_FE_I_048_V10_EN_Emergency Stop with monitored Start and .doc
History
Table 8-1 History
Version V1.0
Change
Page 27/27
CD-FE-I-048-V10-EN