programmierbare systeme_weitere informationen

TÜV Rheinland Industrie Service GmbH Automation and Functional Safety (AFS)

Programmable Systems 1. General

2. System Structures

3. Standards

4. Conditions and Restrictions

5. Product-independent Conditions and Restrictions

6. Recommended Features of safety-related Engineering Software

General There are considerable restrictions on the use of the PES, especially for the timing restrictions after faults have been detected. These timing restrictions are depending on calculations or applications. Refer to the detailed test reports of the respective TÜV test institute. The reference list represents a common list of the working group "Safety Related PES" of IQSE (TÜV Product Service) and ASI (TÜV Rheinland). It has been compiled to give end users an overview of type certified PES. The list will be updated periodically. With this reference list both test authorities fulfil the requirement given by their European standard EN 45001 and EN 45011 accreditations to publish a list of tye approved systems. All of the above mentioned PES assume that the zero signal of binary inputs and outputs represents the defined safe state for the application. All of the above mentioned PESs with the system structures 1oo1 (1v1) and 1oo2 (2v2) and test reports dated 1989 or later, provide fault tolerance for the I/O-boards. If independent groups of I/O-boards have been defined during configuration or application programming, depending upon the product, a fault localisation on an I/O-board will lead to a shutdown of the associated safety related group only. Groups of I/O-boards can only be mutually independent, if the I/O-signals connected belong to independent parts of the application. Independent means that a part of the application has no safety relation with any other parts of the application. Beginning with the publication of DIN V 19250 and DIN V VDE 0801 in January 1990 the classification and certification have been performed according to the safety categories of DIN V 19250 and the safety requirements of DIN V VDE 0801. All executed certifications take into consideration requirements of a typical application standard, e.g. furnace control. As an alternative, typical application requirements (e.g. fault models, test methods, process reaction time, fault tolerance) are used. The specific application sectors covered by the certification are listed in the test report.


System Structures The nomenclature for system structures describes the possible degradation behaviour after fault detection and fault localisation for the central processing units. Variations are possible due to different implementation possibilities. This table shall give a first guideline.

In the I/O area different degradation mechanisms are possible and implemented on the different systems.

Fault-free system Degradation 1 Degradation 2 Degradation 3 System Structure

2oo4 1oo2 1oo1* shutdown safety-related and fault tolerant *with time restriction

2oo4 1oo2 shutdown safety-related and fault tolerant 1oo3 shutdown safety-related

2oo3 1oo2 1oo1* shutdown safety-related and fault tolerant *with time restriction

2oo3 1oo2 shutdown safety-related and fault tolerant

1oo2D 1oo1D shutdown safety-related and fault tolerant with time restriction

1oo2 shutdown safety-related 2oo2 1oo1 shutdown safety-related and fault tolerant 1oo1 shutdown safety-related

Part 4 of the IEC 61508 gives the defintion of:

MooN : M out of N channel architecture (for example 1oo2 is 1 out of 2 architecture, where either of the two channels can perform the safety function) MooND : M out of N channel architecture with diagnostic


Standards The set of standards used for certification and their publishing date is specified by the report of the certificate. The following list represents a compilation of the most generic standards only.

[N1] DIN V 19250 "Fundamental safety aspects for measurements and control equipment" Safety requirements according to [N1] RC 8 - highest requirements [N3] abd [N4.n]:RC 1 - lowest requirements

[N2] IEC 61508 "Functional safety of electrical / electronic / programmable electronic systems (PES)" part 1 to 7 (2000) Safety requirements according to [N2] SIL 4 - highest requirements SIL 1 - lowest requirements

[N3]DIN 19251 "MC Protection Equipment"

[N4.1] DIN V VDE 0801 "Principles for computers in safety-related systems"

[N4.2] DIN V VDE 0801 Amendment A1

[N5] DIN VDE 0116 "Electrical Equipment for Furnaces"

[N6.1] DIN VDE 0160 "Electronic Equipment used in Electrical Power Installations" (corresponds to prEN 50178) DIN VDE 0110 "Insulation co-ordination for equipment within low-voltage systems; Fundamental requirements" part 1

[N6.2] EN 61131 "Programmable Controllers" Part 1; "General Information" Part 2; "Equipment requirements and tests"

[N7.1] prEN 50082-2 "Electromagnetic compatibility (EMC); Generic immunity standard Part 2: Industrial environment"

[N7.2] EN 50081-2 "Electromanetic compatibility (EMC); Generic emission standard - Part 2: Industrial

environment" EN 55011 "Limits and methods of measurement for radio disturbance characteristics of ISM radio frequency equipment", severity: limit class A

[N8] DIN IEC 68 / DIN EN 60068 "Basic testing procedures", set of standards Part 2-1 / Cold Part 2-2-A / Dry heat Part 2-3 / Dump heat, steady state Part 2-6 / Vibration, sinusoidal Part 2-27 / Shock


Conditions and Restrictions General

• When planning a safety instrumented function with a safety-related programmable controller, the safety section of the manufacturer´s handbook is to be used.

• The tested and certified components are listed in the test reports fo the TÜV test institutes. Requirements related to other components of installation will be specified by the application and have to be determined and assessed during the local inspection.

Planning / Protecting • The configuration and the operation of the safety-related programmable controller should be based on a hazard

analysis. • The protective targets of the realised application shall be defined. • Care is to be given to the possibility of a safety shutdown whilst the control process is starting up or closing down.

The behaviour of the programmable controller in all different operating conditions, error conditions and restarting should to be defined.

• The conditions for use specified by the manufacturer are to be observed. Particular attention is to be paid to: o Protection from excessive voltage and EMC; o Environmental conditions; o Ex-protection - if required.

• Care is to be taken that system parameters which may have an affect upon safety are set correctly in safety-critical applications, particularly:

o Requirement class / Safety integrity level o Maximum cycle time o System configuration o Process safety time, interval for foreground tests and background tests o Time limit for monitoring of the communication o Access limitations for external communicators (e.g. programming equipment and process control

systems) o I/O configuration and connections o Reaction to I/O errors o Reaction to system errors

• Equipment and components which are used must be certified. Only safety-related components may be used in safety-critical operation.

• Either the equipment in the shutdown path must be made of type approved fail safe components, or the application must have two separate, independent shutdown paths.

• The safe state of an ESD must be the de-energised state or low (0) state. • In general, the closed loop principle is to be maintained for all external safety circuits which are connected to the

system. Signals should be dynamic where possible. • Care must be taken when projecting, that non-safety related functions can never interfer with safety-related

functions / components in any operating situation. • The conditions and restrictions for operation in degraded mode shall observed. Typically a timing restriction should

be planned for the degraded mode of operation. • The low state of the output components (current and voltage) is to be considered for the appropriate application. • In systems with components which are to be serviced cyclically (e.g. backup batteries) administrative measures

shall ensure that the required work is carried out. • Regarding cabling the local respectively national installation and equipping requirements are to be adhered to.

Programming • Application programming is to be carried out in accordance with the information in the safety section of the

manufacturer´s handbook. • Safety orientated configuration and application programming must be carried out with safety tools and checked by

a competent person who is independent of the application developer. • Care is to be taken that the details of the planning and engineering (system parameters which may have an affect


upon safety) are set correctly in safety critical application. • Programs and data which are relevant to safety must be separated from programs and data which are not relevant

to safety. Safety paths are to be marked in logic plans and parameter lists. Proof of freedom of interaction (interference-free) of non-safety-related program parts must be shown for every modification.

• System reaction times to external requirements are to be tested. System reaction times to internal errors are to be taken into account.

• Discrepancy times are to be specified application-specific, as far as is necessary. • Conformity of the programs that are loaded in the safety-related programmable controller with the programs

theoretically checked previously must be proved. This especially includes proof that the compiled version of the programs, which are to be jointly used, provide the specified safety functions.

• The correct operation of the safety related program should to be shown by means of a complete functional test. The usage a certified revision comparator during the test of modifications is strongly recommended.

Operation • Safety relevant error reactions which only lead to signalling alarms are only permitted under supervised operation. • On-line modification reduces the safety by its nature and are not supported by TÜV. On-line modifications are

under the sole responsibility of the operator. • Modification of the system software (operating system, I/O-drives, diagnostics, libraries e.g.) are subject to the

type certi fication. • In addition to the printed documentation of the application program, copies of the program must be stored on

write-protected data carrier. • PID and other control algorithms must not be used for safety relevant functions. • If it is intended to take safety-related functions temporarily out of operation for maintenance (so-called

"maintenance ovrride) then: o This factor is to be taken into account at the planning stage. o It is to be ensured that the plant operator is clearly informed about this operating condition. o It is to be ensured that the plant operator still receives sufficient information about the safety status of the

plant. o A detailed instruction is to be produced for switching this special condition on or off.

It is recommended, to consider the actual version of the document "Maintenance Override" of TÜV Süddeutschland (TÜV Product Service) and TÜV Rheinland.


Product-independent Conditions and Restrictions

Specification of Safety Instrumented Loops • Specification based on the hazard analysis

Safety functions, immediate safety states, process safety time (PST) Structure of each safety instrumented loop Independent control and protective structure of the plant automation Interacting of plant subsystems Consider a safety shutdown while the process is in start up or controlled shutdown down. Specification of organisational measures (operation , inspection) Hazards to be covered by full / major responsibility of the plant operator.

• Suitable Ex-protection Overvoltage, surge and other EMC protection

• Observe the conditions of use specified by the manufacturer Example: Monitored threshold limits and leakage current of the digital I/O modules Electrical insulation provided by the I/O moduls Specified environmental stress conditions

• Current loop principle (de-energized to trip, 4-20mA) Signals should be dynamic, to the extend possible

Configuration of Safety Instrumented System • Follow the system documentation incl. safety manual

Follow the conditions and restrictions stated in the TÜV report to the certificate • Configuration based on the specification of the safety functions

Check by a competent and independent person (four eye principle) • Separate safety-related and non-safety-related programs and data

Highlight the safety-related paths and data in the logic diagrams and parameter lists • Configuration with the delivered safety engineering tools only • Specify the safety-related configuration

I/O configuration, process safety time (PST), SIL, max. cycle time, System reaction to internal failures and failures of the periphery Application-specific processing of the discrepancy of inputs

• Select system structure suitable for the required availability, SIL and PST (Certified systems provide increased availability but rare software and hardware failures can lead to a complete shutdown) Time limitation of degraded operation

• Only certified safety-related modules for safety functions Interference-free modules ("Rückwirkunsfrei") for non-safety-related functions

Communication • Safety-related communication is currently only supported between systems of the same family- vendor-independent

safety bus specifications are currently under certification Communication with other non-safety-related systems can be made safe only by additional measures in the application program Access control for external communication partners (Examples: Engineering work station and DCS)

• Communication adds to the safety-related reaction time Specify and configure time limit for the monitoring of the communication Unfavourable communication structures and parameters may reduce the plant availability


Application Programming • Program based on logic diagrams or cause + effect matrices only • Program with the delivered safety engineering tools only

(if no safety engineering tools exist, each path must be fully tested) • Avoid instruction lists / mnemonics

Use function block diagrams, cause + effect matrix or sequential function charts • Use proven-in-use or pre-tested function blocks

Maintain a library of such blocks • Keep the reaction time of the application program constant

Test of the maximum system reaction time to all external events • Test the re-start after power failure in all operating modes • Check modifications always with the certified revision comparator • Check during commissioning that the compiled configuration loaded in the safety

instrumented system and the configuration theoretically checked previously are equal

Operation and Modifications • Safety relevant fault reactions which only lead to signalling are only permitted under

supervised operation. (Operator must have enough information and time to react) • Maintenance Override requires (operator-specified) guidelines

Plant operator must nevertheless receive sufficient information about the safety status of the plant see the Document "Maintenance Override"

• Hazards associated with on-line modifications On-line modifications reduce safety by its nature. Full functional testing should be done at simulators or at a similar plant.

Timing restriction after degradation • The generic standards ( IEC 61508 and DIN 19250 in companion with DIN 0801) don't give exact figures or

guidelines for a system, when a fault has been detected in the system, and the system strucure has been degraded as a result of that fault.

• For ESD applications, where the AK system according to the DIN 19250 is used, only supervised operation should be possible after reaching a single channel mode of operation. Online repair is possible. If not repaired, single channel operation is possible with the following maximum timing : - in AK 5 : shutdown after a maximum of 72 hours of supervised operation in single channel mode - in AK 6 : shutdown after a maximum of 1 hour of supervised operation in single channel mode


Recommended Features of safety-related Engineering Software Features to facilitate configuration, programming and tests

• Encapsulation of program units • Libraries of pre-tested, application-specific function blocks • Standardised programming languages, e.g. as a subset of IEC 61131-3

(Function blocks, sequential function charts, strong data type checking) • Cause + effect matrix programming • Use of Simulator

Features to support modifications

• Encapsulation of program units • Function blocks without global variables • Safety-related and non-safety-related program and parameter are secrued by individual CRC-checksums • Revision comparator • Version-Control System with individual access rights

Configuration checker (Example: is the proposed online-modification allowed ?)

programmierbare systeme_weitere informationen

Documents