Functional Example CD-FE-I-029-V30-EN Safety-related controls SIRIUS Safety Integrated

Size: px

Start display at page:

Download "Functional Example CD-FE-I-029-V30-EN Safety-related controls SIRIUS Safety Integrated"

Phebe Norman
5 years ago
Views:

1 Functional Example Safety-related controls SIRIUS Safety Integrated Two safety circuits in a cascade up to SIL 3 acc. to IEC 6206 and PL e acc. to ISO with ET 200S Safety Motorstarter Solution Local (PM-D F X and failsafe motor starters)

2 Preliminary comment Safety Functional Examples are functional and tested automation circuits based on standard I IA/DT products. They can be used to simply, quickly and cost-effectively implement applications in safety technology. Each of the Safety Functional Examples covers a subtask of a typical customer application involving safety technology that is frequently encountered. In addition to a list of all of the necessary software and hardware components, and a description of their interconnection, the Functional Examples also contain tested and commented codes. This enables the functions described here to be adapted quickly and thus used as a basis for individual extensions. Important Note The Safety Functional Examples are not binding and do not claim to be complete regarding the circuits shown and equipping as well as possible eventualities. The Safety Functional Examples do not represent customer-specific solutions. They are only intended to provide support for typical applications. You are responsible in ensuring that the described products are correctly used. These Safety Functional Examples do not relieve you of the responsibility in safely and professionally using, installing, operating and servicing equipment. When using these Safety Functional Examples, you recognize that Siemens cannot be made liable for any damage/claims beyond the liability clause described above. We reserve the right to make changes to these Safety Functional Examples at any time without prior notice. If there are any deviations between the recommendations provided in these Safety Functional Examples and other Siemens publications - e.g. Catalogs - then the contents of the other documents have priority. SIRIUS Safety Integrated Page 2/23

3 Table of contents Warranty, liability and support Function Description of the functionality Advantages/customer benefits Planning and engineering Installation and commissioning Operation Service and maintenance: Upgrades and expansions Failsafe Motor Starters Components required Structure and wiring An overview of the hardware structure Connecting-up the hardware components Important hardware component settings... 5 Evaluation acc. to IEC 6206 and ISO 3849-: Safety functions Evaluation safety functions and Evaluation according to IEC Evaluation according to ISO 3849-: Summary of safety functions and Evaluation of safety function Evaluation according to IEC Evaluation according to ISO 3849-: Summary of safety function Contact partners History SIRIUS Safety Integrated Page 3/23

4 Warranty, liability and support We do not accept any liability for the information contained in this document. We are not liable for any damage caused by the use of the examples, information, programs, configuration and performance data, etc. described in this Safety Functional Example, independent of the legal ground upon which this is based, unless we are imperatively liable according to the product liability law due to, e.g., cases of premeditation, an act of gross negligence, injury to life, body or health, or unless the quality of a product has been guaranteed, or due to fraudulent concealment of a defect or serious breach of contract. Damages due to serious breach of contract are, however, restricted to prevalent and foreseeable contractual damages, in as much as there is no premeditation or gross negligence nor imperative liability due to injury to life, body or health. This does not constitute a change in the burden of proof to your disadvantage. Copyright 2007 Siemens I IA/DT. It is not permissible to transfer or copy these Safety Functional Examples or excerpts of them without first having prior authorization from Siemens I IA/DT in writing. SIRIUS Safety Integrated Page 4/23

5 2 Function 2. Description of the functionality If people (in production technology) are close to machines, then they must be protected using the appropriate equipment. The EMERGENCY STOP command device represents a widely established component that protects man, machine and environment against potential hazards. This safety function example will show how a cascaded EMERGENCY STOP shutdown with 2 motor starter groups can be implemented in an ET 200S station. A PM-D F X safety module can provide a total of 6 safety-related shutdown groups (refer to the ET 200S Motor Starter Manual) by accessing the SG to SG6 buses (safety groups) of the Failsafe Motor Starter. It routes the safetyrelated control voltage of the safety shutdown groups SG to SG6 to the SG rail of the terminal module of the next Failsafe Motor Starter. The terminal modules of the Failsafe Motor Starter additionally have a coding block. This allows the motor starter to be assigned one of the six safety-related shutdown groups (refer to Chapter 4.3). The shutdown is realized by a safety relay switching one of the 6 SG buses into a no-voltage condition. The first two motor starters (refer to Chapter 4.) are, in this function example, connected to SG the others to SG2. The motor starters can be shutdown in a safety-related fashion by shutting down an SG. The EMERGENCY STOP command devices with positively-driven contacts are monitored by the 3TK284 safety relays. If the EMERGENCY STOP of group is actuated, then the 3TK284 (Evaluate ) shuts down its enable circuit according to stop Category 0 according to EN SG and the 3TK284 (Evaluate 2) are shutdown. The 3TK284 (Evaluate 2) in turn shuts down the SG2. If the EMERGENCY STOP of group. is actuated, the 3TK284 (Evaluate 2) shuts down its enable circuit according to stop Category 0 in compliance with EN SG2 is shutdown. Drives are stopped in this particular function example. Before restarting or acknowledging the EMERGENCY STOP shutdown using the start button, it is checked as to whether the contacts of the EMERGENCY STOP commanding device are closed. This functional example only discusses the safety function. The motor starter is operationally switched using a standard PLC and is not considered any further here. Note Equipment, functional aspects and design guidelines for EMERGENCY STOP can be found in EN ISO 3850: EN : 2006 must be observed in addition. SIRIUS Safety Integrated Page 5/23

6 2.2 Advantages/customer benefits 2.2. Planning and engineering Lower time and costs for engineering and documentation: Motor starters are re-parameterized and documented using the standard Step7 tool The PLC can handle all of the control functions of the motor starter Only 2 motor starter versions are required to cover the power range up to 7.5 kw Installation and commissioning Quick installation: Very quick installation of the ET 200S with self-assembling 50 A energy bus. Several cable channels and terminal blocks are no longer required All load feeders are completely wired apart from the motor connection Every power supply voltage is only connected once and is automatically connected to the next modules Optimum cabinet design without de-rating up to 60 C Low space requirement (either few / smaller electrical cabinets): Less material and wiring mean less space requirements in the cabinet and thus less space requirements in the complete system. Fast commissioning: Less inspection effort due to modular and standardized system concepts no risk of wiring errors. Easy low-cost approval (machine guideline): Motor starters and safety modules have been certified by the TÜV (German Technical Inspectorate) Operation The availability and productivity have been increased: Faults are detected early on thanks to powerful diagnostic functions Easy overload acknowledgement of the motor starters via remote reset using PROFIBUS (or PROFINET) Emergency Start function Coordination type 2 for 50 ka SIRIUS Safety Integrated Page 6/23

2.2.4 Service and maintenance: Simple and preventive service and maintenance: Single diagnostics, overload and short circuit are separately detected Short downtimes: Hot swapping (motor starters can

7 2.2.4 Service and maintenance: Simple and preventive service and maintenance: Single diagnostics, overload and short circuit are separately detected Short downtimes: Hot swapping (motor starters can be replaced in just a few seconds in operation without requiring any tools) thanks to the pre-configured wiring Self-coding motor starters (an incorrect motor starter cannot be inserted as it is mechanically interlocked) Automatic remote parameterization by the master during hot-swapping Full motor protection thanks to the overload protection short circuit protection dissymmetry anti-stall protection zero current detection, long motor starter lifetimes up to 0 million switching operations Lower costs when stocking spare parts: There are only 2 motor versions up to 7.5kW with wide setting ranges Upgrades and expansions Existing plants and systems can be simply and quickly upgraded/expanded 2.3 Failsafe Motor Starters A Failsafe Motor Starter comprises a circuit-breaker with shunt release, a contactor with positively-driven auxiliary contacts and an electronic evaluation unit for fault detection. The PM-D F X power module switches off the contactor supply voltage. If the contactor control does not match the switching status of the positively-driven auxiliary switch, the electronic evaluation unit detects a fault and switches off the circuit-breaker. In this case, the second shutdown element is therefore the circuitbreaker that is shutdown from a monitored shunt release when a fault occurs. SIRIUS Safety Integrated Page 7/23

8 3 Components required Hardware components Table 3- Component Typé Order no / Order information Qty. Manufacturer EMERGENCY STOP Start button Mushroom head pushbutton, NC, 40 mm, with yellow upper section without protective collar Switching element with a switching contact, NC contact Empty enclosure of a command point NO contact for basemounting Pushbutton, black with flat actuator, 22 mm nominal diameter optional: Inscription plate "Start" 3SB3 80-0DG3 3SB C 3SB3 80-0AA3 3SB3 420-OB 3SB AA 3SB3 906-EL Safety relay 3TK284 safety relay 3TK284-BB40 2 Failsafe direct starter; 2.4 3RK30-0BB3-0AA2 to 8 A 4 Terminal module for a 3RK903-3AC00 direct starter F with feeder cable connection Terminal module for a 3RK903-3AC0 direct starter F without 3 feeder cable connection Terminal module for the 3RK903-3AE00 ET 200S - station supply terminal module PM-D F X; supply at the left PM-D F X power module 3RK903-3DA00 (feed terminal module) IM 5 to connect ET 6ES75-AA03-0AB0 200S to PROFIBUS DP optional: 3RK903-2AC00 Supply block M65-PEN-F M65-PEN-S connection 3RK903-2AC0 block 3 Power supply 6ES7307EA00-0AA0 PS307 5A SIMATIC S7 SIMATIC S7-300, CPU 35-2DP 6ES735-2AG0-0AB0 Micro Memory Card MMC 52 kb 6ES LJ0-0AA Siemens AG Note The functionality was tested using the specified hardware components. Products that are similar but deviate from this list can be used (e.g. another ET 200S Motor Starter). SIRIUS Safety Integrated Page 8/23

9 IM PM-D S PW SG SG 2 SG 4 SG Two safety circuits in a cascade up to SIL 3 and PL e Article-ID: Structure and wiring 4. An overview of the hardware structure "Evaluate + 2" Group Group 2 PLC F-DSe- F-DSe- F-DSe- F-DSe- SG SG SG2 SG2 Feeding R SG "Respond " PROFIBUS-DP ET200S with PM-D-FX and motor starter Failsafe "Respond 2" "Detect " "Detect 2" E-Stop Group Start 3TK284 E-Stop Group 2 Start 3TK284 "Evaluate " "Evaluate 2" Additional motor starters can be inserted in an ET 200S Station. These are assigned to a group and can be shutdown by actuating the appropriate EMERGENCY STOP command device. SIRIUS Safety Integrated Page 9/23

10 4.2 Connecting-up the hardware components Group Group 2 A0 A A2 A3 A4 A5 Q Q2 24V M PLC Master PROFIBUS-DP 24V M IM 5 PM-D F X TM-PF 30 S47 G F-DSe-x F-DSe-x F-DSe-x F-DSe-x =SG =SG =SG2 =SG2 Termination module End cover 3TK284 3TK284 A A SG SG2 A A2 Q Y32 Y35 Y34 Y 3 ON 4 A A2 Q2 Y32 Y35 Y34 Y 3 ON 4 L+ 2L+ M 2M L+ U ext. M SG3 SG4 SG5 SG6 Y2 Y22 Y Y2 Y22 Y Wiring must be cross-circuit proof! SIRIUS Safety Integrated Page 0/23

4.3 Important hardware component settings Set the safety-related shutdown group on the terminal module of the Failsafe Motor Starter Condition when supplied

11 4.3 Important hardware component settings Set the safety-related shutdown group on the terminal module of the Failsafe Motor Starter Condition when supplied Example for SG2 Example for SG5 Some important settings in the STEP7 hardware configuration are shown below as an overview. SIRIUS Safety Integrated Page /23

12 Picture Note Safety shutdown group The safety shutdown group must be set. This number is compared with the safety-related mechanical assignment on the terminal module this is not visible from outside and must match this. Default: Not assigned Rated operating current Here, the rated operating current is entered, which the feeder can conduct without any interruption (switching device and motor) (rated motor current). The current that can be set depends on the motor starter current range (e.g. 0.3 A to 3 A; 2.4 A to 8 A; 2.4 A to 6 A). This can be set in 0 ma steps within a specific range. Wide range setting Default: Minimum value Current limit Upper current limit: The mechanical system/equipment is more difficult to move e.g. if the bearings are damaged, the mixture being mixed is too viscous Current is greater than set Lower current limit: The system becomes easier to move, e.g. when the material processed by the system runs out or a driving belt breaks Current is smaller than set. Protection by evaluating how the current limit is violated Default: Alarm SIRIUS Safety Integrated Page 2/23

13 Picture Note Overload, thermal motor model The motor winding temperature is calculated from the measured motor currents and the device parameters, rated operating current and shutdown class. It is therefore possible to identify as to whether the motor is overloaded or is operating in the normal operating range. Default: Shutdown without restart The pause time is the time that is specified for cooling-down after operational shutdowns, i.e. not as a result of overload trips. After this time has expired, the thermal memory of the motor starter is changed to 0% for motor temperature rise < 50% reduced to 50% for motor temperature rise > 50% This means that frequent starting attempts are possible (jog mode). Zero current detection Zero current is detected if the motor current in all phases is <8,75 % of the selected rated operating current. Default: Shutdown SIRIUS Safety Integrated Page 3/23

14 Dissymmetry AC asynchronous motors respond to minor supply voltage asymmetries with a higher asymmetric current consumption. This way, the temperature in the stator and rotor windings increases. The dissymmetry limit value is a percentage value by which the motor current in the individual phases may deviate. Dissymmetry is present if the difference between the smallest and the highest phase current is greater than 30 %. Default: Shutdown SIRIUS Safety Integrated Page 4/23

15 5 Evaluation acc. to IEC 6206 and ISO 3849-: Safety functions Comments EMERGENCY STOP is not a means of risk mitigation. EMERGENCY STOP is a "Supplementary Safety Function" Safety functions Further considerations are based on the following safety functions: Supplementary safety function SF Shutdown group must be switched off when "EMERGENCY STOP " is actuated. SF 2 Shutdown group 2 must be switched off when "EMERGENCY STOP " is actuated. SF 3 Shutdown group 2 must be switched off when "EMERGENCY STOP 2" is actuated. The safety functions listed above are evaluated below according to the two standards IEC 6206and ISO 3849-:2006. The same components are involved in safety functions and 3. Therefore, they are only evaluated once in this example. SIRIUS Safety Integrated Seite 5/23 CD-FE-I-029-V30-DE

16 5.2 Evaluation safety functions and Evaluation according to IEC 6206 Parameters for the calculation of PFH D for "Detection" and/or "Detection2" (EMERGENCY STOP) Parameters Value Reason Definition B0 EMERGENCY STOP * 0 5 Proportion of hazardous failures 0.2 (20%) EMERGENCY STOP T Service life C Number of operations of EMERGENCY STOP T2 Diagnostics test interval EMERGENCY STOP b (CCF factor) Proneness to failures as a result of common cause DC Degree of diagnostic coverage Evaluation parameters 75,200 hrs (20 years) 6 * 0-3 /hrs Assumptions: Actuated once per week (7 * 24 hours) (EMERGENCY STOP test). Actuation takes place every day of the year (365 days) 68hrs When the EMERGENCY STOP is actuated a defective contact is detected in the 3TK. An actuation takes place every week (7 * 24 hours) (see "C"). 0. If installed according to IEC 6206, a CCF factor of 0. (0%) can be assumed. With this value, the user errs on the side of caution ("conservative value") (99%) Discrepancy evaluation for EMERGENCY STOP; Siemens User Parameters Component Value Definition PFH D (3TK) 3TK * 0 - Siemens PFH D (PM-D FX) PM-D FX Failsafe 5.70 * 0 - Response parameters Parameters Component Value Definition PFH D (motor starter) F motor starters.80 * 0-09 Siemens 2 units 3.60 * 0-09 Result IEC 6206 SILCL Detect 3 Hardware error tolerance: HFT = Proportion of safe failures: SFF 0.99 (99%) PFH D.9 * 0-0 Architecture: Basic subsystem architecture D Evaluate 3.0 * 0-0 Respond * 0-09 Result 3 SILCL of all tasks of the supplementary safety function is at least 3. PFH D (=3.82 * 0-09 ) of the entire supplementary safety function fulfills SIL 3. SIRIUS Safety Integrated Seite 6/23 CD-FE-I-029-V30-DE

17 5.2.2 Evaluation according to ISO 3849-:2006 Parameters for the calculation of MTTF d for "Detection " and "Detection 2" (EMERGENCY STOP) Parameters Value Reason Definition B0 EMERGENCY STOP * 0 5 Siemens Proportion of hazardous failures EMERGENCY STOP 0.2 d op Mean operating time in days per year h op Mean operating time in hours per day t Cycle Mean time between the start of two consecutive cycles of the component EMERGENCY STOP 365 days per year 24 hours per day 68hrs/cycle Interim results (for EMERGENCY STOP) Interim results Reason (20%) Assumption: Actuation takes place every day of the year Assumption: There is an interval of one week between actuations of the EMERGENCY STOP (EMERGENCY STOP test) (7 * 24 hours) MTTF d High MTTF d 30 years DC High DC=99% Discrepancy evaluation for EMERGENCY STOP; evaluation of read-back signals (positively-driven contacts) of both contactors Measures against CCF Fulfilled It is assumed that the necessary measures are taken by the user. Category 4 System behavior: A single fault does not result in the loss of the safety function. The single fault is detected. MTTF d : high, DC: high, measures against CCF: fulfilled Evaluation parameters Parameters Component Value Definition PFH D (3TK) 3TK * 0 - Siemens PFH D (PMD-FX) PM-D FX Failsafe 5.70 * 0 - Response parameters Parameters Component Value Definition PFH D (motor starter) F motor starters.80 * 0-09 Siemens 2 units 3.60 * 0-09 Result ISO 3849-:2006 PL PFH D Detect e 2.47 * 0-08 (from Annex K; see note) Evaluate e.0 * 0-0 Respond e 3.60 * 0-09 Result e PL of all tasks of the supplementary safety function is at least e. The number of tasks is less than or equal to 3. Note: The MTTF d for each channel is limited to max. 00 years! User SIRIUS Safety Integrated Seite 7/23 CD-FE-I-029-V30-DE

18 5.2.3 Summary of safety functions and 3 IEC 6206 ISO 3849-:2006 SILCL PFH D PL PFH D Detect 3.9 * 0-0 e 2.47 * 0-08 Evaluate 3.0 * 0-0 e.0 * 0-0 Respond * 0-09 e 3.60 * 0-09 Result SIL 3 PL e SIRIUS Safety Integrated Seite 8/23 CD-FE-I-029-V30-DE

19 5.3 Evaluation of safety function Evaluation according to IEC 6206 Parameters for the calculation of PFH D for "Detection" (EMERGENCY STOP) Parameters Value Reason Definition B0 EMERGENCY STOP * 0 5 Proportions of hazardous failures 0.2 (20%) EMERGENCY STOP T Service life C Number of operations of EMERGENCY STOP T2 Diagnostics test interval EMERGENCY STOP b (CCF factor) Proneness to failures as a result of common cause DC Degree of diagnostic coverage 75,200 hrs (20 years) 6 * 0-3 /h Assumptions: Actuated once per week (7 * 24 hours) (EMERGENCY STOP test). Actuation takes place every day of the year (365 days) 68hrs When the EMERGENCY STOP is actuated a defective contact is detected in the 3TK. An actuation takes place every week (7 * 24 hours) (see "C"). 0. If installed according to IEC 6206, a CCF factor of 0. (0%) can be assumed. With this value, the user errs on the side of caution ("conservative value") (99%) Discrepancy evaluation for EMERGENCY STOP; Siemens User SIRIUS Safety Integrated Seite 9/23 CD-FE-I-029-V30-DE

20 Evaluation parameters Parameters Component Value Definition PFH D (3TK) 3TK * 0 - Siemens PFH D (PMD-FX) 2 units PM-D FX Failsafe.07 * * 0 - Response parameters Parameters Component Value Definition PFH D (motor starter) F motor starters,80 * 0-09 Siemens 2 units 3.60 * 0-09 Result IEC 6206 SILCL Detect 3 Hardware error tolerance: HFT = Proportion of safe failures: SFF 0.99 (99%) PFH D.9 * 0-0 Architecture: Basic subsystem architecture D Evaluate 3.64 * 0-0 Respond * 0-09 Result 3 SILCL of all tasks of the supplementary safety function is at least 3. PFH D (=3.82 * 0-09 ) of the entire supplementary safety function fulfills SIL 3. SIRIUS Safety Integrated Seite 20/23 CD-FE-I-029-V30-DE

21 5.3.2 Evaluation according to ISO 3849-:2006 Parameters for the calculation of MTTF d for "Detection " (EMERGENCY STOP) Parameters Value Reason Definition B0 EMERGENCY STOP * 0 5 Siemens Proportion of hazardous failures EMERGENCY STOP 0.2 (20%) d op Mean operating time in days per year h op Mean operating time in hours per day t Cycle Mean time between the start of two consecutive cycles of the component EMERGENCY STOP 365 days per year 24 hours per day 68hrs/cycle Interim results (for EMERGENCY STOP) Interim results Reason Assumption: Actuation takes place every day of the year Assumption: There is an interval of one week between actuations of the EMERGENCY STOP (EMERGENCY STOP test) (7 * 24 hours) MTTF d High MTTF d 30 years DC High DC=99% Discrepancy evaluation for EMERGENCY STOP; evaluation of read-back signals (positively-driven contacts) of both contactors Measures against CCF Fulfilled It is assumed that the necessary measures are taken by the user. Category 4 System behavior: A single fault does not result in the loss of the safety function. The single fault is detected. MTTF d : high, DC: high, measures against CCF: fulfilled User SIRIUS Safety Integrated Seite 2/23 CD-FE-I-029-V30-DE

22 Evaluation parameters Parameters Component Value Definition PFH D (3TK) PFH D (PMD-FX) Siemens Response parameters 3TK284 2 units PM-D FX Failsafe 5.35 * * * 0 - Parameters Component Value Definition PFH D (motor starter) F motor starters,80 * 0-09 Siemens 2 units 3,60 * 0-09 Result ISO 3849-:2006 PL PFH D Detect e 2.47 * 0-08 (from Annex K; see note) Evaluate e.64 * 0-0 Respond e 3,60 * 0-09 Result e PL of all tasks of the supplementary safety function is at least e. The number of tasks is less than or equal to 3. Note: The MTTF d for each channel is limited to max. 00 years! SIRIUS Safety Integrated Seite 22/23 CD-FE-I-029-V30-DE

23 5.3.3 Summary of safety function 2 IEC 6206 ISO 3849-:2006 SILCL PFH D PL PFH D Detect 3.9 * 0-0 e 2.47 * 0-08 Evaluate 3.64 * 0-0 e.64 * 0-0 Respond * 0-09 e 3.60 * 0-09 Result SIL 3 PL e 6 Contact partners Technical Assistance for low-voltage switchgear In person from Mon. - Fri to 7.00 (CET) Telephone: +49 (9) technical-assistance@siemens.com Internet: By fax 24 hours a day Fax: +49 (9) History Table 7- History Version Date Change V First issue V Revision of the hardware assembly overview - New chapter: Evaluation according to IEC 6206 and ISO V Revision of title and description of functionality SIRIUS Safety Integrated Seite 23/23 CD-FE-I-029-V30-DE

Applications & Tools. Evaluation of the selection of a safetyrelated mode using non-safety-related components

Applications & Tools. Evaluation of the selection of a safetyrelated mode using non-safety-related components Cover sheet Evaluation of the selection of a safetyrelated mode using non-safety-related components SINUMERIK 840D sl SINUMERIK Safety Integrated Application description February 2015 Applications & Tools