Hello Bijoy;

Safety PLCs (CPUs, networks and IO modules) are the tools that the automation industry has used to implement Machine Safety international standards, through their recent evolutions:

-EN 954 1, from CAT B/1 to CAT 4

-IEC 62061, from SIL1 to SIL3

-ISO 13849-1, from PLa/b to PLe.

These standards use other tools, such as risk evaluation, Hazop,, safety components (for example, normalized emergency stop pushbuttons, safety relays and door guards), national safety rules and legislations such as CSA, NFPA and OSHA and statistical analysis, to prevent harm, injuries and death from occurring in industrial settings. So the use of Safety PLCs is only one part of a process that every industry has to follow to prevent accidents of all consequences.

Siemens manufacturers F-CPUs (Safety CPUs) for most of its PLC families. Here is a presentation of the F-CPUs of the S7-300 family:

http://w3.siemens.com/mcms/programmable-logic-controller/en/advanced-controller/s7-300/cpu/fail-safe-cpus/pages/default.aspx

Siemens F-CPUs can process both safety and standard programs on the same CPU, with a mixture of Safety I/O and standard I/O. The Safety program is compiled separately from the standard program, and a Safety certificate (from TÜV) is applied to the Safety program on compilation, to prevent undesired changes, and to certify that the required safety category (eg SIL3 or PLd) have been attained.

On the suggested webpage you will find numerous links that will help you research this further.

Hope this helps,

Daniel Chartier

Hello William;

There are many differences in the components of a F-system compared to a standard CPU + I/O modules, although all are not immediately apparent to the user. For example, test circuits are integrated in all F-I/O modules so the F-CPU can transparently determine the accuracy of all input and outputs required for the safety program.

One of the most obvious differences between a standard program and a Safety program, for someone starting to program them, is the requirement for setting monitoring times for different portions of the program: monitoring the cycle time of the Safety program execution, monitoring the communication time between F-CPU and .F-I/O, monitoring the time of communications between F-CPUs, and evaluation the F-system response time.

These are all parameters that must be calculated (by the system program and with the help of special documents developed by the Siemens SET team) and integrated in the safety functions. Any exceeding of any monitoring time will cause a shutdown to a safe state of the whole system, even though the reported status of the F-I/O (by themselves) do not cause a shutdown.

So, not only does a safety digital input (for example) report on the status of its input signals, it also reports on its operational status to the F-CPU within a predetermined time to ensure the system that it is responsive. Failure to do so disrupts the safety program and causes passivation of the F-DI module.

The following manual discusses F-System engineering without getting into the details of each F-CPU family, so it can give general ideas on safety systems. Look in Appedix A for a description of monitoring times.

SIMATIC Industrial Software Safety Engineering in SIMATIC S7

https://support.industry.siemens.com/cs/ww/en/view/12490443

Hope this helps,

Daniel Chartier