Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015
17
Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off
Verification and Validation Plan
Verification and validation play important roles in the avoidance of faults throughout the safety system design and
development process. ISO 13849-2 sets the requirements for verification and validation. The standard calls for a
documented plan to confirm that all of the safety functional requirements have been met.
Verification is an analysis of the resulting safety control system. The Performance Level (PL) of the safety control system is
calculated to confirm that the system meets the required Performance Level (PLr) specified. The SISTEMA software is
typically used to perform the calculations and assist with satisfying the requirements of ISO 13849-1.
Validation is a functional test of the safety control system to demonstrate that the system meets the specified requirements
of the safety function. The safety control system is tested to confirm that all of the safety-related outputs respond
appropriately to their corresponding safety-related inputs. The functional test includes normal operating conditions in
addition to potential fault injection of failure modes. A checklist is typically used to document the validation of the safety
control system.
This document uses, as an example, a SensaGuard switch for an input device. Notice that in the validation process, all of the
purposely-created faults are created at the input terminals of the Guardmaster dual-input safety relay. All of the relay’s
responses to these faults are the same as they would be using any typical input device with OSSD outputs, or an electro-
mechanical input device using the Guardmaster dual-input safety relay pulse test output feature.
Some of the SensaGuard switch’s reactions to these faults are unique to the SensaGuard switch, as some responses from
other OSSD devices might be unique to those devices.
The responses of the PowerFlex 527 drive and the PowerFlex 525 drive to faults on their STO inputs are the same.
Therefore, the following tests, using purposely-created faults, are appropriate for either drive.
Verification and Validation Checklist
General Machinery Information
Machine Name/Model Number
Machine Serial Number
Customer Name
Test Date
Tester Name(s)
Schematic Drawing Number
Input Devices
440N-Z21SS2AN9
GuardMaster Dual-input Safety Relay
440R-D22R2
GuardMaster Multifunction-delay Expansion Module
440R-EM4R2D
Variable Frequency Drive
25B-B5PON104 (PowerFlex 525 drive) or 25C-V2P5N104 (PowerFlex 527 drive)
Safety Wiring and Relay Configuration
Test Step
Verification
Pass/Fail
Changes/Modifications
1
Confirm that all components' specifications are suitable for the application. Refer to
Basic Safety Principles and Well-tried Safety Principles from ISO 13849-2.
2
Visually inspect the safety relay circuit to confirm that it is wired as documented in the
schematics.
