5. Functional safety engineering
Festo P.BE-CMMP-AS-3A-HW-EN 0708NH
47
Category
1)
Summary of requirements
System behaviour
2)
Principles for achieving
safety
3
The category B requirements have
to be fulfilled and proven safety
principles must be used. Safety-
relevant parts must be equipped as
follows:
-
A single fault in any component
must not lead to a loss of the
safety function.
-
Single faults must be recog-
nised as soon as this is rea-
sonably possible.
When this one fault occurs,
the safety function is still
preserved.
Some, but not all faults will
be detected.
The occurrence of a number
of undetected faults
together can lead to a loss
of the safety function.
4
The category B requirements have
to be fulfilled and proven safety
principles must be used. Safety-
related components must be con-
structed as two-channel systems
with constant self-monitoring and
full error recognition!
When faults occur, the
safety function must always
be preserved.
The faults must be detected
early enough to prevent a
loss of the safety function.
1)
The category is not intended to define any sort sequence or hierarchical arrangement of safety-
related requirements.
2)
Risk analysis is used to determine whether a complete or partial loss of safety function(s) due to
faults is acceptable.
Table 5.1 Description of the category requirements as per EN 954-1
Among other issues, the EN 60204-1 standard deals with the handling of emergencies and
defines the terms EMERGENCY-OFF and EMERGENCY-STOP (see Table 5.2).
Handling
Definition (EN 60204-1)
Danger case
EMERGENCY-
OFF
Electrical safety in case of emergency by
switching off the electrical energy to all or
part of the installation.
EMERGENCY-OFF is to be used where a
risk of electric shock or other electrical
risk exists.
EMERGENCY-
STOP
Functional safety in case of emergency by
bringing a machine or movable parts to a
standstill.
EMERGENCY-STOP is used to stop a process
or a motion if this represents a danger.
Table 5.2 EMERGENCY-OFF and EMERGENCY-STOP as per EN 60204-1
Electrical isolation does not occur with the "Safe standstill" function. This does not pro-
vide protection from an electric shock. In the sense of the standards, an EMERGENCY-OFF
system cannot be implemented via "Safe standstill" because this requires the complete
plant to be switched off via a mains power isolator of some kind (main power switch or
mains circuit breaker).
The EN 60204-1 standard describes three Stop categories that can be used for shutdowns,
depending on the results of a risk analysis (see Table 5.3).
Summary of Contents for CMMP-AS-C2-3A
Page 2: ......