Safety in F-Systems
4.8 Safety Requirements
Safety Engineering in SIMATIC S7
4-16
System Manual, 04/2006, A5E00109529-05
Determining Contribution of F-System to Probability of Failure
The contribution of the F-system to the probability of failure of a safety function is determined
by summing the probabilities of failure for the F-CPUs and F-I/O involved. In so doing,
redundant F-CPUs count once and redundant F-I/O twice.
(Redundant F-I/O with inputs count twice, because the input signals that are read
redundantly via two addresses are internally ORed and, consequently, there are two causes
of failure--either one F-I/O or the other.
A redundant F-I/O with outputs counts twice, because the outputs for the two F-I/O that are
activated redundantly via two addresses are ORed from the hardware point of view.)
The contribution of the safety-related communication is then added. More than one F-system
can be involved with one safety function as well.
The failure probability of a safety function is calculated by adding the contribution of the
F-system to the contribution of the sensors and actuators involved in the safety function.
Calculation Example
A safety function is implemented using an S7 FH Systems F-system. The F-CPUs and
F-SMs indicated in the following table are involved in the safety function.
The F-CPU and F-SMs are set up redundantly. They have a proof-test interval of 10 years.
The F-SMs operate in safety mode for SIL3/Category 4. Operation is in high demand mode:
Table 4-4
Calculation Example for the Contribution of the F-System to the Failure Probability of a
Safety Function
F-CPUs, F-SMs, and Safety-
Related Communication
Involved in the Safety Function
Number
Redundancy
Probability of a dangerous failure
per hour
(probability of a dangerous failure
per hour)
CPU 417-4H
6ES7 417-4HL04-0AB0
1
Yes
4.29 E-09
SM 326; DO 10 ☓ DC 24V/2A
6ES7 326-2BF01-0AB0
1
Yes
2.00 E-09
SM 326; DI 24 ☓ DC 24V
6ES7 326-1BK01-0AB0
2
Yes
4.00 E-09
Safety-related communication
1.00 E-09
Total
11.29 E-09
