Bernecker + Rainer 4MP181.0843-03, Руководство пользователя

Страница: 118 / 160

118
Standards and Certifications • Standards and Definitions for Safety Technology
Mobile Panel User's Manual V 1.5
When using a category 1 stop function for the emergency stop function, it must be guaranteed
that the power to the machine drive elements is completely switched off. These elements must
be switched off using electromechanical equipment
1)
.
Safety category according to EN 954-1/03.97 (safety of machines - safety related parts of
control systems, part 1: general design principles)
1)
The safety related parts of control systems must meet one or more of the requirements for five
defined safety categories. The safety categories define the required behavior of safety related
controller parts regarding their resistance to errors.
These considerations lead to a safety category (B, 1, 2, 3, 4) that specifies how the safet-related
parts on a machine must be implemented.
1) To prevent confusing EN 951-1 categories with IEC 60204-1 stop categories, the term "safety categories" was used in the text shown
above for EN 954-1 categories.
Safety Category
(according to EN 954-1) Safety integrity level -
SIL (according to IEC
61508-2) Short description System Behavior
B - Safety related parts must be designed and built so
that they can meet the expected operational
requirements.
(No specific safety measures are implemented.) Caution!
An error can cause the safety
function to fail.
1 1 Safety related parts must be designed and built so
that only reliable components and safety principles
are used.
(e.g. preventing short circuits by using sufficient
distances, reducing the probability of errors by over-
dimensioning components, defining the failure route
- closed-circuit current principle, etc.) Caution!
An error can cause the safety
function to fail.
2 1 Safety related parts must be designed so that their
safety functions are checked in suitable intervals by
the machine controller.
(e.g. automatic or manual check during start-up) Caution!
An error between checks can
cause the safety function to
fail. If the safety function
fails, it will be recognized
during the check.
3 2 Safety related parts must be designed so that
individual errors do not cause the safety function to
fail. Individual errors should - if possible - be
recognized the next time (or before) the safety
function is required. Caution!
The safety function remains
active when an error occurs.
Some, but not all errors are
recognized. A buildup of
errors can cause the safety
function to fail.
4 3 Safety related parts must be designed so that
individual errors do not cause the safety function to
fail. Individual errors must be recognized the next
time (or before) the safety function is required. If this
type of recognition is not possible, a buildup of errors
is not allowed to cause the safety function to fail. Information:
The safety function remains
active when an error occurs.
Errors are recognized in time
to prevent the safety function
from failing.
Table 64: Safety category overview