Achievable Safety Classes with F-I/O
5.2 Safety Functions for Achieving Safety Classes for F-I/O with Inputs
Safety Engineering in SIMATIC S7
System Manual, 04/2006, A5E00109529-05
5-5
Example: Two Redundant Sensors Connected via One Channel to Two F-DIs (High Availability;
SIL2/Category 3)
The following figure presents the wiring diagram for a 1oo1 sensor evaluation of two
redundant sensors connected to two SM 326, DI 24 ☓ 24 VDC modules. The sensor is
supplied by the F-I/O. This wiring enables SIL2/Category 3 and high availability to be
achieved. SIL2/Category 3 can only be achieved if a suitably-qualified sensor is used.
/
0
',
9V
/
0
',
9V
60
',['&9
60
',['&9
0HDVXUHPHQWRIWKHVDPH
SURFHVVGDWDZLWKPHFKDQLFDOO\
LQVXODWHGVHQVRUV
Figure 5-3
Example: Wiring Diagram for Two Redundant Sensors Connected via 1 Channel to Two
F-DIs (1oo1, High Availability)
5.2.2
1oo2 Evaluation for F-I/O with Inputs
Introduction
This section presents examples for wiring of sensors to provide a better understanding of
1oo2 evaluation. The examples, taken from the
Automation System S7-300 Fail-safe Signal
Modules manual, show several options for wiring sensors to F-SMs.
1oo2 Evaluation
In the case of 1oo2 evaluation, two input channels are occupied either by one two-channel
sensor or by two single-channel sensors. The input signals are compared internally for
equivalence or non-equivalence.
Discrepancy Analysis with 1oo2 Evaluation
To differentiate a hardware failure from a transient, random signal change, the safety-related
input signals undergo an internal discrepancy analysis as part of 1oo2 sensor evaluation.
Discrepancy analysis is initiated when different levels are detected for two associated input
signals (for non-equivalence testing, when the same levels are detected). After a
programmable time, the so-called discrepancy time, has elapsed, a check is made to
determine whether the difference has disappeared (for non-equivalence testing: whether the
agreement has disappeared). If not, this means that a discrepancy error exists.
