Requirements Of Sensors And Actuators For Fail-Safe Modules - Siemens SIMATIC S7-1500/ET 200MP System Manual

Wiring
7.2 Additional rules and regulations for operation of the S7-1500/ET 200MP with fail-safe modules
7.2.2

Requirements of sensors and actuators for fail-safe modules

General requirements for sensors and actuators
Note the following important warning regarding safety-related use of sensors and actuators:
Note that instrumentation with sensors and actuators bears a considerable safety
responsibility. Also bear in mind that sensors and actuators generally do not have a service
life of 20 years as defined in IEC 61508:2010 without considerable loss of safety.
The probability of hazardous faults and the rate of hazardous faults of safety functions must
comply with an SIL-defined high limit. A listing of values achieved by F-modules in the
technical specifications of the F-modules is available under "Fail-safe performance
characteristics".
To achieve the respective safety class, suitably qualified sensors and actuators are
necessary.
Additional sensor requirements
General rule: A single-channel sensor is sufficient to achieve SIL3/Cat.3/PLd. However, to
achieve SIL3/Cat.3/PLd with a single-channel sensor, the sensor itself must be SIL3/Cat.3/PLd-
capable. Otherwise you can only reach this security level through the two-channel
connection of sensors.
To reach Cat.4, connect the sensors to two channels.
In the case of fail-safe input modules, a "0" value is output to the F-CPU after detection of
faults. You therefore need to make sure that the sensors are implemented in such a way as
to ensure the reliable reaction of the safety program when the sensor is in the "0" state.
Example: In its safety program, an EMERGENCY-STOP sensor must achieve the shutdown of
the respective actuator when it is in the "0" state (EMERGENCY-STOP button pressed).
152
WARNING
WARNING
Automation system
System Manual, 01/2023, A5E03461182-AK