Competence; Residual Risk; Intentional Misuse; Decommissioning - ABB ACS880 User Manual

30 Maintenance
The person responsible for the design of the complete safety system should also note the
Recommendation of Use CNB/M/11.050 published by the European co-ordination of Notified
Bodies for Machinery concerning dual-channel safety-related systems with electromechanical
outputs:
• When the safety integrity requirement for the safety function is SIL 3 or PL e (cat. 3 or
4), the proof test for the function must be performed at least every month.
• When the safety integrity requirement for the safety function is SIL 2 (HFT = 1) or PL d
(cat. 3), the proof test for the function must be performed at least every 12 months.
This is a recommendation and depends on the required (not achieved) SIL/PL. For example,
safety relays, contactor relays, emergency stop buttons, switches, etc. are typically safety
devices which contain electromechanical outputs. The STO circuit of the inverter unit does
not contain any electromechanical components.

Competence

The maintenance and proof test activities of the safety function must be carried out by a
competent person with expertise and knowledge of the safety function as well as functional
safety, as required by IEC 61508-1 clause 6.

Residual risk

The safety functions are used to reduce the recognized hazardous conditions. In spite of
this, it is not always possible to eliminate all potential hazards. Therefore the warnings for
the residual risks must be given to the operators.

Intentional misuse

The safety circuit is not designed to protect a machine against intentional misuse.

Decommissioning

When you decommission a POUS group or an inverter unit, make sure that the safety of
the machine is maintained until the decommissioning is complete.