Sil 2

Hello everybody,
This question is related to SIL2. I've been digging around some SIL docs on what I need to get my PLC fully compling with SIL2 requeriments.
My PLC is a controllogix, which I know is already SIL2 certified, my major doubts are:
- I need to implement in my application automatic I/O test, so the system periodically runs a test routine to verify the system health?
- Do I have to design interconnection arrangement in my panel so it also complies with SIL2, as we can see in AB SIL system configuration manuals?
- is there such thing as the technician responsible for programming the PLC has to be SIL certified in order to have my programming certified?

Thanks a lot.

you application requires 'Risk Analysis' then you can understand what yoy need.
I assume SIL 2 is the same as our CAT.2 level safety.
Personally, I Know the PLC is rated to sil 2, I would avoid using a PLC as the principle safety control in any application.
the main problem with PLC safety is in most cases the PLC program can be changed by any person

welcome to the site by the way

Thanks a lot for you fast answer!

pbritto said:

- [Do] I need to implement in my application automatic I/O test, so the system periodically runs a test routine to verify the system health?

Click to expand...

You should. Safety-rated I/O such as the POINT Guard, automatically conduct pulse testing to ensure continuity and no shorts between channels, to ground, or to +V. This eliminates a large number of potential failures.

pbritto said:

- Do I have to design interconnection arrangement in my panel so it also complies with SIL2, as we can see in AB SIL system configuration manuals?

Click to expand...

Yes. The entire safety function must be designed to meet SIL2 requirements. The SIL rating of the system is only as good as its weakest link. The ControlLogix is only part of the chain. Your input and output must also be SIL2-rated, this includes sensors and final actuating elements (such as switches and contactors).

pbritto said:

- is there such thing as the technician responsible for programming the PLC has to be SIL certified in order to have my programming certified?

Click to expand...

No. Anyone can do the programming provided they follow all the requirements of the safety standard that is being used.
I would highly recommend that one become very familiar with requirements before undertaking such a task.

Have you read ControlLogix in SIL2 Applications?

Your answer was very enlightening, thanks alot

Timbert said:

You should. Safety-rated I/O such as the POINT Guard, automatically conduct pulse testing to ensure continuity and no shorts between channels, to ground, or to +V. This eliminates a large number of potential failures.

Yes. The entire safety function must be designed to meet SIL2 requirements. The SIL rating of the system is only as good as its weakest link. The ControlLogix is only part of the chain. Your input and output must also be SIL2-rated, this includes sensors and final actuating elements (such as switches and contactors).

No. Anyone can do the programming provided they follow all the requirements of the safety standard that is being used.
I would highly recommend that one become very familiar with requirements before undertaking such a task.

Have you read ControlLogix in SIL2 Applications?

Click to expand...

Yes, I am still reading it, but some points are not much clear to me. In a nutshell, as soon as the probability of failure of a PLC and its IOs modules falls into the SIL 2 range, as far as my panel, should I care about making its IO rendudant, having redundant power supply, making external relay arrangements and so on?

There is also information here:
http://www.dguv.de/ifa/en/pub/rep/pdf/rep07/biar0208/rep22008e.pdf

pbritto said:

Yes, I am still reading it, but some points are not much clear to me. In a nutshell, as soon as the probability of failure of a PLC and its IOs modules falls into the SIL 2 range, as far as my panel, should I care about making its IO rendudant, having redundant power supply, making external relay arrangements and so on?

Click to expand...

With SIL ratings, the architecture is less important than the probability of hazardous failure. Having redundancy and other means reduces the probability of hazardous failures.
However, there is a limit to the highest safety integrity level that can be claimed based on fault tolerances and safe failure fractions of the various subsystems. According to IEC 62061, to claim SIL2 without fault tolerance (redundancy) the safe failure fraction (SFF) of a hardware subsystem must be at least 90%. A simple limit switch only has an SFF of 50% (won't close = safe; won't open = dangerous).
I don't believe with simple single channel inputs and outputs that you can reach a SIL claim limit of SIL2. So, you will with all likelihood need redundant inputs and outputs.
As for a redundant power supply, if off = safe then loss of power will result in a safe system so a redundant power supply wouldn't be needed.

You might want to look up SICK flexisoft for what its worth. I have used them in the past with great success on machine safety systems.

Also it generates all the documentation once the project is complete. If you are unsure of things SICK can even go out and set up and program it for you. Price is incredibly good too. Timbert is correct. Once you have done your risk assessment you will then have the facts to decide what architecture(single or dual channel/ cross monitoring etc) and therefore what components you should be using.

Zane_Terblanche said:

Also it generates all the documentation once the project is complete. If you are unsure of things SICK can even go out and set up and program it for you. Price is incredibly good too. Timbert is correct. Once you have done your risk assessment you will then have the facts to decide what architecture(single or dual channel/ cross monitoring etc) and therefore what components you should be using.

Click to expand...

Ok, I just took a look at it, I am kinda stuck as far is my hardware configuration, speacially when it's not an AB modules. That's why I am so concerned about what I have to consider to meet the SIL 2 requirements, because we have already quoted a non-redundant I/O configuration and if I really have to change it right now it's going to be a chaos. I need to read some more of the Rockwell SIL configuration document as per posted by Timbert to talk more clearly about all that, it is still very foggy in my mind.

Ab have the Guardmaster safety devices.
I understand that you quoted to do this job
I am sorry to say you have won the tender by incorectly quoting.
now you are trying to get around it - it is time to bite the bullet and do the job to SIL. 2 safety level it is going to cost you about $1~2 thousand
that is what happens when you misread the specs and underquote.
I still suggest it is cheaper to go with the independant safety devices.
take this job as a learning curve and move on to the next one.

iant said:

Ab have the Guardmaster safety devices.
I understand that you quoted to do this job
I am sorry to say you have won the tender by incorectly quoting.
now you are trying to get around it - it is time to bite the bullet and do the job to SIL. 2 safety level it is going to cost you about $1~2 thousand
that is what happens when you misread the specs and underquote.
I still suggest it is cheaper to go with the independant safety devices.
take this job as a learning curve and move on to the next one.

Click to expand...

I agree, but there are still some customers deals which I still have to go through, these gaps in the SIL 2 PLC might be endorsed by our customers. I need to understand it as most as possible in case I have to conflict the customer decision in order to avoid a harzardous project.

Make sure that your 'Risk Anaylsis' documentation explains all the conceivable risks. this needs to be done prior to the customer accepting the machine.
Or the customer could bankrupt your business if there is an accident.