Shut off power circuit in PLd safety level

In a new electrical cabinet we have to apply to safety level PLd.
We have a circuit for direct online motors.
We will be using two power contactors in series to shut down power to the motors if an Estop is pushed.
We use S7 1500 failsafe plc. To comply with PLd, can we use only one safety digital output to drive both contactors? Or is for PLd one safe digital output for each contactor neccesarry? (this is not concering the maximum output power of the output, but conecering the safety level).
What about the readback of the contactors, can we bring the NC-contacts of the contactors in series on one safe digital intput or do we need one safe digital input for each contactor?

When I did my last PLd setup I was told that an output had to be used for each of the contactors, but the feedbacks for discrepancy timing could be wired in series.

Take a look at the Siemens app example below, it says it is good for SIL3/PLe, so that should cover PLd as well. The manuals for the IO also have good info and diagrams.
https://support.industry.siemens.com/cs/dk/en/view/21331098

This app example shows both two contactors in one F-DQ, and also both feedbacks going to a single DI. Note that it appears it can be a standard DI, and doesn't need to be an F-DI.

At least here in the US, this is probably something that might or might not be OK depending on who you talk to. I hear the rules are a little clearer in Europe, so I can't speak to that.

In my integration I have used two unique outputs for both Cat3 and Cat4. Cat3 gets common EDM feedback, Cat4 gets unique EDM feedback.

Originally posted by mk42:

This app example shows both two contactors in one F-DQ, ...

Click to expand...

That surprises me a little. Not so much that both contactors are controlled by a single output. The output point itself is already redundant and checked. However, the installer would need to be fairly careful with the wiring to prevent a case where a single point of failure (in this case the control wire shorted high) would render the circuit inoperable. This is conceptually easier to insure with separate wired from separate outputs.

Keith

kamenges said:

That surprises me a little. Not so much that both contactors are controlled by a single output. The output point itself is already redundant and checked. However, the installer would need to be fairly careful with the wiring to prevent a case where a single point of failure (in this case the control wire shorted high) would render the circuit inoperable. This is conceptually easier to insure with separate wired from separate outputs.

Keith

Click to expand...

Very fair, "is installed correctly" is a required step 0.


The IO manual calls out that the wires need to be connected in a "cross-circuit-proof manner (for example, as separate sheathed cables or in separate cable ducts)".