Programming. Schneider Electric Quantum Safety PLC, Safety
Reklama
Reklama
Modicon Quantum
33003879 10/2017
Programming Chapter 3
Programming
Introduction
This chapter deals with the topics important for programming your SIL3 project. The requirements for programming a Safety-Related System are described and the SIL3 features are explained.
What Is in This Chapter?
This chapter contains the following sections:
Section
3.1
3.2
3.3
3.4
Topic
General Information on Programming
Software Description
Operating Procedures
Special Features and Procedures
Page
33003879 10/2017
69
General Information on Programming Section 3.1
General Information on Programming
Introduction
This section provides general information on programming a SIL3 application with regard to programming and monitoring requirements.
What Is in This Section?
This section contains the following topics:
Topic
Available Language Sections
Exceptions and Requirements for Programming
Process Safety Time
Page
70
33003879 10/2017
Available Language Sections
Introduction
For programming your SIL3 project, you are only allowed to use the following 2 programming languages:
function block diagram (FBD) ladder diagram (LD)
Both are languages defined by the IEC 61131-3 for the programming of PLCs.
Description of the Restrictions on Language
If you create a SIL3 project, the following restrictions apply:
At creation time, Unity Pro XLS restricts your choice of programming language.
At import time, Unity Pro XLS ignores any section other than FBD or LD, but does not stop the import. The use of sections other than FBD or LD generates errors.
At analyze time, Unity Pro XLS checks each section for its language. If any test fails, it creates an error and does not generate your program.
You can find a detailed description of the restrictions on program structure, language elements,
and data configuration in Exceptions and Requirements for Programming,
page 72
.
33003879 10/2017
71
Exceptions and Requirements for Programming
Introduction
To program a SIL3 project, you must use the programming languages FBD and LD only while at the same time observing the rules listed below concerning the program structure, language elements, and data configuration.
Requirements for the Program Structure
You are only allowed to program your SIL3 project in master task (MAST task) sections.
You are not allowed:
to program FAST, TIMER, INTERRUPT, and AUX tasks. In case of an import, Unity Pro XLS
ignores the objects not allowed and informs you of their existence. If you continue the import, it is done without the objects that are not allowed, which may lead to errors or it may stop if the import is not possible to use subroutines (SR sections) to schedule segments to call remote I/Os in parallel
WARNING
POSSIBLE LOSS OF THE ABILITY TO PERFORM SAFETY FUNCTIONS
Do not use conditional section execution with Unity Pro XLS.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
Requirements for Language Elements
You are only allowed to use functions and function blocks (FFBs) that are certified for use in Safety logic and described in the Unity Pro Safety Block Library.
You are allowed to create your own derived function blocks (DFBs) and store them in the safety library.
You are not allowed to use ST expressions.
In LD, you are not allowed to use:
halt coils
call coils returns operate blocks compare blocks
NOTE: Though jumps to labels are allowed in FBD and LD, Schneider Electric recommends not using them for a better structuring of your Safety logic.
72
33003879 10/2017
Requirements for Configuring Data
You are only allowed to use:
the elementary data types (EDTs) BOOL , EBOOL , BYTE , WORD , DWORD , INT , UINT , DINT ,
UDINT , FLOAT and TIME simple arrays (the index can only be a literal), for details see the chapter "Programming" in the
Unity Pro XLS Operating Mode Manual Safety PLC Specifics direct addressing, for instance, writing %MW4000 by a coil in LD located variables. All instances of variables are not only checked with regard to being located
but also as to being located in a valid memory area, see also Memory Area Description,
page 104
You are not allowed to create derived data types (DDTs).
NOTE: You are not allowed to use variables from the unrestricted memory areas in your user logic unless you may connect it to the input of S_SMOVE_BIT or S_SMOVE_WORD function blocks, see
page 104
Checks for Programming
At creation time of a SIL3 project, Unity Pro XLS offers only the features allowed for Safety logic.
Any attempt to create objects not allowed leads to an error.
However, objects not allowed can be inserted through source file import. Therefore, Unity Pro XLS checks all objects at analyze time. At any rule not obeyed or any object not allowed, Unity Pro XLS creates an error and does not generate your project.
In the project settings, Unity Pro XLS provides the following different options concerning the warnings of the language analyzer:
Variables not used
Multiple writing of variables
Parameters not assigned
Multiple use of FB instances
Overlapping of addresses
WARNING
POSSIBLE LOSS OF THE ABILITY TO PERFORM SAFETY FUNCTIONS
Switch on all warning options in the project settings and check the warnings to make sure that they are not critical and that the behavior is intended.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
33003879 10/2017
73
Requirements for Monitoring
Unity Pro XLS is the only programming software allowed to load or to modify your SIL3 project.
Other programming packages or HMIs may monitor both the state and functions of the Safety-
Related System but must not alter them. Any other device is allowed to read data from the Safety
PLC but writing to a Safety PLC is restricted, see also Memory Area Description,
page 104
74
33003879 10/2017
Process Safety Time
Description of the Process Safety Time
The process Safety time (PST) is a critical measure of each process. It is defined as the period between the occurrence of a failure in equipment under control (EUC) and the occurrence of a hazardous event if the Safety Function is not performed.
NOTE: The process Safety time is given by the process. It must be ensured that the Safety-Related
System is able to perform the Safety Functions within the process Safety time.
Description of the System Reaction Time
The system reaction time is the sum of the PLC reaction time and the time for the used sensor device (T
S
) and the time for the used actuator device (T
A
). T
S
and T
A
are device specific.
The following equation is valid:
System reaction time = PLC reaction time + T
S
+ T
A
This equation is illustrated below:
The system reaction time must be less than the process Safety time.
Description of the PLC Reaction Time
The PLC reaction time is the sum of the related time for the used input module (T
I output module (T
O
) and the CPU reaction time (T
CPU
).
) and the used
The following equation is valid:
PLC reaction time = T
CPU
+ T
I
+ T
O
33003879 10/2017
75
Description of the CPU Reaction Time
The CPU reaction time is directly impacted by the CPU cycle time which is needed to execute the
Safety logic. A signal may appear just at the beginning of the execution cycle when the signals have already been processed. Therefore, 2 cycles may be necessary to react to the signal.
This leads to the following equation:
CPU reaction time = 2 x CPU cycle time
In addition, it is possible to define a maximum number of accepted CRC faults (N
CRC
) for the communication with the I/Os. This has been introduced to reduce spurious effects (for instance by an EMC disturbance). This number can be defined to take a value between 1 and 3. This must be taken into account because the number of cycles for the output module to react is increased.
Therefore, the equation above is extended as follows:
CPU reaction time = (2 + N
CRC
) x CPU cycle time
NOTE: If you are using a peer-to-peer safe communication to perform the safety function, the CPU reaction time estimation is different
see page 120
.
Description of the Time for Input Modules
The maximum times (worst case) for the Safety digital input module and for the Safety analog input module T
I
are 45 ms (3 times the module’s cycle time).
Description of the Time for Output Modules
The maximum time T
O
for the Safety digital output module is equal to the cycle time of the module:
T
O
= 15 ms
For the Safety digital output module, a timeout T
OUT be greater than the CPU cycle time, see below.
must be configured. The module timeout must
You can find a detailed procedure for configuring the module timeout of digital output modules in the chapter "Configuring I/O Modules for Safety Projects" in the Unity Pro XLS Operating Mode
Manual Safety PLC Specifics .
Description of the Maximum CPU Cycle Time
Knowing the required PST and the maximum reaction time of the sensors and actuators, you are able to calculate the maximum PLC reaction time tolerable in your process.
To ensure that the system reaction time is smaller than the process Safety time, the maximum CPU cycle time must fulfill the following condition:
Max. CPU cycle time < (PST - T
I
- T
O
- T
S
- T
A
) / (2 + N
CRC
)
In addition, you must consider the following relation between the maximum timeout T
OUT output modules and the maximum CPU cycle time:
for the
T
OUT
> max. CPU cycle time x (1 + N
CRC
)
76
33003879 10/2017
NOTE: If you are using a peer-to-peer safe communication to perform the safety function, the
maximum CPU cycle time estimation is different (
see page 120
.
Example Calculation
The following values are given:
required PST = 1.1 s
T
I
= 45 ms
T
O
T
S
T
A
= 15 ms
= 100 ms
= 500 ms
N
CRC
= 1
The maximum CPU cycle time is calculated as follows:
Max. CPU cycle time < (1100 ms - 45 ms - 15 ms - 100 ms - 500 ms) / 3
Max. CPU cycle time < 146.7 ms
The requirement that the module timeout of the digital output module must be greater than the CPU cycle time is fulfilled:
T
OUT
> 300 ms
In case of a fault of the CPU, the outputs are set to Safe state after the timeout has expired.
Therefore, the system needs the following time to shut down the outputs:
T
OUT
+ T
O
In the example, this time amounts to
300 ms + 15 ms = 315 ms
CPU Cycle Time in a Hot Standby System
In a normally running Hot Standby system, the formula for the CPU cycle time is the same:
Max. CPU cycle time < (PST - T
I
- T
O
- T
S
- T
A
) / (2 + N
CRC
)
In addition, you must consider the following relation between the maximum timeout T
OUT output modules and the maximum CPU cycle time:
for the
T
OUT
> 4 x max. CPU cycle time (worst case)
Configuring the Maximum CPU Cycle Time
The Quantum Safety PLC can perform cyclic or periodic execution. There is no difference between the behavior of a standard Quantum PLC and a Quantum Safety PLC regarding cyclic and periodic execution. In both cases, you must configure the maximum acceptable CPU cycle time in
Unity Pro XLS.
33003879 10/2017
77
78
The maximum allowed CPU cycle time (watchdog) is configured in the properties of the MAST task. For details, see the chapter "Programming" in the the chapter "Presentation of the Master Task" in the
Reference Manual .
Unity Pro Operating Modes Manual and
Unity Pro Program Languages and Structure
NOTE: The minimum CPU cycle time is 20 ms.
NOTE: Only configure a maximum number of %M and %MW that is really needed. All configured memory ranges %M and %MW are compared as part of the double execution, which takes roughly
5.5 ms per 10,000 words. Therefore, you increase the cycle time unnecessarily if you configure more memory than needed.
You must check your CPU cycle time when commissioning your project. At this time, Unity Pro XLS provides the real time values from the PLC.
You can find this information
in the Task tab available using the menu entry Tools → PLC Screen.
in %SW30, containing the current time of the MAST task execution.
in %SW31, containing the maximum time of the MAST task execution.
in %SW32, containing the minimum time of the MAST task execution.
For details, see Description of the System Words %SW30 to %SW59,
"Description of the System Words %SW30 to %SW47" in the
page 164
or the chapter
Unity Pro Program Languages and
Structure Reference Manual . If your maximum acceptable CPU cycle time is exceeded, you must adjust your configuration or your user logic or both to reach the required value.
WARNING
RISK OF EXCEEDING THE PROCESS SAFETY TIME
Set the maximum CPU cycle time taking into account your process Safety time.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
33003879 10/2017
Software Description Section 3.2
Software Description
Introduction
This section describes the special characteristics of Unity Pro XLS developed to program SIL3 applications.
What Is in This Section?
This section contains the following topics:
Topic
Unity Pro XLS
Functions/Function Blocks for SIL3 Applications
Application Password
Page
33003879 10/2017
79
Unity Pro XLS
Introduction
To meet the requirements of the IEC 61508, only certified software is allowed for programming
SIL3 applications. For this purpose, Schneider Electric has developed the Safety version of the programming tool Unity Pro XLS (XL-Safety). It is able to perform both fault diagnostics and project protection to an extent necessary for programming a SIL3 project.
NOTE: When you create a new project with Unity Pro XLS, the choice of the Quantum PLC type determines if a SIL3 or non-Safety project is created.
SIL3 and Non-Safety Applications
Unity Pro XLS can be used to program both SIL3 and non-Safety applications. Thus, no other programming software is necessary. Only 1 version can be installed on your computer.
Your SIL3 project is stored in binary project files ( executable binary files (
Mode" in the
APX ) into a Safety CPU. For details, see the chapter "Services in Offline
Unity Pro Operating Modes Manual .
STU ) and in archive project files ( STA ). You cannot open these files with non-Safety versions of Unity Pro. Further, you can only download your
Non-Safety projects created by non-Safety Unity Pro versions must be exported using the appropriate Unity Pro version and imported into Unity Pro XLS.
Description of the Project Protection
Unity Pro XLS offers protection against unauthorized access concerning your SIL3 project and the
Quantum Safety PLC as well as Unity Pro XLS itself.
Your SIL3 project and the Quantum Safety PLC are protected by the following password mechanisms:
The SIL3 project is protected by a password at the application level, the application password.
When you create a SIL3 project, an empty password, which you can change, is set.
The Quantum Safety PLC is also protected by the application password. In case there is no application in the PLC, it accepts any password.
Connecting to a Safety PLC requires to enter the application password if the currently opened project in Unity Pro XLS is different or no project is opened.
Unity Pro XLS itself is protected by the following mechanisms:
You can define access rights or a list of functions a user is allowed to perform using the Security
Editor provided together with Unity Pro XLS (and having the same functionality as in
Unity Pro XL).
After a configured time of inactivity, Unity Pro XLS is locked automatically. Before being able to continue to work with it, you must enter the application password. While Unity Pro XLS is locked, the connection to the PLC is maintained and it stays in the current mode.
80
33003879 10/2017
Description of the Security Editor
To protect Unity Pro XLS against unauthorized access, you can use the Security Editor
to apply a policy and to create profiles and users for it.
to manage access rights to it.
For example, you can restrict the access for
creating or modifying the application password,
entering Maintenance Mode, or adapting the auto-lock timeout.
For details of using the Security Editor, see also the chapter "Access Security Managment" in the
Unity Pro Operating Modes Manual and the chapter "Security Management for Unity Pro XLS" in the Unity Pro XLS Operating Mode Manual Safety PLC Specifics .
NOTE: Use the features provided by the Security Editor to protect Unity Pro XLS against unauthorized access. However, using the Security Editor does not remove the necessity to protect your SIL3 project by using an application password.
Description of the Auto-Lock Feature
Unity Pro XLS offers the option to protect itself against unauthorized access after a configured time of inactivity. After this time is exceeded, Unity Pro XLS prompts you to enter the application password.
You can find a detailed procedure for activating the auto-lock in the chapter "Protection of a Safety
Project with Unity Pro XLS" in the Unity Pro XLS Operating Mode Manual Safety PLC Specifics .
Default Values
When you create a new SIL3 project, the following values are set by default:
The application password is empty.
The auto-lock is activated, allowing 10 minutes of inactivity before Unity Pro XLS is locked.
33003879 10/2017
81
Functions/Function Blocks for SIL3 Applications
Introduction
Schneider Electric offers you a number of elementary functions (EF) and function blocks (EFBs) that are certified for use in SIL3 applications. For details, see the Unity Pro Safety Block Library.
Remark
FFBs that are available for different data types are labeled with *** .
For example, the elementary function S_AND_*** is available for the data type
BOOL as S_AND_BOOL .
BYTE as S_AND_BYTE .
WORD as S_AND_WORD .
DWORD as S_AND_DWORD .
Description of the Safety FFBs for Mathematics
The following table lists the Safety FFBs belonging to the family of mathematic functions:
Name
S_ADD_***
S_SUB_***
S_MUL_***
S_DIV_***
S_NEG_***
S_ABS_***
S_SIGN_***
S_SMOVE_BIT
S_SMOVE_WORD
EF
EF
EF
EF
EFB
Type Used...
EF to add the input values
EF
EF to substract the input 2 from the input 1 value to multiply the input value to divide the Divident input value by the Divisor input value to negate the input values to compute the absolute value of the input value to detect negative signs to assign the input value to the output (to use data from unrestricted memory area in the Safety logic)
Description of the Safety FFBs for Comparison
The following table lists the Safety FFBs belonging to the family of comparison functions:
Name
S_EQ_***
S_GT_***
S_GE_***
S_LT_***
S_LE_***
S_NE_***
EF
EF
EF
Type Used to check the values of successive inputs...
EF for equality
EF
EF for a decreasing sequence for a decreasing sequence or equality for an increasing sequence for an increasing sequence or equality for inequality
82
33003879 10/2017
Description of the Safety FFBs for Logic
The following table lists the Safety FFBs belonging to the family of logic functions:
Name
S_AND_***
S_OR_***
S_XOR_***
S_NOT_***
S_SHL_***
S_SHR_***
S_ROL_***
S_ROR_***
S_RS
S_SR
S_F_TRIG
S_R_TRIG
EF
EFB
EFB
EFB
EFB
EF
EF
EF
EF
Type Used...
EF to perform a bit by bit AND link of the input bit sequence
EF
EF to perform a bit OR link of the input bit sequence to perform a bit XOR link of the input bit sequence to negate the input sequence bit by bit to shift a bit pattern to the left to shift a bit pattern to the right to rotate a bit pattern circularly to the left to rotate a bit pattern circularly to the right as RS memory with a dominant reset input as SR memory with a dominant set input to detect falling edges to detect rising edges
Description of the Safety FFBs for Statistics
The following table lists the Safety FFBs belonging to the family of statistical functions:
Name
S_MIN_***
S_MAX_***
S_LIMIT_***
S_MUX_***
S_SEL
Type Used...
EF to assign the smallest input value to the output
EF
EF to assign the largest input value to the output to transfer the unchanged input value to the output if it lies within the minimum and the maximum limit
EF
EF to transfer the respective input value to the output depending on the K input value for a binary selection between 2 input values
Description of the Safety FFBs for Timers and Counters
The following table lists the Safety FFBs belonging to the family of timer and counter functions:
Name
S_CTU_***
S_CTD_***
S_CTUD_***
S_TON
S_TOF
Type Used...
EFB for counting upwards
EFB
EFB for counting downwards for counting upwards and downwards
EFB
EFB as on delay timer as off delay timer
33003879 10/2017
83
Name
S_TP
Type Used...
EFB for generating a pulse with defined duration
Description of the Safety FFBs for Type Conversion
The following table lists the Safety FFBs belonging to the family of type conversion functions:
Name
S_BOOL_TO_***
S_BYTE_TO_***
S_WORD_TO_***
S_DWORD_TO_***
S_INT_TO_***
S_DINT_TO_***
S_UINT_TO_***
S_UDINT_TO_***
Type Used to convert an input value of the data type...
EF
EF
BOOL to a data type
BYTE , WORD , DWORD , INT , DINT , UINT , or UDINT
BYTE
to a
BOOL
,
WORD
,
DWORD
,
INT
,
DINT
,
UINT
, or
UDINT data type
EF
EF
WORD
to a
BOOL
,
BYTE
,
DWORD
,
INT
,
DINT
,
UINT
, or
UDINT data type
DWORD to a BOOL , BYTE , WORD , INT , DINT , UINT , or UDINT data type
EF
EF
EF
EF
INT
to a
BOOL
,
BYTE
,
WORD
,
DWORD
,
DINT
,
UINT
, or
UDINT data type
DINT to a BOOL , BYTE , WORD , DWORD , INT , UINT , or UDINT data type
UINT
to a
BOOL
,
BYTE
,
WORD
,
DWORD
,
INT
,
DINT
, or
UDINT data type
UDINT
to a
BOOL
,
BYTE
,
WORD
,
DWORD
,
INT
,
DINT
, or
UINT data type
Description of the Safety FFBs for High Availability
The following table lists the Safety FFBs belonging to the family of functions for high availability:
Name
S_DISIL2
S_AISIL2
Type Used...
EFB to select the data from the 2 digital input modules in case of a redundant input module configuration
EFB to select the data from the 2 analog input modules in case of a redundant input module configuration
Description of the Safety FFBs for Hot Standby
The following table lists the Safety FFBs belonging to the family of functions for Hot Standby:
Name
S_HSBY_SWAP
Type Used...
EFB to swap between primary and standby CPU in case of a Hot
Standby solution
84
33003879 10/2017
Details on how to use the Safety FFBs in your project are provided in the Unity Pro Safety Block
Library .
Description of the Safety DFBs for Safe Peer-to-Peer Communication
The following table lists the Safety DFBs belonging to the family of functions for Safe Peer-to-Peer communication:
Name
S_WR_ETH
S_RD_ETH
Type Used...
EFB to compute data to send on Safe Peer-to-Peer communication from the sender PLC
EFB to compute data received from Safe Peer-to-Peer communication in the receiver PLC
Details on how to use the Safety DFBs in your project are provided in the Unity Pro Safety Block
Library .
Description of the Non-Interfering FFBs for Quantum I/O
WARNING
LOSS OF ABILITY TO PERFORM SAFETY FUNCTIONS
Do not use output of the non-interfering function blocks to perform Safety functions.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
The following table lists the non-interfering FFBs belonging to the family of functions for
Quantum I/O:
Name
NI_QUANTUM
Type Used...
EFB to edit the configuration data of a Quantum main rack
NI_DROP EFB
NI_ERT_854_20 EFB to edit the configuration data of a remote I/O station to give access to the time stamp and status functions of the
140 ERT 854 20 module
Details on how to use the non-interfering FFBs in your project are provided in the Unity Pro Safety
Block Library .
33003879 10/2017
85
Application Password
Password Protection Management
In the following situations, you are requested to enter the application password:
opening an existing SIL2 or SIL3 project
modifying the application password clearing the application password connecting to the Safety PLC exceeding the configured time of inactivity and launching the auto-lock mechanism
You can find detailed procedures for managing the application password in the chapter "Project
Properties and Password for Unity Pro XLS" in the Unity Pro XLS Operating Mode Manual Safety
PLC Specifics .
NOTE: Schneider Electric strongly recommends changing the default password immediately after having selected a Quantum Safety CPU in order to protect your project against unauthorized access from the beginning. Yet, if you forget to change the default password, the empty password is kept even if you save and close your project. When re-opening it, just click OK, that is leave the edit field empty, and change the password as soon as possible.
Losing the Application Password
You can find detailed procedures for what to do in case you have lost the application password in the chapter "Loss of Password" in the Unity Pro XLS Operating Mode Manual Safety PLC
Specifics .
86
33003879 10/2017
Operating Procedures Section 3.3
Operating Procedures
Introduction
This section deals with the operating procedures of the Quantum Safety PLC with special regard to its 2 special operating modes.
What Is in This Section?
This section contains the following topics:
Topic
Operating Modes of the Safety PLC
Safety Mode
Maintenance Mode
Forcing
Page
33003879 10/2017
87
Operating Modes of the Safety PLC
Introduction
The default behavior of the Quantum Safety PLC is to perform Safety Functions to achieve and to maintain the Safe state of a process. Nevertheless, you must be able to debug and to maintain your project.
Use the Safety Mode to control your process and the Maintenance Mode for debugging and refining your project.
In Maintenance Mode, the I/O and CPU modules are still executing the diagnostics and establishing the Safe state if a fault is detected. Only the application program and the application data, which may be changed in Maintenance Mode, are not checked.
NOTE: To program a Safety PLC, Unity Pro XLS is required.
Safety and Maintenance Mode Features
The operating mode of the Quantum Safety PLC depends on events such as application exception, power on/off, and so on. The functions available in Unity Pro XLS depend on the operating mode.
Switching between the modes requires defined conditions and follows certain procedures. For details, see the chapter “Switching Between Safety and Maintenance Mode” in the Unity Pro XLS
Operating Mode Manual Safety PLC Specifics .
You can interact with the Safety PLC using:
Unity Pro XLS programming tool
Quantum Safety CPU keypad
Quantum Safety CPU key switch
Depending on the operating mode, the Safety PLC can be in different states.
After power up, it automatically enters run state of the Safety Mode if the following 2 conditions are fulfilled:
There is a valid application.
The Automatic start in Run option is activated.
In case of an invalid application, it enters the not configured (no conf) state of the Maintenance
Mode (only if the key state is unlocked), in which you are able to download your project.
If a fault is detected, the PLC enters
Halt state when running in Maintenance Mode.
Error state when running in Safety Mode.
88
33003879 10/2017
PLC States
The following figure shows the state diagram of the Quantum Safety PLC:
Operating Mode Identification
The LCD display on the CPU indicates the current operating mode by showing the letters
Maintenance Mode or S for Safety Mode.
M for
The status bar field on the PLC screen indicates the current operating mode as shown in the following figure:
33003879 10/2017
89
Safety Mode
Safety Mode Description
The Safety Mode is the default mode of the Quantum Safety PLC. It is a restricted mode in which modifications and maintenance activities are prohibited.
Safety Mode Restrictions
When the PLC is running in Safety Mode, the following restrictions are implemented by
Unity Pro XLS:
Download changes are not allowed.
Setting and forcing of Safety variables and Safety I/Os is not allowed.
Debugging with breakpoints, watch points, and single step is not allowed.
Animation tables and operator screens must not write Safety variables and Safety I/Os.
The Safety memory is write protected; that means that human-machine interfaces (HMIs) and
other PLCs cannot write to it. This is controlled by the Safety PLC, see also Memory Area
page 104
NOTE: The logic animation, animation tables, and operator screens can influence the scan time.
NOTE: It is possible to download a new version of the Ethernet processor firmware into the
Quantum Safety CPU with the OSLoader. However, it is only allowed to do that in Maintenance
Mode.
WARNING
POSSIBLE LOSS OF THE ABILITY TO PERFORM SAFETY FUNCTIONS
Do not download a new version of the Ethernet processor firmware into the Quantum Safety CPU in Safety Mode. It is possible to do so but not allowed.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
Safety Mode States
Once the Safety Mode is entered, the PLC can be in run state and in error state. In run state, all restrictions are active and the results of the double user code execution are compared. If any test is unsuccessful, the PLC goes to error state because it has no means to recover from the error.
Entering Safety Mode
There are 4 ways of entering Safety Mode:
when the Safety PLC is powered up
when the Safety Mode is entered from Maintenance Mode when the key is locked when Unity Pro XLS is disconnected either by the customer or because of a broken connection
When the Safety PLC is powered up, it automatically enters Safety Mode.
90
33003879 10/2017
NOTE: After power up and if there is a valid application, the PLC only performs cold start.
Thus, the project is reinitialized and the system performs:
the initialization of data with the initial values defined in the project the initialization of elementary function blocks (EFBs) based on initial data
the initialization of data declared in the EFBs the initialization of system bit and words
the cancellation of any forcing, see also Forcing,
page 94
Switching from Maintenance Mode to Safety Mode is only possible if the PLC is not debugging.
NOTE: Data forced before switching to Safety Mode stay forced after switching, see also Forcing,
page 94
.
Details concerning the transition from Maintenance Mode to Safety Mode can be found in the chapter "Switching Between Safety and Maintenance Mode" in the Unity Pro XLS Operating Mode
Manual Safety PLC Specifics .
Automatic Start in Run Option
You have the possibility to let your project automatically enter Safety Mode’s run state after power up. To do this, activate the option Automatic start in Run, see also the chapter "Configuration of
Quantum Processors" in the project to enter run state.
Unity Pro Operating Modes Manual . However, Schneider Electric recommends using the Run command instead of the Automatic start in Run option for a SIL3
WARNING
UNINTENDED EQUIPMENT OPERATION
Avoid using the Automatic start in Run option. If you use this feature, it is your responsibility to program and configure the system in such a way that it behaves correctly after restart.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
33003879 10/2017
91
Maintenance Mode
Maintenance Mode Description
The Maintenance Mode of the Quantum Safety PLC is a temporary mode for modifying your project and debugging and maintaining your program.
Maintenance Mode Features
This mode is available in both RUN and STOP.
The PLC allows direct transition from RUN SAFE to RUN MAINTENANCE (and RUN
MAINTENANCE to RUN SAFE.)
The Maintenance Mode (protected by a password) allow users to perform:
online modifications (programs enhancements, temporary modifications, etc.)
forcing values for sensor or actuator maintenance system installation and commissioning
When the PLC is running in Maintenance Mode, the following features are implemented by Unity
Pro XLS:
Download changes are allowed.
Setting and forcing of Safety variables and Safety I/Os is allowed. However, only variables of the type EBOOL can be forced.
Switching to Safety Mode while forcing is allowed. The forced variables stay forced, see also
page 94
Debugging with breakpoints, watch points, and single step is allowed. However, the PLC must be in run state.
Animation tables and operator screens can write Safety variables and Safety I/Os.
The Safety memory is write protected; that means that HMIs or other PLCs cannot write to it.
This is controlled by the Safety PLC, see also
page 104
.
Entering Maintenance Mode
You can only enter Maintenance Mode from Safety Mode because after power up the PLC automatically enters Safety Mode. To exit Safety Mode and enter Maintenance Mode, the key switch must be unlocked. You can find procedures for switching between the modes in the chapter
"Switching Between Safety and Maintenance Mode" in the Unity Pro XLS Operating Mode Manual
Safety PLC Specifics .
Maintenance Mode States
In Maintenance Mode, the PLC can be in run state or in halt state. When it is in run state, you can modify your project. Further, you can switch to Debug Mode if you want to debug and maintain your program. In run state, the double code execution is performed but the result of the comparison is ignored.
92
33003879 10/2017
DANGER
RISK OF LOSING THE SAFETY FUNCTION DURING COMMISSIONING AND MAINTENANCE
All modifications of the running system must follow the requirements of the IEC 61508.
Failure to follow these instructions will result in death or serious injury.
33003879 10/2017
93
Forcing
Introduction
Forcing is only possible in Maintenance Mode. However, it is possible to switch from Maintenance
Mode to Safety Mode while data are forced and the forcing stays active.
NOTE: Check the latest version of the TÜV document
Rheinland Group website http://www.tuvasi.com/ .
Maintenance Override for the procedures which must be applied when using forcing in a Safety-Related System. You can find it on the TÜV
WARNING
LOSS OF ABILITY TO PERFORM SAFETY FUNCTIONS
Make sure that the forcing is turned on only temporarily and that the user logic is supervising the status of forcing (%SW108, see
Description of the System Words %SW60 to %SW127,
page 168
).
Failure to follow these instructions can result in death, serious injury, or equipment damage.
Handling Forced Data
Because forced data stays forced, Unity Pro XLS warns you before executing your switch command from Maintenance Mode to Safety Mode and prompts you to confirm it.
NOTE: In case of a disconnection between PLC and Unity Pro XLS, the latter also warns you if there are forced data, independently of the mode the PLC is in. This is due to the fact that the PLC automatically enters Safety Mode when being disconnected from Unity Pro XLS by the user or a communication interruption.
RISK OF PROCESSING FORCED DATA
WARNING
Check the state of your data before switching from Maintenance Mode to Safety Mode. Forced data stays forced and the PLC continues processing them. Make sure that your PLC processes the correct, unforced data necessary for performing the Safety Functions.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
You can check the status of forcing by reading the system word %SW108. It contains the number of forced I/O module bits. The system word is incremented on every forcing and decremented on every unforcing.
94
33003879 10/2017
Special Features and Procedures Section 3.4
Special Features and Procedures
Introduction
This section explains the special features and procedures using Unity Pro XLS as a programming tool for SIL3 projects.
What Is in This Section?
This section contains the following topics:
Topic
Checking the Programming Environment
Starting the Quantum Safety PLC
Version Stamp
Upload
Project Backups
Detected Faults
Page
33003879 10/2017
95
Checking the Programming Environment
Introduction
Unity Pro XLS provides the possibility to perform a self-test in order to verify that the components currently in use are the correct versions originally installed and are not corrupted, for instance by hard disk corruption. The self-test is done by evaluating the CRC.
Description of the Self-Test
When performing the self-test, Unity Pro XLS checks the version and CRC of
DLLs of Unity Pro XLS,
the Safety FFB-library database, and the hardware catalog database.
WARNING
RISK OF CORRUPTED PROGRAM
Use the self-test of Unity Pro XLS on a regular basis to check the integrity of your program. At least, perform the self-test after installing any software on or removing it from your computer.
before loading the final operating program into the Safety PLC.
before modifying a program in the running Safety PLC.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
You can find details of how to start the self-test in the chapter "Unity Pro XLS Self-Test" in the Unity
Pro XLS Operating Mode Manual Safety PLC Specifics .
96
33003879 10/2017
Starting the Quantum Safety PLC
Preconditions
Preconditions to start the Quantum Safety PLC are that you have
configured your Safety-Related System correctly,
programmed your SIL3 project correctly, tested the integrity of both your SIL3 project and Unity Pro XLS, connected Unity Pro XLS to your Safety PLC, and downloaded your SIL3 project into the Safety PLC.
Starting the Quantum Safety PLC
Once the Quantum Safety PLC contains a valid project, it only performs cold start. Therefore, you can only start your SIL3 project by performing a cold start except when you have just downloaded your project into the PLC.
Hence, you can start your project out of the following 2 initial states:
The PLC is powered up and you have downloaded your SIL3 project since power up.
The PLC is powered off.
Further, Unity Pro XLS offers the Automatic start in Run option. If it is activated, your PLC automatically enters run state in Safety Mode after power up. However, Schneider Electric recommends not using this option.
WARNING
UNINTENDED EQUIPMENT OPERATION
Avoid using the Automatic start in Run option. If you use this feature, it is your responsibility to program and configure the system in such a way that it behaves correctly after restart.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
You can find detailed procedures for starting a SIL3 project in the chapter "Starting and Stopping a Safety Project" in the Unity Pro XLS Operating Mode Manual Safety PLC Specifics .
33003879 10/2017
97
Version Stamp
Version Stamp Description
In Unity Pro XLS, each generated binary file of a SIL3 project has a version stamp, providing date and time of build. Thus, you can check both if and when your project has been subject to modifications.
You can find a detailed procedure for checking the project version in the chapter "Project
Properties for Unity Pro XLS" in the Unity Pro XLS Operating Mode Manual Safety PLC Specifics .
98
33003879 10/2017
Upload
Uploading a SIL3 Project
Uploading a project from the PLC to Unity Pro XLS is also available for SIL3 projects. If you want to use this feature, it must be selected in the project settings. In a SIL3 project, the application password must be known to be able to connect to the PLC. In addition, the PLC must be switched to Maintenance Mode to perform the upload. For further details, see the chapter "Project Settings" in the Unity Pro Operating Modes Manual .
33003879 10/2017
99
Project Backups
Introduction
Unity ProXLS checks the integrity of your SIL3 project by calculating a CRC when you close it and checking the CRC when you open it again. The CRC indicates by changing its value if your project has been damaged or corrupted. In this case, the comparison indicates the values are not the same and Unity Pro XLS does not open your project. As a result, you cannot connect Unity Pro
XLS to the Safety PLC and, therefore, have no possibility of modifying or repairing your corrupt project.
Project Backup Description
Besides uploading the project from the PLC (see
can copy back your project data, that is restore them.
page 99
), the only way to get access to your project is to have a copy of its original, that is a backup of your project. From this backup, you
NOTE: Create backups of your SIL3 project on a regular basis. Once your project is damaged or corrupted, you cannot open it to modify or repair it yourself.
Advice for Creating Backups
Creating backups requires careful planning including consideration of
Backup software
Automated backup cannot be affected by human error to the extent that manual backup can.
Backup procedure
Making more than 1 copy and storing them offsite increases the possibility of a successful data recovery
Backup type.
In general, a backup can be full, incremental, or differential depending on which data it backs up.
Backup interval
Regularly scheduled backups improve the reliability of data recovery.
Backup media type
Whereas hard disk based storage is very practical, remote backups imply offsite storage.
Advice for Recovering Data
A backup is only as useful as its associated recovery strategy. Therefore, it is not only important to save the backup data but also to have access to the software required to read them.
NOTE: Choose the backup policy that is the most appropriate for your Safety-Related System.
Make the adequate amounts and types of backups. Test frequently the process for restoring the original project from the backup copies.
100
33003879 10/2017
Detected Faults
Introduction
If a fault is detected by any of the internal diagnostic measures and system tests, the behavior of the Quantum Safety PLC varies according to the mode that it is in.
Fault Behavior in Safety Mode
Running in Safety Mode, your PLC enters error state in case of a single detected fault because it has no means to recover from it. The error state is a hardware locked state. Your project is stopped and you cannot intervene or communicate with it.
Leaving the Error State
The only way to leave the error state is to start your PLC again, whereupon the PLC performs selftests and initializes your project.
If your project ...
is valid is invalid
Then your PLC...
enters stop state, which it is forced to do because of the detected fault.
enters no conf state.
NOTE: The PLC may be in an error state if the persistent detection of an error occurs. In this case, it may be necessary to replace the PLC.
Depending on the state which your PLC is in, perform the following steps:
If your project is ...
in stop state and the autorun option activated
Then ...
either power on your PLC again or perform a Run command.
in stop state and the autorun option not activated perform a Run command.
in no conf state download a backup of your project.
Fault Behavior in Maintenance Mode
Running in Maintenance Mode, your PLC enters
halt state in case of a diagnostic error.
error state in case of a hardware watchdog occurrence.
If the PLC is in halt state, you still have the possibility to communicate with it and therefore to debug your project. With the Init command or the download of a project, the PLC goes to stop state and can now be restarted. If the PLC is in error state, the behavior is the same as described above in
Fault Behavior in Safety Mode .
33003879 10/2017
101
102
33003879 10/2017
Preuzimanje
Javni link je ažuriran
Javni link do vašeg ćaskanja je ažuriran. You may view and manage your chat links after registration here.
Javni link dokumenta
Reklama