Safety Response Time for SLCv2

This topic contains information on the following:

• General information on the safety response time

• Technical background information

• General steps: from parameter determination to response time calculation

• Displaying and verifying the safety response time in Machine Expert – Safety

The safety response time is the time between the arrival of the sensor signal on the safety-related input module and the output of the request signal for the defined safe-state at the safety-related output module. Based on the calculated safety response time, the safety-related equipment must be planned and installed. For example, the safety response time delivers the required minimum distance of a safety-related sensor (such as a light beam) from the protected zone of operation.

The following figure illustrates the influences on the safety response time:

The safety response time (SRT) is composed by the following partial time values:

SRT = safety processing time in safety-related input module (SPTi)

      + SafeDataDuration time input path (SDDi) * (ToleratedPacketLoss + 1)

      + SafeDataDuration time output path (SDDo) * (ToleratedPacketLoss + 1)

      + safety processing time in safety-related output module (SPTo)

In short, the calculation of the SRT is as follows:

SRT = SPTi + SDDi * (TPL +1) + SDDo * (TPL +1) + SPTo

With SPT = higher value of SPTi and SPTo and SDD = SDDi = SDDo (symetrical system), the following applies:

SRT = 2 * SPT + 2* SDD * (TPL+1)

As shown in the figure, the overall response time of the safety function, i.e., the time period that elapses from the occurrence of the safety function requesting event until the machine/plant is in the defined safe-state, additionally comprises the signal processing time of the safety-related sensor as well as the time for the actuator to stop.

The parameters SafeDataDuration (SDD) and ToleratedPacketLoss (TPL) must be specified for the SLC and each safety-related module involved in the Machine Expert – Safety 'Devices' window.

According to the above formula for a symmetrical system, SDD is calculated as follows:

SDD = (SRT - 2*SPT) / (2*(TPL+1))

For verification purposes, the 'Response Time Calculator' dialog is provided in the 'Project' menu. This dialog outputs the SRT for each input-output signal path.

The signal processing time in safety-related input and output modules (SPTi and SPTo) depends on the individual modules and their set parameters (such as filter settings, etc.).

The transport time is the time that is needed to transfer data from a data producer to a consumer. The input transport time (SDDi) relates to the data transfer from a safety-related input module to the Safety Logic Controller via TM5 (except for AS-i Gateway and Drive Safety Module (DSM)) and SERCOS III bus. Accordingly, the output transport time (SDDo) is the time for transferring data from the Safety Logic Controller to a safety-related output module via SERCOS III and TM5 bus (except for AS-i Gateway and DSM).

Safety-related data communication: According to the openSAFETY specification, devices (safety-related I/O modules and drives as well as the Safety Logic Controller) communicate by sending and receiving cyclic data, referred to as openSAFETY telegrams. A telegram generating (sending) device is designated as producer, a receiving device is a consumer.

Monitoring of the safety-related data communication: Transport times of openSAFETY telegrams between producers and consumers are monitored in order to verify safety-related communication. For verification, the internal parameters calculated on the basis of SafeDataDuration and ToleratedPacketLoss are used. These parameters are defined in the Device Parameterization editor for the modules involved. They also are the basis for calculating the safety response time.

1. Calculate the value for the parameter SafeDataDuration parameter for each input and output path of the functional safety application.

   Calculation: SDD = (SRT - SPTi - SPTo) / (2* (TPL + 1))

   With SPT = higher value of SPTi and SPTo and SDD = SDDi = SDDo (symetrical system), SDD is calculated as follows:

   SDD = (SRT - 2*SPT) / (2*(TPL+1))

   The risk analysis you have performed for your functional safety application delivers the maximum allowed overall response time for your safety function and, as part of this, the safety function response time (SRT) of the signal chain.

   From the allowed SRT, deduct the processing times of the safety-related input module (Safety Processing Time Input, SPTi) and the output module (Safety Processing Time Output, SPTo).

   The result is the total maximum permissible time for the safety-related data transmission on the complete safety-related path, i.e., from the input module to the output module. As the SafeDataDuration parameter relates to only one transmission path (input module -> SLC or SLC -> output module), you must divide the value by 2 to get the required value to be entered in the parameter grid.

   A tolerated packet loss greater than zero is taken into account in the calculation formula.

   NOTE:

   Based on the SDD and TPL values you have specified for the modules involved, Machine Expert – Safety calculates internal system parameters during compilation and verifies them against known physical timing limitations.

   If system limits are reached, a compiler alert is generated, which contains suggestions for optimizing your system (e.g., by reducing filter times or the SLC cycle time or SERCOS, BC cycle times etc.).

2. For each safety-related module: Enter the calculated values in the parameter group 'SafetyResponseTime' in the 'Devices' window.

   Observe the possibility of using individual or default parameter values for the modules involved.

   • If you want to use one common SafeDataDuration and ToleratedPacketLoss value for the modules involved, fill in the 'Safety Response Time Defaults' group that belongs to the Safety Logic Controller parameters. Additionally, the 'Manual Configuration' parameter must be set to 'No' for each module which is to use (inherit) these default values from the SLC.

   • If individual parameter values are required for a module, enter the values in the 'Safety Response Time' group of each involved module. Additionally set 'Manual Configuration = Yes' for each module that is to use its own individual values.

3. Use the 'Response Time Calculator' dialog ('Project > Response time calculator' menu item) to calculate the safety response time for each selected input module, the available input channels, and the output module. Refer to the following section for details.

4. Use the results for projecting your safety function. Validate each parameter and the resulting safety response time value with regard to your risk analysis.

   Observe the following hazard message.

1. Make sure that safety response time-relevant parameters for the modules involved are specified in the 'Devices' window. These parameters are:

   • ManualConfiguration

   • SafeDataDuration

   • ToleratedPacketLoss

2. In Machine Expert – Safety, select the 'Project > Response Time Calculator' menu item.

   The 'Result' section at the bottom shows the overall worst case response time for the user-defined functional safety system.

   You can now display the safety response time for individual input-output signal paths (input module, the available channel, and the output module) as follows:

3. Select the input module for which the response time is to be calculated, and, if applicable, for the selected module, an input channel.

   The response time-relevant parameters set for the selected input module/channel are now shown in the area below. Initially, the parameter values are set to zero if no output module is selected.

4. In the right list box, select the output 'Module' for which the response time is to be calculated.

   The dialog automatically shows the calculated response time(s).

   Note that the safety-related parameter values used to determine the safety response time are only shown if an input module, an available channel, and an output module are selected.

   NOTE:

   If 'Manual Configuration = No' is set for modules, their response times only differ due to module-specific processing times as they use the same common SafeDataDuration and ToleratedPacketLoss value specified for the SLC.