Commissioning a palletiser cell, the customer's risk assessment says PLr d on the guard door, and I built the SISTEMA file the way the drawings show: a Siemens 3SE5 mechanical interlock with two NC contacts, both channels into an ET 200SP F-DI with cross monitoring on, CPU 1512SP F-1 PN running the logic with blocks from the Siemens library, and two 3RT2 contactors in series switched from an F-DQ.
SISTEMA keeps coming back PL c. Category shows 3, MTTFd high, and it's still c.
I tried swapping the switch for one with better B10d numbers, still c. Thought about a second safety relay in front of the contactors, but that felt like guessing so I stopped.
Not sure if its the switch subsystem, or something in how I entered the F-CPU, or neither. Could someone explain what's holding it at c when the category comes out 3 and MTTFd is high?
What DC did you enter for the output subsystem, and how are the contactors monitored? Is there a feedback loop from the contactors back into an F-DI, or do they just switch?
DC for the output subsystem I set to none, because there is no feedback wired. The contactors just switch. The switch subsystem is at DC99 with the cross monitoring. So the contactors are the problem, I guess?
That's your c. Category 3 wants diagnostics on the channels, and an unmonitored contactor pair has none, which is the DC none you entered yourself, against DC99 on the switch side. Your overall PL is the worst subsystem in the chain and that is the output one. The switch was never the problem, neither was MTTFd. The SISTEMA help has a chapter on DC for output elements, that is where the entry you want sits.
Exactly. The fix is EDM, feedback from the contactors. The NC auxiliary blocks for a 3RT2 come as mirror contacts, check the type on the ones actually fitted, then wire both in series into a spare F-DI channel. In the safety program use FDBACK from the safety library on that output, feedback time set to something the contactor datasheet supports. Then in SISTEMA enter DC for the output subsystem as direct monitoring via mirror contacts, and take the DC figure from the standard's table, not from me.
Do it in that order. The SISTEMA file has to describe the panel that exists.
Added the feedback loop in SISTEMA with the DC from the table for direct monitoring. PL d, before touching a wire. Two spare F-DI channels on the station, so it is only wiring and one block in the safety program.
Good. Now wire it and put FDBACK in, otherwise the SISTEMA file describes a machine that doesn't exist. Longer version of the category and PL side here: https://plctr.com/introduction-to-functional-safety-in-plc-programming/
Wired the two NC mirrors in series into F-DI channel 5, FDBACK on the contactor output with a feedback time from the 3RT2 datasheet, new collective signature, and with the motor circuit isolated we held one contactor in to prove the loop, which passivated the output as it should. SISTEMA at PL d and the customer's safety person accepted the file.
Never the switch, never the CPU. The contactors had no feedback at all, that subsystem had no diagnostic coverage, and it was the one holding the whole function at c.
The customer's file for a sister machine has DC99 on the outputs with nothing wired. Somebody copied it across. Not my machine, but I said something. Thanks larsdk and hkraus.
Seen a lot of SISTEMA files for machines that were never built.