Welcome to the new Schneider Electric Community

It's your place to connect with experts and peers, get continuous support, and share knowledge.

  • Explore the new navigation for even easier access to your community.
  • Bookmark and use our new, easy-to-remember address (community.se.com).
  • Get ready for more content and an improved experience.

Contact SchneiderCommunity.Support@se.com if you have any questions.

Close
Invite a Co-worker
Send a co-worker an invite to the Exchange portal.Just enter their email address and we’ll connect them to register. After joining, they will belong to the same company.
Send Invite Cancel
84455members
353661posts

Integrating Safety and Process Environments with Modicon M580 Safety

Modicon PAC Forum

A forum for topics related to the scope of Modicon PAC offers and ecosystem along the whole lifecycle: Modicon M580 and 340, EcoStruxure Control Expert, EcoStruxure Process Expert (Unity Pro) and more.

Michael_Chan
Lt. Commander Lt. Commander
Lt. Commander
6
2561

Integrating Safety and Process Environments with Modicon M580 Safety

Integrating Safety and Process Environments

Using a single programmable controller such as Schneider Electric’s M580 Safety controller to manage both process and safety systems can help speed up deployment, improve reliability and sustainability of operations, enhance cybersecurity and support greater productivity and transparency.

 

The Concept of Common Safety

Common safety ensures that both process and safety operations are separate and independent in a common engineering environment.

2020-10-01_16h23_03.png

 

Architecture with standalone M580 Safety

2020-10-01_16h25_08.png

 

Architecture with redundant M580 Safety

HSBY.png

Integrated Cyber security

The Modicon M580 integrated cyber security has proven secure under both real world and simulated cyber attack. By encrypting and verifying hardware, firmware, and software systems together at every startup and during runtime, critical system integrity is maintained, secure from unauthorized modification

 

Michael Chan Kum Yuen
Attachments
Tags (1)
6 Replies 6
S_Stolyarov
Lieutenant JG
Lieutenant JG

Re: Integrating Safety and Process Environments with Modicon M580 Safety

Safety first, thank you for the information!

Tags (1)
PatrickV
Crewman Crewman
Crewman
0 Likes
4
2262

Re: Integrating Safety and Process Environments with Modicon M580 Safety

It would be great if the CoPro would still keep the SAFE TASK running if the main CPU fails in a standalone Safety CPU configuration.

 

I know we meet 1oo2 CPU architecture to achieve SIL3 but what does that mean ? If one CPU out of the 2 fails, we go to safe state😎 ? or lose control of the safety loop 😱?

 

If we are going to expect consultants and end users to promote common safety, we need to ensure CPU redundancy failsafe in a standalone configuration

 

Any thoughts on this ? 

 

 

 

 

 

 

Patrick Vaz
Tags (1)
pmgpa
Cadet
3
2251

Re: Integrating Safety and Process Environments with Modicon M580 Safety

Hi Patrick,

 

My understanding of the Safety CPU and Co-Processor is that they dont provide hardware redundancy for the safety process, only a logic comparison. If any differences in the logic result are detected between the two processors, the process goes to safe state. Therefore it would mean that if the CPU or CoProcessor fail, that the system goes to the safe state as there is no valid comparison.

 

From the M580 Safety Manual: "1oo2 (“one out of two”) architecture means that two independent channels execute the safety
process and, if an error is detected on either channel, the safety function is activated and a shutdown occurs."

 

Hot/Standby Safety Processors are available if hardware CPU redundancy is required.

Tags (1)
DanielWeber
Ensign Ensign
Ensign
0 Likes
2
2242

Re: Integrating Safety and Process Environments with Modicon M580 Safety

This is correct Paul,
the Safety CPU is based on a redundant processor architecture to allow a redundant execution of the logic.
The 1oo2 architecture and voter allow reaching the SIL3 level. In case one processor fails, no voting is possible, so the system cannot be considered Safe and the Safe task goes in Halt mode (then reaching the Safe state). The non-safe tasks stay in Run, for sure the Process "should" stop but you can still control it.

Common Safety means the PAC is able to execute both Process control and Safety independently.
Same as if you have a different PLC for Process and Safety, if one fails the system should not be fully operating.

Tags (1)
RoozeeR
Lt. Commander Lt. Commander
Lt. Commander
0 Likes
1
2235

Re: Integrating Safety and Process Environments with Modicon M580 Safety

Problem in this is the use of the word "redundant" in "Safety CPU is based on a redundant processor architecture". The general meaning of redundant is "Unnecessary" or "Surplus" or in plain language: You do not need the second one for the first one do perform it's function.

In case of a Safety system this means that the Safe functioning of the system is maintained when the "redundant" processor fails: The Process will be stopped to the defined SAFE situation. This redundancy will increase the reliability (SIL level) of the Safety function. But for the safety system to continue functioning (without going to SAFE state), this second CPU is very necessary.

 

In a "normal" redundant system, like M580 HotStandby, redundancy means when one fails, the remaining CPU will continue to control the process without any change (bumpless). This will increase the Availability of the total system.

 

So if you want the combination of a reliable SAFE system (using this internal CPU redundancy) and high availability of the process control, including SAFE control, you need M580 Safe Hot-Standby.

 

When the reliability level of the SAFETY system, can be decreased (ex. from SIL3 to SIL1), this could technically be offered by a single CPU (without Copro). However this has not been implemented in M580, @DanielWeber , any comment on that?

R.Roozee
Sr Solution Architect (SAE Master)
Tags (1)
DanielWeber
Ensign Ensign
Ensign
0 Likes
0
2230

Re: Integrating Safety and Process Environments with Modicon M580 Safety

I think it's clear now there exists redundancy for Safety and redundancy for availability.

The M580 Safety CPU (based on 2 processors) cannot safely operate if one CPU fails. As our Safety modules (CPU and I/O) are not designed to operate in a 1oo1 mode the system goes in Halt. This is a choice we did...and it's not a plan to change.

 

Tags (1)