Integrating Safety and Process Environments with Modicon M580 Safety

[Michael_Chan]

Integrating Safety and Process Environments

Using a single programmable controller such as Schneider Electric’s M580 Safety controller to manage both process and safety systems can help speed up deployment, improve reliability and sustainability of operations, enhance cybersecurity and support greater productivity and transparency.

The Concept of Common Safety

Common safety ensures that both process and safety operations are separate and independent in a common engineering environment.

Architecture with standalone M580 Safety

Architecture with redundant M580 Safety

Integrated Cyber security

The Modicon M580 integrated cyber security has proven secure under both real world and simulated cyber attack. By encrypting and verifying hardware, firmware, and software systems together at every startup and during runtime, critical system integrity is maintained, secure from unauthorized modification

[S_Stolyarov]

Safety first, thank you for the information!

[PatrickV]

It would be great if the CoPro would still keep the SAFE TASK running if the main CPU fails in a standalone Safety CPU configuration.

I know we meet 1oo2 CPU architecture to achieve SIL3 but what does that mean ? If one CPU out of the 2 fails, we go to safe state😎 ? or lose control of the safety loop 😱?

If we are going to expect consultants and end users to promote common safety, we need to ensure CPU redundancy failsafe in a standalone configuration

Any thoughts on this ? 

[pmgpa]

Hi Patrick,

My understanding of the Safety CPU and Co-Processor is that they dont provide hardware redundancy for the safety process, only a logic comparison. If any differences in the logic result are detected between the two processors, the process goes to safe state. Therefore it would mean that if the CPU or CoProcessor fail, that the system goes to the safe state as there is no valid comparison.

From the M580 Safety Manual: "1oo2 (“one out of two”) architecture means that two independent channels execute the safety
process and, if an error is detected on either channel, the safety function is activated and a shutdown occurs."

Hot/Standby Safety Processors are available if hardware CPU redundancy is required.

[DanielWeber]

This is correct Paul,
the Safety CPU is based on a redundant processor architecture to allow a redundant execution of the logic.
The 1oo2 architecture and voter allow reaching the SIL3 level. In case one processor fails, no voting is possible, so the system cannot be considered Safe and the Safe task goes in Halt mode (then reaching the Safe state). The non-safe tasks stay in Run, for sure the Process "should" stop but you can still control it.

Common Safety means the PAC is able to execute both Process control and Safety independently.
Same as if you have a different PLC for Process and Safety, if one fails the system should not be fully operating.

[RoozeeR]

Problem in this is the use of the word "redundant" in "Safety CPU is based on a redundant processor architecture". The general meaning of redundant is "Unnecessary" or "Surplus" or in plain language: You do not need the second one for the first one do perform it's function.

In case of a Safety system this means that the Safe functioning of the system is maintained when the "redundant" processor fails: The Process will be stopped to the defined SAFE situation. This redundancy will increase the reliability (SIL level) of the Safety function. But for the safety system to continue functioning (without going to SAFE state), this second CPU is very necessary.

In a "normal" redundant system, like M580 HotStandby, redundancy means when one fails, the remaining CPU will continue to control the process without any change (bumpless). This will increase the Availability of the total system.

So if you want the combination of a reliable SAFE system (using this internal CPU redundancy) and high availability of the process control, including SAFE control, you need M580 Safe Hot-Standby.

When the reliability level of the SAFETY system, can be decreased (ex. from SIL3 to SIL1), this could technically be offered by a single CPU (without Copro). However this has not been implemented in M580, @DanielWeber , any comment on that?

[DanielWeber]

I think it's clear now there exists redundancy for Safety and redundancy for availability.

The M580 Safety CPU (based on 2 processors) cannot safely operate if one CPU fails. As our Safety modules (CPU and I/O) are not designed to operate in a 1oo1 mode the system goes in Halt. This is a choice we did...and it's not a plan to change.