Allen-Bradley GuardPLC 1754 User manual

Safety Reference Manual
(Catalog Numbers 1753, 1754, and 1755 )
GuardPLC Controller Systems
Allen-Bradley Parts

Important User Information
Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety Guidelines
for the Application, Installation and Maintenance of Solid State Controls (publication SGI-1.1 available from your local
Rockwell Automation sales office or online at http://literature.rockwellautomation.com) describes some important differences
between solid state equipment and hard-wired electromechanical devices. Because of this difference, and also because of the
wide variety of uses for solid state equipment, all persons responsible for applying this equipment must satisfy themselves
that each intended application of this equipment is acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the
use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability
for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is
prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Rockwell Automation, Allen-Bradley, TechConnect, GuardPLC, CompactBlock Guard I/O, ArmorBlock Guard I/O, RSNetWorx for DeviceNet, RSLogix Guard PLUS!, and RSLinx are trademarks of Rockwell
Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
WARNING Identifies information about practices or circumstances that can cause an explosion in a
hazardous environment, which may lead to personal injury or death, property damage, or
economic loss.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
ATTENTION Identifies information about practices or circumstances that can lead to personal injury or death,
property damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and
recognize the consequence
SHOCK HAZARD Labels may be on or inside the equipment, for example, a drive or motor, to alert people that
dangerous voltage may be present.
BURN HAZARD Labels may be on or inside the equipment, for example, a drive or motor, to alert people that
surfaces may reach dangerous temperatures.

3Publication 1753-RM002C-EN-P - September 2008 3
Summary of Changes
The information below summarizes the changes to this manual since
the last publication.
To help you find new and updated information in this release of the
manual, we have included change bars as shown to the right of this
paragraph.
We removed all references to 1791DS products, and updated the list of
additional resources on page 11.
Allen-Bradley Parts

4Publication 1753-RM002C-EN-P - September 2008
Summary of Changes

5Publication 1753-RM002C-EN-P - September 2008 5
Table of Contents
Preface Purpose of This Manual. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
List of Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Additional Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 1
Safety Concept for GuardPLC
Controllers and GuardPLC I/O
Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Introduction to Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Safety Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Safety Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Chapter 2
GuardPLC Central Functions
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Power Supply Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Functional Description of the Central Processing Unit. . . . . . 24
Self-test Routines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
GuardPLC Controllers and I/O Modules Error Diagnostics. . . 26
Chapter 3
GuardPLC Controller and
GuardPLC I/O Module Input
Channels
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
General Information on GuardPLC Safety Input Modules . . . 29
Safety of Sensors, Encoders, and Transmitters. . . . . . . . . . . . 29
Digital Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Analog Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Counter Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Checklist for Safety Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Chapter 4
GuardPLC Controller and
GuardPLC I/O Output Channels
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Overview of GuardPLC Output Modules . . . . . . . . . . . . . . . 42
General Safety Information On GuardPLC Safety Outputs . . . 42
Digital Outputs for Non-relay Output Modules . . . . . . . . . . . 43
Safety-related 2-pole Digital Outputs . . . . . . . . . . . . . . . . . . 45
Relay Outputs in the 1753-OW8 Module . . . . . . . . . . . . . . . 48
Analog Outputs in the 1753-IF8XOF4. . . . . . . . . . . . . . . . . . 49
Analog Outputs in the 1755-OF8 Module . . . . . . . . . . . . . . . 50
Checklist for Safety Outputs . . . . . . . . . . . . . . . . . . . . . . . . 52
Chapter 5
GuardPLC DeviceNet Safety
Scanner
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Safety Requirements for DeviceNet Safety Scanner . . . . . . . . 54
User Verification Procedure . . . . . . . . . . . . . . . . . . . . . . . . . 59
Safety Lock with Password Protection . . . . . . . . . . . . . . . . . 60
Error Reaction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Allen-Bradley Parts

6Publication 1753-RM002C-EN-P - September 2008
Table of Contents
Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Reaction Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Connection Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
DeviceNet Scanner Configuration Checklist . . . . . . . . . . . . . 63
Chapter 6
DeviceNet Safety I/O for the
GuardPLC Control System
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Typical Safety Functions of DeviceNet Safety I/O Modules . . 68
Safety Considerations for I/O Module Replacement . . . . . . 72
Safety-lock with Password Protection. . . . . . . . . . . . . . . . . . 72
Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Checklist for DeviceNet Safety I/O Modules . . . . . . . . . . . . . 74
Chapter 7
GuardPLC Controller Operating
System
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Software for GuardPLC Controllers and I/O Modules . . . . . . 75
Technical Safety for the Operating System . . . . . . . . . . . . . . 77
Operating Mode and Functions of the Operating System. . . . 77
Technical Safety for Programming . . . . . . . . . . . . . . . . . . . . 77
Parameters of the Automation System . . . . . . . . . . . . . . . . . 80
Forcing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Protection Against Manipulation . . . . . . . . . . . . . . . . . . . . . 82
Checklist for the Creation of an Application Program . . . . . . 83
Chapter 8
Technical Safety for the
Application Program
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
General Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Basis of Programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Variable Declaration and I/O Naming . . . . . . . . . . . . . . . . . 87
Functions of the Application Program . . . . . . . . . . . . . . . . . 89
Program Documentation for Safety Applications . . . . . . . . . . 95
Considerations for DeviceNet Safety Data. . . . . . . . . . . . . . . 95
Chapter 9
Configuring Communication
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Standard Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
Peer-to-peer Safety Communication via GuardPLC Ethernet . 98
High-speed Safety Protocol . . . . . . . . . . . . . . . . . . . . . . . . 102
Reaction Times for DeviceNet Safety Communication . . . . . 103

Publication 1753-RM002C-EN-P - September 2008 7
Table of Contents
Appendix A
Specifications
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Climatic Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Mechanical Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
EMC Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Power Supply Conditions . . . . . . . . . . . . . . . . . . . . . . . . . 110
Appendix B
Use in Central Fire Alarm Systems
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Index
Allen-Bradley Parts

8Publication 1753-RM002C-EN-P - September 2008
Table of Contents

9Publication 1753-RM002C-EN-P - September 2008 9
Preface
Read this preface to familiarize yourself with the rest of the manual. It
provides information concerning:
•the purpose of this manual.
•list of abbreviations.
•additional resources.
Purpose of This Manual
This manual explains how the GuardPLC Control System, including
the GuardPLC controllers and distributed I/O, DeviceNet safety
scanner, and DeviceNet safety I/O, can be used in safety applications
up to and including SIL 3 according to IEC 61508, and applications up
to and including Category (CAT) 4, according to EN954-1.
IMPORTANT You must read and understand the safety concepts and
requirements presented in this manual prior to operating a
GuardPLC controller-based safety system.
Allen-Bradley Parts

10 Publication 1753-RM002C-EN-P - September 2008
Preface
List of Abbreviations
The following table defines terms or abbreviations used in this
manual.
Term Definition
1oo2 One Out of Two Safety Architecture. Consists of 2 channels connected
in parallel, such that either channel can process the safety function.
Thus, a dangerous failure would have to occur in both channels before
a safety function failed on demand
2oo3 Two out of Three Safety Architecture. Consists of 3 channels
connected in parallel with a majority voting arrangement for the
output signals, such that the output state is not changed if only 1
channel gives a result that disagrees with the other 2 channels
CRC Cyclic Redundancy Check. A number derived from and stored or
transmitted with a block of data in order to detect corruption
EN European Norm. The official European Standard
EPROM Erasable Programmable Read-only Memory
HSP High-speed Safety Protocol
IEC International Electrotechnical Commission Standard
MAC ID Media Access Identifier. A node’s address on a network or subnet
Non-interacting Does not interfere or affect functions of the safety system
PES Programmable Electronic System
PFD Probability of Failure on Demand
PFH Probability of Failure per Hour
POU Program Organization Unit
PS Programming System
SIL Safety Integrity Level
SNN Safety Network Number
SRS System, Rack, Slot (This number is used as the System ID)
Standard Any object, task, tag, or program, that is not marked as being a safety
item
TÜV Technischer Überwachungs-Verein (Technical Inspection Association)
UNID Unique Node Identifier
WD Watchdog Time

Publication 1753-RM002C-EN-P - September 2008 11
Preface
Additional Resources
The table below provides a listing of publications that contain
important information about GuardPLC controller systems.
If you would like a manual, you can:
•download a free electronic version from the Internet at
http://literature.rockwellautomation.com.
•purchase a printed manual by contacting your local
Allen-Bradley distributor or Rockwell Automation sales office.
Resource Description
GuardPLC Controller Systems User Manual, publication 1753-UM001 Information on configuration and operation for a GuardPLC
Controller System
Using RSLogix Guard PLUS! Software with GuardPLC Controllers
Programming Manual, publication 1753-PM001 Procedural information on programming a GuardPLC Controller
System with RSLogix Guard PLUS! software
CompactBlock Safety I/O Modules on DeviceNet Series 1791DS
Installation Instructions, publication 1791DS-IN001 Information on installing CompactBlock Safety I/O modules on
DeviceNet networks
Guard I/O DeviceNet Safety Modules User Manual, publication
1791DS-UM001 Information on configuration and programming on DeviceNet
networks for ArmorBlock and CompactBlock Guard Safety I/O
Modules
GuardPLC Certified Function Blocks - Basic Suite Safety Reference
Manual, publication 1753-RM001 Information on programming with GuardPLC Certified Function
Blocks
CompactBlock Guard I/O DeviceNet Safety Modules Installation
Instructions, publication 1791DS-IN002 Information on Installing 1791DS-IB8XOBV4 modules
ArmorBlock Guard I/O DeviceNet Installation Instructions, publication
1732DS-IN001 Installing ArmorBlock Guard I/O modules on DeviceNet networks
Industrial Automation Wiring and Grounding Guidelines, publication
1770-4.1 In-depth information on grounding and wiring Allen-Bradley
programmable controllers
Application Considerations for Solid-State Controls, publication
SGI-1.1 A description of important differences between solid-state
programmable controller products and hard-wired electromechanical
devices
National Electrical Code - Published by the National Fire Protection
Association of Boston, MA. An article on wire sizes and types for grounding electrical equipment
Allen-Bradley Industrial Automation Glossary, publication AG-7.1 A glossary of industrial automation terms and abbreviations
Allen-Bradley Parts

12 Publication 1753-RM002C-EN-P - September 2008
Preface

13Publication 1753-RM002C-EN-P - September 2008 13
Chapter 1
Safety Concept for GuardPLC Controllers and
GuardPLC I/O
This chapter introduces you to the safety concept for the following
GuardPLC products.
Catalog Number Description
1753-DNSI DeviceNet Safety Scanner for GuardPLC
1753-IB16 GuardPLC 16-point Input Module
1753-IB20XOB8 GuardPLC I/O Module
1753-IB8XOB8 GuardPLC I/O Module
1753-IB16XOB8 GuardPLC I/O Module
1753-IF8XOF4 GuardPLC Analog I/O Module
1753-L28BBBM GuardPLC 1600 controller with Modbus Communications
1753-L28BBBP GuardPLC 1600 controller with Profibus-DP Communications
1753-L32BBBM-8A GuardPLC 1800 controller with Modbus Communications
1753-L32BBBP-8A GuardPLC 1800 controller with Profibus-DP Communications
1753-OB16 GuardPLC 16-point Output Module
1753-OW8 GuardPLC Relay Output Module
1754-L28BBB GuardPLC 1200 Controller
1755-A6 GuardPLC 2000 I/O Chassis
1755-L1 GuardPLC 2000 Controller
1755-HSC GuardPLC 2000 High-Speed Counter Module
1755-IB24XOB16 GuardPLC 2000 Digital I/O Module
1755-IF8 GuardPLC 2000 Analog Input Module
1755-OF8 GuardPLC 2000 Analog Output Module
1755-PB720 GuardPLC 2000 Power Supply Module
Allen-Bradley Parts

14 Publication 1753-RM002C-EN-P - September 2008
Chapter 1 Safety Concept for GuardPLC Controllers and GuardPLC I/O
Certification
Certificate No. 968/EZ164.00/04
TÜV Rheinland Group
TÜV Industrie Service GmbH
Automation, Software, and Informatinstechnologie
Safety restrictions can be found in this manual. See Safety
Requirements on page 17.
For a listing of TÜV certified product and software versions, refer to:
http://www.rockwellautomation.com/products/certification/safety/
Introduction to Safety
The Programmable Electronic System (PES) for the Allen-Bradley
GuardPLC system is safety-related, based on the 1oo2 microprocessor
structure for one central module. These controllers are safety-related
up to and including Safety Integrated Level (SIL) 3 according to IEC
61508 and category 3,4 according to EN 954-1.
Safety tests are based on the safety standards current at the time of
certification. These safety tests consist of test routines that are run
during the entire operating phase. The routines are guaranteed to the
highest degree of integrity for existing systems, making the PES
suitable for the Safety Machinery Application.
Safety State
The PES has been designed to the closed-circuit current principle,
which requires that systems be designed so that the normally closed
or on state of external sensors and actuators is the normal run
condition. The off or normally open state is the safe state. This means
that in the event of a fault or safety trip, all inputs and outputs revert
to the off (current-free/voltage-free) state.
Topic Page
Certification 14
Introduction to Safety 14
Safety Requirements 17
Safety Times 20

Publication 1753-RM002C-EN-P - September 2008 15
Safety Concept for GuardPLC Controllers and GuardPLC I/O Chapter 1
PFD and PFH Calculations
The average probability of a system to fail to satisfactorily perform its
safety function on demand is called Probability of Failure on Demand
(PFD). The probability of a system to have a dangerous failure occur
per hour is called Probability of Failure per Hour (PFH).
PFD and PFH calculations have been carried out for the GuardPLC
controllers and GuardPLC I/O system in accordance with IEC 61508.
For SIL 3, IEC 61508-1 sets the following minimum PFD and PFH
values:
PFD and PFH Values
Type SIL 3 value per IEC 61508-1
PFD 10-4…10-3
PFH 10-8 …10-7 per hour
GuardPLC Controllers
SIL-certified
Module IEC 61508 MTTF (in years) PFD PFH
GuardPLC 1200
Controllers 19.84 1.451664E-04 3.094950-E9
GuardPLC 1600
Controllers 17.69 4.158987E-05 3.926815E-09
GuardPLC 1800
Controllers 14.58 5.460105E-05 5.665043E-09
GuardPLC 2000
SIL-certified
Module IEC 61508 MTTF (in years) PFD PFH
Chassis 704.66 4.195800E-06 8.10000E-11
L1 44.03 4.884170E-05 4.36713E-09
IF8 73.12 1.746768E-05 4.14836E-09
HSC 45.33 5.993297E-05 3.28725E-09
IB24XOB16 34.28 3.710908E-05 1.09636E-09
Allen-Bradley Parts

16 Publication 1753-RM002C-EN-P - September 2008
Chapter 1 Safety Concept for GuardPLC Controllers and GuardPLC I/O
The safety functions, consisting of a safety loop (input, processor,
output, and communication between GuardPLC modules), fulfill the
above requirements in any combination. These requirements are also
met by the GuardPLC distributed I/O modules.
Safety requirements, including PFD and PFH, for the DeviceNet Safety
Scanner are in Chapter 5.
Safety requirements, including PFD and PFH, for the DeviceNet Safety
I/O are in Chapter 6.
GuardPLC I/O
SIL-Certified
Module IEC 61508 MTTF (in years) PFD PFH
1753-IB16(1)
(1) The PFD and PFH data is based on a functional verification test interval of 10 years.
45.02 3.684285E-05 2.772601E-09
1753-OB16(1) 15.22 3.625669E-05 3.902687E-09
1753-IB20XOB8(1) 20.48 5.107536E-05 4.247003E-09
1753-IB8XOB8(1) 19.02 4.603845E-05 6.581646E-09
1753-IB16XOB8(1) 12.38 6.655234E-05 6.189071E-09
1753-IF8XOF4(1) 35.01 8.575442E-05 5.159597E-09
1753-OW8(2)
(2) The PFD and PFH data is based on a functional verification test interval of 3 years.
34.16 2.240516E-05 1.730251E-09

Publication 1753-RM002C-EN-P - September 2008 17
Safety Concept for GuardPLC Controllers and GuardPLC I/O Chapter 1
Safety Requirements
The following safety requirements must be followed when using the
safety PES of the GuardPLC system.
Hardware Configuration
There are product-independent and product-dependent hardware
configurations for the GuardPLC system.
Product Independent
•Use only GuardPLC hardware and software that appear in the
GuardPLC version list available at
http://www.rockwellautomation.com/products/certification/safety/.
•Use RSNetWorx for DeviceNet software version 6.0 or later to
configure the DeviceNet safety scanner and DeviceNet safety
I/O module.
•Use RSLogix Guard PLUS! programming software, according to
IEC 61131-3, for support in the creation of safety programs for
GuardPLC controllers and GuardPLC I/O modules. Programming
software is defined in IEC 61131-1.
•Follow the specifications listed in Appendix A.
•Hardware modules and software components which are not
fail-safe, but do not cause any adverse reactions, can be used to
process standard signals. However, they cannot be used to carry
out safety tasks.
•Use the closed-circuit current principle in all external safety
circuits connected to the system.
Allen-Bradley Parts

18 Publication 1753-RM002C-EN-P - September 2008
Chapter 1 Safety Concept for GuardPLC Controllers and GuardPLC I/O
Product Dependent
Only equipment that can be safely isolated from the main power
should be connected to the system.
The safe electrical isolation of the power supply must take place in
the 24V DC power supply. Only PELV- or SELV-compliant power
supplies may be used.
See Appendix A or page 23 for details on power supply requirements.
Programming Requirements
There are product independent and product dependent programming
requirements for the GuardPLC system.
Product Independent
Verify that the safety system variables are correctly configured for
safety applications. Pay particular attention to the maximum cycle
time and the safety time.
Product Dependent
•You must use RSLogix Guard PLUS! software to program the
GuardPLC controller.
•You must follow the guidelines listed on page 78 for initial
startup or after a modification to the application program.
•You must perform a complete check of program logic to verify
that logic correctly and fully addresses the functional and safety
requirements in your application specification.
•You must re-check the application as described above each time
you make a modification.
•When a fault occurs in the fail-safe input and output modules,
the error response of the system must be determined by the
application program according to site-specific safety criteria.
ATTENTION Limit the use of standard devices in your GuardPLC application
to standard critical components. If you choose to use standard
devices in a safety critical fashion, you must ensure that the
system design meets SIL 3 requirements.

Publication 1753-RM002C-EN-P - September 2008 19
Safety Concept for GuardPLC Controllers and GuardPLC I/O Chapter 1
Communication
•The total response time of the system must not exceed the fault
tolerance time when safety communication occurs between
devices.
•Safety data cannot be transferred over public networks (for
example, the Internet).
•if the data is transferred across company/factory networks, verify
that sufficient protection is provided against manipulation. For
example, use a firewall or router to separate the standard or
safety I/O subnets from office subnets in your environment.
Refer to Safety Concept of RSLogix Guard PLUS! Software on
page 77 for more information.
•Equipment connected to communication devices should feature
safe electrical isolation.
•Your application should monitor the status bits associated with
safety network connections. Since connections often recover
automatically, make sure this occurrence does not result in an
unsafe machine state. Your application should drive safety
outputs to their safe state when the connection faults or goes
idle. Safety outputs remain in the safe state until a manual reset
occurs. This prevents unexpected output transitions from low to
high when a connection recovers from a faulted or idle state.
Maintenance Override
When using Maintenance Override, follow the requirements of the
most recent version of the Maintenance Override document from the
TÜV Homepage: http://www.tuv-fs.com (TÜV Rheinland).
If necessary, the operator must consult the acceptance department
responsible for the application to determine the administrative
requirements to provide access protection for the system.
Allen-Bradley Parts

20 Publication 1753-RM002C-EN-P - September 2008
Chapter 1 Safety Concept for GuardPLC Controllers and GuardPLC I/O
Safety Times
Individual errors that may lead to a dangerous operating condition are
detected by the self-tests and trigger defined error reactions which
transfer the faulty modules into the Safety state within the safety time
of the PES. The following sections describe self-test safety times.
Fault Tolerance Time (FTT)
See DIN VDE 0801 Appendix A1 2.5.3
The fault tolerance time is an attribute of the process and describes
the time span in which faulty signals can be tolerated in the process
without a dangerous condition occurring. If the fault condition lasts
longer than the FTT, the faulty signals can create a dangerous
condition.
Safety Time (of the PES)
The safety time is the time within which the PES (while in RUN mode)
must react after an internal error has occurred.
Seen from the process side, the safety time is the maximum amount of
time in which the safety system must react (reaction time) to a change
in the input signals or module or component failure.
Multiple Error Occurrence Time (MOT)
The occurrence time for multiple faults is the period of time in which
the probability for the occurrence of multiple faults, which in
combination are critical to safety, is sufficiently low.
The multiple fault occurrence time is defined at 24 hours in the
operating system.