dl-breadcrumbs__homedl-breadcrumb-item__separatorAC500-S safety PLCdl-breadcrumb-item__separator...dl-breadcrumb-item__separatorSafety user manual V1.3.2dl-breadcrumb-item__separatorChecklists for AC500-S commissioningdl-breadcrumb-item__separatorChecklist for operation, maintenance and repair
dl-pagination__prev-inactivedl-pagination__prev-activedl-pagination__next-inactivedl-pagination__next-active
Checklist for operation, maintenance and repair

This is the web edition of the original ‎⮫ AC500-S safety user manual, version 1.3.2. This web edition is provided for quick reference only. The original safety user manual must be used to meet functional safety application requirements.

No.

Item to check

Fulfilled (yes / no)?

Comment

1.

Make sure that all safety modules are properly placed on their positions at the terminal base for safety CPU or terminal units for safety I/Os and stable contact between terminals and safety modules is assured.

2

Check that proper temperature monitoring measures (e.g., temperature sensors could be placed in the switchgear cabinet and connected to AI581-S safety analog input channels) are implemented in the switchgear cabinet where AC500-S safety modules are placed, if the operating temperature range for AC500-S safety PLC cannot be guaranteed.

Note:

Safety digital outputs of DX581-S module have internal built-in overtemperature protection and always deliver fail-safe "0" values in case of overtemperature.

3.

Make sure that the following rule, as defined by PROFIsafe standard (refer to ‎⮫ www.profisafe.net for more details), was considered in the safety application analysis:

  • A maximum of 10 communication links (i.e., PROFIsafe connections from the given safety input to the given safety output) per safety function is permitted for an average probability of a dangerous failure of 10-9/h (SIL 3). In case of more than 10 communication links per safety function, the probability of a dangerous failure increases by 10-10/h per additional communication link. Correspondingly, a maximum of 100 communication links is permitted in case of SIL 2.

4.

Make sure that all network devices used in conjunction with AC500-S safety PLC meet the requirements of IEC 61010 or IEC 61131-2 (e.g., PELV). Single port routers are not permitted as borders for a safety island.

Refer to⮫ [2] for further details.

5

Before any deployment of a safety application with PROFIsafe, especially those using wireless components, an assessment for dangerous threats such as eavesdropping or data manipulation shall be executed (refer to⮫ [11] for more details). Check that adequate level of security defining security zones with security gates was established.

In case of no threat, no security measures are necessary.

Note:

There are two possible threats identified so far mainly for applications with wireless components⮫ [2]:

  • Willful changes of parameters of F-Devices and safety programs.

  • Attacks on the cyclic communication, e.g., simulation of the safety communication.

6.

The complete functional testing of all parts of the safety application has to be performed. This test must be carried out with the machine in its final configuration including mechanical, electrical and electronic components, sensors, actuators, and software.

7.

Verify that clear operation, maintenance and repair procedures (organization, responsibility, spare parts, project data backup, etc.) for safety application are defined.

Note:

  • Restart of the corresponding safety control loop is only permitted, if there is no hazardous process state, and after an operator acknowledgment (OA_C).

    Refer to⮫ [2] for further details.

8.

Verify that proper electrical contact is available between safety I/O modules (AI581-S, DI581-S and DX581-S) and TU582-S terminal units. Follow the assembly instructions for safety I/O modules⮫ “Assembly of DI581-S”⮫ “Assembly of DX581-S”⮫ “Assembly of AI581-S”.

9.

Ensure that average operating temperature for used safety modules (AC500-S and AC500-S-XC) does not exceed +40 °C (e.g., temperature sensors could be placed in the switchgear cabinet and connected to AI581-S safety analog input channels for temperature monitoring).

10.

Verify that no automatic reboot of non-safety CPU is programmed in non-safety program. The automatic reboot of non-safety CPU would lead to automatic restart of the safety CPU, which is directly attached to non-safety CPU. Such automatic restart of the safety CPU may not be accepted in some safety applications.

Reviewer(s):

Machine/Application <ID>:

Signature:

Date: