Description of the Process Safety Time

The process safety time (PST) is an essential measure of a process executed by a safety loop. It is defined as the period between the occurrence of a failure in equipment under control (EUC) and the occurrence of a hazardous event if the safety function is not performed (i.e. if the safe state is not achieved).

Description of the System Reaction Time

The system reaction time is the sum of the PAC reaction time, plus the reaction times for both the selected sensor (T_S) and the selected actuator (T_A).

For each safety loop, verify that the system reaction time is less than the process safety time.

System reaction time is illustrated below:

The components of the system reaction time can include the following:

Description of the PAC Reaction Time

For I/O placed in the local main rack (with the CPU) the PAC reaction time is the sum of the related reaction times for both the selected input module (T_I) and the selected output module (T_O), plus the CPU & Copro reaction time (T_CPU):

PAC reaction time (local) = T_CPU + T_I + T_O

If the I/O are located in a remote rack, the PAC reaction time also includes input communication delay (T_{COMM_IN}) and output communication delay (T_{COMM_OUT}) times:

PAC reaction time (remote) = T_CPU + T_{COMM_IN} + T_I + T_{COMM_OUT} +T_O

Description of the CPU & Copro Reaction Time

The CPU & Copro reaction time is directly impacted by both the SAFE task period and the FAST task period. Verify that safety logic will be executed within the SAFE task period.

Because a signal may appear just at the beginning of the execution cycle when the signals have already been processed, two SAFE task cycles may be necessary to react to the signal.

Because the FAST task takes priority over the SAFE task, you also need to consider the time to execute the FAST task when estimating jitter.

This leads to the following equation for the maximum (i.e. worst case) reaction time:

CPU & Copro reaction time = 2 x T_SAFE + T_FAST

Description of the Time for Input Modules

The maximum times (worst case) for the safety digital input module and for the safety analog input module T_I are 6 ms.

Description of the Time for Output Modules

The maximum time T_O for the safety digital output module is estimated to be 6 ms.

A fallback safety timeout S_TO needs to be configured for both the digital output module and the digital relay output module. Depending on the configured SAFE task period (T_SAFE), the value for S_TO needs to be configured as follows:

• If (2.5 * T_SAFE) ≤ 40 ms, set S_TO to a minimum of 40 ms.

• If (2.5 * T_SAFE) > 40 ms, set S_TO to a minimum of (2.5 * T_SAFE) ms.

For Hot Standby applications, consider the impact on the fallback safety timeout (S_TO) parameter of additional time (T_SWAP) required by a swap, and of additional time T_SWITCH required by a switchover.

Computation of System Reaction Time

Knowing the required process safety time (PST) and the maximum reaction time of the sensors and actuators, you are able to calculate the maximum system reaction time (SRT) tolerable in your process.

The maximum (i.e. worst case) system reaction time can be computed as follows:

For systems with I/O in remote drops:

Max SRT = T_S + T_I + 2 x T_CRA + T_RPI + 2 x T_SAFE + T_FAST + T_O +T_A.

or

Max SRT = 16 ms + T_S + 2.5 x T_SAFE + T_FAST + T_A.

For systems with local I/O:

Max SRT = T_S + T_I + 2.5 x T_SAFE + T_FAST + T_O +T_A.

or

Max SRT = 15 ms + T_S + 2.5 x T_SAFE + T_FAST + T_A.

• While an unexpected event and a switchover occurs, maximum safety reaction time could increase by adding the component T_SWITCH to the above calculations.

• While the system operator performs a swap, maximum safety reaction time could increase with an additional component T_SWAP to the above calculations.

System Reaction Time During a Swap

A swap is the operator-initiated action on a Hot Standby system, which causes the primary and standby PACs to exchange roles. A swap consumes additional time, because during the swap no information may be lost and all system outputs need to be safely timed out.

The added swap time component is added to the T_CPU time following the normal T_JITTER component, as shown below:

The T_SWAP time component is added to the T_CPU time following the normal T_JITTER component. This sequence is displayed below. Except for the inclusion of the swap component, the system reaction time description is the same as described above:

The T_SWAP time component is the sum of the following:

T_{ADDITIONAL_JITTER} + T_TRANSFER

The swap-specific components are described as follows:

T_TRANSFER can be calculated as follows:

K3 x (MAST_KB + 2 x SAFE_KB + FAST_KB) + K4 x (MAST_DFB + 2 x SAFE_DFB + FAST_DFB) / 1000

Where:

• TASK_KB = Size of the data (in Kbytes) exchanged for the TASK between the primary PAC and standby PAC.

• MAST_DFB = The number of DFBs declared in the TASK.

• K3 and K4 are constants with values determined by the specific CPU module used in the application, as follows:

If the system operator wants to perform a swap without safety module outputs going into their fallback state, set the fallback safety timeout parameter of the safety output modules (S_TO) to, at least, a value greater than: T_{MULTITASK_JITTER} + T_SWAP + T_SAFE.

System Reaction Time During a Switchover

A switchover occurs when the standby PAC in a Hot Standby system becomes the primary PAC in response to an unexpected event, for example, when hardware in the primary PAC suddenly becomes non-operational. The goal of the switchover is for the new primary PAC to seamlessly replace the old one, and begin operations at the point where the old primary PAC ceased to function. Nevertheless, the last cycle may be re-executed. The system target is to achieve the fastest possible recovery.

The T_SWITCH time component is added to the T_CPU time following the normal T_JITTER component. This sequence is displayed below. Except for the inclusion of the switchover component, the system reaction time description is the same as described above:

The T_SWITCH time component is the sum of the following:

T_DETECT + T_{ADDITIONAL_JITTER}

The switchover-specific components are described as follows

Unlike a swap, no additional time is needed to perform a data transfer.

To allow the system to respond to an unexpected event and perform a switchover without safety module outputs going into their fallback state, set the fallback safety timeout parameter of the safety output modules (S_TO) to, at least, a value greater than: T_JITTER + T_SWITCH + T_SAFE.

Configuring the Maximum CPU SAFE and FAST task Periods

The M580 safety PAC can perform only periodic execution for the SAFE and FAST tasks (cyclic execution is not supported for these tasks).

The SAFE task Period and the maximum allowed CPU Watchdog settings are configured in the General tab of the Properties of SAFE dialog. The safety digital output Fallback Timeout settings are configured in the Configuration tab for the output module.

Similarly, the FAST task Period and the maximum allowed CPU Watchdog settings are configured in the General tab of the Properties of FAST dialog.

Verify that the watchdog setting is greater than the SAFE task period.

Check your CPU SAFE task period setting when commissioning your project. At this time, Control Expert Safety provides the real time values from the PAC.

You can find this information in Control Expert Safety in the Task tab using the menu entry Tools > PLC Screen.

The following drawing illustrates the execution of each task in a multi-task system, and depicts the preemption of CPU resources depending on the task priority:

Calculating the Impact of Task Execution Periods on CPU Bandwidth

Each configured task consumes a portion of CPU processing time, or bandwidth. The estimated percentage of CPU bandwidth consumed by a task is the result (or quotient) of the estimated execution time required by a task (E_TASK) divided by the configured execution period for that task (T_TASK), and can be presented as follows:

Task bandwidth = E_TASK / T_TASK.

Thus, the total percentage of CPU bandwidth consumed by an application is the sum of consumed CPU bandwidth percentages for all tasks.

The following table presents two applications, and indicates the impact of high priority tasks (FAST and SAFE) on total CPU bandwidth usage: