Using a General Purpose (Hot-Standby) PLC in Safety

摘要

For the lower Safety Integrity Levels, SIL1 and SIL2, as defined by the functional safety standards ANSI/ISA 84.01 [1], IEC 61508 [2], and process industry specific draft EEC 61511 [3], many end-users/operating companies tend to focus on the use of a General Purpose PLC instead of a Safety PLC as the logic solver in their Safety Instrumented Functions. In order to improve the reliability of the General Purpose PLC, the use of a Hot-Standby PLC is often suggested. This paper will describe the advantages and disadvantages of a Hot-Standby General Purpose PLC when compared to a General Purpose PLC, simplex Safety PLC, and ultimately a fully redundant Safety PLC. The difference in system behavior for a General Purpose PLC, a Hot-Standby PLC, and the simplex or fully redundant Safety PLC will be described using Markov models derived for each of the logic solver configurations. Using these models the performance parameters, PFDavg and MTTFS, for the configurations will be calculated. An important aspect why end-users/operating companies are more favorable of the General Purpose Hot-Standby PLC compared to a fully redundant Safety PLC is the perceived cost of ownership. However, especially when considering applications that need to achieve SIL2, extra validation steps need to be taken to ensure the suitability of the logic solver for that Safety Integrity Level. The Safety PLC manufacturer has performed these additional validation steps, whereas the General Purpose PLC manufacturer has not. This means that the extra validation steps need to be performed by the end-user/operating companies which will drastically influence the cost of ownership. The cost benefits of each of the logic solver configurations will also be discussed in this paper.