HIMax Safety Manual - Tuv-fs.com

3 Safety Concept for Using the PES HIMax3.3.1 Proof Test ExecutionThe execution of the proof test depends on how the system (EUC = equipment undercontrol) is configured, its intrinsic risk potential and the standards applicable to theequipment operation and required for approval by the responsible test authority.According to IEC 61508 1-7, IEC 61511 1-3, IEC 62061 and VDI/VDE 2180 sheets 1 to 4,the operator of the safety-related systems is responsible for performing the proof tests.3.3.2 Frequency of Proof TestsThe HIMA PES can be proof tested by testing the entire safety loop.In practice, shorter proof test intervals are required for the input and output field devices(e.g., every 6 or 12 months) than for the HIMax controller. Testing the entire safety looptogether with a field device automatically includes the test of the HIMax controller. There istherefore no need to perform additional proof tests of the HIMax controller.If the proof test of the field devices does not include the HIMax controller, the HIMaxcontroller must be tested for SIL 3 at least once every 10 years. This can be achieved byrestarting the HIMax controller.3.4 Safety RequirementsThe following safety requirements must be met when using the safety-related PES of theHIMax system:3.4.1 Hardware ConfigurationPersonnel configuring the HIMax hardware must observe the following safety requirements.Product-Independent Requirements• To ensure safety-related operation, only approved fail-safe hardware modules andsoftware components may be used. The approved hardware modules and softwarecomponents are specified in theVersionsliste der Module und der Firmware der HIMax-Systeme der Firma HIMA PaulHildebrandt GmbH + Co KG (version list of modules and firmware for HIMax systemsfrom HIMA Paul Hildebrandt GmbH + Co KG). The latest versions can be found in theversion list maintained together with the test authority.• The operating requirements specified in this safety manual (see Chapter 'OperatingRequirements') about EMC, mechanical, chemical, climatic influences must beobserved.Product-Dependent Requirements• Only connect devices to the system that are safely electrically isolated from the powersupply.• The operating requirements detailed in the system manual, particularly those concerningsupply voltage and ventilation, must be observed.3.4.2 ProgrammingPersonnel developing user programs must observe the following safety requirements.Product-Independent Requirements• In safety-related applications, ensure that the safety-relevant system parameters areproperly configured.• In particular, this applies to the system configuration, maximum cycle time and safetytime.3.4.3 Requirements for Using the Programming Tool• SILworX must be used for programming.Page 20 of 70HI 801 003 D Rev.2.0