Retrofit press: SIL 2 claim from an FSoE light curtain
A retrofit of a 40-ton hydraulic press adds a Type 4 light curtain on the operator side. The risk assessment, done to IEC 62061, assigns the guarding function SIL 2 because the press has a 250 ms stopping performance and access is frequent. The chosen light curtain has an integrated FSoE slave. Its data sheet gives PFHd = 2.5 × 10^-7 per hour, DC = 90 %, MTTFd = 30 years, and a proof-test interval of 10 years. The safety PLC master claims PFHd = 1.0 × 10^-8 per hour. The machine builder already has an ISO 13849 PL d, Category 3 design from the previous guard. The end user asks whether the FSoE guard can be signed off as SIL 2 without further calculation, and whether the 10-year proof test can be kept. The FSoE watchdog is set to 150 ms and the press cycle is 1.2 s.
1. Can the SIL 2 claim be accepted from the PFHd figure alone? Explain the checks you would require before sign-off.
Read the worked answer
No. The PFHd of 2.5 × 10^-7 per hour lies inside the SIL 2 range, but that only shows the numerical failure-rate budget for one subsystem. Before sign-off I would require the complete safety function to be verified: light curtain, FSoE slave, FSoE master, PLC logic, and the final contactors or valves. The FSoE black-channel residual error must be included, not treated as zero. I would also check the architectural constraints: hardware fault tolerance, safe failure fraction, DC, and common-cause measures. A PL d, Category 3 design under ISO 13849 does not automatically become SIL 2 under IEC 62061; the claim must be verified against the standard used in the risk assessment. Systematic capability evidence is also needed for the safety stack and configuration tools. Finally, the proof-test interval must be justified by the diagnostics and the demand mode. If the press is high-demand, PFHd is appropriate, but the proof test still needs to cover undetected failures in the guard and output path.
2. How should the 150 ms FSoE watchdog and the 10-year proof-test interval be assessed against the 250 ms stopping performance?
Read the worked answer
The watchdog is a detection limit, not the whole reaction time. I would build a timing budget from guard actuation through input sampling, FSoE cycle and watchdog expiry, PLC scan, output reaction, and valve or contactor drop-out. A 150 ms watchdog leaves only 100 ms for everything else if the 250 ms stopping performance is the limit. That may be too tight, especially if the watchdog expires only after several missed frames. The FSoE watchdog should be longer than normal jitter and frame loss but short enough that the total stop still occurs before access is possible. For the 10-year proof test, I would check whether the PFHd calculation assumed periodic proof testing or relied on diagnostics. High diagnostic coverage can justify a long interval, but the proof test must still detect failures that diagnostics cannot, such as welded contacts or loss of redundancy. I would not keep the 10-year interval without a documented justification and a test procedure.
3. What documentation would you require to close the verification and validation?
Read the worked answer
I would require a SIL verification report covering the entire safety function, not only the light curtain. It should show the PFHd or PFDavg calculation, the FSoE residual-error assumption, DC, common-cause measures, and architectural constraints. The FSoE configuration record should identify the FSoE address, watchdog time, safe input and output mapping, and the master and slave firmware versions. Validation evidence should include a stop-time measurement at the worst-case operating condition and a test that opens the guard, injects an FSoE communication loss, and confirms the fail-safe reaction. I would also require the proof-test procedure, the systematic capability evidence for the safety stack, and a configuration checksum or signature. Finally, the documentation should state which standard was used for the SIL claim and why the previous PL d design is or is not relevant. Without those records, the PFHd figure alone is not a closed verification.