Failsafe concept - 218045 - Industry Support Siemens (2025)

Hi

I have read the documents quickly through, but I can't seem to find anything like the post from the other topic. There is nothing about how it works in general and about diversity and redundancy.

This is what fritz wrote:

"The TUV certificate is in general the "ultimate" certificate to have for it, but good on you for questioning what is really going on behind the scenes and how does Siemens "get away" with doing CAT4/SIL3 certified safetyin a single F-CPU.

The answer is in general quite simple: Through time based redundancy and diversity.

What this means is this:
You program your safety logic in F-LAD and/or F-FBD.
When youhit the compile button, the compiler takes your safety logic andinverts it as well as converts it toa WORD based logic (this gives you diversity).

When the Safety program is executed, it willbe executed twice every time its called (without you as a programmer having to "worry" about it).
First execution is done on what youprogrammed followed by an execution of the "diversified" (inverted and WORD based) logic that the compiler created for you (this is the "time based redundancy" part).

Whenboth executions are done the safety call compares the resultsand "expects" that they will be exactly opposite (and if not shut down the CPU).

This is how Siemens is able to achieve TUV certified CAT4/SIL3 rating for a single CPUand it is not only pretty "safe" but also pretty clever in my humble opinion."

Best regards

Azkaban