learn · South Africa
Safety PLC Introduction: SIL, Reset and Response Time
Safety PLC introduction covering SIL, reset versus restart, response-time examples and proof-testing questions for South African PLC training and courses.
A safety PLC introduction should begin with the function that must reduce risk, not the colour of a controller or a SIL number on its brochure. A safety controller can be one element of that function. Selecting it does not, by itself, establish the performance of the connected sensors, application logic, outputs, final elements or installation.
This guide explains the questions a South African learner should take into functional-safety training. It includes a fictional response-time worksheet and a virtual indicator exercise for distinguishing reset from restart. Neither is a protective circuit, a validated safety program or evidence that a machine achieves a Safety Integrity Level. Start with PLC training in South Africa if you still need the general programming foundation.
Define the safety function before choosing hardware
Write down the initiating condition, the required response, the equipment boundary and the conditions under which the response must work. “Install a safety PLC” is a purchasing instruction. It leaves unanswered what the system must detect, what state it must achieve and how quickly that state must be reached.
For a learning assignment, use a requirements worksheet with separate fields for the hazard, trigger, required state, maximum response time, operating modes, reset conditions and verification evidence. Leave unknown engineering values explicitly unresolved. A blank marked “requires assessment” is more honest than an invented stopping time copied from an unrelated machine.
Draw the complete chain on paper. Identify the detecting device, input interface, communications where applicable, logic, output interface and final element. Then add any utilities required for the response. A controller command is an intermediate event; it is not proof that a physical mechanism has reached the required condition.
The HSE technical discussion of control systems explains that the safety-related boundary includes all elements needed to perform the function, including utilities. It also distinguishes timely performance from availability when required. This is a UK technical reference, not a statement of South African legal adoption or an installation approval.
Keep ordinary control and risk reduction distinguishable
A production sequence might request motion when a container arrives. A protective function has its own defined purpose and evidence requirements. Showing that the production program responds correctly to a Boolean input does not establish the behaviour of the complete protective path under relevant faults.
For your worksheet, draw a boundary around each claim. “The simulated lamp turns off when Permit becomes false” is a testable software observation. “The machine stops safely” requires evidence outside that observation. This distinction makes training reports clearer without requiring a beginner to calculate the integrity of a real installation.
SIL, PL and the standards questions to ask
Different applications lead to different standards and assessment methods. The IEC 62061 consolidated publication, including amendments from 2024 and 2026, concerns the design, integration and validation of safety-related control systems for machinery. Record the edition used by a course or project instead of treating every document with the same standard number as interchangeable.
For machinery courses, also ask how the provider treats ISO 13849-1 and Performance Level terminology. For process safety, ask whether the syllabus addresses safety instrumented functions and the IEC 61511 lifecycle. Do not translate “SIL course” into “covers every machinery and process application.” A course should identify its scope and the assessment method it teaches.
A useful reading habit is to separate three questions: what integrity is required, what the design can achieve under its stated assumptions, and how that achievement is demonstrated throughout use. A component certificate answers only the questions within that component's certificate and associated conditions. It cannot replace application assessment.
Do not choose SIL from machine size or injury labels
A small conveyor is not automatically SIL 2, and a large press is not automatically SIL 3. Such labels conceal the hazard assessment, exposure assumptions, other protective measures and allocation of risk reduction. A training exercise should supply a defined assessment case before asking learners to defend a target.
Similarly, two input channels do not automatically prove a particular achieved PL or SIL. Ask what faults the architecture addresses, which assumptions support the calculation and how the design is validated. A neat diagram and a large number on a controller datasheet are insufficient evidence for the whole function.
Understand the units before comparing reliability numbers
Low-demand discussions commonly use average probability of dangerous failure on demand, written PFDavg. High-demand or continuous-mode discussions use a dangerous failure frequency measure expressed per hour, often written PFH. Probability and a per-hour measure are different quantities; a table must label the operating mode and units.
Do not describe SIL as a promise of an accident every fixed number of operating hours. It is not an accident calendar. For introductory study, explaining the meaning and boundaries of a measure is more useful than memorising a numerical band while confusing demand probability with frequency. Ask your specialist course to demonstrate the appropriate calculation using its declared assumptions.
What safety hardware and diagnostics do—and what to verify
Use the exact controller, I/O module, firmware, safety manual and approved configuration when reading a vendor example. “All safety PLCs have two identical processors” is not a useful selection rule. Products may implement their safety mechanisms differently, and an application must follow the conditions relevant to the chosen equipment.
Input monitoring also depends on the particular device and configuration. Do not assume that every two-channel emergency-stop arrangement uses one normally closed and one normally open contact, or that every supported sensor accepts the same test pulses. Record the field-device compatibility and the manufacturer's connection requirements rather than inventing a universal wiring pattern.
A diagnostic message establishes that a particular condition has been detected under the implemented monitoring scheme. It does not prove that every possible fault is detected in one scan. Response time, diagnostic coverage, fault exclusions and repair assumptions answer different questions. Keep their evidence in separate worksheet columns so one result cannot silently stand in for another.
If a training rig reports a channel discrepancy, the learning task is to interpret the documented condition and follow the approved investigation procedure. Changing diagnostic settings until the warning disappears does not establish that the cause has been resolved. This article supplies no bypass recipe or commissioning settings for a protective system.
For general signal interpretation, work through PLC troubleshooting observations and test records. Its distinction between a command, an input observation and a physical result is useful here, while its ordinary logic examples remain ordinary logic examples.
Worked response-time budget: the output command is not the endpoint
Consider a fictional worksheet with four sequential, non-overlapping stages. The supplied values are upper bounds solely for this arithmetic exercise. Assume they cover the entire modelled path, with no additional scheduling, communication or mechanical delay omitted. None of these numbers is a recommended value for a real machine.
| Stage | Supplied bound | Cumulative time from trigger |
|---|---|---|
| Detect and present the input condition | 20 ms | 20 ms |
| Process logic and included communications | 15 ms | 35 ms |
| Output interface response | 10 ms | 45 ms |
| Final mechanism reaches the specified endpoint | 80 ms | 125 ms |
The total is 20 + 15 + 10 + 80 = 125 ms. Against a fictional 150 ms worksheet deadline, the arithmetic margin is 25 ms. The output event occurs at 45 ms, but the stated endpoint occurs at 125 ms. Reporting 45 ms as the total would omit 80 ms of the model.
Now change one assumption at a time. If the final stage is 120 ms, the total becomes 165 ms and the margin becomes minus 15 ms. If the input stage is 45 ms while all original other stages remain unchanged, the total becomes 150 ms with zero arithmetic margin. If a stage is unknown, a defensible total cannot be established by treating that unknown as zero.
This worksheet teaches bookkeeping, not the selection of an acceptable deadline. A real assessment must establish the required response and the applicable method for demonstrating it. Do not infer stopping distance, protective-device positioning, achieved SIL or permission to operate from these four fictional numbers.
Avoid counting one delay twice
Suppose a supplier gives an end-to-end response bound that already includes its input filter and internal task scheduling. Adding those same components again would double-count them. Conversely, a processor execution measurement might omit I/O and network delays. Label every supplied value with its start event, end event, conditions and source.
In a course report, draw a timeline with the trigger at zero and each boundary event after it. If two stages overlap, the simple sequential sum requires revision. If timing varies with configuration, record the applicable configuration. A faster average observation does not replace an upper bound required by the assessment.
Reset is a distinct action from restart
The Pilz explanation of emergency-stop reset states that resetting an operated emergency-stop device must prepare for restart without automatically restarting the machine. That principle does not mean every product implements reset with the same signal edge or the same function-block interface. Consult the particular device instructions.
The following worksheet isolates the difference using two virtual lamps. It deliberately contains no motor output, field wiring or safety-rated data. Its three states are Blocked, Ready and Lit. A Boolean called Permit is simply a supplied exercise value; its name does not establish that any physical condition is safe.
At initialisation, set the state to Blocked, set StartArmed to false and initialise PreviousReset to the current raw ResetRequest value. This last choice prevents an already-held reset at startup from being treated as a new press. Define FreshReset as current ResetRequest true and PreviousReset false.
Evaluate exactly one old-state branch for each input snapshot, then commit the new state once. First priority is an invalid old state or Permit false: go to Blocked and clear StartArmed. Otherwise use these rules:
- In Blocked, FreshReset moves to Ready with StartArmed false. A start request cannot advance the state during that same evaluation.
- In Ready, observing StartRequest false arms the next start. A subsequent true StartRequest moves to Lit only if already armed. Otherwise remain Ready.
- In Lit, remain Lit while Permit is true. ResetRequest has no state-changing effect here. Losing Permit returns to Blocked through the first-priority rule.
Update PreviousReset from the raw ResetRequest after every evaluation, including blocked evaluations. Set ReadyLamp true only in Ready and LitLamp true only in Lit. Both are false in Blocked. These outputs are display indicators for a worksheet, not a protective output arrangement.
Twelve snapshots that expose held-button mistakes
Begin with both reset history and StartArmed false. Each row below describes the resulting state after evaluation, with inputs held at the stated Boolean values for that snapshot. A value of one means true.
| Snapshot | Permit | ResetRequest | StartRequest | Result |
|---|---|---|---|---|
| 1 | 0 | 0 | 1 | Blocked |
| 2 | 1 | 0 | 1 | Blocked |
| 3 | 1 | 1 | 1 | Ready, unarmed |
| 4 | 1 | 1 | 1 | Ready, unarmed |
| 5 | 1 | 0 | 0 | Ready, armed |
| 6 | 1 | 0 | 1 | Lit |
| 7 | 0 | 1 | 1 | Blocked |
| 8 | 1 | 1 | 1 | Blocked |
| 9 | 1 | 0 | 1 | Blocked |
| 10 | 1 | 1 | 1 | Ready, unarmed |
| 11 | 1 | 0 | 0 | Ready, armed |
| 12 | 1 | 0 | 1 | Lit |
Snapshot three accepts reset but ignores the held start as a restart request. Snapshot five observes a released start before snapshot six accepts it. Snapshot seven consumes the raw reset edge while Permit is false; restoring Permit in snapshot eight does not queue that old edge for later use.
Try an intentionally incorrect version that updates PreviousReset only when Permit is true. It can manufacture a fresh edge after a blocked interval, even though the operator has not pressed again. Another incorrect version uses several independent state-changing conditions in one evaluation and can advance from Blocked through Ready to Lit immediately. Compare both counterexamples against the stated rules.
For additional ordinary-program practice, use sequencer patterns with one transition per evaluation and PLC program testing resources. Use the twelve rows as a requirements discussion and test record. They do not certify an implementation on a real safety controller.
Standard tags, safety tags and application boundaries
Reading safety status for a production display is different from letting standard program data control a safety function. The direction of information flow matters, as do the controller's permitted access rules and the application's treatment of the data.
Rockwell's GuardLogix standard-tag mapping documentation explains that standard tasks can read safety tags. It also describes mapping standard data into safety tags and warns that this does not turn the originating standard data into safety data. Appropriate qualification and use must be established; copying a value does not upgrade its integrity.
In a classroom architecture drawing, label each signal's origin, destination, purpose and permitted influence. Distinguish a status display, an operator request and data used in a protective decision. A one-way arrow is only a description until the actual access behaviour and implementation are verified. Do not apply one vendor's mapping syntax to another platform.
Proof testing, maintenance and controlled changes
There is no universal rule that SIL 2 means annual testing and SIL 3 means six-monthly testing. The proof-test interval belongs to the design's assumptions and supporting evidence. The HSE proof-testing discussion links performance claims to test frequency and the ability to reveal otherwise unrevealed failures, and calls for procedures with success criteria and safe arrangements.
An automatic diagnostic and a scheduled proof test are not interchangeable labels. Ask which failure modes a procedure is intended to reveal, which parts of the function it covers and what remains outside its coverage. A successful button demonstration alone does not explain that coverage. Nor should a procedure be described as detecting every conceivable fault without supporting evidence.
For a training maintenance record, include the function identifier, approved procedure revision, equipment configuration, test conditions, expected result, actual result, exceptions and restoration record. An unsuccessful test should remain visible in the history even after correction. “Passed after adjustment” omits the original finding unless both observations are retained.
A project checksum or safety signature can help identify a configuration. It is not a substitute for validation of the whole installed function. When equipment, parameters, code or operating conditions change, identify the affected requirements and evidence before deciding what verification must be repeated. Do not assume that a matching filename means the application is unchanged.
The safety PLC versus standard PLC comparison provides a proposal-review exercise for checking evidence against stated requirements. Use it to practise identifying unresolved conditions before treating a component choice as a complete safety solution.
Choosing safety PLC training in South Africa
Separate a course in using a vendor's safety programming environment from training in functional-safety assessment and lifecycle responsibilities. Both can be useful, but their learning outcomes and entry requirements can differ. Ask for a syllabus showing the exact equipment, standards editions, practical work and assessment deliverables before paying.
For classroom training in Gauteng, KwaZulu-Natal, the Western Cape or another region, confirm the actual venue and dates with the provider. For remote learning, confirm whether the practical element uses software only, a supervised physical rig or a separate workplace assessment. A city name in a search result does not establish local laboratory access.
Request a sample exercise and its marking criteria. A meaningful introductory assignment might require a labelled function boundary, a response-time worksheet, a reset/start trace and an explanation of evidence limitations. Specialist design competence requires more than successfully completing these introductory tasks.
Ask who issues any certificate and what it signifies. Course attendance, a provider's practical assessment and a recognised qualification are different claims. Verify any stated accreditation or credential with its issuing body. This page makes no claim that reading it, using a simulator or passing a basic quiz confers authority to approve a safety installation.
For foundation revision, browse the PLC wiring lesson catalogue. Treat that as supporting education in circuit concepts; it is not a certified safety-controller runtime or an end-to-end physical validation service.
Questions learners ask about safety PLC programming
What should I ask before choosing Siemens safety PLC training?
Ask the provider to name the fail-safe controller family, engineering software, prerequisites and supervised exercises. Confirm how the course treats the complete safety function, validation evidence and controlled changes, rather than only the appearance of safety instructions. Use the Siemens training guide to frame platform questions, then request the specific safety course outline. Completing the conceptual exercises here does not establish competence to commission a safety application.
Can I learn safety PLC concepts online without hardware?
You can study terminology, requirements, state traces and evidence records online. The virtual indicator exercise is suitable for that purpose. Hardware-specific diagnostics, installation behaviour and validation need the equipment, instructions and competent assessment appropriate to the actual task. Ask a course provider exactly which practical outcomes its online format can demonstrate.
Does a SIL 3 controller make my application SIL 3?
No. Its capability and conditions of use are inputs to the application assessment. The complete function still needs a defined requirement and evidence covering the implemented chain. A certificate for one purchased item does not validate the rest of the installation or its maintenance arrangements.
Is reset the same as acknowledging an alarm?
Not necessarily. In a requirements document, define what each action changes. Acknowledgement may record that an operator has seen a message, while reset may prepare a function for a subsequent start. The lamp worksheet gives reset one explicit meaning; do not assume that meaning applies to every device or alarm system.
Can standard PLC simulation prove emergency-stop performance?
It can demonstrate behaviour within its model, such as the twelve input snapshots above. It cannot establish unmodelled physical failure behaviour, certified timing or achieved risk reduction. Report the model, observations and limits together so the result remains useful without becoming an unsupported claim.
What should I prepare before an advanced safety course?
Bring confidence in Boolean logic, state transitions, I/O interpretation and structured test records. Practise explaining why a result follows from a specific input history. Keep a list of questions about application scope, standards editions, hardware access and assessment. Those questions help you select training that fits your intended role rather than buying a course solely because its title contains SIL.