Home

VersaSafe VersaPoint IC220SDL543 Safe Input Module

1. ssssss 4 6 5 Parameterization of the safety module itii eee tenter ee 5 1 5 1 Parameterization in a VersaSafe system sssssssse 5 1 5 2 Parameterization in a PROFIsafe system ssssssseeeee 5 2 5 3 Parameterization of the safe inputs 5 3 5 4 Parameterization of clock outputs UT1 and UT2 nunsseerssennssnnnnnsnnnnnnnnnnn nenn 5 7 6 Duration of a safety demand is iere Pe ki eure 6 1 6 1 VersaSafe usi bete e HA ew rE LIP ERE coe 6 1 6 2 PROFISafG uut tele t re dite Ee 6 1 7 Connection examples for safe Inpuls nier donee tere an 7 1 7 1 Explanation of the examples uuesunuerssnnnernnnnnnnnnnnennnnennnnnnennnnen ernennen nn 7 1 7 2 Measures required to achieve a specific safety integrity level 7 3 7 3 Single channel assignment of safe inputs 240snssennnnnsnnennnennnnennnnnnnnn nn 7 5 7 3 1 Single channel Supply through UT1 clocking enabled or UT2 clocking enabled 222404424444nnHBnennnnnnnnnnnennnsnnnnnannnnnnannnnn nenn 7 6 7 3 2 Single channel Supply through UT1 clocking disabled or UT2 clocking disabled or external supply eeeennnensnnnnensnnnnnnnnnensnnnnnnnnnnn nee 7 3 3 Single channel Supply through OSSD sese 7 4 Two channel equivalent assignment of safe inputs 7 4 1 Notes about errors for two channel equivalent assignment of SATO Inputs 5 5 e tuii DO
2. Acknowledgment Yes 1 Acknowledging the diagnostic message deletes the message 9 6 PROFIsafe errors In addition to the module errors specified the following errors can occur PROFIsafe system errors These messages can be found in Section Diagnostic messages for parameter errors on page B 3 PROFIBUS or PROFINET system errors For information about these errors please refer to the documentation for the system used 9 8 User manual IC220SDL543 September 2011 GFK 2730 D H 9 7 Acknowledging an error 9 7 1 Acknowledging an error for VersaSafe An IC220SDL543 error is acknowledged completely via the configurable safety module For instructions on error acknowledgment please refer to the documentation for the configurable safety module used 9 7 2 Acknowledging an error for PROFIsafe Remove the cause of the error Then acknowledge the diagnostic message For instructions on error acknowledgment please refer to the documentation for the controller used WARNING Acknowledgment may result in a hazardous system state With the exception of a few special cases the acknowledgment of an error immediately returns the safe input to the operating state Before acknowledging an error you must therefore make sure that the acknowledgment will not cause the machine to switch to a dangerous state When planning the machine or system ensure that acknowledgmen
3. see 11 Technical data and ordering dala coit t rat pee pee ae ee ion pns 11 1 sSystem datazu eue 2222 ee ee e den 11 15 MersaSafe 2 ene Ped eisen aun ae 11 1 2 PROElISafe x iie ec URGERE En 142 1C220S5DL543 qnte eid ad depre ai acea ee edt GFK 2730 Table of contents lii 11 3 Conformance with EMC Directive essen 11 6 11 4 SOrdering data m erecta ies ales feces adds PNEU RUM 11 6 11 4 1 Ordering data Safety module see 11 6 11 4 2 Ordering data Accessories unnerssnsneennnennennnnnnnnnnnnnnnnnnnnnnn nen 11 6 11 4 3 Ordering data Documentation seeeee 11 7 A Appendix PROFIsafe terms used in the manual sss A 1 B Appendix F Parameters and iParameters 444444444444HHnH nn nnnHnnnnnnnnnnnnnnnnnnannnnnnnnn nenn B 1 B 1 F Parameters 2 doen nde ee edes B 1 B2 IParameters ue c ette Den un ad xe t ou p Qe cede dete Rene B 2 B3 Diagnostic messages for parameter errors 22224440snnnnnnnnnnnnnnnnnnnnnnnnnnnnnn B 3 B 3 1 Diagnostic messages for F Parameters and iParameters for PROPFlsafe eet perite ceret eredi n eR IE hors Red B 3 B3 2 Diagnostic messages for parameter errors for VersaSafe B 4 C Appendix Checklists rp C 1 C 1 Planning elle Eie eM D e ERREUR ERE dl C 2 C2 Assembly and electrical installation s C 3 C3 Startup and
4. AN WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a medium level of diagnostic coverage 90 to 99 and medium MTTFd A high level of diagnostic coverage 9996 is recommended for the application according to PL d Use sensors that can achieve the required safety integrity level To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 31 GFK 2730 Chapter 7 Connection examples for safe inputs 7 45 Device diagnostics and behavior of the module in the event of an error Table 7 18 Two channel non equivalent Supply through a clock output clocking disabled or external supply Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected as the state only changes in one channel A contact will not close metry violation Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Input cable interrupt between Yes Sym No The error is detected on a change in state at the latest as the state clock outp
5. See http www profisafe net Make sure you always use the latest documentation It can be downloaded at http support ge ip com www profibus com pall meta downloads Documentation for PROFIsafe PROFIBUS and PROFINET is available on the Internet at GFK 2730 Chapter 11 Technical data and ordering data 11 7 11 User manual IC220SDL543 September 2011 GFK 2730 A Appendix PROFIsafe terms used in the manual Consecutive number CRC F_Destination_Address F_Source_Address F CPU F I O device F Parameter F Slave Some of the terms that are used in connection with PROFIsafe in this manual are de scribed below A definition of PROFIsafe terms is also provided in the PROFIsafe profile Consecutive number Method for ensuring that the safe data is transmitted completely and in the correct order Cyclic Redundancy Check A cyclic redundancy check is used to verify the validity of the process data contained in the safety telegram check whether the assigned address relationships are correct and verify the safety related parameters This value is part of the safety telegram F Parameter PROFIsafe destination address address of the safe device see also F Parameter F Parameter PROFIsafe source address address of the safe controller see also F Parameter Failsafe control system safe controller Failsafe I O device safe input and or output modules Modul
6. 7 5 1 Notes about errors for two channel non equivalent assignment of safe inputs For the following examples please note the resulting behavior in the event of an error il Note about cross circuits The cross circuit error results in the transmission of the safe state in the process data image of the affected inputs Remove the error and then acknowledge the message Acknowledging the diagnostic message deletes the message and activates the input The states at the input are detected immediately In your safe application program ensure that the system cannot be restarted unintentionally following acknowledgment of the diagnostic message Please observe the maximum failure detection time of 80 ms Exceptions in the failure detection time are indicated in the tables If a 1 signal is present at the input and an error occurs a maximum of 80 ms elapses until the error is detected Within this time another 1 can also be transmitted even in the event of an error Within the failure detection time 80 ms maximum the error can cause the state to change unexpectedly from 0 to 1 Ensure that such a change in state cannot restart the system unintentionally 7 32 User manual IC220SDL543 September 2011 GFK 2730 Note about symmetry violation The symmetry violation diagnostic message is only displayed if it was not disabled during parameterization of the affected input Start inhibit due to symmetry
7. Please note that in order to achieve the specified PL the sensor must have a high level of diagnostic coverage gt 99 and high MTTFa Use sensors that can achieve the required safety integrity level To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 31 GFK 2730 Chapter 7 Connection examples for safe inputs 7 37 Device diagnostics and behavior of the module in the event of an error Table 7 15 Two channel non equivalent Supply through UT1 and UT2 of which one clock pulse is disabled Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected as the state only changes in one channel A contact will not close metry violation Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Input Yes Sym No The error is detected on a change in state at the latest as the state Cable interrupt between clock bus only changes in one channel output and sensor or between wiolanan sensor and input Cross circuit Input to input Yes Cross No Cross circuit detection depends on the switch position circuit A cross circuit is detected if the expected behavior of the input with regard to the test pulse of the assigned clock output is not achieved
8. All serious errors that can result in the loss of or adversely affect the safety function cause the entire module to enter the safe state The FS LED on the safety module is permanently on The following errors result in the safe state Serious hardware fault in the internal circuit User error Module overload Overheating of the module Incorrect supply The relevant diagnostic message is transmitted to the safe controller PROFIsafe or the configurable safety module VersaSafe see Errors Messages and removal on page 9 1 WARNING Loss of the safety function due to sequential errors In the event of a device error the following measures should be taken to prevent sequential errors Disconnect the module from the power supply and replace it 2 7 4 Parameterization errors Parameterization errors are indicated Aslong as the module is not parameterized or In the event of faulty parameterization Parameterization errors cause the entire module to enter the safe state The FS LED on the safety module flashes In the event of faulty parameterization the relevant diagnostic message is transmitted to the safe controller PROFIsafe or the configurable safety module VersaSafe see Pa rameterization errors on page 9 6 GFK 2730 Chapter 2 Product description 2 11 2 8 Process data words 2 8 1 VersaSafe The module occupies four words in the VersaPoint system For
9. Date Test engineer 1 2 Remark Requirement mandatory Requirement optional Enter the device type and or the equipment identification for the relevant device Enter the hardware and firmware version of the device see Structure of the safety module on page 2 2 Enter the date on which you began to fill in this checklist Enter the names of the test engineers Enter a remark if necessary These requirements must be met for a safety application in order to complete the relevant phase using the checklist These requirements are optional For points that are not met please enter an appropriate remark in the relevant field GFK 2730 Chapter C Appendix Checklists C 1 C1 Planning Checklist for planning the use of the safety module Device type equipment identification Version HW FW Date Test engineer 1 Test engineer 2 Remark No Requirement mandatory Remark 1 Has the current module user manual been used as the basis for planning Revision 2 Are the sensors approved for connection to the module according to the technical data and parameterization options Has the voltage supply been planned according to the specifications for the protective extra low voltage in accordance with PELV Is external fuse protection of the module planned according to the specifications in this user manual for supply voltage Uy Are measures planned t
10. 10 3 Decommissioning and disposal The machine or system manufacturer specifies the procedure for decommissioning Decommissioning may only take place according to these specified procedures GFK 2730 Chapter 10 Maintenance repair decommissioning and disposal 10 1 10 User manual IC220SDL543 September 2011 GFK 2730 11 11 Technical data and ordering data PROFIsafe PROFIsafe profile General data 11 1 System data 11 1 1 VersaSafe For the system data for your system please refer to the corresponding documentation for the controller used 11 1 2 PROFIsafe 2 4 For the system data for your system please refer to the corresponding documentation for the controller used 11 2 1C220SDL543 Housing dimensions width x height x depth 48 8 mm x 120 mm x 71 5 mm Weight with connectors Operating mode VersaSafe PROFIsafe Transmission speed Ambient temperature Operation Storage transport Humidity Operation 200g Process data mode with 4 words Process data mode with 4 words and 1 word PCP internal use 500 kbaud or 2 Mbaud 25 C to 455 C 25 C to 70 C 75 on average 85 occasionally no condensation il In the range from 25 C to 55 C appropriate measures against increased humidity must be taken Storage transport 75 on average 85 occasionally no condensation il For a short period slight condensation may appear on the outside of the housi
11. cccsccesesceeeeeeeeeeceeeseeeseseeeeeseeeneneneeeeeeens 2 11 2 8 Process data WOrds 5 x nunt oet deel 2 12 2 8 1 Mersaoal6 a de detti ten nate ete ero ts 2 12 2 8 2 PROFIsafe PROFIBUS PROFINET seseeeens 2 12 2 9 Programming data configuration data e 2 13 2 9 1 Localbus 5 onte isneboieete dia pe 2 13 2 9 2 X Other bus systems PROFIBUS PROFINET etc ss 2 13 3 VersaPoint potential and data routing and VersaPoint connectors sssssssusse 3 1 3 1 VersaPoint potential and data routing s 3 1 3 2 Supply Voltage Up u 22 2 ettet ette tu dede 3 1 3 3 Supply woltage Ui tetti e Pape o ePi 3 2 3 4 Terminal point assignment essem 3 3 GFK 2730 Table of contents i 4 Assembly removal and electrical installation sssss nenn nennen 4 1 4 1 Assembly and removal esses eese nter nnne 4 1 4 1 1 Unpacking the module enne 4 1 4 1 2 General ded etre dontateadeieceequidii ee 4 1 4 1 3 Setting the DIP switches sssseeeeneeneennnn 4 2 4 1 4 Assembly and removal of the safety module 4 4 4 2 Electrical installatlon ici RU Banken 4 6 4 2 1 Electrical installation of the VersaPoint station 4 6 4 2 2 Electrical installation of the safety module
12. 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the affected inputs as the faulty input was not previously set to state 0 A contact will not close Yes Sym No On a change in state from 0 to 1 a 0 is transmitted in the metry process data image of the affected inputs as only one channel violation reports this change in state Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Input Yes Sym No The error is detected in state 1 or on a change in state from 0 to Cable interrupt between clock metry 1 as the state only changes in one channel output and sensor or between violation sensor and input Cross circuit Input to input Yes Cross No The error is detected in state 1 circuit Input to assigned clock output Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs if the faulty input was not previously set to state 0 Input to non assigned clock output Yes Cross No See No
13. 8 inputs are set load at clock outputs UT1 and UT2 is 100 mA each Electrical isolation isolation of the voltage areas 2 From Uy 0 4 A short circuit and overload protection Um 1 V 100 No The total length of the connected cables must not exceed 200 m per clock output None One red LED for each UT1 UT2 see Local diagnostic and status indicators on page 2 8 1560 mW 2330 mW i To provide electrical isolation between the logic level and the I O area it is necessary to supply the bus coupler and this safety module from separate power supply units Interconnection of the power supply units in the 24 V area is not permitted see also user manual Separate potentials in the system comprising bus coupler power terminal and safety module Test distance 5 V supply incoming remote bus 7 5 V supply bus logic 5 V supply outgoing remote bus 7 5 V supply bus logic 7 5 V supply bus logic 24 V supply Uy FE Test voltage 500 V AC 50 Hz 1 min 500 V AC 50 Hz 1 min 500 V AC 50 Hz 1 min i The isolating distance between Uy and FE is covered by a varistor GFK 2730 Chapter 11 Technical data and ordering data 11 Approvals For the latest approvals please visit http support ge ip com 11 3 Conformance with EMC Directive Conformance with EMC Directive 2004 108 EC Noise immunity test according to DIN EN 61000 6 2 Electrostatic discharge ESD EN 61000
14. Within a VersaSafe or PROFIsafe system the IC220SDL543 safety module can be used to achieve safety functions with the following requirements Upto SIL 3 according to standard EN 61508 Upto SIL CL 3 according to standard EN 62061 Upto Cat 4 PL e according to standard EN ISO 13849 1 GFK 2730 Chapter 2 Product description 2 1 2 2 Structure of the safety module 76020002 Figure 2 1 Structure of the safety module 1 Data jumpers local bus 2 Electronics base with labeling including hardware firmware version designation not shown 3 Switch for setting the transmission speed and operating mode 4 Switch for setting the protocol and address For more detailed information about setting the switches please refer to Setting the DIP switches on page 4 2 5 6 7 Potential jumper Diagnostic and status indicators for assignment and meaning see Local diagnostic and status indicators on page 2 8 VersaPoint connector for assignment see Terminal point assignment on page 3 3 Terminal points Labeling field 2 2 User manual IC220SDL543 September 2011 GFK 2730 2 3 Housing dimensions Le pe Ko Me fe e 120 48 8 Figure 2 2 n Biggs nenne Housing dimensions in mm 76022010 GFK 2730 Chapter 2 Product description 2 3 Technical
15. gt 10 20 30 40 50 60 70 80 9 100 110 t ms 73410011 Figure 5 4 Typical pulse pattern standard sensor Key T Test pulse Pulse width lt 1 ms Period length lt 80 ms 5 8 User manual IC220SDL543 September 2011 GFK 2730 6 Duration of a safety demand The duration of a safety demand must be greater than the processing time of the corresponding input tin see also Processing time of the input tjn in the event of a safety demand on page 5 7 6 1 VersaSafe If the safety module detects a safety demand after the processing time of the input tjy has elapsed when using VersaSafe this time is extended by the module until the configurable safety module has received the safety demand 6 2 PROFIsafe If the safety module detects a safety demand safe 0 after the processing time of the input ty has elapsed when using PROFIsafe this time is extended by the module until the consecutive number has changed twice WARNING Loss of functional safety Observe the behavior of the controller when processing the safe inputs In addition to the processing time of the input tiy please observe the system specific PROFIsafe behavior e g watchdog time duration of demand processing time of the safe controller GFK 2730 Chapter 6 Duration of a safety demand 6 1 6 2 User manual IC220SDL543 September 2011 GFK 2730 7 Connection examples for safe inputs 7 1 Explanation of the
16. start inhibit due to symmetry violation is disabled 1 INO Ch1 0 1 INO_Ch2 0_Ch2 5 1 0 Diag 1 Bit 1 Q 0 S S S S S S 76200 Figure 5 3 Example for a signal change outside the parameterized time for symmetry monitoring start inhibit due to symmetry violation is enabled After acknowledging the diagnostic message see Acknowledging an error on page 9 9 the current state at the input is immediately transmitted to the safe controller PROFIsafe or the configurable safety module VersaSafe If a startup inhibit is required following error acknowledgment this must be implemented by the user in the application program A symmetry violation can also be triggered by a cross circuit see Connection examples for safe inputs on page 7 1 5 6 User manual IC220SDL543 September 201 1 GFK 2730 Processing time of the input tj in the event of a safety demand The processing time of the input tjy in the event of a safety demand comprises the parameterized filter time trie and the firmware runtime try It is calculated for the IC220SDL543 module according to the following formula tin fritter rw Where tin Processing time of the input tFilter Parameterized filter time tew Firmware runtime For standard sensors 250 us Forintelligent sensors For additional information please refer to the data sheet for the GE Intelligent Platforms intelligent sensor used 5 4 Parameteriza
17. to 0 in state 1 of the input An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally Typical parameterization Parameterization Parameterized as Remark Input Assignment Used Evaluation Single channel Sensor type Standard sensor Filter time trier 3 ms Application specific Symmetry Disabled Not relevant Clock selection pulse selection No assignment Bouncing time monitoring Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Not relevant violation Input signal Equivalent Not relevant Clock output UT1 OFF 24 V UT2 any Not relevant i OSSD sensor Set the filter time for the input to a value greater than the width of the test pulse for the The input must not be assigned to a clock 7 12 User manual IC220SDL543 September 2011 GFK 2730 7 7 4 Two channel equivalent assignment of safe inputs For two channel assignment of the inputs two adjacent inputs are always used This assignment is fixed and cannot be parameterized see Two channel on page 5 3 For two channel equivalent assignment the state changes from 0 to 1 only when both inputs change state from 0 to 1 If symmetry monitoring is enabled and the state at both inputs d
18. 1 GFK 2730 Device diagnostics and behavior of the module in the event of an error Table 7 12 Two channel equivalent Supply through a clock output clocking disabled or external supply Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the affected inputs as the faulty input was not previously set to state O A contact will not close Yes Sym No On a change in state from 0 to 1 a 0 is transmitted in the metry process data image of the affected inputs as only one channel violation reports this change in state Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Cable interrupt between clock Yes None No Behavior when the input is in state 1 output or external supply and The error is detected as a change in state from 1 to 0 An Sensor unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unint
19. 1 Switch position for VersaSafe VersaSafe Mode switch Address switch Island number Satellite number 9 8 7 6 5 4 3 2 1 0 Mode 2 off off 1dec to 31 dec 1dec to S dec Table 4 2 Switch position for VersaSafe in multiplexer mode VersaSafe multiplexer mode Mode switch Address switch Island number Satellite number 9 8 7 6 5 4 3 2 1 0 Mode 2 off off on on on 1 dec to 31 dec 7 dec Table 4 3 Switch position for PROFIsafe PROFIsafe Mode switch Address switch 9 8 7 6 5 4 3 2 1 0 Mode 1 Thex to 3FEhex Procedure If the DIP switch settings have to be modified proceed as follows Use the switch to set the transmission speed to 500 kbaud or 2 Mbaud Set the address Set the DIP switches before assembling the module in the VersaPoint station The switches cannot be accessed when the safety terminal is installed in the VersaPoint station GFK 2730 Chapter 4 Assembly removal and electrical installation 4 3 4 1 4 Assembly and removal of the safety module For general information about mounting and removing VersaPoint terminals please refer to the GFK 2736 user manual Assembly Set the DIP switches prior to assembly see Setting the DIP switches on page 4 2 The DIP switches cannot be accessed when the safety module is installed in the Ver saPoint station Observe a mounting distance of 30 mm above and 40 mm below the
20. 2730 Chapter 7 Connection examples for safe inputs 7 25 7 4 6 Two channel equivalent Supply through a clock output clocking disabled or external supply S1 S1 S2 IN1_Ch1 Two switching elements S2 UT1 UT2 IN1 Ch2 i Supply through UT1 or UT2 UT1 UT2 69402030 Figure 7 13 Two channel equivalent assignment of inputs supply through UT1 or UT2 clocking disabled IN1 Ch1 S S1 S2 Two switching elements IN1 Ch2 S2 i 424 V 24 V 70070024 External supply Figure 7 14 Two channel equivalent assignment of inputs external supply Basic specifications Sensor Two channel equivalent Sensor supply Internally through clock output UT1 or UT2 clocking disabled or externally Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 3 PL d AN WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a medium level of diagnostic coverage 90 to 99 and medium MTTFd A high level of diagnostic coverage 9996 is recommended for the application according to PL d Use sensors that can achieve the required safety integrity level To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 13 7 26 User manual IC220SDL543 September 201
21. 4 2 Criterion B IEC 61000 4 2 6 kV contact discharge 8 kV air discharge Electromagnetic fields EN 61000 4 3 Criterion A field strength 10 V m IEC 61000 4 3 Fast transients burst EN 61000 4 4 Criterion B test voltage 2 kV IEC 61000 4 4 Surge voltage EN 61000 4 5 Test intensity 2 Criterion B IEC 61000 4 5 DC supply lines 0 5 kV 0 5 kV symmetrical asymmetrical Signal lines 1 0 kV 2 0 kV symmetrical asymmetrical Conducted interference EN 61000 4 6 Criterion A test voltage 10 V IEC 61000 4 6 Noise emission test according to DIN EN 61000 6 4 Noise emission EN 55011 Class A industrial applications 11 4 Ordering data 11 4 1 Ordering data Safety module Description Catalog No Pcs Pkt VersaPoint module with safe digital inputs IC220SDL543 1 11 4 2 Ordering data Accessories Description Catalog No Pcs Pkt Connector set consisting of four IC2208CO543 1 set VersaPoint connectors with integrated discharge electronics 11 6 User manual IC220SDL543 September 201 1 GFK 2730 11 e i 11 4 3 Ordering data Documentation Description VersaPoint Automation terminals of the VersaPoint product range user manual VersaSafe VersaPoint module with integrated safety logic and safe digital outputs user manual PROFIsafe PROFIsafe Profile for Safety Technology on PROFIBUS DP and PROFINET IO Ver sion 2 4 February 2007 specification Catalog No Pcs Pkt GFK 2736 GFK 2731
22. CL 3 or PL d or e controlling devices must usually be designed redundantly Please observe any special environmental requirements in your application when selecting the controlling devices Please observe the applicable C standards in your application e g EN 1010 in which for example the number of controlling devices required to achieve a particular category is specified GFK 2730 Chapter 2 Product description 2 5 Parameterization i Technical data Behavior in the event of an error Error detection Diagnostics 2 4 2 Clock outputs UT1 and UT2 The module has two independent clock outputs They provide the supply voltage for the safe inputs Each of these clock outputs can provide a pulse pattern to detect cross circuits and short circuits in the external wiring of the inputs Intelligent sensors can also be supplied by the clock outputs Depending on the application both clock outputs can be parameterized differently For information about the parameterization of the clock outputs please refer to Parameterization of clock outputs UT1 and UT2 on page 5 7 The clock outputs are also switched on and monitored when not parameterized If a short circuit occurs at a clock output when it is in this state the clock output is switched off This is indicated by the local diagnostic LED To exit the error parameterize the device and acknowledge the error message For the technical data for the clock
23. For inputs that are parameterized for two channel operation are both channels parameterized correctly for each other Is the assignment to the clock outputs parameterized for the inputs Are the clock outputs parameterized OW LI OF LI No Requirement optional Yes No Remark Are safety distances that must be observed calculated according to the response and delay times implemented Date Signature test engineer 1 Date Signature test engineer 2 C 4 User manual IC220SDL543 September 2011 GFK 2730 C4 Validation Checklist for validating the safety module Device type equipment identification Version HW FW Date Test engineer 1 Test engineer 2 Remark No Requirement mandatory Yes Remark 1 Have all the mandatory requirements for the Planning checklist been 7 met 2 Have all the mandatory requirements for the Assembly and electrical 7 installation checklist been met 3 Have all the mandatory requirements for the Startup and 7 parameterization checklist been met 4 Does the parameterization of the safe inputs and clock outputs 7 correspond to the version and the actual connection of the controlling device 5 Hasthe assignment of the sensors to the inputs and the variables of 7 the safe application program been tested also as online status in Saf
24. a change in state from 1 to 0 in state 1 of the input An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally Clock output to ground Yes Short No The affected clock output is disabled circuit UTx ON Typical parameterization Parameterization Parameterized as Remark Input Assignment Used Evaluation Single channel Sensor type Standard sensor Filter time trier 3 ms Application specific Symmetry Disabled Not relevant Clock selection pulse UT1 Or UT2 selection Bouncing time monitoring Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Not relevant violation Input signal Equivalent Not relevant Clock output UT1 ON UT2 any If clock selection UT1 GFK 2730 Chapter 7 Connection examples for safe inputs 7 7 7 3 2 Single channel Supply through UT1 clocking disabled or UT1 UT2 e _ 69403101 UT2 clocking disabled or external supply S1 S1 INI CH amp Safety switch UT1 UT2 Supply through UT1 or UT2 Figure 7 2 Single channel assignment of inputs Supply through UT1 or UT2 clocking disabled for each S1 S1 INT Ch amp Safety switch 24 V 24V 6 _ 70070018 Supply through external 24 V Figure 7 3 Single channel assignment of inputs External sup
25. assignment of the inputs supply through UT1 clocked or UT2 clocked Basic specifications Sensor Single channel Sensor supply Internally through clock output UT1 clocked or UT2 clocked Achievable SIL SIL CL Cat PL SIL 2 SIL CL 2 Cat 3 PL d A d WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a medium level of diagnostic coverage 90 to 99 and medium MTTFd A high level of diagnostic coverage gt 99 is recommended for the application according to PL Use sensors that can achieve the required safety integrity level Device diagnostics and behavior of the module in the event of an error Table 7 5 Single channel Supply through UT1 clocked or UT2 clocked Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open No None Yes The error cannot be detected and results in the loss of the safety function A contact will not close No None No The error cannot be detected Other errors Please take into consideration possible errors that can occur in depending on the sensor the sensor Error in the wiring Interrupt Input Yes None No Behavior when the input is in state 1 Cable interrupt betw
26. can be achieved depends on the sensor used GFK 2730 Chapter 2 Product description 2 7 2 Clocking Error detection The clocking for the inputs is provided when clock outputs UT1 and UT2 are parameterized accordingly The parameterization of UT1 and UT2 applies to the entire module When parameterizing the inputs specify which clock output is assigned to which input For two channel inputs there are various options for assignment 2x Both channels are assigned different clock outputs with clocking switched on 1x Only one channel is assigned a clock output with clocking switched on or both channels are assigned the same clock output with clocking switched on With Either a clock output with clocking switched off is assigned or no clock output is out assigned For information about error detection according to clocking please refer to Clock outputs UT1 and UT2 on page 2 6 For information about the special features of error detection please refer to the connection examples 2 6 Local diagnostic and status indicators 76020003 Figure 2 3 Local diagnostic and status indicators on the IC220SDL543 module 2 8 User manual IC220SDL543 September 2011 GFK 2730 Table 2 1 Local diagnostic and status indicators D Green LED Diagno
27. data Parameterization i 2 4 Safe digital inputs and clock outputs UT1 and UT2 2 4 1 Safe digital inputs The safety module has four safe digital inputs for two channel assignment or eight safe digital inputs for single channel assignment The supply voltage for the inputs can be provided externally or via the clock outputs For the technical data for the safe inputs please refer to page 11 4 The individual safe digital inputs of a safety module can be parameterized differently This means that the inputs can be adapted to various operating conditions and different safety integrity levels can be implemented SIL SIL CL Cat PL The safety integrity level SIL SIL CL Cat PL and error detection that can be achieved depend on the parameterization the structure of the sensor and the cable installation see Connection examples for safe inputs on page 7 1 For information about the parameterization of the inputs please refer to Parameterization of the safe inputs on page 5 3 Diagnostics Diagnostics are provided via both the local diagnostic indicators and the diagnostic messages which are transmitted to the safe controller PROFIsafe or to a configurable safety module VersaSafe For information about the diagnostic messages of the inputs please refer to Safe digital input errors on page 9 3 AN CAUTION Diagnostic data is not safety related Do not use the diagnostic data to execute safety r
28. examples Depending on the type of wiring the inputs of a module can achieve different safety integrity levels SIL SIL CL Cat PL at the same time as long as the settings do not contradict one another The following examples only describe the options for the electrical connection of sensors to the safe inputs Should you have any questions regarding applications to be implemented please contact the GE Intelligent Platforms The following are specified for each example Basic specifications The main data for the example is specified in the table Device diagnostics and behavior of the module in the event of an error Diagnostic capability depends on the parameterization If a message is transmitted to the safe controller PROFIsafe or the configurable safety module VersaSafe in the event of an error the message is specified in the tables For information about the relevant error code possible remedies and information about whether acknowledgment is required please refer to Errors Messages and removal on page 9 1 The symmetry violation diagnostic message is only displayed if it was not disabled during parameterization of the affected input Typical parameterization The table illustrates an example of all the parameters for the specified assignment Key for all figures and tables in this section Table 7 1 Figures Representation Meaning Floati itch hanical lectrical o
29. in a VersaSafe system Parameterization includes the following Specifying the VersaSafe address for the corresponding configurable safety module Parameterizing the inputs and clock outputs The VersaSafe address is a unique ID for the safety module in the VersaSafe structure It is assigned in the configuration software for the assigned configurable safety module The address of the connected satellites here IC220SDL543 is based on the island number of the configurable safety module and the position in the bus navigator of the software tool Set this address via the DIP switches prior to assembly see Setting the DIP switches on page 4 2 For more detailed information about the VersaSafe address please refer to the documentation for the configurable safety module used The parameterization of the safe inputs and clock outputs determines the behavior of the module and thus has a considerable effect on the safety integrity level that can be achieved To parameterize the module the parameterization of the configurable safety module created in the parameterization tool is automatically written to the module on every power up or reset The supply voltage must be present and the local bus must be in the RUN state The module cannot be operated if it is not parameterized In this case the FS LED flashes The module is ready to operate if the parameters for all inputs and clock outputs are valid and transmitted wi
30. information about how these words are mapped please refer to the documentation for the configurable safety module used The input data can only be accessed via the standard control system In the following tables both the maximum single channel and maximum two channel assignment are illustrated Depending on the parameterization other process data word assignments are also possible Assignment of inputs to the process data input word in the standard control system Word bit view Word Word 1 Bit 15 14 13 12 11 10 9 8 7 6 5 4 3 211 0 Byte bit view Byte Byte 2 Byte 3 Bit 7 6 5 4 3 2 1 0 7 6 5 4 3 211 0 Module Taa IN3 IN3 IN2 IN2 IN1 IN1 INO INO 9 Ch2 _Ch1 _Ch2 _Ch1 _Ch2 _Ch1 _Ch2 Chl channel Reserved Input IN3 IN2 IN1 INO two channel 0 Ch o Ch 0 Ch 0 Ch 1 amp 2 1 amp 2 1 amp 2 1 amp 2 The diagnostic data is transmitted to the standard control system via the configurable safety module 2 8 2 PROFIsafe PROFIBUS PROFINET The module occupies four words in the VersaPoint system and three words in the PROFIBUS system The way in which these words are mapped in the higher level control system is specific to the controller used and is described in the Quick Start Guide for the controller 2 12 User manual IC220SDL543 September 201 1 GFK 2730 2 9 Programming data configuration data 2 9 1 Local bus Proto
31. inputs of a safety module can be parameterized differently and thus achieve different safety integrity levels SIL SIL CL Cat PL If the inputs are operated via two channels the following fixed assignment applies NO Ch1 to INO Ch2 N1 Chi to IN1 Ch2 N2 Ch1 to IN2 Ch2 N3 Ch1 to IN3 Ch2 If two channel operation in the external wiring of the inputs is not required the inputs can be parameterized in such a way that they operate independently of one another single channel Word bit view Byte bit view Module Word Word 0 Bit 15 14 13 12 11 10 9 8 71 6 5 4 3 2 140 Byte Byte 0 Byte 1 Bit 7 6 5 4 3 2 1 0 71 6 5 4 3 2 140 dd i INS na IN2 IN2 INT INT INO INO single Ch2 Chi Ch2 _Ch1 Ch2 Chi Ch2 Chi channel Reserved Input IN3 IN2 IN INO two channel 0 _Ch 0 _Ch 0 _Ch 0 _Ch 182 1 amp 2 1 amp 2 1 amp 2 Clock outputs i Please observe the settings of clock outputs UT1 and UT2 when parameterizing the safe inputs If the safe inputs are assigned the same or no clock output cross circuit detection is not possible GFK 2730 Chapter 5 Parameterization of the safety module 5 3 5 Parameterization Parameterize all safe inputs individually The parameterization options are described in Table 5 1 Table 5 1 Parameterization of inputs Parameterization Value range
32. loss of the safety function 7 46 User manual IC220SDL543 September 2011 GFK 2730 Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time trier 3ms 3ms Application specific same for both inputs Symmetry 10 ms 10 ms Application specific same for both inputs Clock selection pulse UT1 UT1 Or both UT2 or no assignment selection external Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Non equivalent Non equivalent Same for both inputs Clock outputs UT1 OFF 24 V UT2 any Where clock selection UT1 GFK 2730 Chapter 7 Connection examples for safe inputs 7 47 7 48 User manual IC220SDL543 September 2011 GFK 2730 8 Startup and validation 8 1 Initial startup To start up proceed as described in Table 8 1 Table 8 1 Steps for startup Step Relevant section and literature Set the transmission speed and the operating mode Setting the DIP switches on page 4 2 Set the protocol address Setting the DIP switches on page 4 2 Install the safety module within the V
33. may only be carried out by qualified personnel Planning Configuration parameterization programming Installation startup servicing Maintenance decommissioning This user manual is therefore aimed at Qualified personnel who plan and design safety equipment for machines and systems and are familiar with regulations governing safety in the workplace and accident prevention Qualified personnel who install and operate safety equipment in machines and systems GFK 2730 Chapter 1 For your safety 1 1 Documentation Safety of personnel and equipment Error detection Do not carry out any repairs Do not open the housing security seal Measures to prevent incorrect connection and polarity reversal In terms of the safety notes in this manual qualified personnel are persons who because of their education experience and instruction and their knowledge of relevant standards regulations accident prevention and service conditions have been authorized to carry out any required operations and who are able to recognize and avoid any possible dangers You must observe all information in this manual as well as in the documents listed in Documentation on page 1 6 The safety of personnel and equipment can only be assured if the safety module is used correctly see Correct usage on page 1 5 Depending on the wiring and the corresponding setting of the safe input module parameters the VersaSafe or PROFI
34. modified manually Overview of the F Parameters for the module F Parameter Default value Description F Source Address Automatic The parameter uniquely identifies the PROFIsafe source address controller address The address is assigned automatically F Destination Address Automatic PROFIsafe destination address address of the safe device The address is assigned automatically However the value can be modified Make sure that the value set under F Destination Address and the value that you have set via the 10 pos DIP switch are the same Value range 1 1022 F WD Time 150 Monitoring time in the safety module A valid current safety telegram must arrive from the safe controller within the monitoring time Otherwise the safety module enters the safe state The selected monitoring time must be sufficiently high for telegram delays to be tolerated by the communication but still ensure a sufficiently fast error response in the event of an error e g interruption in communication Value range 1 65534 in 1 ms increments Unit ms F SIL SIL 3 Safety integrity SIL according to IEC 61508 of the safety module A WARNING Safety functions up to SIL 3 can be achieved with the safety module The safety integrity level that can actually be achieved depends on the parameterization the structure of the sensor and the cable installation see Connection examples f
35. ms Application specific same for both inputs Clock selection pulse UT1 UT2 Or vice versa selection Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Non equivalent Non equivalent Same for both inputs Clock outputs UT1 ON and UT2 ON 7 36 User manual IC220SDL543 September 2011 GFK 2730 7 7 5 3 Two channel non equivalent Supply through UT1 and UT2 of which one clock pulse is disabled S1 IN1_Ch1 S1 S2 Two switching elements UT1 amp IN1_Ch2 SE UT2 69404222 Figure 7 20 Two channel non equivalent assignment of inputs supply through UT1 and UT2 of which one clock pulse is disabled S1 IN1 Ch1 1 S2 Two switching elements UT2 G IN1 Ch2 32 UT1 69401226 Figure 7 21 Two channel non equivalent assignment of inputs supply through UT1 and UT2 of which one clock pulse is disabled Basic specifications Sensor Two channel non equivalent Sensor supply Internally through clock output UT1 and UT2 of which one clock pulse is disabled Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 4 PL e AN WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3
36. outputs please refer to page 11 5 In the event of short circuit to GND or overload of the clock outputs the clock outputs are switched off At the same time the error is indicated at the UT1 and or UT2 LEDs anda diagnostic message is generated at the safe controller PROFlsafe or at a configurable safety module VersaSafe This error must be acknowledged so that the system can be started up again following error removal Error detection depends on both the parameterization of the clock outputs and which input is assigned to which clock output As there are two clock outputs for eight inputs there may be reciprocal effects between the inputs Diagnostics are provided via both the local diagnostic indicators and the diagnostic messages which are transmitted to the safe controller PROFIsafe or to a configurable safety module VersaSafe For information about the diagnostic messages of the clock outputs please refer to Clock output UT1 and UT2 errors on page 9 5 CAUTION Diagnostic data is not safety related Do not use the diagnostic data to execute safety related functions or actions 2 6 User manual IC220SDL543 September 2011 GFK 2730 2 2 5 Connection options for sensors depending on the parameterization Sensors that meet various safety requirements depending on the parameterization can be connected to the inputs For connection examples please refer to Section 7 Connection examples for safe in
37. outside the permissible range The clock output parameters are invalid or do not correspond to the set sensor type Correct value and resend parameter data to the module GFK 2730 Chapter 9 Errors Messages and removal 9 5 General errors Table 9 6 General errors Error cause Error code LED Remark Effect Remedy Acknow hex ledgment Device 01F2 Immediate Check and adapt Yes 1 temperature shutdown Further Ambient at critical temperature conditions value increase causes the _ Derating module to switch to _ Switchin the safe state ng frequency Error due to 01F3 Error due to receipt The Check and adapt Yes 1 receipt of an of an unexpected acknowledgment the assignment of unexpected message while process during the diagnostic and message acknowledging a which an confirmation diagnostic unexpected variables at the message message was corresponding Th d vice firmware received is aborted function block see handles this The corresponding documentation for diagnostic message sted ee inthe the controller used with the highest Eror Memeye Acknowledge DU Diagnostic priority Only when m O1F3 i diagnostic message this message has dr Br 3 01F3 so that the been acknowledged magaga next message from correctly are other the error memory errors indicated if can be indicated present Hardware FSON Error in the logic Module is inthe safe Replacement fault area state
38. parameterization eunnensseerneensnnnnnennnnnnnnennnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn C 4 C4 Malidatlon iei RORIS Ee C 5 DEEE no Dc steigen ichinkirbehbeickienielnbk hohen D 1 iv User manual IC220SDL543 September 2011 GFK 2730 1 For your safety Requirements Qualified personnel Purpose of this manual The information in this document is designed to familiarize you with how the IC220SDL543 safety module works its operating and connection elements and its parameter settings This information will enable you to use the IC220SDL543 module within a VersaSafe or PROFIsafe system according to your requirements Validity of the user manual This manual is only valid for the IC220SDL543 module in the version indicated on the inner cover page 1 1 General safety notes WARNING Depending on the application incorrect handling of the safety module can pose serious risks for the user When working with the safety module within the VersaSafe or PROFIsafe system please observe all the safety notes included in this section Knowledge of the following is required The non safety related target system e g PROFIBUS PROFINET The VersaSafe or PROFIsafe system The components used in your application The VersaPoint product range Operation of the software tools used Safety regulations in the field of application In the context of the use of the VersaSafe or PROFIsafe system the following operations
39. safety module Shorter distances may inhibit proper handling during installation Disconnect the power to the station Snap on base Before snapping on the safety module remove the inserted connectors from the safety terminal and the adjacent connector from the neighboring VersaPoint terminal on the left This prevents the potential routing knife contacts and the keyway featherkey connections from being damaged Hold the safety module perpendicular and snap it onto the DIN rail 7 5 mm in height H Ensure that all featherkeys and keyways on adjacent terminals are securely interlocked S EI S N Figure 4 2 Snapping on the safety module base Check that all the snap on mechanisms are securely snapped into place Insert connectors Insert the connectors in the specified order A B il Only use the connectors supplied with the module S E Figure 4 3 Inserting the connector 4 4 User manual IC220SDL543 September 201 1 GFK 2730 Removal Disconnect the power to the station Remove the connectors from the safety module and the adjacent connector from the neighboring VersaPoint terminal on the left Remove connectors Remove the connector by pressing the back shaft latching A and levering off the connector B RO N Figure 4 4 Removing the connector Remove base Release the base by pressing on the front and back snap on mec
40. sensor must have a high level of diagnostic coverage gt 99 and high MTTFd Use sensors that can achieve the required safety integrity level To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 31 Device diagnostics and behavior of the module in the event of an error Table 7 17 Two channel non equivalent Supply through a clock output clocked Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected as the state only changes in one channel A contact will not close metry violation Other errors depending on the sensor Please take into consideration all possible errors that can occur in the sensor Error in the wiring Interrupt Input cable interrupt between clock output and sensor or between sensor and input Yes Sym No The error is detected on a change in state at the latest as the state metry only changes in one channel violation GFK 2730 Chapter 7 Connection examples for safe inputs 7 43 7 Table 7 17 Two channel non equivalent Supply through a clock output clocked Error type Detec Diag Loss of Remark tion nostics SF Cross circuit Input to input Yes Sym No The error is detected as the state only changes in one channel metry violation Input to assig
41. specific same for both inputs Symmetry 10 ms 10 ms Application specific same for both inputs Clock selection pulse UT1 UT1 Or both UT2 selection Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs 7 44 User manual IC220SDL543 September 2011 GFK 2730 Parameterization Parameterized as Remark Input Channel 1 Channel 2 Input signal Non equivalent Non equivalent Same for both inputs Clock outputs UT1 ON 24 V UT2 any Or vice versa 7 5 6 Two channel non equivalent Supply through a clock output clocking disabled or external supply S1 S1 S2 IN1 Ch1 8 Two switching elements IN1 Ch2 S It UT1 UT2 S2 Supply through UT1 or UT2 UT1 UT2 O l 69404223 Figure 7 25 Two channel non equivalent assignment of inputs supply through UT1 or UT2 clocking disabled S1 S1 S2 INI_Ch1 8 4 Two switching elements IN1 Ch2 gt gt 24 V S2 Supply through external 24 V 24 V S t 70070023 Figure 7 26 Two channel non equivalent assignment of inputs external supply Basic specifications Sensor Two channel non equivalent Sensor supply Internally through clock output UT1 or UT2 clocking disabled or externally Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat S PL d
42. test pulse exceeded This error can also result in symmetry violation as the signal cannot be changed in both channels simultaneously Input to assigned clock output Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Input assigned to the clocked Yes Cross No See Note about cross circuits on page 7 32 clock output to non assigned clock circuit output Input assigned to the clock output Yes Sym No The error is detected as the state only changes in one channel that is not clocked to non metry assigned clock output violation Clock output to clock output Yes Cross No The error is detected for inputs which are assigned to the clocked circuit clock output The error is detected if the input assigned to the clocked clock output is active In this case please note that the failure detection time depends on the switch position Short circuit Input to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation Clock output to ground Yes Short No The error is detected in state 1 or on a change in state from 0 to circuit 1 as the state only changes in one channel UTx ON The error is also detected as a short circuit of the cloc
43. the faulty input was not previously set to state 0 Input assigned to the clock output Yes Sym No The error is detected on a change in state as the state only changes that is not clocked to non metry in one channel assigned clock output violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs Clock output clocked to clock Yes Cross No The error is detected for inputs which are assigned to the clocked output not clocked circuit clock output Short circuit Input to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation 7 18 User manual IC220SDL543 September 2011 GFK 2730 Table 7 9 Two channel equivalent Supply through UT1 and UT2 of which one clock pulse is disabled Error type Detec Diag Loss of Remark tion nostics SF Clock output to ground Yes Short No The error is detected in state 1 or on a change in state from 0 to circuit 1 as the state only changes in one channel UTx ON The error is also detected as a short circuit of the clock output i For all inputs that are assigned to the clock output that is not clocked cross circuits and short circ
44. the safe sensors correctly Perform a function test and error simulation Please observe the checklist Validation on page C 5 during validation GFK 2730 Chapter 8 Startup and validation 8 3 8 4 User manual IC220SDL543 September 2011 GFK 2730 9 Errors Messages and removal i Error removal Error acknowledgment Module replacement following an error Depending on the error type errors that are diagnosed are displayed via the local diagnostic indicators and or transmitted to the safe controller PROFIsafe or the configurable safety module VersaSafe as diagnostic messages The tables below provide an overview of the diagnosed errors their causes effects and possible measures for error removal For VersaSafe please also refer to the documentation for the configurable safety module used For every error that occurs the cause of the error must first be removed If necessary the error is then acknowledged Errors that must be acknowledged are indicated in the Acknowledgment column in the tables below If error codes are indicated by the system which do not appear in the tables below please contact GE Intelligent Platforms To remove the cause of an error please proceed as described in the Remedy column in the tables below Instructions on how to acknowledge an error can be found in Section Acknowledging an error on page 9 9 If in the event of failure the safety module
45. 0SDL543 September 201 1 GFK 2730 B3 Diagnostic messages for parameter errors B 3 1 Diagnostic messages for F Parameters and iParameters for PROFIsafe Table B 2 F Parameter parameter errors Error code Error cause Remedy dec hex 64 40 The parameterized F_Destination_Address does not Make sure that the PROFIsafe address of the match the PROFIsafe address set on the safety module safety module and the value in F Module F Destination Address are the same 65 41 Invalid parameterization of F Destination Address Correct value Addresses 000054 and FFFFpe are not permitted 66 42 Invalid parameterization of F Source Address Correct value Addresses 0000hex and FFFFh x are not permitted 67 43 Invalid parameterization of F WD Time Correct value A monitoring time of 0 ms is not permitted 68 44 Invalid parameterization of F SIL Use a device with the required SIL The safety module F Module cannot support the The safety module achieves SIL 3 maximum required SIL 69 45 Invalid parameterization of F CRC Length Check device description The CRC length generated by the safety module F Module does not match the required length 70 46 Invalid F Parameter record version Check device description The safety module F Module version does not match Only V2 mode permitted the required version 71 47 The checksum determined by the safety module Check F Parameters repeat calculation F
46. 30 Chapter 8 Startup and validation 8 1 8 Table 8 1 Steps for startup Step Relevant section and literature Program the safety function User manuals for the function blocks used Documentation for the configurable safety module used VersaSafe Documentation for the controller used PROFIsafe For PROFIsafe When verifying the safety function check whether the F_iPar_CRC parameter is greater than 0 for all devices If not modify the settings Checklist Validation on page C 5 Quick Start Guide for configuring VersaPoint modules with safe inputs or outputs under PROFIsafe on your controller Perform a function test and validation Check whether the safety function responds as planned during programming and parameterization Checklist Validation on page C 5 When connecting the supply voltages use the diagnostic and status indicators to check whether the module has started up correctly or whether any errors are indicated For instructions on how to proceed in the event of an error please refer to Errors Messages and removal on page 9 1 8 2 User manual IC220SDL543 September 2011 GFK 2730 8 2 Restart after replacing a safety module 8 2 1 Replacing a safety module WARNING Unintentional machine startup Do not assemble or remove the module while the power is connected Before assembling or removing the module disconnect the power to the module and th
47. 4V DC External fuse PELV 8 A maximum U for supply at a bus coupler or a power terminal GND for supply at a bus coupler or a power terminal 76191004 Figure 3 1 Supply Uy with connection to functional earth ground according to EN 60204 1 NOTE Damage to module electronics in the event of surge voltage Do not use a DC distribution network DC distribution network according to IEC 61326 3 1 A DC distribution network is a DC power supply network which supplies a complete industrial hall with DC voltage and to which any device can be connected A typical system or machine distribution is not a DC distribution network For devices that are provided for a typical system or machine distribution the DC connections are viewed and tested as I O signals according to IEC 61326 3 1 User manual IC220SDL543 September 2011 GFK 2730 3 4 Terminal point assignment 1 1 NE E 1 2 VE 13 2 1 3 NO 14 42 B 73410004 Figure 3 2 Terminal point assignment The VersaPoint connectors are supplied with the module They are keyed and labeled a ccordingly for connection to prevent polarity reversal il Only use the connectors supplied with the module T he following applies for the tables below Al
48. 5 5 Test duration 4 days Resistant Resistant Not resistant to chloroform Spring cage terminals 0 2 mm to 1 5 mm solid or stranded 24 16 AWG Operation 2g Criterion A 15g over 11 ms Criterion A SIL 2 single channel SIL 3 two channel Depends on the parameterization and wiring see Connection options for sensors depending on the parameterization on page 2 7 and Connection examples for safe inputs on page 7 1 SIL 2 1 of 10 maximum corresponds to 1 x 107 SIL 3 1 of 103 maximum corresponds to 1 x 10 8 SIL 2 1 of 109 maximum corresponds to 1 x 10 SIL 3 1 of 107 maximum corresponds to 1 x 10 Depends on the parameterization see Table 7 4 on page 7 3 1 20 years SIL CL SIL 2 single channel SIL CL SIL 3 two channel Depends on the parameterization and wiring see Connection options for sensors depending on the parameterization on page 2 7 and Connection examples for safe inputs on page 7 1 99 User manual IC220SDL543 September 2011 GFK 2730 11 Safety characteristics according to DIN EN 62061 Probability of a dangerous failure per hour for the entire module PFH Hardware fault tolerance HFT of the module Permissible duration of use Safety characteristics according to EN ISO 13849 1 Achievable performance level Diagnostic coverage DC Mean time to dangerous failure MTTFd Supply voltage U logic SIL 2 1 of 10 max
49. E iParameter sart wig deed nx eet wt A 2 Error Codear een 9 2 L Errorlocati m ninn na 9 2 Errors Length Codex ire pere o 2 13 Acknowledgment eee 9 9 General ta is tu s 9 8 M Inputs onere nu euer 9 3 Maintenance 244444440HH EA on NA ng 10 1 Parameterization s es 9 6 module AA eed ie eek ee ie 2 8 h moval i een 9 1 Mounting Supply voltage seen 9 5 LOCATON sisi ie eee etui 4 1 Evaluation oneris 5 4 O Output address area eect eee eect teeeeteees 2 13 GFK 2730 Chapter D D 1 D P Packages ss ed as ns een aa 4 1 Parameter channel see 2 13 ParameterizZation ccssssseeceeeeeeeeeeeeeeees 5 1 6 1 B 1 Clock o utp ts 2 tee 5 7 INPUIS oem 5 8 Passivation ee e e ette A 2 PEL sin dene eet deu 1 3 3 1 Power supply unit cccsecceeeeceeesseeeeseneeseeeeeneseeenes 1 3 Processing time of the input esere 5 7 PROEIsalfe E EE E EE ee NES A 2 PROFIsafe address eeesee 5 1 5 2 A 2 PROFIsafe monitoring time ssssse A 2 Q Qualified personnel sse 1 1 R Register longth cccescsceseeceteeeceeeeesesesteeeesenenes 2 13 Removals ann reet etre etes 4 4 Re pals kaikki ais a eA 10 1 Replacement module sess 8 3 Resta Ain rc irn 8 3 S Safe stale ie og 2 10 Inputs osten eee 2 10 2 11 Ope
50. G Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a high level of diagnostic coverage gt 99 and high MTTFd Use sensors that can achieve the required safety integrity level Device diagnostics and behavior of the module in the event of an error To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 13 Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor Channel failure Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the affected inputs as the faulty input was not previously set to state 0 Other errors depending on the sensor Please take into consideration all possible errors that can occur in the sensor GFK 2730 Chapter 7 Connection examples for safe inputs 7 29 7 Table 7 13 Two channel equivalent External supply OSSD Error type D
51. GE Intelligent Platforms Programmable Control Products VersaSafe VersaPoint Module IC220SDL543 SAFE INPUT 24VDC POSITIVE LOGIC 8PT User s Manual GFK 2730 September 2011 User s manual VersaPoint module with safe digital inputs 2011 09 29 Catalog No GFK 2730 Revision 05 This user manual is valid for Catalog No Revision IC220SDL543 HW FW 00 201 HW FW 00 202 Ho BB PB Please observe the following notes In order to ensure the safe use of the product described you have to read and understand this manual The following notes provide information on how to use this manual User group of this manual The use of products described in this manual is oriented exclusively to qualified electricians or persons instructed by them who are familiar with applicable standards and other regulations regarding electrical engineering and in particular the relevant safety concepts GE Intelligent Platforms accepts no liability for erroneous handling or damage to products from GE Intelligent Platforms or third party products resulting from disregard of information contained in this manual Explanation of symbols used and signal words injury hazards Obey all safety messages that follow this symbol to avoid This is the safety alert symbol It is used to alert you to potential personal AN possible injury or death DANGER This indicates a hazardous situation which if not avoided will result in deat
52. Input to ground Yes Sym No The error is detected in state 1 or on a change in state from metry 0 to 1 as the state only changes in one channel violation Clocked clock output to external Yes Cross No The error is detected by the absence of the clock pulses of the clock 24V circuit output in the assigned input Clock output to ground Yes Short No The error is detected in state 1 or on a change in state from 0 to circuit 1 as the state only changes in one channel UTx ON The error is also detected as a short circuit of the clock output The affected clock output is disabled External 24 V to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation For all inputs that are not assigned to a clock output cross circuits and short circuits are not detected by the device diagnostics but only on a change in state of the input signals as the state only changes in one channel Early error detection e g by testing the safety function at regular intervals is required as an accumulation of errors may result in the loss of the safety function Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time Filter 3 ms 3 ms Application specific same value S
53. L 3 4 IN1 Ch1 S1 2 UT2 9 Two switching elements IN1_Ch2 ie UTI 69401224 Figure 7 8 Two channel equivalent assignment of inputs supply through UT1 and UT2 both clocked Basic specifications Sensor Two channel equivalent Sensor supply Internally through clock output UT1 and UT2 both clocked Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 4 PL e A WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a high level of diagnostic coverage gt 99 and high MTTFd Use sensors that can achieve the required safety integrity level GFK 2730 Chapter 7 Connection examples for safe inputs 7 15 i Device diagnostics and behavior of the module in the event of an error To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 13 Table 7 8 Two channel equivalent Supply through UT1 and UT2 both clocked Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from
54. Loss of Remark tion nostics SF Short circuit Input to ground Yes None No Behavior when the input is in state 1 The error is detected as a change in state from 1 to 0 An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally Clock output to ground Yes Short No The error is detected as a change in state from 1 to 0 An circuit unexpected change from 0 to 1 is possible e g due to a loose UTx ON contact Ensure that such a change in state cannot restart the system unintentionally The error is also detected as a short circuit of the clock output The affected clock output is disabled Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time trier 3 ms 3 ms Application specific same value Symmetry 10 ms 10 ms Application specific same value Clock selection pulse UT1 UT1 Or both UT2 selection Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Equivalent Equivalent Clock output UT1 ON UT2 any Where clock selection 2 UT1 GFK
55. Module via the PROFIsafe parameters CRC1 does not match the CRC1 transmitted in the parameter telegram 255 FF During active process data communication a new Only send modified parameter data when F Parameter block was received which differs from the process data communication is not active F Parameter block currently used Incorrect type ID for the F Parameter block Check device description F Block ID GFK 2730 Chapter B Diagnostic messages for parameter errors B 3 B Table B 3 iParameter parameter errors Error code Error cause Remedy hex 03F2 iPar_CRC is incorrect Check iParameters repeat calculation 03FA iPar_CRC is not equal to F_iPar_CRC Apply correct value 03FB PST_Device_ID is incorrect Correct value 10 for IC220SDL543 OSFC F Destination Address in the iParameters is incorrect Correct value Make sure that the value set under F Destination Address and the value that you have set via the 10 pos DIP switch are the same 03FD Incorrect order of iParameter blocks Check infrastructure components B 3 2 Diagnostic messages for parameter errors for VersaSafe Table B 4 Parameter errors VersaSafe Error cause Remedy error code dec hex 1088 440 VersaSafe Make sure that the addresses are the same The parameterized VersaSafe address does not match the address set on the safety module 1089 441 25 dh Internal errors Please contact GE Intelligent Plat
56. RT RERIENRARCU MER 7 14 7 4 2 Two channel equivalent Supply through UT1 and UT2 clocking enabled for both s 7 15 7 4 8 Two channel equivalent Supply through UT1 and UT2 of which one clock pulse is disabled sseeeeseeess 7 17 7 4 4 Two channel equivalent Supply through a clock output clocking enabled and external supply sese 7 20 7 4 5 Two channel equivalent Supply through a clock output clocking enabled 5 nee eem mete 7 23 7 4 6 Two channel equivalent Supply through a clock output clocking disabled or external supply eeees 7 26 7 4 7 Two channel equivalent External supply OSSD 7 29 ii User manual IC220SDL543 September 201 1 GFK 2730 7 5 Two channel non equivalent assignment of safe inputs 7 5 1 Notes about errors for two channel non equivalent assignment of Safe Inputs eite Die im e pr tx besser USA ek ERES 7 5 2 Two channel non equivalent Supply through UT1 and UT2 clocking enabled for both ssm 7 5 3 Two channel non equivalent Supply through UT1 and UT2 of which one clock pulse is disabled z2usrsneeen nenn rennen nennen 7 5 4 Two channel non equivalent Supply through a clock output clocking enabled and external supply sees 7 5 5 Two channel non equivalent Supply through a
57. Remark Assignment Not used For unused inputs the data is filled with 0 Used Evaluation Single channel For two channel The assignment of the inputs to one Two channel another is specified and cannot be parameterized Sensor type Standard sensor Intelligent sensor If intelligent sensors are used the clock outputs for standard sensor mode are no longer available In this case all inputs that are operated with standard sensors are operated without clock outputs Select the clock output setting no assignment for these inputs Please note that error diagnostics for I O devices are only limited in this operating mode Filter time trine 1 5 ms The filter time is used to suppress interference for the input 3 ms signals 5 ms Select the filter time so that the duration of the input signal 15 ms is greater than the filter time For inputs that are parameterized for two channel opera tion select the same filter time for both channels D The filter time directly affects the response time of the safety function Symmetry Disabled Parameterization is only active if the input is parameterized 10 ms for two channel operation Select the same value for both 50 ms channels i ms See also Symmetry start inhibit on page 5 5 5s Start inhibit due to symmetry Disabled Disabled default setting A diagnostic message is gener violation Enabled ated in the event of symmetry violation Enabled A diagnostic
58. UT2 and externally 84 1 S2 IN1_Ch1 Se Two switching elements 24V 9 24 V S2 Supply through external 24 V Sn S INIzEn UT1 UT2 UT1 UT2 56070000 Supply through UT1 or UT2 Figure 7 11 Two channel equivalent assignment of inputs supply through UT1 or UT2 and externally Basic specifications Sensor Two channel equivalent Sensor supply Internally through clock output UT1 or UT2 and externally Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 4 PL e AN WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a high level of diagnostic coverage gt 99 and high MTTFd Use sensors that can achieve the required safety integrity level 7 20 User manual IC220SDL543 September 201 1 GFK 2730 i Device diagnostics and behavior of the module in the event of an error To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 13 Table 7 10 Two channel equivalent Supply through a clock output clocked and external supply Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected on a ch
59. afe I O modules For VersaSafe function blocks Please also observe the relevant information about the bus system used PROFIsafe When working on the PROFIsafe system and its components you must always keep this user manual and other items of product documentation to hand and observe the information therein User manuals For the safe controller used For PROFIsafe I O modules For PROFIsafe function blocks Please also observe the relevant information about PROFIBUS PROFINET and PROFIsafe which is available on the Internet at www profisafe net VersaPoint product range GFK 2736 Automation terminals of the VersaPoint product range configuration and installation Documentation for the Network Interface Unit NIU used 1 6 User manual IC220SDL543 September 201 1 GFK 2730 1 7 Abbreviations used Table 1 1 Abbreviations used Abbrevia Meaning Standard Example tion SIL Safety integrity level EN 61508 SIL 2 SIL 3 SIL CL SIL claim limit EN 62061 SIL CL 3 Cat Category EN ISO 13849 1 Cat 2 Cat 4 PL Performance level EN ISO 13849 1 PL e PL d Table 1 2 Abbreviations used Abbrevia Meaning tion PELV Protective extra low voltage A circuit in which the voltage cannot exceed 30 V AC 42 4 V peak value or 60 V DC under normal conditions and under single fault conditions except earth faults in other circuits A PELV circuit is like a SELV circuit but is connected to protect
60. alent Supply through a clock output clocked and external supply Error type Detec Diag Loss of Remark tion nostics SF Clocked clock output to external Yes Cross No The error is detected by the absence of the clock pulses of the clock 24V circuit output in the assigned input In this case please note that the failure detection time depends on the switch position Clock output to ground Yes Short No The error is detected in state 1 or on a change in state from 0 to circuit 1 as the state only changes in one channel UTx ON The error is also detected as a short circuit of the clock output External 24 V to ground Yes Sym No The error is detected in state 1 or on a change in state from metry 0 to 1 as the state only changes in one channel violation i loss of the safety function For all inputs that are not assigned to a clock output cross circuits and short circuits are not detected by the device diagnostics but only on a change in state of the input signals as the state only changes in one channel Early error detection e g by testing the safety function at regular intervals is required as an accumulation of errors may result in the Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time trier 3 ms 3 m
61. ange in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the affected inputs as the faulty input was not previously set to state 0 A contact will not close Yes Sym No On a change in state from 0 to 1 a 0 is transmitted in the metry process data image of the affected inputs as only one channel violation reports this change in state Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Input Yes Sym No The error is detected in state 1 or on a change in state from 0 to Cable interrupt between clock metry 1 as the state only changes in one channel output and sensor or between violation sensor and input Cross circuit Input to input Yes Cross No The error is detected in state 1 circuit Input to assigned clock output Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs if the faulty inp
62. apter 7 Connection examples for safe inputs 7 27 7 Table 7 12 Two channel equivalent Supply through a clock output clocking disabled or external supply Error type Detec Diag Loss of Remark tion nostics SF Clock output that is not clocked to No None No The error is not detected external 24 V Clock output to ground Yes Short No The error is detected as a change in state from 1 to 0 An circuit unexpected change from 0 to 1 is possible e g due to a loose UTx ON contact Ensure that such a change in state cannot restart the system unintentionally The error is also detected as a short circuit of the clock output The affected clock output is disabled External 24 V to ground Yes None No The error is detected as a change in state from 1 to 0 An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally i For all inputs that are not assigned to a clock output cross circuits and short circuits are not detected by the device diagnostics but only on a change in state of the input signals as the state only changes in one channel Early error detection e g by testing the safety function at regular intervals is required as an accumulation of errors may result in the loss of the safety function Typical parameterization Parameteriz
63. ased by a maximum of 100 Symmetry monitoring can be used to monitor the contact wear of the switch Symmetry monitoring checks the extent to which the related filtered inputs enter another state simultaneously Symmetry is violated if the inputs indicate different states for a time greater than the value parameterized for symmetry This applies for positive and negative edges The safe controller PROFIsafe or the configurable safety module VersaSafe is informed of asymmetry violation by a diagnostic message If start inhibit due to symmetry violation is enabled symmetry violation means that the affected input enters the safe state Key for the following diagrams S Symmetry monitoring Diag Diagnostics Q Acknowledgment of the diagnostic message after acknowledging the diagnostic message the current state is read For non equivalent parameterization a negated signal is present at input INO Ch2 shown in the diagrams GFK 2730 Chapter 5 Parameterization of the safety module 5 5 1 1 INO_Ch1 INO_Ch1 0 C 0 A 0 1 1 I INO_Ch2 NO Ch2 0 i 0 x 1 1 Bit Bit o 0 E i TON Diag 0 Diag 0 S S 76020007 Figure 5 1 Example for a signal change within the parameterized time for symmetry monitoring 1 1 INO Ch1 INO Ch1 0 i 0 1 1 I h INO_Ch2 NO_Ch2 0 E 0 4 1 1 Bit Bit 0 0 im T Diag 0 Diag 0 S S 76020008 Figure 5 2 Example for a signal change outside the parameterized time for symmetry monitoring
64. ate 1 output and sensor The error is detected as a change in state from 1 to 0 An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally Cable interrupt between sensor Yes Sym No The error is detected in state 1 or on a change in state from 0 to and input metry 1 as the state only changes in one channel violation Cross circuit Input to input No None No The error is not detected An accumulation of errors can result in the loss of the safety function Input to assigned clock output Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs if the faulty input was not previously set to state 0 Input to non assigned clock output Yes Cross No See Note about cross circuits on page 7 14 circuit Clock output to clock output Yes Cross No The error is detected for inputs which are assigned to the clocked circuit clock output 7 24 User manual IC220SDL543 September 2011 GFK 2730 Table 7 11 Two channel equivalent Supply through a clock output clocked Error type Detec Diag
65. ating switch mechanical or electrical 73410009 Table 7 2 Device diagnostics and behavior of the module in the event of an error tables Representation Meaning SF Safety function UTx UT1 or UT2 LED diagnostic message for each clock output Clocked Clocking enabled GFK 2730 Chapter 7 Connection examples for safe inputs 7 1 Table 7 3 Parameterization tables Representation Meaning Bold Mandatory setting Normal Typical setting another setting is possible depending on the application Not evaluated Errors cross circuits short circuits which can be prevented by correct installation e g protected cable installation isolated cable installation double insulation use of ferrules are not described in the following tables Therefore for example only errors between inputs which are on the same connector are described For example in the event of correct installation cross circuits with inputs outputs of other connectors cannot occur For all examples please also observe the measures specified in the individual tables which must be taken to achieve the specified SIL SIL CL Cat PL and all measures according to standards EN 61508 EN 62061 and EN ISO 13849 1 to achieve the specified SIL SIL CL Cat PL The input signals can be supplied externally or by the clock outputs The clock outputs and the assignment of the input signals to the clock outputs are parameterized as
66. ation Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time trier 3 ms 3 ms Application specific same value Symmetry 10 ms 10 ms Application specific same value Clock selection pulse UT1 UT1 Or both UT2 selection or both no assignment Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Equivalent Equivalent Clock output UT1 OFF 24 V UT2 any Where clock selection UT1 7 28 User manual IC220SDL543 September 2011 GFK 2730 A 7 4 7 Two channel equivalent External supply OSSD OSSD 24V INI_Ch1 S 4 a IN1_Ch2 GS 4 GND 70070028 Figure 7 15 Two channel equivalent assignment of inputs external supply OSSD WARNING Loss of functional safety due to parasitic voltages Connect the sensor ground directly to terminal point GND of the safety module An external ground may not be used Basic specifications Sensor Two channel OSSD output with internal testing Sensor supply External OSSD sensor Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 4 PL e A i Table 7 13 Two channel equivalent External supply OSSD WARNIN
67. ched on again Make sure the entire station is reassembled before switching the power back on Observe the diagnostic indicators and any diagnostic messages The system may only be started provided neither the station nor the system poses a hazard The IC220SDL543 safety terminal is designed for use within a VersaPoint station Only use the safety terminal in the 24 V DC area of a VersaPoint station To ensure reliable operation install the safety terminal in housing protected from dust and humidity IP54 or higher In order to prevent manipulation secure the housing control cabinet control box against being opened by unauthorized persons Mount all VersaPoint terminals on 35 mm DIN rails Only connect the cables using the supplied VersaPoint connectors or VersaPoint connectors listed in the ordering data GFK 2730 Chapter 4 Assembly removal and electrical installation 4 1 2 pos DIP switch Left switch Transmission speed Right switch Mode 10 pos DIP switch Proto col address switch il i 4 1 3 Setting the DIP switches The module has a 2 pos and a 10 pos DIP switch The DIP switches are located on the left hand side of the safety module 500 KBD A Mode2 F Address off 76022004 Figure 4 1 DIP switches A Switch for setting the transmission speed and the operating mode B Switch for setting the protocol or the address for PROFIsafe VersaSafe The transmission speed a
68. cking enabled and external supply 4 S1 S2 IN1_Ch1 S 4 Two switching elements UT1 UT2 65 UT1 UT2 Supply through UT1 or UT2 Supply through external 24 V 24V 9 70070021 Figure 7 22 Two channel non equivalent assignment of inputs internal supply through a clock output clocked and external supply S1 S1 S2 IN1_Ch1 S 4 Two switching elements Supply through external 24 V IN1 Ch2 s UT1 UT2 UT1 UT2 m Supply through UT1 or UT2 Figure 7 23 Two channel non equivalent assignment of inputs internal supply through a clock output clocked and external supply Basic specifications Sensor Two channel non equivalent Sensor supply Internally through clock output UT1 or UT2 clocked and externally Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 4 PL e AN WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a high level of diagnostic coverage gt 99 and high MTTFa Use sensors that can achieve the required safety integrity level To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 31 7 40 User manual IC220SDL543 September 201 1 GFK 2730 Dev
69. clock output clocking enabled eeececessceceseeeeeeseeeeneneeeeseeeseeeneneseneneneneeseeeenes 7 5 6 Two channel non equivalent Supply through a clock output clocking disabled or external supply eeeenenessnnnensnenennnnnnnennnnen nenn 8 Startup and validation pete eub tk a bie tu pu a einen Erg us 8 1 8 1 Initial Start p se He een 8 2 Restart after replacing a safety module uussssnenessnnnenennnensnnnnnnnnnen ernennen 8 2 1 Replacing a safety module sss 8 2 2 ca E E 8 3 Validation Hr Ri 9 Errors Messages and removalan ee qu ados dte p RR dead eres 9 1 Safe digital input errors n nenssas eme ey ee 9 2 Clock output UT1 and UT2 errors nnsunsnennnnensnnnnnnennnnnnnnnnnnnnnnnennnnnnnnnnnnnnn 9 3 Supply voltage errors i atrae o iode et oH RR 9 4 Parameterization errors eesssesseesesee eese entente nnne nnne nnne nin nennn 9 5 Gerleralettors n d o i iota edge uet dec dut aon 9 6 PROFlIS fe etrors nie unu ria ubt 9 7 Acknowledging an error sese 9 7 1 Acknowledging an error for VersaSafe ssssssssesss 9 7 2 Acknowledging an error for PROFIsafe sese 10 Maintenance repair decommissioning and dispOSal cccccccceeeceeceeeeeeeeeeeeeeeeeeeeeteeeees 10 1 Maintenarice t REI ete diit scene 10 2 REPAIR rent tette a c eee te fus 10 3 Decommissioning and disposal
70. col VersaSafe PROFIsafe Protocol address switch 9nex FFhex Any determined by the configurable safety module thex 3FEhex Operating mode Mode 2 Mode 1 ID code A3hex 1 63gec CBhex 203 dec Length code 04 hex 04 dec 04 hex 04 dec Input address area Controller specific Controller specific Output address area Controller specific Controller specific Parameter channel PCP 0 words 1 word Register length 4 words 4 words The PCP channel is only used internally The switch position of the protocol address switch is specified by the configurable safety module see documentation for the configurable safety module 2 9 2 Other bus systems PROFIBUS PROFINET etc For the programming data configuration data of other bus systems please refer to the corresponding electronic device data sheet GSD EDS Chapter 2 Product description 2 13 2 14 User manual IC220SDL543 September 2011 GFK 2730 3 VersaPoint potential and data routing and VersaPoint connectors 3 1 VersaPoint potential and data routing In order to operate the safety module it must be integrated in a VersaPoint station within the VersaSafe or PROFIsafe system The bus signals are transmitted via the VersaPoint data jumpers The required supply voltages are transmitted via the VersaPoint potential jumpers For more d
71. consumption Permissible interruption time Surge protection Protection against polarity reversal 24 V DC according to EN 61131 2 and EN 60204 15 20 including an entire AC voltage component with peak value of 5 3 6 Vpp 19 2 V DC to 30 0 V DC ripple included 25 mA typical plus current consumption of the inputs when supplied through the clock outputs plus current consumption of the connected initiators when supplied through the clock outputs 10 ms output voltage of the clock outputs can fail Yes in the bus coupler power terminal Yes in the bus coupler power terminal D polarity reversal must be prevented NOTE Module damage due to polarity reversal Polarity reversal places a burden on the electronics and despite protection against polarity reversal can damage the module Therefore Undervoltage detection Diagnostic indicators External fuse Yes at 17 V approximately Green Uy LED see Local diagnostic and status indicators on page 2 8 8 A slow blow maximum D NOTE Module damage in the event of overload The power supply unit must be able to supply four times 40096 the nominal current of the external fuse Safe digital inputs Number Input design Supply Input current Maximum permissible current for 0 Minimum permissible current for 1 Permissible input voltage range Voltage range for 0 Voltage range for 1 Maximum switching frequency Filter
72. ctuated Please note that a single error can result in the loss of the safety function between tests Ensure that the external wiring is tested by the machine control system on machine startup and at suitable intervals This test must detect the loss of the safety function GFK 2730 Chapter 7 Connection examples for safe inputs 7 3 Cat 3 Use proven and basic safety principles according to EN ISO 13849 2 Use appropriately qualified sensors see Requirements for controlling devices sensors on page 2 5 Please note that mechanical failure of the switching device can result in the loss of the safety function Take appropriate measures e g fuse protection redundancy positive opening etc to ensure that the contacts can be opened e g following welding or mechanical failure when a switch is actuated Please take into consideration errors with a common cause All errors that cannot be detected can result in the loss of the safety function Take appropriate measures to prevent such errors Suitable measures include for example protected cable installation or double insulation Please note the information in the following tables Ensure that a single error does not result in the loss of the safety function If single channel sensors are not available for this category use two channel sensors Cat 4 Use proven and basic safety principles according to EN ISO 13849 2 Use appropriately qualified sensors see Re
73. d UT2 of which one clock pulse is disabled S1 o 17 3 4 IN1_Ch1 S1 S2 UN 96 Two switching elements IN1_Ch2 o UT2 69404212 Figure 7 9 Two channel equivalent assignment of inputs supply through UT1 and UT2 of which one clock pulse is disabled Basic specifications Sensor Two channel equivalent Sensor supply Internally through clock output UT1 and UT2 of which one clock pulse is disabled Achievable SIL SIL CL Cat PL SIL S SIL CL 3 Cat 4 PL e A WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a high level of diagnostic coverage 9996 and high MTTFd Use sensors that can achieve the required safety integrity level GFK 2730 Chapter 7 Connection examples for safe inputs 7 17 i Device diagnostics and behavior of the module in the event of an error To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 13 Table 7 9 Two channel equivalent Supply through UT1 and UT2 of which one clock pulse is disabled Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is de
74. e entire VersaPoint station and ensure that it cannot be switched on again Make sure the entire station is reassembled before switching the power back on Observe the diagnostic indicators and any diagnostic messages The system may only be started provided neither the station nor the system poses a hazard If replacing a module proceed as described for assembly and removal see Assembly removal and electrical installation on page 4 1 Ensure that the new safety module is mounted at the correct position in the local bus The new module must meet the following requirements Same device type Same or later version 8 2 2 Restart Once the safety module has been replaced proceed as described for initial startup see Initial startup on page 8 1 The parameterization of the previous module remains the same and is transmitted to the new module when the system is started Plug the VersaPoint connectors into the correct connections Perform a function test after replacing the module 8 3 X Validation Carry out a safety validation every time you make a safety related modification to the Ver saSafe or PROFIsafe system When validating your individual EUC check the assignment of the sensor connections Determine whether The correct safe sensors are connected to the safety module The safety module has been parameterized correctly The variables used in your application program have been linked to
75. e No The error cannot be detected as clocking is disabled Short circuit Input to external 24 V No None Yes The error cannot be detected and results in the loss of the safety function as the safety switch is jumpered Input to ground Yes None No The error is only detected as a change in state from 1 to 0 in state 1 of the input An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally Clock output to external 24 V No None No The error cannot be detected as clocking is disabled Clock output to ground Yes Short No The affected clock output is disabled circuit UTx ON External 24 V to ground Yes None No The error is only detected as a change in state from 1 to 0 in state 1 of the input An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally GFK 2730 Chapter 7 Connection examples for safe inputs Typical parameterization Parameterization Parameterized as Remark Input Assignment Used Evaluation Single channel Sensor type Standard sensor Filter time trier 3 ms Application specific Symmetry Disabled Not relevant Clock selection pulse selec UT1 Or UT2 or no assignment tion Bouncing time monitoring Disabled Application specific bounce time mon
76. e input was The symmetry monitoring function can x 0 3 896 INO Chi parameterized for intelligent sensors only be activated for operation with INO Ch1 IN3_Ch1 symmetry monitoring was activated for standard sensors x 7 K 899 IN3 Ch1 the input INO Ch2 IN3 Ch2 903 INO Ch2 Correct value and resend parameter 906 IN3_Ch2 data to the module 039x Even though the input was Non equivalent processing of two x 0 3 912 INO Chi parameterized for intelligent sensors channel inputs may only be activated INO Ch1 IN3 Cht non equivalent signal processing was for operation with standard sensors KE SELE un ch activated for the input INO Ch2 IN3_Ch2 919 INO_Ch2 i Correct value and resend parameter 922 IN3_Ch2 data to the module 03Ax The settings for the input signal for the Assign the same setting for the input x 0 3 928 INO_Ch1 amp 2 indicated input and the related input signal for related inputs and resend INO_Ch1 amp 2 IN3_Ch1 amp 2 differ parameter data to the module 931 IN3_Ch1 amp 2 03Cx The filter time of inputs parameterized Assign the same setting for the filter x 0 3 for two channel operation differs time for related inputs and resend INO Ch182 IN3 Ch182 960 INO Ch1 amp 2 963 IN3 Ch182 parameter data to the module O3Ex x 0 Clock output UT1 x 7 Clock output UT2 992 Clock output UT1 999 Clock output UT2 The setting for the clock output is
77. e observe the maximum failure detection time of 80 ms If a 1 signal is present at the input and an error occurs a maximum of 80 ms elapses until the error is detected Within this time another 1 can also be transmitted even in the event of an error Within the failure detection time 80 ms maximum the error can cause the state to change unexpectedly from O to 1 Ensure that such a change in state cannot restart the system unintentionally Please note that the processing time for the input tj increases by up to 80 ms in the event of an error The following supply options are available for single channel assignment 1 UT1 clocking enabled 2 UT2 clocking enabled 3 UT1 clocking disabled 4 UT2 clocking disabled 5 External supply external 24 V or OSSD State evaluation The module evaluates the states of the inputs and transmits the result to the safe controller PROFIsafe or the configurable safety module VersaSafe In the process data image of a safe input A 0 is transmitted if a 0 signal is present at the input or an error has been detected A 1 is transmitted if a 1 signal is present at the input and no error has been detected GFK 2730 Chapter 7 Connection examples for safe inputs 7 5 73 1 IN1_Ch1 _ UT1 UT2 e _ Figure 7 1 Single channel Supply through UT1 clocking enabled or UT2 clocking enabled S1 S1 Safety switch 69403101 Single channel
78. ectors 3 1 3 3 Supply voltage Un Supply the supply voltage at a bus coupler or a power terminal It is supplied to the safety module via the VersaPoint potential jumper Uy WARNING Loss of the safety function when using unsuitable power supplies Please observe the points in Section Electrical safety on page 1 3 The supply voltage Uy is used to supply the input circuits and the clock outputs For the technical data for supply voltage Uy please refer to Section Supply voltage UM sensors clock outputs on page 11 4 The maximum current carrying capacity for the main circuit Uy is 8 A total current with the segment circuit that is not used in the safety terminal This current carrying capacity can be reduced if certain terminals are used Please refer to the information in the terminal spe cific data sheets If the limit value of the potential jumpers Uy and Us is reached total current of Us and Up a new power terminal must be used NOTE Module damage due to polarity reversal Polarity reversal places a burden on the electronics and despite protection against polarity reversal can damage the module Therefore polarity reversal must be prevented For the behavior of the safety module in the event of an error at the supply voltage Uy please refer to Section Supply voltage errors on page 9 5 U for supply at a bus coupler or a power terminal not required in the safety terminal 2
79. eeee e 5 7 B F Parameter a ed us pes A 1 Bouncing TIME etude cei er a i buste 5 5 F SysleiTic i e e ER cde aee A 2 Bouncing time monitoring bounce time monitoring 5 5 H C Housing dimensions eee 2 3 Clock outputs parameterization 5 7 Clock selection pulse selection 5 5 l Clockitng iate RR 2 8 BAT et ere er iit et En 2 13 Conformance with EMC Directive 11 6 Indicators diagnostic and status 2 8 Consecutive number sse A 2 Input address area 2 13 GRG aise eng ERR IUE A 1 lnput siginial nein rte temen 5 5 Current carrying capacity sssssss 3 1 3 2 Iriputs get CH Re Det 2 4 Device errors esesseeeeeeeeeeeneeennnnnnn 2 11 D Equivalent ena ite iege 2 7 Decommissioning LEE 10 1 VOER OF s i relever Besen 2 10 Device errors Non equivalent eee 2 7 Irip ts oic de ee een ee 2 11 Parameterization een 5 3 Serlous eiTO S inen ah e et de decis 2 11 Requirements for sensors ssseees 2 5 Diagnostic indicators sese 2 8 Single channel nennen 2 7 DirectiVeS ce etu edet or dain dice 1 5 Two channel een 2 7 Disposal sc oon cxi redii ede DM este 10 1 Installation Documentation latest 1 6 INSTRUCTIONS roro eei ORBI ette 4 1 Insulation rating usa sa ai handles 1 3
80. een clock output and sensor or between sensor and input The error is detected as a change in state from 1 to 0 An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally Behavior when the input is in state 0 Please note that if this error causes the safety switch to be switched on again this can result in delayed transmission of state 1 in the process data image of the inputs e g due to a loose contact User manual IC220SDL543 September 2011 GFK 2730 Table 7 5 Single channel Supply through UT1 clocked or UT2 clocked Error type Detec Diag Loss of Remark tion nostics SF Cross circuit Input to input No None Yes The error cannot be detected and results in the loss of the safety function as the safety switch is jumpered If the inputs are assigned different clock outputs this error is detected as across circuit after 80 ms Input to assigned clock output No None Yes The error cannot be detected and results in the loss of the safety function as the safety switch is jumpered Input to non assigned clock output Yes Cross No See Note about cross circuits on page 7 5 circuit Clock output to clock output Yes Cross No The error is only detected in state 1 of the input circuit Short circuit Input to ground Yes None No The error is only detected as
81. el 2 5 4 FE 6 4 FE Table 3 4 Terminal point assignment for connector 4 Terminal point Signal Channel assignment LED 7 1 INS Ch1 Input 3 channel 1 3 1 8 1 IN3 Ch2 Input 3 channel 2 3 2 7 2 UT1 Clock output 1 8 2 UT2 Clock output 2 7 3 0 V GND Channel 1 and channel 2 8 3 0 V GND Channel 1 and channel 2 7 4 FE 8 4 FE WARNING Loss of functional safety due to parasitic voltages For sensors that require a GND this must be wired to 0 V GND on the module 3 4 User manual IC220SDL543 September 2011 GFK 2730 4 Assembly removal and electrical installation 4 1 Assembly and removal 4 1 1 Unpacking the module The module is supplied in an ESD box together with a package slip with installation instructions Please read the complete package slip carefully The module may only be installed and removed by qualified personnel y NOTE Electrostatic discharge ta The safety module contains components that can be damaged or destroyed by electrostatic discharge When handling the safety module observe the necessary safety precautions against electrostatic discharge ESD according to EN 61340 5 1 and EN 61340 5 2 4 1 2 General AN WARNING Unintentional machine startup Do not assemble or remove the module while the power is connected Before assembling or removing the module disconnect the power to the module and the entire VersaPoint station and ensure that it cannot be swit
82. elated functions or actions 2 4 User manual IC220SDL543 September 201 1 GFK 2730 2 Requirements for controlling devices sensors The error detection of the module varies depending on the parameterization This results in specific requirements for the sensors To acquire input signals the signal duration must be greater than the parameterized filter time The sensors must be suitable for the application Only use appropriately qualified sensors Suitable for the required category SIL SIL CL PL Use switches with a positive opening contact according to IEC 60947 5 1 Part 5 of this standard includes a description of the specific requirements for control switches with a positive opening contact All positive opening control switches which meet these specific requirements are marked with the following symbol Use reliable components These include for example Mechanical position switches with personal protection function with positive opening contact according to EN 60947 5 1 Cam operated switches with positive opening contact Emergency stop buttons cable operated switches with positive opening contact according to EN 60947 5 1 Controlling devices can be evaluated on a single channel or two channel connection depending on the application Under certain circumstances switches e g for position monitoring must be designed redundantly depending on the risk In order to achieve Cat 3 Cat 4 SIL 3 SIL
83. entionally Cable interrupt between sensor Yes Sym No The error is detected in state 1 or on a change in state from 0 to and input metry 1 as the state only changes in one channel violation Cross circuit Input to input No None No An accumulation of errors can result in the loss of the safety function Input to clock output assigned or Yes Sym No The error is detected on a change in state as the state only changes not assigned metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs if the faulty input was not previously set to 0 Clock output to clock output No None No The error is not detected Short circuit Input to external 24 V Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs as the faulty input was not previously set to 0 Input to ground Yes None No The error is detected in state 1 or on a change in state from 0 to 1 as the state only changes in one channel GFK 2730 Ch
84. eration used to detected and their If not evaluate the states transmitted contacts of to the safe Check value for connected controller symmetry switches State PROFIsafe ora Check switches change in both configurable safety channels takes module Replace switches longer than the VersaSafe during next value TX maintenance parameterized for Start inhibit due to Activate connected symmetry violation 1 9 devi n symmetry is enabled Affected ee ISENADIEC e g activate and This message can input is in the safe unlock emergency also be triggered by state stop a cross circuit short circuit Hardware 014x All module inputs Power up with error Yes 3 fault are in the safe state free selftest x 0 3 INO_Ch1 IN3_Ch1 Replacement x 7 A INO_Ch2 IN3_Ch2 Sensor error 015x Atthe inputthat was Affected input is in Check sensor Yes 2 x 20 3 INO Ch182 IN3 Ch182 parameterized for the safe state i an intelligent sensor GFK 2730 Chapter 9 Errors Messages and removal 9 3 9 Table 9 1 Safe digital input errors Error cause Error code LED Remark Effect Remedy Acknow hex ledgment Signal error 016x _ Atthe inputthat was Affected input is in Check sensor Yes 2 x 20 3 INO Ch182 IN3 Ch182 parameterized for the safe state i an intelligent sensor incorrect or distorted clock signal e g due to short circuit different states at both inputs Hard
85. ersaPoint station Assembly removal and electrical installation on page 4 1 Connect the bus system and supply voltage cables to the VersaPoint station GFK 2736 or documentation for the bus coupler Wire the inputs according to your application Assembly removal and electrical installation on page 4 1 VersaPoint potential and data routing and VersaPoint connectors on page 3 1 User manuals for the function blocks used Before applying the operating voltage Ensure that there are no wiring errors e g cross cir cuit or short circuit or grounding errors by testing with a multimeter Check whether the ground connection is safe Connect the required voltages to the VersaPoint station GFK 2736 or documentation for the bus coupler Once the operating voltage has been applied f possible measure the wave form of the voltages to ensure that there are no deviations Measure the input voltages on the module to ensure that they are in the permissible range Usethe LEDs on the module to check that the module starts up without any errors Check the assembly and installation Checklist Assembly and electrical installation on page C 3 Carry out the necessary parameterization Parameterization of the safety module on page 5 1 Documentation for the configurable safety module used VersaSafe Documentation for the controller used PROFIsafe GFK 27
86. es with integrated safety functions which are approved for safety related operation According to PROFIsafe system description Version 09 November 2007 F Parameters contain information for adapting the PROFIsafe layer to specific customer specifications and for checking the parameterization by means of a separate method diverse The main F Parameters are F_S D_Address A unique address for F Devices within a PROFIsafe island The F Address for technology part of the F Device compares the value with the short address switch locally or with an assigned F Address in order to check the authenticity of the connection F WD Time Specifies the millisecond value for the watchdog timer The timer monitors the time that elapses until the next valid PROFIsafe message is received F SIL Indicates the SIL that the user can expect from the relevant F Device It is compared with the manufacturer s specification that is stored locally F iPar CRC A checksum that is calculated from all iParameters of the technology specific part of the F Device F Par CRC A CRC signature which is created via all F Parameters and ensures error free transmission of the F Parameters Failsafe slave GFK 2730 Chapter A Appendix PROFIsafe terms used in the manual A 1 A F System Failsafe system A failsafe system is a system that remains in the safe state or immediately enters a safe state when specific failures occur iParameter Individual saf
87. etailed information about potential and data routing within a VersaPoint sta tion please refer to the GFK 2736 user manual The segment circuit is looped through the safety module and is available again after the module The segment circuit cannot be accessed in the safety module 3 2 Supply voltage UL Supply the 24 V supply voltage Upgy Us4y at a bus coupler or a suitable power terminal The 7 5 V voltage U is generated from this 24 V supply voltage in the bus coupler or power terminal It is supplied to the safety module via the VersaPoint potential jumper UL AN WARNING Loss of the safety function when using unsuitable power supplies Please note for the voltage supply at the bus coupler or power terminal that Only power supplies according to EN 50178 VDE 0160 PELV may be used Make sure that the output voltage of the power supply does not exceed 32 V even in the event of an error Please also observe the points in Section Electrical safety on page 1 3 The supply voltage U is used to supply the communications power For the technical data for supply voltage U please refer to Supply voltage UL logic on page 11 3 The maximum current carrying capacity for the supply voltage U is 2 A This current carrying capacity can be reduced if certain terminals are used Please refer to the information in the terminal specific data sheets GFK 2730 Chapter 3 VersaPoint potential and data routing and VersaPoint conn
88. etec Diag Loss of Remark tion nostics SF Error in the wiring Interrupt Input Yes Sym No The error is detected in state 1 or on a change in state from 0 to Cable interrupt between sensor metry 1 as the state only changes in one channel and input violation Input No None No The error must be detected by the sensor Cable interrupt between sensor The sensor must ensure that the safe state is entered in the and GND event of an error Cross circuit Input to input No None Yes The error must be detected by the sensor The sensor must ensure that the safe state is entered in the event of an error Input to clock output Yes Sym No The error is detected on a change in state if the clock output is set to metry 1 as the state only changes in one channel violation Short circuit Input to 24 V Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Input to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time tFitter 3 ms 3 ms Application specific same value Symmetry 10 ms 10 ms Application specific same value Clock selectio
89. ety parameter of a device Passivation If the safety module F I O device detects an error it switches the affected channel or all channels of the module to the safe state the channels are then passivated The detected errors are indicated at the safe controller For a safe input module when the F System is passivated instead of the process values present at the safe inputs substitute values 0 are provided for the safety program For a safe output module when the F System is passivated instead of the output values provided by the safety program substitute values 0 are transferred to the safe outputs PROFIsafe Safety related bus profile based on PROFIBUS DP or PROFINET It defines the communication between a safety program and the safe I O device F I O device in a safe system F System PROFIsafe address Each safe module has a PROFIsafe address This address must be set on the safety module F I O device via DIP switches and then configured in the configuration tool for the safe controller used PROFIsafe monitoring Monitoring time for safety related communication between the safe controller F CPU and time safe I O device F I O device This time is parameterized in the F WD Time F Parameter A 2 User manual IC220SDL543 September 201 1 GFK 2730 B Appendix F Parameters and iParameters Table B 1 B 1 F Parameters i The values indicated in italics in Table B 1 are preset by the system and cannot be
90. etyProg 6 Has a function test been performed to check all safety functions in 7 which the module is involved 7 Have measures been taken to achieve a specific Cat Oo 8 Do all cables correspond to the specifications 7 9 Does the voltage supply correspond to the specifications for the 7 protective extra low voltage in accordance with PELV 10 Is external fuse protection of the module implemented according to the 7 specifications in this user manual for supply voltage UM 11 Have measures been taken to prevent simple manipulation 7 12 Have measures been taken to prevent connectors being mixed up 7 13 Are the requirements for the sensors and cable installation observed 7 according to the SIL SIL CL Cat PL to be achieved 14 Are the specifications for the parameterization for each channel 7 implemented 15 For PROFIsafe Is the F_iPar_CRC parameter greater than 0 for all 7 devices 16 Has it been ensured that any person intentionally starting hazardous 7 movements has a direct view of the danger zone Date Signature test engineer 1 Date Signature test engineer 2 GFK 2730 Chapter C Validation C 5 C 6 User manual IC220SDL543 September 2011 GFK 2730 D Index A F Abbreviations nennen 1 7 FeO PU ite Ein aed A 1 Assembly ioo eei eee aie pte 4 4 F l O device iat npe lena A 1 Assignment 2 2 4 2er 5 4 Filtettlfng z icut debe 5 4 Firmware runtime eeee
91. forms 1094 446 1095 447 The configurable safety module detected a distortion in Attempt transmission again the configuration and parameter data record If the error occurs permanently the data record in the controller is distorted In this case you can get VersaConf Safety to generate a new data record B 4 User manual IC220SDL543 September 2011 GFK 2730 C Appendix Checklists i The checklists listed in this section provide support during the planning assembly and electrical installation startup parameterization and validation of the IC220SDL543 module These checklists may be used as planning documentation and or as verification to en sure the steps in the specified phases are carried out carefully Archive the completed checklists to use as reference for recurring tests The checklists do not replace the validation initial startup and regular testing performed by qualified personnel The following section of a checklist shows an example of a completed checklist Checklist Device type equipment identification IC220SDL543 BK20NA10 Version HW FW 00 200 Date January 1 2008 Test engineer 1 John Smith Test engineer 2 Jane Brown Remark System XXX has been checked for engine hood production No Requirement mandatory Yes Remark x C No Requirement optional Yes No Remark X 1 Ll Key Equipment identification Version HW FW
92. h or serious injury WARNING This indicates a hazardous situation which if not avoided could result in death or serious injury CAUTION This indicates a hazardous situation which if not avoided could result in minor or moderate injury The following types of messages provide information about possible property damage and general information concerning proper operation and ease of use NOTE This symbol and the accompanying text alerts the reader to a situation which may cause damage or malfunction to the device either hardware or software or surrounding property This symbol and the accompanying text provides additional information to the reader It is also used as a reference to other sources of information manuals data sheets literature on the subject matter product etc User manual IC220SDL543 September 201 1 GFK 2730 Internet Subsidiaries Published by General terms and conditions of use for technical documentation This document is based on information available at the time of its publication While efforts have been made to be accurate the information contained herein does not purport to cover all details or variations in hardware or software nor to provide for every possible contin gency in connection with installation operation or maintenance Features may be de scribed herein which are not present in all hardware and software systems GE Intelligent Pla
93. hanisms A and pull it out perpendicular to the DIN rail B N Figure 4 5 Removing the safety module base GFK 2730 Chapter 4 Assembly removal and electrical installation 4 5 i 4 2 Electrical installation WARNING Electric shock unintentional machine startup Prior to electrical installation disconnect the power to the system and make sure that it cannot be switched on again unintentionally Make sure installation has been completed before switching the power back on The system may only be started provided the system does not pose a hazard 4 2 1 Electrical installation of the VersaPoint station Electrical installation of the VersaPoint station includes the following Connecting the bus system to the VersaPoint station Connecting the supply voltages for the VersaPoint station Carry out electrical installation for the VersaPoint station according to the GFK 2736 user manual Please also observe the specifications in the documentation for the bus coupler used 4 2 2 Electrical installation of the safety module During installation always observe the instructions in Electrical safety on page 1 3 Take measures to prevent the incorrect connection polarity reversal and manipulation of connections The supply voltages are supplied at a bus coupler and or a power terminal and are supplied to the safety module via the potential jumpers Therefore the electrical ins
94. ice diagnostics and behavior of the module in the event of an error Table 7 16 Two channel non equivalent Supply through a clock output clocked and external supply Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected as the state only changes in one channel A contact will not close meiry violation Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Input Yes Sym No The error is detected on a change in state at the latest as the state Cable interrupt between clock metry only changes in one channel output and sensor or between violation sensor and input Cross circuit Input to input Yes Cross No Cross circuit detection depends on the switch position circuit A cross circuit is detected if the expected behavior of the input with regard to the test pulse of the assigned clock output is not achieved test pulse exceeded This error can also result in symmetry violation as the signal cannot be changed in both channels simultaneously Input to assigned clock output Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected input
95. ideration possible errors that can occur in depending on the sensor the sensor Error in the wiring Interrupt Input Yes None No Behavior when the input is in state 1 Cable interrupt between clock The error is detected as a change in state from 1 to 0 An output and sensor or between unexpected change from 0 to 1 is possible e g due to a loose sensor and input contact Ensure that such a change in state cannot restart the system unintentionally Behavior when the input is in state 0 Please note that if this error causes the safety switch to be switched on again this can result in delayed transmission of state 1 in the process data image of the inputs e g due to a loose contact Cross circuit Input to input No None Yes The error cannot be detected and results in the loss of the safety the inputs are assigned different function as the safety switch is jumpered clock outputs Input to input No None Yes The error cannot be detected and results in the loss of the safety the inputs are assigned the same function as the safety switch is jumpered clock output Input to assigned clock output No None Yes The error cannot be detected and results in the loss of the safety function as the safety switch is jumpered Input to non assigned clock output No None Yes The error cannot be detected and results in the loss of the safety function as the safety switch is jumpered Clock output to clock output No Non
96. imum the error can cause the state to change unexpectedly from 0 to 1 Ensure that such a change in state cannot restart the system unintentionally Note about symmetry violation The symmetry violation diagnostic message is only displayed if it was not disabled during parameterization of the affected input Start inhibit due to symmetry violation is disabled The symmetry violation message does not result in the transmission of the safe state see also Symmetry start inhibit on page 5 5 The message must be acknowledged However the current status of the inputs is displayed in the process data image of the inputs Start inhibit due to symmetry violation is enabled The symmetry violation message results in the transmission of the safe state see also Symmetry start inhibit on page 5 5 The message must be acknowledged The current status of the inputs is displayed in the process data image of the inputs following acknowledgment The message can be used to monitor the wear of the safety switch User manual IC220SDL543 September 201 1 GFK 2730 7 4 2 Two channel equivalent Supply through UT1 and UT2 clocking enabled for both Possible wiring versions S1 G 3 IN1 Ch1 S1 S2 UI Two switching elements IN1 Ch2 s n UT2 G emaan Figure 7 7 Two channel equivalent assignment of inputs supply through UT1 and UT2 both clocked S1 G
97. imum corresponds to 1 x 10 9 SIL 3 196 of 107 maximum corresponds to 1 x 109 Depends on the parameterization see Table 7 4 on page 7 3 1 20 years PL e two channel PL d single channel Depends on the parameterization and wiring see Connection options for sensors depending on the parameterization on page 2 7 and Connection examples for safe inputs on page 7 1 99 For single channel assignment 76 years For two channel assignment 100 years The safety terminal is supplied with communications power via the bus coupler or a designated power terminal in the station The communications power is led in the VersaPoint station via potential routing For the technical data please refer to the data sheet for the bus coupler or power terminal used Current consumption 180 mA maximum GFK 2730 Chapter 11 Technical data and ordering data 11 3 11 Supply voltage Uy sensors clock outputs i The safety terminal is supplied with main voltage Uy via the bus coupler or a power terminal in the station The main voltage is led in the VersaPoint station via potential routing For the technical data please refer to the data sheet for the bus coupler or power terminal used A WARNING Loss of the safety function when using unsuitable power supplies Only use power supplies according to EN 50178 VDE 0160 PELV Nominal voltage Tolerance Ripple Permissible voltage range Current
98. indicated with Yes in the Acknowledgment column Special conditions for re enabling an input or the module are specified in brackets e g Yes 1 in the Acknowledgment column and explained below the relevant table 9 2 User manual IC220SDL543 September 201 1 GFK 2730 9 1 Safe digital input errors Table 9 1 Safe digital input errors Error cause Error code LED Remark Effect Remedy Acknow hex ledgment Permissible 011x _ Not safety related Inputs continue to Check switches and Yes 1 bouncingtime Poor switch quality be detected and replace if was exceeded contact bouncing is their states necessary x 20 8 INO Ch1 IN3_Cht too long compared transmitted to the check x 7 A INO_Ch2 IN3_Ch2 to the filter time safe controller parameterized filter PROFIsafe or a ti ime configurable safety module VersaSafe Cross circuit 012x Cross circuit with Affected input is in Check sensor Yes 2 x 20 3 INO Ch1 IN3_Cht another inputor with the safe state Check clock outputs x 7 A INO_Ch2 IN3 Ch2 a clock output Check connector and cabling Symmetry 013x _ Not safety related Start inhibit due to Check whether the Yes 4 violation Only for inputs symmetry violation message was x 20 3 INO Ch182 IN3 Ch182 parameterized for is disabled Inputs triggered by a short i two channel continue to be circuit cross circuit op
99. is replaced please proceed as described in Section 8 2 Restart after replacing a safety module and Section Restart after replacing a safety module on page 8 3 GFK 2730 Chapter 9 Errors Messages and removal 9 1 Structure of the error code Error code Error location Example LED Acknowledgment Notes on the tables below The error code of a diagnostic message is comprised of the code for the error cause and the code for the error location Error code Code for Code for error cause error location E g 012 x The error code is specified in Table 9 1 and onwards In the error code specified x specifies the location of the error The value range for x is specified in the relevant row of the table For some errors a single channel is specified as the error location e g INO_Ch1 Some errors only occur for inputs outputs parameterized for two channel operation Here the channel pair is specified as the error location e g INO_Ch1 amp 2 Safe input errors Table 9 1 Error cause Error code hex Cross circuit 012x x 20 8 INO Cht IN3_Ch1 x27 ALINO Ch2 IN3 Ch2 012x Cross circuit 012x Error location This means for example 0122 Cross circuit at IN2 Ch1 input 2 channel 1 012A Cross circuit at IN3 Ch2 input 3 channel 2 The LED column specifies which local diagnostic LEDs indicate the error Errors that must be acknowledged are
100. itch to be switched on again this can result in delayed transmission of state 1 in the process data image of the inputs e g due to a loose contact ee Example of correct and incorrect signal change i ne HEER INO Chi 1 INO Ch2 a INO Ch1 Ch2 p Figure 7 16 Correct signal change 69402017 1 INO Chi 6 1 INO Ch2 0 INO Ch1 Ch2 1 0 69402018 Figure 7 17 Error during signal change In Figure 7 17 the condition that both signals must be in the opposite state before the change in state is not met In this case diagnostic message 018Xpex is generated GFK 2730 Chapter 7 Connection examples for safe inputs 7 81 Key for Figure 7 5 and Figure 7 6 INO_Ch1 Signal sequence at input 0 channel 1 INO_Ch2 Signal sequence at input 0 channel 2 INO Ch1 Ch2 Safety related signal for two channel input 0 channel 1 and channel 2 at the safe controller PROFlsafe or the configurable safety module VersaSafe State evaluation The module evaluates the states of the inputs and transmits the result to the safe controller PROFIsafe or the configurable safety module VersaSafe In the process data image of the safe inputs A 1 is transmitted if a 1 signal is present at channel 1 of the input and a 0 signal is present at channel 2 of the input and no error has been detected and the conditions are met for a change in state according to Figure 7 17 A Q is transmitted in all other cases
101. itoring Start inhibit due to symmetry Disabled Not relevant violation Input signal Equivalent Not relevant Clock output UT1 OFF 24 V UT2 any If clock selection UT1 A 7 3 3 24V 0 IN1_Ch1 S 4 GND OSSD Figure 7 4 Single channel Supply through OSSD 70070027 Single channel assignment of inputs External supply OSSD WARNING Loss of functional safety due to parasitic voltages Connect the sensor ground directly to terminal point GND of the safety module An external ground may not be used Basic specifications Sensor Single channel OSSD output with internal testing Sensor supply External OSSD sensor Achievable SIL SIL CL Cat PL SIL 2 SIL CL 2 Cat 2 PL d 7 10 User manual IC220SDL543 September 2011 GFK 2730 WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL cross circuits must be avoided Please note that in order to achieve the specified PL the sensor must have a medi um level of diagnostic coverage 90 to 99 and high MTTFd A high level of diag nostic coverage gt 99 is recommended for the application according to PL d Use sensors that can achieve the required safety integrit
102. ive earth ground According to EN 61131 2 EUC Equipment under control OSSD OSSD Output signal switching device OSSD is the part of electrosensitive protective equipment which is connected to the machine control system and switches off if the sensor part responds during correct operation For terms and abbreviations used for PROFIsafe please refer to Appendix PROFIsafe terms used in the manual on page A 1 GFK 2730 Chapter 1 For your safety 1 7 User manual IC220SDL543 September 2011 GFK 2730 2 Product description 2 1 Brief description of the safety module The IC220SDL543 module is an input module which is designed for use within a VersaPoint station The IC220SDL543 safety module can be used as part of a VersaPoint station at any point within a VersaSafe or PROFIsafe system The transmission speed of the VersaPoint local bus can be set to 500 kbaud or 2 Mbaud on the safety module using switches One transmission speed must be used seamlessly in the relevant VersaPoint station in a VersaSafe or PROFIsafe system The module has a 10 pos DIP switch which is used to set the VersaSafe or PROFIsafe address The module has four safe digital inputs for two channel assignment or eight safe digital inputs for single channel assignment The inputs can be parameterized according to the application and enable the integration of sensors in the VersaSafe system or in the PROFIsafe system
103. k output 7 38 User manual IC220SDL543 September 2011 GFK 2730 For all inputs that are assigned to the clock output that is not clocked cross circuits and short circuits are not detected by the device diagnostics but only on a change in state of the input signals as the state only changes in one channel Early error detection e g by testing the safety function at regular intervals is required as an accumulation of errors may result in the loss of the safety function Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time trier 3 ms 3 ms Application specific same for both inputs Symmetry 10 ms 10 ms Application specific same for both inputs Clock selection pulse UT1 UT2 Or vice versa selection Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Non equivalent Non equivalent Same for both inputs Clock outputs UT1 ON and UT2 OFF 24 V For specified clock selection GFK 2730 Chapter 7 Connection examples for safe inputs 7 39 7 5 4 Two channel non equivalent Supply through a clock out put clo
104. l inputs are safe digital inputs The assignment to the clock output must be parameterized see Parameterization of the safe inputs on page 5 3 0 V GND Common ground of inputs and clock outputs FE Common functional earth ground UT1 Controlled by first channel UT2 Controlled by second channel Table 3 1 Terminal point assignment for connector 1 Terminal point Signal Channel assignment LED 1 1 INO_Ch1 Input 0 channel 1 0 1 2 1 INO_Ch2 Input 0 channel 2 0 2 1 2 UT1 Clock output 1 UT1 2 2 UT2 Clock output 2 UT2 13 0 V GND Channel 1 p channel 23 0 V GND Channel 1 Fe channel 1 4 FE 2 4 FE GFK 2730 Chapter 3 VersaPoint potential and data routing and VersaPoint connectors 3 3 A Table 3 2 Terminal point assignment for connector 2 Terminal point Signal Channel assignment LED 3 1 IN1_Ch1 Input 1 channel 1 1 1 4 1 IN1_Ch2 Input 1 channel 2 1 2 3 2 UT1 Clock output 1 4 2 UT2 Clock output 2 3 3 0 V GND Channel 1 and channel 2 4 3 0 V GND Channel 1 and channel 2 3 4 FE 4 4 FE Table 3 3 Terminal point assignment for connector 3 Terminal point Signal Channel assignment LED 5 1 IN2 Ch1 Input 2 channel 1 2 1 6 1 IN2 Ch2 Input 2 channel 2 2 2 5 2 UT1 Clock output 1 6 2 UT2 Clock output 2 5 3 0 V GND Channel 1 and channel 2 6 3 0 V GND Channel 1 and chann
105. ment identification Version HW FW Date Test engineer 1 Test engineer 2 Remark No Requirement mandatory Yes Remark 1 Was assembly completed according to the specifications specifica 7 tions from the planning phase or according to the user manual 2 Was the safety module installed in the control cabinet IP54 7 3 Do the cable cross sections correspond to the specifications 7 No Requirement optional Yes No Remark 4 Is the transmission speed and the operating mode set correctly q EH according to the specifications 5 Is the protocol address set correctly according to the specifications aqa o Date Signature test engineer 1 Date Signature test engineer 2 GFK 2730 Chapter C Assembly and electrical installation C 3 C3 Startup and parameterization Checklist for startup and parameterization of the safety module Device type equipment identification Version HW FW Date Test engineer 1 Test engineer 2 Remark No Requirement mandatory Yes Remark 1 Was startup completed according to the specifications specifications from the planning phase or according to the user manual 2 During startup is it ensured that any person starting hazardous movements intentionally can only do so with a direct view ofthe danger zone Are all parameters parameterized for the inputs
106. message is generated in the event of symmetry violation In addition the affected input is set to the safe state 5 4 User manual IC220SDL543 September 2011 GFK 2730 Table 5 1 Parameterization of inputs Parameterization Value range Remark Clock selection in software No assignment Assignment of the input to a clock output pulse selection UT1 Only relevant for standard sensors UT2 When using intelligent sensors UT1 is used as the power supply and UT2 as the pulse generator for all inputs Bouncing time monitoring in Disabled Monitoring of the activation and deactivation of the software bounce time Enabled bouncing time monitoring See also Bouncing time monitoring bounce time monitoring on page 5 5 Input signal Non equivalent Parameterization is only active if the input is parameterized Equivalent for two channel operation Select the same setting for both channels Non equivalent Connect N C contact to INx Ch1 Connect N O contact to INx Ch2 Equivalent Connect N C contact to both channels Bouncing time monitoring bounce time monitoring Symmetry start inhibit Input signal bouncing can lead to delayed state transitions If a detected state transition is 200 longer than the parameterized filter time a corresponding diagnostic message is sent The exception is a filter time of 15 ms For this filter time the duration of the state transition can be incre
107. meterized for two x 0 3 832 INO Ch182 monitoring of related inputs is not the channel operation must have the same INO Ch182 IN3 Ch182 same symmetry settings 835 IN3 Ch182 Correct values and resend parameter data to the module 035x The value for symmetry monitoring is Correct value and resend parameter x20 3 848 INO Chi outside the permissible range data to the module INO Ch1 IN3 Cht X27 851 IN3_Ch1 INO_Ch2 IN3_Ch2 855 INO_Ch2 858 IN3_Ch2 9 6 User manual IC220SDL543 September 2011 GFK 2730 Table 9 5 Parameterization errors Error code Short description Remedy hex dec 036x Intelligent sensor has been connected Connect intelligent sensor to an input x 0 864 INO Chi to an input parameterized for single parameterized for two channel INO Ch IN3 Cht channel operation operation and parameterize inputs X27 A 867 IN3 Ch1 according INO_Ch2 IN3_Ch2 871 INO_Ch2 gly 874 IN3_Ch2 Correct values and resend parameter data to the module 037x Even though the input was The bouncing time monitoring function x 0 3 880 INO Chi parameterized for intelligent sensors can only be activated for operation with INO Ch1 IN3 Cht bouncing time monitoring was standard sensors x 7 A 883 IN3_Ch1 activated INO Ch2 IN3 Ch2 887 INO Ch2 i Correct value and resend parameter 890 IN3 Ch2 data to the module 038x Even though th
108. n pulse No assignment No assignment selection Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Equivalent Equivalent Clock output Any i Set the filter time for the input to a value greater than the width of the test pulse for the OSSD sensor The input must not be assigned to a clock 7 30 User manual IC220SDL543 September 2011 GFK 2730 7 7 5 Two channel non equivalent assignment of safe in puts For two channel assignment of the safe inputs two adjacent inputs are always used This assignment is fixed and cannot be parameterized see Two channel on page 5 3 For two channel non equivalent assignment the state changes from 0 to 1 only when input INx_Ch1 changes state from 0 to 1 and input INx_Ch2 changes state from 1 to 0 If symmetry monitoring is enabled and the state at both inputs does not change within the parameterized time a diagnostic message is generated The state is active when the state of the signal at channel 1 is equal to 1 and the signal at channel 2 is equal to 0 Cross circuits can only be detected if the input signals are assigned to different clock outputs and clocks are enabled for the clock outputs Please note that if a delayed change in state at one of the two inputs causes the safety Sw
109. nd the operating mode Mode are set via the 2 pos DIP switch The transmission speed can be set to 500 kbaud or 2 Mbaud The transmission speed is set to 2 Mbaud by default Only use devices with a uniform transmission speed within a VersaPoint station a local bus A mixture of devices with different transmission speeds cannot be operated For PROFIsafe set Mode 1 For VersaSafe set Mode 2 The protocol VersaSafe or PROFIsafe is set via the 10 pos DIP switch If you are using VersaSafe or PROFIsafe use this DIP switch to set the VersaSafe address or the PROFIsafe address F Address VersaSafe Set the VersaSafe address specified by the configurable safety module For more detailed information about the VersaSafe address please refer to the documentation for the configurable safety module used PROFIsafe Set the PROFIsafe address for the PROFIsafe device PROFIsafe addresses 1 to 1022 15e to 3FEhex are permitted The terminal is detected as a PROFIsafe device by means of the set PROFIsafe address The DIP switch is set to 3FFhex by default This address is not valid for a VersaSafe or PROFIsafe system therefore a valid address must be set 4 2 User manual IC220SDL543 September 201 1 GFK 2730 Overview of the switch ositions P Table 4
110. ned clock output Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Input to non assigned clock output Yes Cross No See Note about cross circuits on page 7 14 circuit Clock output to clock output Yes Cross No The error is detected for inputs which are assigned to the clocked circuit clock output In this case please note that the failure detection time depends on the switch position Short circuit Input to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation Clock output to ground Yes Short No The error is detected as a change in state from 1 to 0 circuit The error is also detected as a short circuit of the clock output UTx ON The affected clock output is disabled i Early error detection e g by testing the safety function at regular intervals is required as an accumulation of errors may result in the loss of the safety function Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time tFiter 3 ms 3 ms Application
111. ng Air pressure Operation 80 kPa to 108 kPa up to 2000 m above sea level Storage transport 66 kPa to 108 kPa up to 3500 m above sea level GFK 2730 Chapter 11 Technical data and ordering data 11 1 11 General data Degree of protection Housing material Air and creepage distances Protection class IP20 Plastic PBT self extinguishing VO According to IEC 60664 1 Ill PELV Gases that may endanger functions according to DIN 40046 36 DIN 40046 37 Sulfur dioxide SO2 Hydrogen sulfide H2S Resistance of the housing material to termites Resistance of the housing material to fungal decay Ambient compatibility Connection data for VersaPoint connectors Connection method Conductor cross section Mechanical requirements Vibration according to IEC 60068 2 6 Shock according to IEC 60068 2 27 Safety characteristics according to IEC 61508 EN 61508 Achievable SIL Probability of a dangerous failure on demand by the safety function PFD Probability of a dangerous failure per hour for the entire module PFH Hardware fault tolerance HFT of the module Permissible duration of use Safety characteristics according to DIN EN 62061 Achievable SIL claim limit Safe failure fraction SFF Concentration 10 0 3 ppm Ambient conditions Temperature 25 C 2 K Humidity 7596 5 Test duration 10 days Concentration 1 0 3 ppm Ambient conditions Temperature 25 C 2 K Humidity 7
112. o prevent simple manipulation Are measures planned to prevent connectors being mixed up da a a a a oO ole Are requirements for the sensors and cable installation observed according to the SIL SIL CL Cat PL to be achieved and is the corresponding implementation planned Are the specifications for the parameterization for each channel specified Has it been ensured that any person intentionally starting hazardous movements has a direct view of the danger zone 10 Does the planned use correspond to the intended use 11 Are the ambient conditions observed according to the technical data 12 Have test intervals been defined O UO O Oy LI No Requirement optional Yes No Remark 13 Have the accessories to be used been planned according to the q EHI ordering data in this user manual cables connectors 14 Have specifications for assembly and electrical installation been oligo defined e g EPLAN and communicated to the relevant personnel 15 Have specifications for startup been defined and communicated to the 7 7 relevant personnel Date Signature test engineer 1 Date Signature test engineer 2 C 2 User manual IC220SDL543 September 2011 GFK 2730 C2 Assembly and electrical installation Checklist for assembly and electrical installation of the safety module Device type equip
113. odule according to the technical data and ambient conditions specified in Section 11 Technical data and ordering data on page 11 1 and onwards Within a VersaSafe or PROFIsafe system the safety module can be used to achieve safety functions with the following requirements depending on the conditions of use Upto SIL 3 according to standard EN 61508 Upto SIL CL 3 according to standard EN 62061 Upto Cat 4 PL e according to standard EN ISO 13849 1 It is designed for connecting single channel or two channel sensors which can be used in association with safety technology For example the module can be used in the following applications Single or two channel emergency stop or safety door equipment Applications with enable button Applications with two hand control devices Applications with mode selector switches As secondary switchgear for safety related optical data links Safety circuits according to EN 60204 Part 1 GFK 2730 Chapter 1 For your safety 1 5 1 6 Documentation Latest documentation Make sure you always use the latest documentation Changes or additions to this document can be found on the Internet at http support ge ip com VersaSafe When working on the VersaSafe system and its components you must always keep this user manual and other items of product documentation to hand and observe the information therein User manuals For the controller used For VersaS
114. oes not change within the parameterized time a diagnostic message is generated An input is active when the state of the signal is equal to 1 Cross circuits between different inputs can only be detected if the input signals are assigned to different clock outputs and clocks are enabled for the clock outputs Please note that if a delayed change in state at one of the two inputs causes the safety switch to be switched on again this can result in delayed transmission of state 1 in the process data image of the inputs e g due to a loose contact ie me Example of correct and incorrect signal change 1 INO_Ch1 zig Ve EEE vu INO_Ch2 INO Ch1 Ch2 h Figure 7 5 Correct signal change 69403014 1 INO Ch1 0 1 INO_Ch2 6 INO Ch1 Ch2 69401029 Figure 7 6 Error during signal change In Figure 7 6 the condition that both signals must be in state 0 before the change in state from 0 to 1 is not met In this case diagnostic message 018x is generated Key for Figure 7 5 and Figure 7 6 INO_Ch1 Signal sequence at input 0 channel 1 INO_Ch2 Signal sequence at input 0 channel 2 INO Safety related signal for two channel input 0 channel 1 and channel 2 at Ch1 Ch2 the safe controller PROFIsafe or the configurable safety module Versa Safe GFK 2730 Chapter 7 Connection examples for safe inputs 7 13 State evaluation The module evaluates the states of the inputs and t
115. omatically written to the module on every power up or reset The following conditions must be met The supply voltage is present The local bus is in the RUN state The communication connection has been established between the controller and safety module The module cannot be operated if it is not parameterized In this case the FS LED flashes The module is ready to operate if the parameters for all inputs and clock outputs are valid and transmitted without errors Valid input data is only read in this state In every other state the safe state is transmitted for each input O in the process image of the inputs If errors are detected during parameterization the parameterization data is not transmitted The invalidity of the parameterization is indicated on the module by the flashing FS LED In addition errors are indicated at the safe controller In this case check and correct the settings For information about error messages and instructions for their removal please refer to Errors Messages and removal on page 9 1 Assign the parameterizable F Parameters and iParameters For an overview of the module iParameters parameters and possible settings please refer to Appendix F Parameters and iParameters on page B 1 5 2 User manual IC220SDL543 September 201 1 GFK 2730 Two channel Single channel Position of the data in the process data word 5 3 Parameterization of the safe inputs The individual
116. or safe inputs on page 7 1 F_CRC_Length 3 byte CRC This parameter transmits the length of the CRC2 code to be expected in the safety telegram to the safe controller GFK 2730 Chapter B Appendix F Parameters and iParameters B 1 B Table B 1 Overview of the F Parameters for the module F Parameter Default value Description F_Block_ID 1 Parameter block type identification 1 The parameter block of the F Parameters contains the F_iPar_CRC parameter F_Par_Version Version number of the F Parameter block 1 Valid for V2 mode F_iPar_CRC 0 CRC checksum via the iParameters The value must be greater than 0 When verifying the safety function check whether the F_iPar_CRC parameter is greater than 0 for all devices If not check the iParameters and the CRC checksum in the iParameter and F Parameter B2 iParameters The iParameters are individual device parameters These include Device parameters see Parameterization of the safe inputs and Parameterization of clock outputs UT1 and UT2 PST Device ID 1046x for IC220SDL543 F Destination Address not included in the checksum calculation iPar CRC The device parameters are verified with a checksum iPar CRC F Destination Address This address is the PROFIsafe address of the module Make sure that it matches the switch position of the 10 pos DIP switch B 2 User manual IC22
117. or the application according to PL d Use sensors that can achieve the required safety integrity level To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 13 GFK 2730 Chapter 7 Connection examples for safe inputs 7 23 Device diagnostics and behavior of the module in the event of an error Table 7 11 Two channel equivalent Supply through a clock output clocked Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the affected inputs as the faulty input was not previously set to state 0 A contact will not close Yes Sym No On a change in state from 0 to 1 a 0 is transmitted in the metry process data image of the affected inputs as only one channel violation reports this change in state Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Cable interrupt between clock Yes None No Behavior when the input is in st
118. ort circuit 01Ex UT1 or Affected clock Check connector Yes 1 or overload UT2 ON output is disabled and cabling acknowledge error at all inputs if necessary Assigned inputs are x 0 Clock output UT1 set to 0 x 7 Clock output UT2 Acknowledging the diagnostic message deletes the message and re enables the clock output and the assigned inputs In your safe application program ensure that the system cannot be restarted unintentionally following acknowledgment of the diagnostic message Acknowledgment Yes 1 The clock outputs are also switched on and monitored when not parameterized If a short i circuit occurs at a clock output when it is in this state the clock output is switched off To exit the error parameterize the device and acknowledge the error message 9 3 Supply voltage errors Table 9 3 Supply voltage Uy errors Error cause Error code LED Remark Effect Remedy Acknow hex ledgment Undervoltage 01F0 UM Um below the All module inputs Check and supply Yes 1 Un flashing permissible voltage are in the safe state voltage level range Check supply line length and load Acknowledgment Yes 1 Undervoltage at Um Acknowledging the diagnostic message deletes the message and activates the inputs Supply voltage Uy is measured If Uy lt 17 V a diagnostic message is generated GFK 2730 Chapter 9 Errors Mes
119. output is switched off until the acknowledgment is received by the safety module see also Clock output UT1 and UT2 errors on page 9 5 IN Green LED Status of each input see Terminal point assignment on page 3 3 0 1 3 2 ON Input at logic 1 OFF Input at logic 0 il Even when the module is not parameterized the physical state at the inputs is indicated However substitute value 0 is transmitted to the safe controller GFK 2730 Chapter 2 Product description 2 9 Inputs 2 7 Safe state The safe state for the module is the transmission of the value equal to 0 in the image of the inputs to the safe controller PROFIsafe or the configurable safety module Versa Safe PROFIsafe The safe state for the F Input data is 0 The safe state is entered by means of passivation see iParameter on page A 2 The safe state can be entered in the following cases 1 Operating state 2 Error detection in I O devices 3 Device errors 4 Parameterization errors 2 7 1 Operating state In the operating state the inputs can enter states 1 or 0 In general state 0 is the safe state An exception is a non equivalent parameterized input For channel 2 of this input 1 is the safe state 0 is represented in the process data image of the two channel input Table 2 2 Operating state depending on the state of the inputs Type of input Operating state equals 1 in input state Operating state equals 0 safe
120. ply Basic specifications Sensor Single channel switch Sensor supply nternally through clock output UT1 or UT2 clocking disabled for each External 24 V Achievable SIL SIL CL Cat PL SIL 2 SIL CL 2 Cat 2 PL d A WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL cross circuits must be avoided Please note that in order to achieve the specified PL the sensor must have a medi um level of diagnostic coverage 90 to 99 and high MTTFd A high level of diag nostic coverage gt 99 is recommended for the application according to PL d Use sensors that can achieve the required safety integrity level 7 8 User manual IC220SDL543 September 2011 GFK 2730 Device diagnostics and behavior of the module in the event of an error Table 7 6 Single channel Supply through UT1 clocking disabled or UT2 clocking disabled external supply or OSSD Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open No None Yes The error cannot be detected and results in the loss of the safety function A contact will not close No None No The error cannot be detected Other errors Please take into cons
121. pter 1 For your safety 1 3 1 3 Safety of the machine or system The machine system manufacturer and the operator are solely responsible for the safety of the machine or system and the implemented application in which the machine or system is used The Machinery Directive must thus be observed Draw up and implement a In order to use the safety module described in this document you must have drawn up an safety concept appropriate safety concept for your machine or system This includes a hazard and risk analysis according to the directives and standards specified in Directives and standards on page 1 5 as well as a test report checklist for validating the safety function see Appendix Checklists on page C 1 il VersaSafe Please refer to the documentation for the configurable safety module used The target safety integrity level SIL according to EN 61508 SIL CL according to EN 62061 or performance level and category according to EN ISO 13849 1 is ascertained on the basis ofthe risk analysis The safety integrity level ascertained determines how to connect and parameterize the safety module within the overall safety function Within a VersaSafe or PROFIsafe system the safety module can be used to achieve safety functions with the following requirements depending on the conditions of use Upto SIL 3 according to standard EN 61508 Upto SIL CL 3 according to standard EN 62061 Upto Cat 4 PL e according to
122. puts The maximum achievable SIL SIL CL Cat PL is specified in the table In order to achieve this Observe the information in the connection examples see Section 7 Connection examples for safe inputs Observe the requirements of the standards with regard to the external wiring and the sensors to be used to achieve a SIL SIL CL Cat PL see Measures required to achieve a specific safety integrity level on page 7 3 Input Connection to the Single channel sensor or Two channel redundant controlling device sensor Intelli VersaPoint connec redundant sensor gent tors sensor Input signal Equivalent Non equivalent Clocking UT1 With Without 2x 1x Without 2x 1x Without UT2 Sensors that can be S connected So Contact based Yes Yes Yes Yes Yes Yes Yes Yes 9 2 With OSSD No Yes No No Yes No No No 39 outputs 3 D Achievable SIL SIL SIL2 SIL2 SIL2 SIL3 SIL3 SIL3 SIL3 SIL3 SIL3 SIL3 32 CL Cat PL SIL CL SIL CL SIL CL SIL CL SIL CL SIL CL SIL CL SIL CL SIL CL SILCL S 5 o o 99 2 2 2 3 3 3 3 3 3 3 Cat 3 Cat 2 Cat 2 Cat 4 Cat 4 Cat 3 Cat 4 Cat 4 Cat 4 Cat 3 PLd PLd PLd PLe PLe PLd PLe PLe PLe PLd For connection 7 6 7 8 7 10 7 15 7 17 7 26 7 29 7 34 7 37 7 45 example 7 20 7 40 see page 7 23 7 43 Key 5 Cat 3 can only be achieved with a redundant sensor The category that
123. quirements for controlling devices sensors on page 2 5 Please note that mechanical failure of the switching device can result in the loss of the safety function All errors that cannot be detected can result in the loss of the safety function Take appropriate measures to prevent such errors Suitable measures include for example protected cable installation or double insulation Please note the information in the following tables An accumulation of errors must not result in the loss of the safety function Following the third error evaluation can be aborted if the probability of further errors occurring is low Please take into consideration errors with a common cause 7 4 User manual IC220SDL543 September 2011 GFK 2730 7 3 Single channel assignment of safe inputs For the single channel assignment of safe inputs the inputs operate independently of one another The assignment of each input signal to the clock output can be freely selected For the following examples please note the resulting behavior in the event of an error il Note about cross circuits Please note that cross circuits with other inputs can only be detected if the input signals are assigned to different clock outputs and clocks are enabled for the clock outputs The cross circuit error results in the transmission of the safe state in the process data image of the affected inputs Remove the error and then acknowledge the message Pleas
124. ransmits the result to the safe controller PROFIsafe or the configurable safety module VersaSafe In the process data image of the safe inputs A 0 is transmitted if a 0 signal is present at at least one of the two inputs or an error has been detected A i is transmitted if a 1 signal is present at both inputs and no error has been detected and the conditions are met for a change in state according to Figure 7 6 7 4 1 Notes about errors for two channel equivalent assignment of safe inputs For the following examples please note the resulting behavior in the event of an error Note about cross circuits The cross circuit error results in the transmission of the safe state in the process data image of the affected inputs Remove the error and then acknowledge the message Acknowledging the diagnostic message deletes the message and activates the input The states at the input are detected immediately In your safe application program ensure that the system cannot be restarted unintentionally following acknowledgment of the diagnostic message Please observe the maximum failure detection time of 80 ms Exceptions in the failure detection time are indicated in the tables If a 1 signal is present at the input and an error occurs a maximum of 80 ms elapses until the error is detected Within this time another 1 can also be transmitted even in the event of an error Within the failure detection time 80 ms max
125. rating state 2 10 Safety Notes 2 2 5 keinen 1 1 Security Seal 1 2 Sensor types een 5 4 Sensors Connection options seeeeeeee 2 7 Requirements eese 2 5 Standards icine SUD EU 1 5 Start inhibit due to symmetry violation 5 4 iC pa EE 8 1 Status Indicators etie a 2 8 Supply voltage UM intet th ete tacit 3 1 3 2 Symmetry neh eee lah 5 4 T nig a I 5 7 IF siete ate A SE SE A endet TERESE 5 7 UN eo ac bec er d etae eerte b c raft 5 7 Transmission speed uurssnnersnnnnenennnnennnner ernennen 1 2 fure nr Ba ae 4 2 U Usage correct anerkennen nu 1 5 V Validation nte ra 8 3 D 2 User manual IC220SDL543 September 201 1 GFK 2730
126. required 7 2 User manual IC220SDL543 September 201 1 GFK 2730 SIL SIL CL Performance level i il 7 2 Measures required to achieve a specific safety integrity level The safety integrity level SIL SIL CL performance level and category that can be achieved is specified for each connection example In order to determine the probability of failure according to EN 61508 SIL use the standard In order to determine the probability of failure according to EN 62061 SIL CL use this standard When the SIL SIL CL is specified the module takes up 1 of the specified SIL SIL CL Table 7 4 PFD and PFH depending on the SIL SIL CL PFD PFH SIL 2 SIL CL 2 1 of 10 1 of 10 SIL 3 SIL CL 3 1 of 103 1 of 107 Use standard EN ISO 13849 1 to determine the performance level Category In order to actually achieve the specified category the required measures listed below must be implemented Cat 2 Use proven and basic safety principles according to EN ISO 13849 2 Use appropriately qualified sensors see Requirements for controlling devices sensors on page 2 5 Please note that mechanical failure of the switching device can result in the loss of the safety function Take appropriate measures e g fuse protection redundancy positive opening etc to ensure that the contacts can be opened e g following welding or mechanical failure when a switch is a
127. s Input assigned to the clocked Yes Cross No See Note about cross circuits on page 7 32 clock output to non assigned clock circuit output Input not assigned to a clock Yes Sym No The error is detected on a change in state as the state only changes output to non assigned clock metry in one channel output violation Clock output to clock output Yes Cross No The error is detected for inputs which are assigned to the clocked circuit clock output Error detection depends on the switch position The error is detected if the input assigned to the clocked clock output is active In this case please note that the failure detection time depends on the switch position Short circuit Input assigned to the clocked Yes Cross No The error is detected by the absence of the clock pulses of the clock clock output to external 24 V circuit output Input not assigned to any clock Yes Sym No The error is detected on a change in state as the state only changes output to external 24 V metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Input to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation GFK 2730 Chapter 7 Connection examples for safe inputs 7 41 7 Table 7 16 Two channel non equiv
128. s Application specific same for both inputs Symmetry 10 ms 10 ms Application specific same for both inputs Clock selection pulse selection UT1 or UT2 No assignment Or vice versa Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Non equivalent Non equivalent Same for both inputs Clock outputs UT1 ON UT2 any For specified clock selection 7 42 User manual IC220SDL543 September 2011 GFK 2730 7 7 5 5 Two channel non equivalent Supply through a clock out put clocking enabled S1 S1 S2 INI_Ch1 S 4 Two switching elements UT1 UT2 IN1 Ch2 gt gt S2 Supply through UT1 or UT2 UT1 UT2 O8 69404223 Figure 7 24 Two channel non equivalent assignment of inputs supply through UT1 or UT2 clocked Basic specifications Sensor Two channel non equivalent Sensor supply Internally through clock output UT1 or UT2 clocked Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 4 PL e A i WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the
129. s of the safety the inputs are assigned the same function as the safety switch is jumpered clock output Input to assigned clock output No None Yes The error cannot be detected and results in the loss of the safety function as the safety switch is jumpered Input to non assigned clock output No None Yes The error cannot be detected and results in the loss of the safety function as the safety switch is jumpered Clock output to clock output No None No The error cannot be detected as clocking is disabled GFK 2730 Chapter 7 Connection examples for safe inputs 7 11 7 Table 7 7 Single channel Supply through OSSD Error type Detec Diag Loss of Remark tion nostics SF Short circuit Input to external 24 V No None Yes The error cannot be detected and results in the loss of the safety function as the safety switch is jumpered Input to ground Yes None No The error is only detected as a change in state from 1 to 0 in state 1 of the input An unexpected change from 0 to 1 is possible e g due to a loose contact Ensure that such a change in state cannot restart the system unintentionally Clock output to external 24 V No None No The error cannot be detected as clocking is disabled Clock output to ground Yes Short No The affected clock output is disabled circuit UTx ON External 24 V to ground Yes None No The error is only detected as a change in state from 1
130. safe system can detect various errors within the safety equipment Repair work may not be carried out on the safety module In the event that an error cannot be removed please contact GE Intelligent Platforms immediately engage a service engineer or send the faulty module directly to GE Intelligent Platforms It is strictly prohibited to open the safety module housing In order to prevent the manipulation of the safety module and to detect the unauthorized opening of the safety module a security seal is applied to the module This security seal is damaged in the event of unauthorized opening In this case the correct operation of the safety module can no longer be ensured Take measures to prevent the incorrect connection polarity reversal and manipulation of connections 1 2 User manual IC220SDL543 September 2011 GFK 2730 A Direct indirect contact Power supply units for 24 V supply Insulation rating Installation and configuration A 1 2 Electrical safety WARNING Hazardous body currents and the loss of functional safety Disregarding instructions for electrical safety may result in hazardous body currents and the loss of functional safety In order to ensure electrical safety please observe the following points Protection against direct and indirect contact according to VDE 0100 Part 410 must be ensured for all components connected to the system In the event of an error parasitic voltages m
131. sages and removal 9 5 9 4 Parameterization errors Table 9 4 Parameterization errors Error cause Error code LED Remark Effect Remedy Acknow hex ledgment Incorrect See FS Each input and Module is in the Check and correct parameteriza Table 9 5 flashing clock output is safe state parameterization tion parameterized individually In order to determine what type of parameterization error has occurred use the corresponding software to access the safe controller PROFIsafe or the standard control system VersaSafe online and read the error Table 9 5 Parameterization errors Error code Short description Remedy hex dec 031x The filter time setting for the input is Correct value and resend parameter x 0 3 784 INO_Ch1 outside the permissible range data to the module INO_Ch1 IN3 Cht x 7 K 787 IN3_Ch1 INO_Ch2 IN3_Ch2 791 INO_Ch2 794 IN3_Ch2 032x The clock assignment for the input is Correct value and resend parameter x 0 3 800 INO Chi outside the permissible range data to the module INO Ch1 IN3 Cht i x 7 A 803 IN3_Ch1 INO_Ch2 IN3_Ch2 807 INO_Ch2 810 IN3_Ch2 033x The parameterization of two related Correct values and resend parameter x 0 3 816 INO Ch182 inputs does not correspond to the two data to the module INO Ch182 IN3 Ch182 channel setting 819 IN3 Ch182 034x The setting for the symmetry Inputs that are para
132. standard EN ISO 13849 1 Check hardware and Carry out a validation every time you make a safety related modification to your overall parameterization system Use your test report to ensure that The safe devices are connected to the correct safe sensors and actuators The safe input and output devices have been parameterized correctly The variables have been linked to the safe sensors and actuators correctly single channel or two channel 1 4 User manual IC220SDL543 September 201 1 GFK 2730 1 4 Directives and standards The manufacturers and operators of machines and systems in which the IC220SDL543 module is used are responsible for adhering to all applicable directives and legislation For the standards observed by the module please refer to the certificate issued by the approval body and the EC declaration of conformity These documents are available on the Internet at http support ge ip com 1 5 Correct usage Only use the VersaSafe or PROFIsafe system in accordance with the instructions in this section The IC220SDL543 safety module is designed exclusively for use in a VersaSafe or PROFIsafe system It can only perform its safety related tasks within the system if it has been integrated into the execution process correctly and in such a way as to avoid errors You must observe all information in this manual as well as in the documents listed in Documentation on page 1 6 In particular only use the m
133. state equivalent Single channel High 1 Low 0 Two channel equivalent High High 1 1 Other Two channel non High Low 1 0 Other Please observe the state transitions see Symmetry start inhibit on page 5 5 2 7 2 Error detection in I O devices If an error is detected at an input the safe state is set at this input and a 0 is represented in the process image of the input 0 safe state Depending on the parameterization the following errors can be detected at inputs Short circuit Cross circuit Overload short circuit of the clock outputs 2 10 User manual IC220SDL543 September 2011 GFK 2730 2 Inputs Serious errors The relevant diagnostic message is transmitted to the safe controller PROFIsafe or the configurable safety module VersaSafe see Safe digital input errors on page 9 3 For information about which errors are detected and when please refer to Connection exam ples for safe inputs on page 7 1 2 7 3 Device errors Device errors can lead to safe communication being set If a hardware fault in the internal circuit is detected at an input all module inputs enter the safe state and 0 values are represented in the process image of the inputs 0 safe state The relevant diagnostic message is transmitted to the safe controller PROFIsafe or the configurable safety module VersaSafe see Safe digital input errors on page 9 3
134. stics OFF Communications power is not present Flashing at Communications power present local bus not active 0 5 Hz Flashing at 4 Hz Communications power present error at the interface between previous and flashing terminal the terminals after the flashing terminal cannot be addressed E g loose contact at the bus interface terminal before the flashing terminal has failed another terminal was snapped on during operation not permitted il Observe the module startup time of approximately 16 s During this time the D LED flashes at 4 Hz and the bus cannot be started up ON Communications power present local bus active FS Red LED Failure state Flashing at 1 Hz Device not parameterized or parameterization was not accepted ON Hardware fault communication to safe controller PROFIsafe or configurable safety module VersaSafe disabled UM Green LED Monitoring the supply voltage Un OFF Communications power is not present Flashing at 1 Hz Uy below the permissible voltage range undervoltage ON Un Present P Green LED Status indicator for safe communication OFF No safe communication Flashing at 0 5 Safe communication running the controller requests operator acknowledgment Hz ON Safe communication running without errors UT1 UT2 Red LED Diagnostic message error for each clock output OFF No error Flashing at 1 Hz Cross circuit of an input with external signals ON Short circuit or overload of the clock output i The clock
135. t is only possible if the danger zone is visible If in the event of failure the safety module is replaced please proceed as described in Section 4 Assembly removal and electrical installation and Section 8 2 Restart after replacing a safety module GFK 2730 Chapter 9 Errors Messages and removal 9 9 9 10 User manual IC220SDL543 September 2011 GFK 2730 10 10 Maintenance repair decommissioning and disposal 10 1 Maintenance The device is designed in such a way that maintenance work is not required during the duration of use However depending on the application and connected I O devices it may be necessary to test the function of the I O devices and the safety chain at regular intervals The duration of use of the module is 20 years Repeat testing within this time is not required Carry out maintenance of connected I O devices e g light grid according to the relevant manufacturer specifications 10 2 Repair Repair work may not be carried out on the safety module In the event of an error send the module to GE Intelligent Platforms It is strictly prohibited to open the safety module In order to prevent the manipulation of the module and to detect the unauthorized opening of the module a security seal is applied to the module This security seal is damaged in the event of unauthorized opening In this case the correct operation of the safety module can no longer be ensured
136. tallation of the safety module only involves connecting the sensors The sensors are connected via VersaPoint connectors e Wire the connectors according to your application For the terminal point assignment please refer to Terminal point assignment on page 3 3 For wiring proceed as follows e Strip 8 mm off the cable VersaPoint wiring is normally done without ferrules However it is possible to use ferrules If using ferrules make sure they are properly crimped Pusha screwdriver into the slot of the appropriate terminal point Figure 4 6 detail 1 so that you can insert the wire into the spring opening GE Intelligent Platforms recommends using a SZF 1 0 6X3 5 screwdriver Insert the wire Figure 4 6 detail 2 Remove the screwdriver from the opening This clamps the wire User manual IC220SDL543 September 201 1 GFK 2730 6452B032 Figure 4 6 Connecting unshielded cables Insert the assembled connectors in the corresponding module slot see Terminal point assignment on page 3 3 Label all connections to prevent connections to the VersaPoint connectors being mixed up see GFK 2736 user manual GFK 2730 Chapter 4 Assembly removal and electrical installation 4 7 4 8 User manual IC220SDL543 September 2011 GFK 2730 5 Parameterization of the safety module VersaSafe address i Parameterization of the inputs and clock outputs 5 1 Parameterization
137. te about cross circuits on page 7 14 circuit Clock output to clock output Yes Cross No The error is detected for inputs which are assigned to different clock circuit outputs Short circuit Input to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation Clock output to ground Yes Short No The error is detected in state 1 or on a change in state from 0 to circuit 1 as the state only changes in one channel UTx ON The error is also detected as a short circuit of the clock output The affected clock output is disabled 7 16 User manual IC220SDL543 September 2011 GFK 2730 Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time tFilter 3 ms 3 ms Application specific same value Symmetry 10 ms 10 ms Application specific same value Clock selection pulse UT1 UT2 Or vice versa selection Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Equivalent Equivalent Clock output UT1 ON and UT2 ON 7 4 3 Two channel equivalent Supply through UT1 an
138. tected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the affected inputs as the faulty input was not previously set to state 0 A contact will not close Yes Sym No On a change in state from 0 to 1 a 0 is transmitted in the metry process data image of the affected inputs as only one channel violation reports this change in state Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Input Yes Sym No The error is detected in state 1 or on a change in state from 0 to Cable interrupt between clock metry 1 as the state only changes in one channel output and sensor or between violation sensor and input Cross circuit Input to input Yes Cross No The error is detected in state 1 circuit Input to assigned clock output Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs if
139. tember 2011 GFK 2730 Table of contents d ROP YOUPS IBD aaa 1 1 1 1 General safety notes eire iu e e emo utdiie 1 1 1 2 Electricalsafety o note be ee e eri ede sg 1 3 1 3 Safety of the machine or system unnserssennnennnnnnsnnnnnnnnnnennnnnnnnnnnnnnnnnn nennen 1 4 1 4 Directives and standards essent 1 5 1 5 Correct sage ege e dde or eet 1 5 1 6 Doc irnentatlons dcc io teen bas ettet innen 1 6 1 7 Abbreviations USCC 5 5 dee RE HR EG ai eE EREE AEE aa 1 7 2 Product descrpllOr sensere dete aste pie Poi eflet Cora mde imet adopta piod o D as taces 2 1 2 1 Brief description of the safety module s 2 1 2 2 Structure of the safety module sssseeeeeeeeneneenens 2 2 2 3 Housing dimersiols oett Heer i it c te ep rtt m ich ER 2 3 2 4 Safe digital inputs and clock outputs UT1 and UT2 sseeeeesess 2 4 2 4 1 Safe digital inputs lt tc siesta sens ati ea ene 2 4 2 4 2 Clock outputs UT1 and UT2 sra aan nedad dne 2 6 2 5 Connection options for sensors depending on the parameterization 2 7 2 6 Local diagnostic and status indicators ss 2 8 2 7 Sate State cci a C EDEN HEREIN 2 10 2 7 1 Op rating state oe uere re i eo ehe ree e Red 2 10 2 7 2 Error detection in I O devices ssssseeenn 2 10 2 7 8 Device GIrls u aan 2 11 2 7 4 Parameterization errors
140. tforms assumes no obligation of notice to holders of this document with respect to changes subsequently made Statement of legal authority GE Intelligent Platforms makes no representation or warranty expressed implied or stat utory with respect to and assumes no responsibility for the accuracy completeness suf ficiency or usefulness of the information contained herein No warranties of merchantabil ity or fitness for purpose shall apply How to contact us Up to date information on GE Intelligent Platforms products and our Terms and Conditions can be found on the Internet at www ge ip com Make sure you always use the latest documentation It can be downloaded at htto support ge ip com If there are any problems that cannot be solved using the documentation please contact your GE Intelligent Platforms subsidiary Subsidiary contact information is available at www ge ip com GE Intelligent Platforms Inc 2500 Austin Dr Charlottesville Virginia Phone 1 800 433 2682 Fax 1 780 420 2047 Should you have any suggestions or recommendations for improvement of the contents and layout of our manuals please send your comments to support ip ge com VersaPoint is a trademark of GE Intelligent Platforms Inc and or its affiliates All other trademarks are the property of their respective owners Copyright 2011 GE Intelligent Platforms Inc All Rights Reserved GFK 2730 User manual IC220SDL543 Sep
141. thout errors Valid input data is only read in this state In every other state the safe state is transmitted for each input O in the process image of the inputs If errors are detected during parameterization the parameterization data is not transmitted The invalidity of the parameterization is indicated on the module by the flashing FS LED In addition errors are indicated at the configurable safety module In this case check and correct the settings GFK 2730 Chapter 5 Parameterization of the safety module 5 1 PROFIsafe address Parameterization of the inputs and clock outputs F Parameters and 5 2 Parameterization in a PROFIsafe system Parameterization includes the following Assigning the PROFIsafe address via the configuration software of the control system manufacturer Parameterizing the inputs and clock outputs Assigning the parameterizable F Parameters and iParameters The PROFIsafe address is a unique ID for the safety module in the PROFIsafe structure It is assigned in the configuration software Set this address via the DIP switches prior to assembly see Setting the DIP switches on page 4 2 The parameterization of the safe inputs and clock outputs determines the behavior of the module and thus has a considerable effect on the safety integrity level that can be achieved To parameterize the module the parameterization of the safe controller created in the parameterization tool is aut
142. time teitter Minimum filter time 4 two channel or 8 single channel According to the requirements of EN 61131 2 Type 3 Via clock outputs UT1 and UT2 or external supply Approximately 4 2 mA at 24 V typical 2mA 3 1 mA 3 V to 30 V 3 V to 5 V 11 V to 30 V 10 Hz Can be parameterized see Parameterization of the safe inputs on page 5 3 1 5 ms accuracy 0 ms 0 5 ms User manual IC220SDL543 September 2011 GFK 2730 11 Safe digital inputs Processing time of the input Simultaneity Symmetry evaluation Derating Permissible cable lengths Status indicators tin tFiter Fw see Processing time of the input ty in the event of a safety demand on page 5 7 100 Yes can be parameterized accuracy 25 No 200 m from the clock output to the safe input total based on forward and return path One green LED per input see Local diagnostic and status indicators on page 2 8 i The switching state of the inputs is constantly monitored In the event of an error e g if a component fails the error is indicated at the safe controller PROFIsafe or a configurable safety module VersaSafe Clock outputs Number Supply Maximum switching current Saturation voltage Simultaneity Derating Permissible cable lengths Status indicators Diagnostic indicators Power dissipation If Uy 24 V no input is set without load at clock outputs UT1 and UT2 If Uy 24 V
143. tion of clock outputs UT1 and UT2 As long as the module is not parameterized The clock outputs are enabled if no errors are present Shortcircuit detection is activated Select the parameterization of clock outputs according to Table 5 2 Table 5 2 Parameterization of clock outputs Values Remark UT1 ON UT2 ON Clocking for UT1 and UT2 enabled UT1 ON UT2 OFF Clocking for UT1 enabled Clocking for UT2 disabled constant 24 V UT1 OFF UT2 ON Clocking for UT1 disabled constant 24 V Clocking for UT2 enabled OFF Clocking for UT1 and UT2 disabled constant 24 V Manufacturer and Setting for intelligent sensors sensor designation for additional information see separate documentation for intelligent sensors If clock outputs are parameterized without clock pulses no cross circuits or short circuits can be detected between the channels If clocking is enabled the clock output is operated with a maximum pulse width of 1 ms and a maximum period length of 80 ms The time offset between the clocks of the clock outputs is approximately 5096 of the period length If both channels of a two channel input are assigned the same clock output cross circuit detection has no effect GFK 2730 Chapter 5 Parameterization of the safety module 5 7 Typical pulse pattern for parameterization UT1 ON and UT2 ON 1 ms T 1 ms T 1 ms UT1 ME E dd APT 1 0 MM EM SSS SS HH
144. to assigned clock output Yes Sym No The error is detected on a change in state as the state only changes metry in one channel violation Input to non assigned clock output Yes Cross No See Note about cross circuits on page 7 32 circuit Clock output to clock output Yes Cross No The error is detected for inputs which are assigned to different clock circuit outputs Short circuit Input to ground Yes None No The error is detected on a change in state at the latest as the state only changes in one channel Clock output to ground Yes Short No The error is detected on a change in state at the latest as the state circuit only changes in one channel UTx ON The error is also detected as a short circuit of the clock output The affected clock output is disabled i An error in input circuit INx_Ch2 can only be detected in the event of a safety demand Early error detection e g by testing the safety function at regular intervals is required as an accumulation of errors may result in the loss of the safety function GFK 2730 Chapter 7 Connection examples for safe inputs 7 35 Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time trier 3 ms 3 ms Application specific same for both inputs Symmetry 10 ms 10
145. trical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a high level of diagnostic coverage gt 99 and high MTTFa Use sensors that can achieve the required safety integrity level To understand the change in state please refer to Example of correct and incorrect sig nal change on page 7 31 7 34 User manual IC220SDL543 September 201 1 GFK 2730 Device diagnostics and behavior of the module in the event of an error Table 7 14 Two channel non equivalent Supply through UT1 and UT2 both clocked Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor A contact will not open Yes Sym No The error is detected as the state only changes in one channel A contact will not close metry violation Other errors Please take into consideration all possible errors that can occur depending on the sensor in the sensor Error in the wiring Interrupt Input Yes Sym No The error is detected on a change in state at the latest as the state Cable interrupt between clock metry only changes in one channel output and sensor or between violation sensor and input Cross circuit Input to input Yes Cross No The error is detected if the other input is set to 1 circuit Input
146. uits are not detected by the device diagnostics but only on a change in state of the input signals as the state only changes in one channel Early error detection e g by testing the safety function at regular intervals is required as an accumulation of errors may result in the loss of the safety function Typical parameterization Parameterization Parameterized as Remark Input Channel 1 Channel 2 Assignment Used Used Evaluation Two channel Two channel Sensor type Standard sensor Standard sensor Filter time triter 3 ms 3 ms Application specific same value Symmetry 10 ms 10 ms Application specific same value Clock selection pulse UT1 UT2 Or vice versa selection Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs Input signal Equivalent Equivalent Clock output UT1 ON and UT2 OFF 24 V Or vice versa GFK 2730 Chapter 7 Connection examples for safe inputs 7 19 7 4 4 Two channel equivalent Supply through a clock output clocking enabled and external supply S1 S1 S2 IN1_Ch1 e Two switching elements UT1 UT2 Se UT1 UT2 Supply through UT1 or UT2 S2 On IN1 Ch2 pr 24V 9 70070018 XS Upply through external 24 V Figure 7 10 Two channel equivalent assignment of inputs supply through UT1 or
147. ust not occur single fault tolerance This can be achieved by Using power supply units with safe isolation PELV Decoupling circuits which are not PELV systems using optocouplers relays and other components which meet the requirements of safe isolation Only use power supply units with safe isolation and PELV according to EN 50178 VDE 0160 PELV This prevents short circuits between primary and secondary sides Make sure that the output voltage of the power supply does not exceed 32 V even in the event of an error When selecting the operating equipment please take into consideration the contamination and surge voltages which may occur during operation The IC220SDL543 module is designed for surge voltage category II according to DIN EN 60664 1 If you expect surge voltages in the system which exceed the values defined in surge voltage category II take into consideration additional measures for voltage limitation Please observe the instructions for installing and configuring the system see Documentation on page 1 6 WARNING Depending on the application incorrect installation and upgrades can pose serious risks for the user The user is obliged to design the devices used and their installation in the system according to these requirements This also means that existing plants and systems retrofitted with VersaSafe or PROFIsafe must be checked and tested again in this respect GFK 2730 Cha
148. ut and sensor or metry only changes in one channel between sensor and input violation Cross circuit Input to input Yes Sym No The error is detected as the state only changes in one channel metry violation Input to clock output assigned or Yes Sym No The error is detected as the state only changes in one channel not assigned metry Change in state from 1 to 0 violation The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Clock output to clock output No None No The error is not detected Short circuit Input to external 24 V Yes Sym No The error is detected on a change in state at the latest as the state metry only changes in one channel violation Input to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation Clock output to external 24 V No None No The error is not detected Clock output to ground Yes Short No The error is detected as a change in state from 1 to O pue The error is also detected as a short circuit of the clock output The affected clock output is disabled External 24 V to ground Yes Sym No The error is detected in state 1 or on a change in state from 0 to metry 1 as the state only changes in one channel violation Early error detection e g by testing the safety function at regular intervals is required H as an accumulation of errors may result in the
149. ut was not previously set to state 0 Input not assigned to a clock Yes Sym No The error is detected on a change in state as the state only changes output to clock output metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs Clock output to clock output Yes Cross No The error is detected for inputs which are assigned to the clocked circuit clock output GFK 2730 Chapter 7 Connection examples for safe inputs 7 21 7 Table 7 10 Two channel equivalent Supply through a clock output clocked and external supply Error type Detec Diag Loss of Remark tion nostics SF Short circuit Input assigned to the clocked Yes Cross No The error is detected by the absence of the clock pulses of the clock clock output to external 24 V circuit output Input not assigned to any clock Yes Sym No The error is detected on a change in state as the state only changes output to external 24 V metry in one channel violation Change in state from 1 to 0 The faulty input remains at 1 A 0 is transmitted in the process data image of the affected inputs Change in state from 0 to 1 A 0 is transmitted in the process data image of the inputs
150. violation is disabled The symmetry violation message does not result in the transmission of the safe state see also Symmetry start inhibit on page 5 5 The message must be acknowledged However the current status of the inputs is displayed in the process data image of the inputs Start inhibit due to symmetry violation is enabled The symmetry violation message results in the transmission of the safe state see also Symmetry start inhibit on page 5 5 The message must be acknowledged The current status of the inputs is displayed in the process data image of the inputs following acknowledgment The message can be used to monitor the wear of the safety switch GFK 2730 Chapter 7 Connection examples for safe inputs 7 33 7 5 2 Two channel non equivalent Supply through UT1 and UT2 clocking enabled for both S1 IN1_Ch1 S1 S2 Two switching elements UT1 amp IN1_Ch2 2 UT2 69404222 Figure 7 18 Two channel non equivalent assignment of inputs supply through UT1 and UT2 both clocked S1 IN1 Ch1 1 S2 Two switching elements UT2 G IN1 Ch2 32 UT1 69401226 Figure 7 19 Two channel non equivalent assignment of inputs supply through UT1 and UT2 both clocked Basic specifications Sensor Two channel non equivalent Sensor supply Internally through clock output UT1 and UT2 both clocked Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 4 PL e AN WARNING Loss of elec
151. ware 0170 All module inputs Power up with error Yes 3 fault are in the safe state free selftest Replacement Error during 018x _ Only for inputs Affected inputs in Set both inputs to Yes 1 signal change parameterized for the safe state the safe state x 0 3 INO Ch182 IN3_Ch1 amp 2 two channel operation implausible signal change at indicated input pair Acknowledgment Yes 1 Acknowledgment Yes 2 Acknowledgment Yes 3 Acknowledgment Yes 4 Acknowledging the diagnostic message deletes the message Acknowledging the diagnostic message deletes the message and activates the input The states at the input are detected immediately In your safe application program ensure that the system cannot be restarted unintentionally following acknowledgment of the diagnostic message Acknowledging the diagnostic message deletes the message The module can only be restarted following power up and error free selftest Start inhibit due to symmetry violation is disabled Acknowledging the diagnostic message deletes the message Start inhibit due to symmetry violation is enabled Acknowledging the diagnostic message deletes the message and activates the disabled inputs again 9 4 User manual IC220SDL543 September 2011 GFK 2730 9 2 Clock output UT1 and UT2 errors Table 9 2 Clock output errors Error cause Error code LED Remark Effect Remedy Acknow hex ledgment Sh
152. y level Device diagnostics and behavior of the module in the event of an error Table 7 7 Single channel Supply through OSSD Error type Detec Diag Loss of Remark tion nostics SF Error in the sensor Depends on the sensor Please take into consideration possible errors that can occur in the sensor Error in the wiring Interrupt Input Yes None No Behavior when the input is in state 1 Cable interrupt between clock The error is detected as a change in state from 1 to 0 An output and sensor or between unexpected change from 0 to 1 is possible e g due to a loose sensor and input contact Ensure that such a change in state cannot restart the system unintentionally Behavior when the input is in state 0 Please note that if this error causes the safety switch to be switched on again this can result in delayed transmission of state 1 in the process data image of the inputs e g due to a loose contact Input No None No The error must be detected by the sensor Cable interrupt between sensor The sensor must ensure that the safe state is entered in the event of an error and GND Cross circuit Input to input No None Yes The error cannot be detected and results in the loss of the safety the inputs are assigned different function as the safety switch is jumpered clock outputs Input to input No None Yes The error cannot be detected and results in the los
153. ymmetry 10 ms 10 ms Application specific same value Clock selection pulse UT1 No assignment Or vice versa selection Bouncing time monitoring Disabled Disabled Application specific bounce time monitoring Start inhibit due to symmetry Disabled Disabled Application specific violation same for both inputs 7 22 User manual IC220SDL543 September 2011 GFK 2730 Parameterization Parameterized as Remark Input signal Equivalent Equivalent Clock output UT1 ON UT2 any For specified clock selection 7 4 5 Two channel equivalent Supply through a clock output clocking enabled S1 S1 S2 IN1_Ch1 Two switching elements S2 UT1 UT2 IN1_Ch2 Supply through UT1 or UT2 UT1 UT2 69402030 Figure 7 12 Two channel equivalent assignment of inputs supply through UT1 or UT2 clocked Basic specifications Sensor Two channel equivalent Sensor supply Internally through a clock output UT1 or UT2 clocked Achievable SIL SIL CL Cat PL SIL 3 SIL CL 3 Cat 3 PL d AN WARNING Loss of electrical and functional safety To achieve the specified category please refer to Measures required to achieve a specific safety integrity level on page 7 3 Please note that in order to achieve the specified PL the sensor must have a medium level of diagnostic coverage 90 to 99 and medium MTTFd A high level of diagnostic coverage 9996 is recommended f

VersaSafe VersaPoint IC220SDL543 Safe Input Module

Contents

Download Pdf Manuals

Related Search

Related Contents