Safety Function: Door-Monitoring Interlock Switch
Contents
1. 24V DC with electric coil bifurcated contact 2 Setup and Wiring For detailed information on installing and wiring refer to the publications listed in the Additional Resources on the back cover System Overview The SensaGuard interlock switch is used to confirm that the guarded door is in the safe closed condition Hazardous motion is ceased or prevented whenever this door is not closed In addition to monitoring the state of the guarded door the SensaGuard switch monitors its outputs for all fault conditions The 440C CR30 configurable safety relay also detects an open wire fault a single channel fault or a short to OV at its SensaGuard switch inputs The 440C CR30 configurable safety relay monitors the pulse tested outputs that drive the safety contactor coils for all fault conditions The proper safe state of the safety contactors K1 and K2 is confirmed by the 440C CR30 configurable safety relay that is monitoring the feedback signals at SMF2 at start up Rockwell Automation Publication SAFETY AT133C EN P October 2015 5 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Electrical Schematic 24V DC Class 2 DC Com 440C CR30 22BBB 440 CR30 Configurable Safety Relay Bn Access Door W ji N UU 440N Z21U16A Bu Feedback 2080 IQ40B4 P1_00 Plug In 1 0 P1_01 800FP R611PQ10V 6 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Doo2. 440C CR30 safety relay must not respond Monitor the status indicator LEDs for proper operation and monitor the 440 CR30 safety relay for proper status by using Connected Components Workbench software Press and release the Reset button on the 440C CR30 safety relay The SOF1 of the 440C CR30 safety relay must energize The hazardous motion must not start Monitor the Status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software Press and release the external Start button Confirm that the motor starts and that the machine begins to operate Validation of Safe Response to Abnormal Operation The safety system responds properly to all foreseeable faults with corresponding diagnostics SensaGuard and 440C CR30 Configurable Safety Relay Tests Verification and Validation Pass Fail Changes Modifications Keep the guarded door closed While the hazardous motion continues to run remove the SensaGuard OSSD1 wire to terminal El_ 00 of the 440C CR30 safety relay The 440C CR30 safety relay must trip immediately The red Fault status indicator LED on the relay must blink Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software i R 2 Reconnect the wire to E1_00 The 440C CR30 safety relay must not respond Press and release the Reset button on the 4
3. CR30 safety relay respond Press and release the Restart button on the 440C CR30 safety relay Neither the SensaGuard switch nor the 440C CR30 safety relay respond Cycle power to the SensaGuard switch Approximately five seconds after power is restored to the SensaGuard switch its status LED turns steady green The blinking red Fault status indicator LED on the 440C CR30 safety relay turns OFF Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper Status by using Connected Components Workbench software Rockwell Automation Publication SAFETY AT133C EN P October 2015 25 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay 31 Press and release the Reset button on the 440C CR30 safety relay The red Safe Stop i stack light must be OFF The SOF1 output on the 440C CR30 safety relay must energize the contactors Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software Validation of Safe Response to Abnormal Operation The safety system responds properly to all foreseeable faults with corresponding diagnostics Contactor 440C CR30 Configurable Safety Relay Tests Test Step Verification and Validation Pass Fail Changes Modifications 1 While the machine continues to run break the connection between terminal EO_ 18 of the 440C CR30 configurable safe
4. Shift Alt Enter Properties Window F4 r1 eo CE Manane Helm Setinine Dhl hFI 2 Select 440C CR30 22BBB xogjoo azaag M4 S P Motor Control A P Graphic Terminals 8 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay 3 In the Project Organizer double click Guardmaster_400C_CR30 Guardmaster 440C CR30 Guardmaster 440C CR30 fer 440C_CR30 amp BOI aie 440C CR30 2 7BEB 2 Verification ID Remote Mode Fault a 4 Safety Relay Safety Relay Serial Port Hame Guardmaster440C_CR30 USB Port LED Configuration Faults Description Modbus Mapping a Plug In Modules Empty Vendor Allen Bradley Empty Catalog ID 440C CR30 226BB Firmware revision 6 002 4 To add the plug in I O module called for in this circuit right click the left plug in module space and choose the 2080 IQ4OB4 module DigitallO TIP The 1 0 module is shown in standard gray because it is not a safety 1 0 module That is permissible in this application because it is not used to connect safety signals Inputs such as Feedback and Reset button are not considered strict safety signals Using the standard 1 0 for these non safety signals can reserve the limited number of safety inputs and outputs for true safety signals Rockwell Automation Publication SAFETY AT133C EN P October 2015 9 Safety Function
5. monitor the 440C CR30 relay for proper status by using the Connected Components Workbench software 26 Rockwell Automation Publication SAFETY AT133C EN P October 2015 E E TC UY 24 5 2 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Close the guarded door The machine must not start The 440C CR30 relay must not respond Monitor the status indicator LEDs for proper operation and monitor the 440C CR30 relay for proper status by using the Connected Components Workbench software Press and release the Reset button on the 440 CR30 safety relay The 440C CR30 relay must not respond Monitor the status indicator LEDs for proper operation and monitor the 440C CR30 relay for proper status by using Connected Components Workbench software Replace the connection at P1_00 Cycle power to the 440C CR30 relay Press the Reset button on the 440C CR30 relay The 440C CR30 relay outputs must energize Press and release the external Start button Confirm that the motor starts and that the machine begins to operate Verification of the Configuration The system must verify the configuration of each individual application by using the Verify command If the 440C CR30 configuration safety relay is not verified it will fault after 24 hours of operation ATTENTION The verification process should be documented in the safety system s technical file Follow these steps to download and verify the
6. safety relay for proper status by using Connected Components Workbench software a Press and release the Reset button on the 440C CR30 safety relay Confirm that the Terminal 18 Terminal 19 and SOF1 output status indicator LEDs are green Monitor the Status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software ei Confirm that the hazardous motion does not start on powerup i a Press and release the drive Start button Confirm that the hazardous motion begins and that the machine begins to operate Press the external Stop button The machine must stop in its normal configured manner The safety system must not respond Press and release the external Start button Confirm that the hazardous motion starts and the machine begins to operate Open the guarded door The safety system must trip The hazardous motion must stop within less than 0 7 seconds Monitor the status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software Press and release the Reset button on the 440C CR30 safety relay The 440C CR30 it configurable safety relay must not respond Monitor the status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software Close the guarded door The machine must not start The
7. the Reset button on the 440C CR30 safety relay Press the external Start button The hazardous motion resumes i Bw 10 11 to 21 Repeat steps 1 to 10 using EO_ 19 in place of EO_ 18 and K2 in place of K1 22 Connect the A1 terminal of K1 to the A1 terminal of K2 After approximately 18 seconds the 440C CR30 safety relay must trip The hazardous motion coasts to a stop The red B Fault status indicator LED on the 440C CR30 safety relay is ON Disconnect the A1 terminal of K1 from the A1 terminal of K2 Press and release the Reset button on the 440C CR30 safety relay The 440C CR30 safety relay must not respond Cycle power to the 440C CR30 safety relay It responds The Fault status indicator LED on the 440C CR30 safety relay is OFF Press and release the Reset button on the 440C CR30 safety relay Press the external Start button The hazardous motion must resume Validation of Safe Response to Abnormal Operation The safety system responds properly to all foreseeable faults with corresponding diagnostics Contactor Feedback 440C CR30 Configurable Safety Relay Tests Verification and Validation Pass Fail Changes Modifications While the machine continues to run remove the K1 feedback connection at terminal P1_00 The machine must continue to run i S a 2 Open the guarded door The safety system must trip The hazardous motion must stop within less than 0 7 seconds Monitor the status indicator LEDs for proper operation and
8. 018 PT 6019 PT hi Feedback None bel gt Reset Type Manual Reset Input 14 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Connected Components Workbench software automatically assigns output terminals EO_18 and EO_19 Pulse Testing is the default for these terminals The default Reset Type is Manual Leave these settings at their defaults 3 Choose SMF 2 from the Feedback pull down menu Safety Output SOF 1 a Sie Immediate OFF Feedback E018 PT 4 E0193 PT F Reset Type Reset Input E018 PT e F019 PT i SMF 2 z Feedback Reset Type Manual Reset Input The safety output configuration is complete Safety Output bd a Immediate OFF y FO18 PT OY 6019 PT a m Feedback SMF 2 m Reset Type Manual Reset Input SMF 3 hi Configure the Logic The Logic section determines how the safety outputs respond to the safety monitoring inputs In this case the safety output follows the safety monitoring input directly 1 Click the blue dot on the right side of the SensaGuard Safety Monitoring input block It turns gray Rockwell Automation Publication SAFETY AT133C EN P October 2015 15 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay 2 Click the blue dot o
9. 40C CR30 safety relay The 440C CR30 safety relay must not respond Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software Pf Open and close the guarded door The red Fault status LED must be OFF Monitor all Status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software 24 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Press and release the Reset button on the 440C CR30 safety relay The SOF 1 output on the 440C CR30 relay must energize Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software Press the external Start button The machine must start to run Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software This step is optional in the following SensaGuard validation tests Steps 6 through 27 With the guarded door closed connect OSSD 1 to 24V DC After approximately 40 seconds the SensaGuard switch trips The 440C CR30 safety relay trips The red Fault Status indicator LED on the 440C CR30 safety relay must blink The status indi
10. 831 Diegem Belgium Tel 32 2 663 0600 Fax 32 2 663 0640 Asia Pacific Rockwell Automation Level 14 Core F Cyberport 3 100 Cyberport Road Hong Kong Tel 852 2887 4788 Fax 852 2508 1846 Publication SAFETY AT133C EN P October 2015 Supersedes Publication SAFETY AT133B EN P November 2014 Copyright 2015 Rockwell Automation Inc All rights reserved Printed in the U S A
11. Application Technique Allen Bradley Safety Function Door Monitoring Interlock Switch witha Configurable Safety Relay Products SensaGuard Switch Guardmaster 440C CR30 Configurable Safety Relay 100S C Safety Contactors Safety Rating CAT 4 PLe to ISO 13849 1 2008 Topic Page Important User Information 2 General Safety Information 3 Introduction 3 Safety Function Realization Risk Assessment 3 Safety Related Stop Safety Function 4 Safety Function Requirements 4 Functional Safety Description 4 Bill of Material 5 Setup and Wiring 5 Configuration 8 Calculation of the Performance Level 21 Verification and Validation Plan 23 Verification of the Configuration 27 Additional Resources 30 LISTEN dala Rockwell Allen Bradley Rockwell Software Automation Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Important User Information Read this document and the documents listed in the additional resources section about installation configuration and operation of this equipment before you install configure operate or maintain this product Users are required to familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes laws and standards Activities including installation adjustments putting into service use assembly disassembly and maintenance are required to be carried out by suitably trained personnel in accordance with ap
12. Door Monitoring Interlock Switch with a Configurable Safety Relay 5 Click the Edit Logic button to open the Connected Components Workbench Workspace master 440C CR30 Guardmaster 440C CR30 Guardmaster_440C_CR30 i t ra la Download Upload Edit Logic Build Verify 440C CR30 22BBB a Verification ID Remote Mode Fault A blank workspace appears Guardmaster 440C_CR30 Quick Tips Quick Tips Safety Monitoring Logic Level A Logic Level B 6 From the View pull down menu choose Toolbox View Debug Tools Communications Window F a e Project Organizer Ctrl Alt P amp Device Toolbox Ctri Alt D E Output Ctrl Alt 0 HHS Quick Tips Ctrl Alt Q A Cross Reference Browser Ctrl W Ctrl C Document Overview Parameters Toolbars E Full Screen Shift Alt Enter Properties Window F4 10 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay The Toolbox appears File Edit View Debug Tools Communications Window Help iN alsawalo c s A g ih emoeddedsotey S IF hd Me HE Ie al Ta u La a oo Ee ai d Ba LQ B Application Language Project Organizer am Toolbox X Guardmaster 440C_CR30 Logic amp GEIR Ete aa Ei EN
13. Fointer n are gt i d Emergency Stop Safety Monitoring Enabling Switch Feedback Monitoring Gate Switch Light Curtain Muting Reset Restart Safety Mats Single Wire Safety Input Two Hand Control un ia miin 4 Logic Functions bh Pointer D AND Alternative Device Configure the Inputs The Toolbox does not list a SensaGuard Safety Monitoring Function Follow these steps to configure one 1 Select Alternative Device Toolbox v A XA Guardmaster_ 440C_CR30 Logic x EI ER ORS 4 Safety Monitoring Functions Pointer es ee Safety Monitoring Enabling Switch Feedback Monitoring Gate Switch Light Curtain Muting Reset Restart Safety Mats Single Wire Safety Input Two Hand Control a i Ezz E D668 2c geo Joe ae 4 Logic Functions Alternative Dewice k Pointer 2 Dragit to the green block in the Safety Monitoring column and release it Connected Components Workbench software automatically assigns the first two available inputs EI_00 and EI_01 to the device Leave those as assigned Connected Components Workbench software automatically assigns the function name SMF 1 to this block By default the software assumes an electro mechanical device and assigns Test Sources The SensaGuard switch has two OSSD outputs and does not require Test Sources Rockwell Automation Publication SAFETY AT133C EN P October 2015 11 Safety Function Door Monit
14. NT Identifies information that is critical for successful application and understanding of the product Labels may also be on or inside the equipment to provide specific precautions SHOCK HAZARD Labels may be on or inside the equipment for example a drive or motor to alert people that dangerous voltage may be present BURN HAZARD Labels may be on or inside the equipment for example a drive or motor to alert people that surfaces may reach dangerous temperatures ARC FLASH HAZARD Labels may be on or inside the equipment for example a motor control center to alert people to potential Arc Flash Arc Flash will cause severe injury or death Wear proper Personal Protective Equipment PPE Follow ALL Regulatory requirements for safe work practices and for Personal Protective Equipment PPE gt gt gt 2 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay General Safety Information Contact Rockwell Automation to find out more about our safety risk assessment services IMPORTANT This application example is for advanced users and assumes that you are trained and experienced in safety system requirements assessment can require additional circuitry to reduce the risk to a tolerable level Safety circuits must take into consideration safety ATTENTION Perform a risk assessment to make sure all task and hazard combinations have bee
15. alculated according to the system s configuration E ve you performed all appropnate functional verification tests on the system Safety Verification ID IMPORTANT _ Allofthe boxes must be marked in order to Generate the Verification ID 5 Click Generate 6 Click Yes to proceed with the verification Connected Components Workbench y Performing a Safety Verify will change the safety relay to Program mode Proceed with the Safety Verify 7 Click Yes to change to Run mode 28 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay 8 Record the Safety Verification ID in the machine s documentation Connected Components Workbench Have you followed installation instructions and precautions to conform to applicable safety standards Have you verted that the electrical specifications of the sensor and inputs are compatible Have you verified that the electrical specifications of the outputs and the actuators are compatible Have you calculated the system s safety response time for each safety chain Is the system response time in proper relation to the process tolerance time Have probability PFD PFH PL values been calculated according to the system s configuration Have you performed all appropriate functional verification tests on the system This process is the feedback to the 440C CR30 relay that the system ve
16. ay 5 Click Download GUARDMASTER CR30 Logic Quick Tips Device Toolbox a Guardmaster 440C CR30 Guardmaster_440C_CR30 e F Edit Logic Build Verify 440C CR30 22BBB ies E g Verification ID Remote Program Mode e r i B E E May ce wp pika Fault lad d au papago dey BeSeooCecoee 6 In the Connection Browser expand the AB_VBP 1 Virtual Chassis and select the Guardmaster 440C CR30 22BBB Connection Browser Autobrowze Refresh Workstation NAUSCHMS5991BW1 as Linx Gateways Ethernet i es AB ETHIP 1 Ethernet AB VBP 1 1789 A17 4 Virtual Chassis l vee m 00 Workstation RSLinx Server i USB 7 Click OK 8 Click Yes to change from Run to Program mode Connected Components Workbench Safety relay is in Run mode Do you want to change to program mode Connected Components Workbench Download Complete amp Do you want to change the safety relay back to Run mode 20 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay 10 Click Edit Logic to see the online diagnostics Ragmi ierne TE Cmdm SC ELE Lepa E a rar i Narre Froid if E Di z tatei L e i T Taah Dea Pani Pea e wa aean CE Tr t comm M ii Su Eat T pjat L ina rpt input E Y T o Green indicates that a block
17. cator on the SensaGuard switch flashes red Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software 7 Disconnect OSSD 1 from 24V DC Neither the SensaGuard switch nor the 440C CR30 safety relay respond Press and release the Restart button on the 440C CR30 safety relay Neither the SensaGuard switch nor the 440C CR30 safety relay respond Monitor i all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software Cycle power to the SensaGuard switch Approximately five seconds after power is restored to the SensaGuard switch its status LED turns steady green The blinking red Fault status indicator LED on the 440C CR30 safety relay turns OFF Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper Status by using Connected Components Workbench software Press and release the Reset button on the 440C CR30 safety relay Monitor all status a indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper Status by using Connected Components Workbench software 10 Connect OSSD 1 to DC COM The 440C CR30 safety relay trips immediately The red Safe Stop stack light turns ON The amber Gate 1 stack light turns ON The red Fault status indicator LED on the 440C CR30 safety relay must blink The stat
18. configuration 1 Make sure the 440C CR30 relay is powered up and connected to your workstation via the USB cable 2 Confirm that the upper right hand corner of the Connected Components Workbench Project tab shows that the 440C CR30 relay is connected If it is not click Connect to Device to establish the software connection juardmaster 440C_CR30 x KEME Device Toolbox Guardmaster 440C_CR30 Logic E Guardmaster_440C_CR30 JE Connected Guardmaster_440C_CR30 t a 2d Download Upload Edit Logic Build Verify Rockwell Automation Publication SAFETY AT133C EN P October 2015 27 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay 3 Click Verify 30 x Quick Tips Device Toolbox pe Giardmaster 440C CR30 Guardmaster 440C CR30 Edit Logic Build Verify Safety Relay 440C CR30 227BBB 2 Verification ID Remote Mode Fault ETE et p WICI b Mae E ave you followed installation instructions and precautions to conform to applicable safety standards E e you verified that the electrical specifications of the sensor and inputs are compatible E we you verified that the electrical specifications of the outputs and the actuators are compatible E e you calculated the system s safety response time for each safety chain E sche system response time in proper relation to the process tolerance time E e probability PFO PFH PLs values been c
19. ction Door Monitoring Interlock Switch with a Configurable Safety Relay Guardmaster 440C_CR30 X Guardmaster_440C_CR30 Safety Monitoring 2 Select LED Configuration 440C CR3I0 22BBB gt Verification ID Remote Mode Fault 4 Safety Relay Serial Port USB Port Faults Modbus Mapping 4 Plug In Modules 2080 IQ40B4 Empty 3 For the Type Filter choose Terminal Status for LED 0 Input LEDs f LED Type Filter Not Used incised Notes Terminal Status Safety Monitoring Function Status Safety Output Function Status Value NotUsed fieira Value f Terminal 00 Terminal 00 Terminal 01 Terminal 03 Terminal 04 Terminal 05 Terminal 06 Terminal 07 Rockwell Automation Publication SAFETY AT133C EN P October 2015 17 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay The Status Indicator LED 0 is now configured to show the status of terminal 00 LED Type Filter Input LEDs SensaGuard OSSD 1 Status SensaGuard OSSD 2 Status SensaGuard Status Feedback Status Reset Status The input status indicator LEDs are now configured 6 Assign the three output LEDs as follows Output LEDs LED Type Filter Value Terminal Status Terminat18 Output Channel 1 Status emrases fremens z Output Channel 2 status Safety Output Status Not Used NotUsed Not Used hi Not Used 18 Roc
20. filled 99 High 100 High e fulfilled This safety related stop initiated by a safeguard safety function can be modeled as follows Input L logic Output E E E E E E E E E E E E E E E E i E E E E E E E E E E E E E E E E E E E E E E E E E E E 1008 E E E i E E E K1 E E E E E E E E z SensaGuard ie r s i E i E E E E z Switch i elay 3 z E E E E E E E E a i q 100S o i a E E E E E i K2 E E E E E E E E E E E E E E E E E Subsystem 1 Subsystem 2 u z Subsystem 3 a i E E E o E E E E E o E Because these are electro mechanical devices the safety contactors data includes the following e Mean Time to Failure dangerous MTTFd e Diagnostic Coverage DCayg e Common Cause Failure CCF Electro mechanical devices functional safety evaluations include the following e How frequently they are operated e Whether they are effectively monitored for faults e Whether they are properly specified and installed SISTEMA calculates the MT TFd by using B10d data provided for the contactors along with the estimated frequency of use entered during the creation of the SISTEMA project The DCavg 99 for the contactors is selected from the Output Device table of ISO 13849 1 Annex E Direct Monitoring The CCF value is generated by using the scoring process outlined in Annex F of ISO 13849 1 The c
21. il Installation Instructions publication 100S IN006 Provides instructions on how to install 100S safety contactors Industrial Automation Wiring and Grounding Guidelines publication 1770 4 1 Provides general guidelines on how to install a Rockwell Automation industrial system Safety Products Catalog publication 117 CA001 Provides information about Rockwell Automation safety products website http www rockwellautomation com rockwellautomation com catalogs overview page Product Certifications website available from the Product Certifications link on http Provides declarations of conformity certificates and other certification details www ab com Rockwell Automation Safety Resource Center http discover rockwellautomation com Provides information about Safety Automation Builder the Safety Evaluator Tool and SFTY_EN_tools aspx the SISTEMA tool Lets you download the SISTEMA tool as well as Rockwell Automation SISTEMA libraries and safety functions The SISTEMA Cookbook 1 available at http www dquv de ifa Praxishilfen Software Provides details on how to model safety functions in the SISTEMA tool SISTEMA SISTEMA Kochb C3 BCcher index 2 jsp You can view or download publications at http www rockwellautomation com literature To order paper copies of technical documentation contact your local Allen Bradley distributor or Rockwell Automation sales representative 30 Rockwell Automation Publication SAFETY AT133C EN P Oct
22. is True or that an input or output terminal is ON Flashing green indicates that a Safety Output Function is ready to be Reset The online diagnostics mode of the 440C CR30 relay can be very helpful during the verification process 11 Review the information in Calculation of the Performance Level on page 21 and Verification and Validation Plan on page 23 before proceeding with Verification of the Configuration on page 27 Calculation of the Performance Level When properly implemented this safety related stop function can achieve a safety rating of Category 4 Performance Level e CAT 4 PLe according to ISO 13849 1 2008 as calculated by using the SISTEMA software PL calculation tool The minimum Performance Level required PLr from the risk assessment for this safety function is PLd Project Safety functions y SF SensaGuard Safety related stop function initiated by safeguard Edit Rockwell Automation Publication SAFETY AT133C EN P October 2015 21 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Safety functiol sarety function w IFA Documentation Subsystems al Library gt Status Type Name PL FFH l h CCF score DCavg Bs MTTFd a 9 Category Requirements of the category y 5B Interlock Switch SensaGuard e f 112E 9 not relevant not relevant not relevant fulfilled hd SE CR 30 e SES not relevant notrelevant not relevant fulfilled y 5B 1005 Contactors ZATES 65 ful
23. kwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Confirm the Validity of the Build Follow these steps to confirm the validity of the logic by using the Build feature in Connected Components Workbench software 1 Click Guardmaster_440C_CR30 in the bar above the Workspace 2 Click Build gt ODT aa Device Toolbox Guardmaster 440C CR3 Guardmaster 440C CR30 440C CR30 22BBB saran B 2 Verification ID Remote Mode Fault Au Show output from Build EF az sy Sx Build started Project Safety Relay aes Build end If an error or omission is discovered during a build a message is displayed which details the error so that it may be corrected After you correct the error you need to perform the build again Save and Download the Project Follow these steps to save and download the project 1 From the File menu choose Save as to save the project IMPORTANT Saving the project with a new name closes the workspace window s 2 In the Project Organizer window double click Guardmaster_440C_CR30 to open the workspace 3 Power up the 440C CR30 safety relay 4 Connect the USB cable to the 440C CR30 relay Rockwell Automation Publication SAFETY AT133C EN P October 2015 19 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Rel
24. n identified and addressed The risk distance calculations which are not part of the scope of this document Introduction This safety function application example explains how to wire and configure a Guardmaster 440C CR30 configurable safety relay to monitor a SensaGuard non contact interlock switch The SensaGuard monitored door allows partial body access to the guarded area When that door is opened while the motor is running or a fault is detected in the monitoring circuit the 440C CR30 configurable safety relay de energizes the two 100S contactors removing power from the motor The hazardous motion coasts to a stop Safety Function Realization Risk Assessment The required performance level is the result of a risk assessment and refers to the amount of the risk reduction to be carried out by the safety related parts of the control system Part of the risk reduction process is to determine the safety functions of the machine In this application the performance level required PLr by the risk assessment is Category 3 Performance Level d CAT 3 PLd for each safety function A safety system that achieves CAT 3 PLd or higher can be considered control reliable Each safety product has its own rating and can be combined to create a safety function that meets or exceeds the PLr From Risk Assessment ISO 12100 1 Identification of safety functions 2 Specification of characteristics of each function 3 Determination of
25. n the left side of the Safety Output block to connect the logic Safety Monitoring Logic Level A Logic Level B Safety Output SMF 1 LLB1 SOF 1 _s e Pass e o Pass e sd Immediate OFF e ain Safety Device Through Through Feedback SMF 2 d Reset Type Manual v Advanced Settings Reset Input SMF 3 v Inputs 20SS5D v v Discrepancy 3 Time x50ms Input Filter 0 x25ms v v The completed logic looks like this Safety Monitoring Logic Level A Logic Level B Safety Output LLB1 SOF 1 foo e o Pas Pas Immediate OFF FO18 PT Through Through EI 01 ve 6019 v PT a S v Advanced Settings Inputs 2 OSSD Discrepancy Time x50ms Input Filter x25ms 4 b 2 0 4 gt SMF 2 P1_00 v Feedback Po e o SMF 3 Poa e o Q Configure the Status Indicators The 440C CR30 configurable safety relay provides ten user configurable input status indicator LEDs and six user configurable output status indicator LEDs In many cases they can be very helpful in installing commissioning monitoring and troubleshooting a 440C CR30 configurable safety relay system They do not affect the operation of the system in any way and it is not necessary to configure them but they are easy to configure and it is a recommended practice to use them 16 Rockwell Automation Publication SAFETY AT133C EN P October 2015 1 Click Guardmaster_440C_ CR30 Safety Fun
26. ober 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Notes Rockwell Automation Publication SAFETY AT133C EN P October 2015 31 Documentation Feedback Your comments will help us serve your documentation needs better If you have any suggestions on how to improve this document complete this form publication RA DU002 available at http www rockwellautomation com literature For more information on Safety Function Capabilities visit http marketing rockwellautomation com safety en safety functions Rockwell Automation maintains current product environmental information on its website at http www rockwellautomation com rockwellautomation about us sustainability ethics product environmental compliance page Allen Bradley Connected Components Workbench Guardmaster LISTEN THINK SOLVE Rockwell Automation Rockwell Software and SensaGuard are trademarks of Rockwell Automation Inc Trademarks not belonging to Rockwell Automation are property of their respective companies Rockwell Otomasyon Ticaret A Kar Plaza Is Merkezi E Blok Kat 6 34752 erenk y Istanbul Tel 90 216 5698400 www rockwellautomation com Power Control and Information Solutions Headquarters Americas Rockwell Automation 1201 South Second Street Milwaukee WI 53204 2496 USA Tel 1 414 382 2000 Fax 1 414 382 4444 Europe Middle East Africa Rockwell Automation NV Pegasus Park De Kleetlaan 12a 1
27. omplete CCF scoring process must be performed when actually implementing an application A minimum score of 65 must be achieved 22 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Verification and Validation Plan Verification and validation play important roles in the avoidance of faults throughout the safety system design and development process ISO 13849 2 sets the requirements for verification and validation The standard calls for a documented plan to confirm that all of the safety functional requirements have been met Verification is an analysis of the resulting safety control system The Performance Level PL of the safety control system is calculated to confirm that the system meets the required Performance Level PLr specified The SISTEMA software is typically used to perform the calculations and assist with satisfying the requirements of ISO 13849 1 Validation is a functional test of the safety control system to demonstrate that the system meets the specified requirements of the safety function The safety control system is tested to confirm that all of the safety related outputs respond appropriately to their corresponding safety related inputs The functional test includes normal operating conditions in addition to potential fault injection of failure modes A checklist is typically used to document the validation of the safety con
28. oring Interlock Switch with a Configurable Safety Relay 3 To properly configure the block open Advanced Settings and select 2 OSSD from the Inputs pull down menu Satety Monitoring EL 00 k EL O1 re Test Source A 12 Test Source B 13 Inputs Pulse Testing Discrepancy Time Sims Input Filter x25ms The resulting block appears as shown Safety Monitoring SMF 1 EI 00 ELOL Advanced Settings Inputs Discrepancy Time 50rns Input Filter 625m 4 Click drag and release a Feedback Monitoring Safety Monitoring function to the Safety Monitoring block below the SensaGuard block in the Workspace 4 Safety Monitoring Functions Pointer Emergency Stop I Enabling Switch bon JL hy eee f PECULO R AA CA E Gate Switch Light Curtain Feedback Monitoring Muting Reset Restart Safety Mats Single Wire Safety Input Two Hand Control Alternative Device 12 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Note that Connected Components Workbench software assigns this to input terminal EI_02 the next available Safety Input terminal The software assumes that this is a single input and automatically assigns the function name SME 2 to this block SMF 2 Ho2 e o i Feedback Inputs 1 Advanced Settings 5 Because the circuit requires two inputs one f
29. plicable code of practice If this equipment is used in a manner not specified by the manufacturer the protection provided by the equipment may be impaired In no event will Rockwell Automation Inc be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment The examples and diagrams in this manual are included solely for illustrative purposes Because of the many variables and requirements associated with any particular installation Rockwell Automation Inc cannot assume responsibility or liability for actual use based on the examples and diagrams No patent liability is assumed by Rockwell Automation Inc with respect to use of information circuits equipment or software described in this manual Reproduction of the contents of this manual in whole or in part without written permission of Rockwell Automation Inc is prohibited Throughout this manual when necessary we use notes to make you aware of safety considerations WARNING Identifies information about practices or circumstances that can cause an explosion in a hazardous environment which may lead to personal injury or death property damage or economic loss ATTENTION Identifies information about practices or circumstances that can lead to personal injury or death property damage or economic loss Attentions help you identify a hazard avoid a hazard and recognize the consequence gt gt IMPORTA
30. r Monitoring Interlock Switch with a Configurable Safety Relay 24V DC Class 2 DC Com 440C CR30 22BBB Al A2 440 CR30 Configurable Safety Relay El_00 EO_18 El_01 EO_19 100S C23EJ23BC O 100S C23EJ23BC L1 L2 L3 External Start Stop 2080 1Q40B4 P1_01 Plug In 1 0 ISO 13849 2 requires transient suppression across the load as a Basic Safety Principal The EJ electronic coil provides suitable suppression Rockwell Automation Publication SAFETY AT133C EN P October 2015 7 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Configuration The 440C CR30 relay is configured by using Connected Components Workbench software release 6 01 or later A detailed description of each step is beyond the scope of this document Knowledge of the Connected Components Workbench software is assumed Configure the 440C CR30 Relay Follow these steps to configure the Guardmaster 440C CR30 relay in Connected Components Workbench software 1 In Connected Components Workbench software choose View and then Device Toolbox i Project32 Connecte Cor Ji i I File Edit View Debug Tools Communications Window Help E H z i Qi Project Organizer Ctrl Alt P Ctrl Alt X Error List Ctrl Alt E Output Ctri At 0 KEDE Quick Tips Ctril Alt Q Tug Cross Reference Browser Ctrl W Ctrl C j 5m ss Document Overview M eve Parameters om i Toolbars b Full Screen
31. required PL PLr for each safety function To Realization and PL Evaluation Rockwell Automation Publication SAFETY AT133C EN P October 2015 3 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Safety Related Stop Safety Function This application includes one safety function Safety related stop initiated by a SensaGuard switch Safety Function Requirements Opening the door trips the SensaGuard switch and stops the hazardous motion by removing power to the motor The hazardous motion coasts to a stop Once the door is closed and the 440C CR30 configurable safety relay is reset power is not restored to the motor until the motor is given an external Start command a deliberate second action Faults at the SensaGuard switch wiring terminals 440C CR30 configurable safety relay or 100S contactors are detected before the next safety demand This circuit can connect to and interrupt power to motors rated up to 12A 600V AC Personnel must not be able to open the door and reach the hazardous motion before it has stopped The nearest hazard is a 32 inch reach from the door Testing has shown that the quickest time between the start of a person opening the door and that person reaching the nearest hazard is 1 5 seconds Calculations based on the worst case stopping time must be done to be certain that the safety system does not permit a person to open the door and reach a moving hazard Testing has shown that the
32. rification and functional tests have been completed The unique verification ID can be used to check if changes have been made to a configuration file Any change to the configuration removes the Safety Verification ID Subsequent Verify actions generate a different verification ID The Safety Verification ID is displayed in Connected Components Workbench software only when you are connected to the 440C CR30 relay Rockwell Automation Publication SAFETY AT133C EN P October 2015 29 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Additional Resources These documents contain additional information concerning related products from Rockwell Automation Resource Description SensaGuard18 mm Plastic Barrel Installation Instructions publication 440N IN010 Provides detailed information on how to install configure wire operate and troubleshoot a unique coded SensaGuard 18 mm plastic barrel Guardmaster 440C CR30 Software Configurable Safety Relay Quick Start Guide publication Provides information on how to configure a Guardmaster 440C CR30 configurable 440C 0S001 safety relay to communicate with a PanelView Component terminal via Modbus communication protocol Guardmaster 440C CR30 Configurable Safety Relay User Manual publication 440C UM001 Provides detailed information on how to install configure operate and troubleshoot a Guardmaster 440C CR30 configurable safety relay Safety Contactors with DC Co
33. rom each contactor change the number of inputs to 2 one for the N C contact from each 100S contactor 6 Assign the inputs to Plug In terminals PI_00 and PI_01 This avoids unnecessarily using Safety Inputs for feedback signals SMF 2 P1_00 rE gz Feedback Po eo Inputs 2 h Advanced Settings Input Filter pams Rockwell Automation Publication SAFETY AT133C EN P October 2015 13 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay 7 Click drag and release a Reset safety monitoring function to the Safety Monitoring block below the Feedback Monitoring block in the Workspace Pointer Emergency Stop Enabling Switch Gate Switch Light Curtain Muting Restart Safety Mats Reset Single Wire Safety Input i q a Feedback Monitoring dy A A Two Hand Control mn ml Connected Components Workbench software automatically assigns the function name SMF 3 to this block Alternative Device 8 Reassign the Reset Input to Plug In terminal PI_02 Advanced Settings W Configure the Outputs Follow these steps to configure the outputs 1 Click and drag Immediate OFF from the Safety Output Function Blocks section of the Toolbox 4 Safety Output Function Blocks k Pointer ON Delay OFF Delay Immediate OFF Jog Muting Lamp 2 Release it on the top block of the Safety Output column in the Workspace Safety Output Jy 6
34. trol system Prior to validating the system confirm that the Guardmaster 440C CR30 configurable safety relay has been wired and configured in accordance with the installation instructions Verification and Validation Checklist General Machinery Information Machine Name Model Number oe fee A C Configurable Safety Relay 440C CR30 22BBB Variable Frequency Drive Safety Contactor 100S C23EJ23BC Safety Wiring and Relay Configuration Test Step Verification Pass Fail Changes Modifications Confirm that all components specifications are suitable for the application Refer to Basic Safety Principles and Well tried Safety Principles from ISO 13849 2 Confirm that the configuration in the 440C CR30 configurable safety relay is the correct intended configuration Visually inspect the safety relay circuit to confirm that it is wired as documented in the schematics Normal Operation Verification The safety system properly responds to all normal Start Stop Reset E stop and SensaGuard switch inputs ooo omo a C S Rockwell Automation Publication SAFETY AT133C EN P October 2015 23 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay Confirm that the Terminal 00 Terminal 01 and SMF1 input status indicator LEDs of the 440 CR30 safety relay are green Confirm that all output status indicators are OFF Confirm that the Power and Run status indicator LEDs are green Monitor the 440C CR30
35. ty relay and the A1 terminal of the K1 coil The hazardous motion must coast to a stop 2 Press the external Stop button Restore the connection Press the external Start button to resume the hazardous motion 3 While the hazardous motion continues to run connect the A1 terminal of the K1 coil to 24V DC After approximately 18 seconds the 440C CR30 safety relay must trip K2 must de energize The hazardous motion coasts to a stop The red Fault status indicator LED on the 440C CR30 safety relay is ON 4 Disconnect the A1 terminal of the K1 coil from 24V DC Press and release the Reset button on the 440C CR30 safety relay The 440C CR30 safety relay must not respond 5 Cycle power to the 440C CR30 safety relay It responds The 440C CR30 safety relay Fault Status indicator LED is OFF Press and release the Reset button on the 440C CR30 safety relay Press the external Start button The hazardous motion must resume 7 While the machine continues to run short the A1 terminal of the K1 coil to DC COM The 440C CR30 safety relay must trip The red Fault status indicator LED on the 440C CR30 safety relay is ON Disconnect the A1 terminal of the K1 coil from DC COM Press and release the Reset button on the 440C CR30 safety relay The 440C CR30 safety relay must not respond Cycle power to the 440C CR30 safety relay The 440C CR30 safety relay responds The Fault status indicator LED on the 440C CR30 safety relay is OFF Press and release
36. us indicator on the SensaGuard switch flashes red Disconnect OSSD1 from DC COM Neither the SensaGuard switch nor the 440C CR30 safety relay respond Press and release the Restart button on the 440C CR30 safety relay Neither the SensaGuard switch nor the 440C CR30 safety relay respond i Cycle power to the SensaGuard switch Approximately five seconds after power is restored to the SensaGuard switch its status indicator LED lights steady green The amber Gate 1 stack light turns OFF The red Safe Off stack light remains ON The blinking red Fault status indicator LED on the 440C CR30 safety relay turns OFF Press and release the Reset button on the 440C CR30 safety relay The 440C CR30 safety relay s SOF 1 must energize the contactors Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software 14 to 27 Repeat steps 1 through 13 using El_01 in place of El_00 and OSSD 2 in place of OSSD 1 28 Connect OSSD 1 to OSSD 2 terminal El_ 00 to terminal El_01 After approximately 50 seconds the SensaGuard switch trips The 440C CR30 safety relay trips The status indicator on the SensaGuard switch flashes red Monitor all status indicator LEDs for proper operation and monitor the 440C CR30 safety relay for proper status by using Connected Components Workbench software 29 Disconnect OSSD 1 from OSSD 2 Neither the SensaGuard switch nor the 440C
37. wer to the motor The motor and the hazardous motion it drives coast to a stop Stop Category 0 The motor cannot be restarted while the monitored door is open Once 4 Rockwell Automation Publication SAFETY AT133C EN P October 2015 Safety Function Door Monitoring Interlock Switch with a Configurable Safety Relay the door is closed the motor can be restarted by pressing and releasing the Reset button to reset the 440C CR30 relay and then initiating the external Start to restore the motor power that is controlled by the 100S C contactors The SensaGuard switch monitors the status open or closed of the door The SensaGuard switch also monitors its two OSSD outputs for faults The 440C CR30 relay monitors the inputs from the SensaGuard switch for faults and it also monitors the status of the Reset and Feedback signals from the 100S C contactors The relay monitors its own outputs for faults as well These outputs control the 100S C contactors The 440C CR30 relay turns off its outputs and removes power to the motor when a fault is detected It does not reset until that fault is corrected Bill of Material This application uses these products 800FP R611 800F reset round plastic type 4 4X 13 IP66 blue R standard pack 1 440C CR30 22BBB Guardmaster 440C CR30 software configured safety relay PLe SIL 3 22 safety 1 0 embedded serial port USB 1 programming port 2 plug in slots 24 0V DC 100S C23EJ23BC MCS 100S C safety contactor 23A
38. worst case coast to stop time is 500 ms The total worst case hazardous motion stop time can be calculated as follows Activity Time in milliseconds SensaGuard switch response OFF time 54 440C CR30 configurable safety relay response OFF time 45 100S contactor response OFF time 20 Worst case coast to stop time 500 Total worst case hazardous motion stop time 619 This system fulfills the requirement of assuring that a person cannot reach the nearest hazard while that hazard is moving If it is not possible to stop the machine in time 500 ms is quite large then the designer must use a guard locking switch for example the new 440G LZ and allow access to the machine only when it has stopped and there are no hazards The safety function in this application technique meets or exceeds the requirements for Category 3 Performance Level d CAT 3 PLd per ISO 13849 1 and control reliable operation per ANSI B11 19 Functional Safety Description Personnel are protected from the hazardous motion by a fixed barrier Access to the hazardous area when necessary is through a swinging door The door is monitored by a SensaGuard non contact interlock which is connected to inputs of the 440C CR30 configurable safety relay The 440C CR30 relay controls two 100S C safety contactors which connected in a series control power to the motor that drives the hazardous motion Whenever this monitored door is opened the safety system removes po
Download Pdf Manuals
Related Search