Emergency Stop Safety Function
Contents
1. Safety Control System Modules Firmware Version GuardLogix Safety Controller 1768 L43S CompactLogix Ethernet Bridge 1768 ENBT POINT 1 0 Input Modules 1734 IB8S POINT 1 0 Output Modules 1734 0B8S GuardLogix Safety System Configuration and Wiring Verification Test Step Changes Modifications _ Verify the safety system has been designed in accordance with the GuardLogix System Safety Reference Manual 1756 RMO93 sare rd Reference Manual 1756 RM095 _ Vaainpec testy sstennewoandiwiedatiamenedntesdenatis sa as documented 5 Visually inspect the RSLogix 5000 application program to verify suitable safety certified instructions are utilized E The logic is readable understandable and testable with the aid of clear comments iene Monitor the status in the RSLogix 5000 Controller Tags window Bo oO Monitor the status in the RSLogix 5000 Controller Tags window Normal Operation Verification The GuardLogix safety system properly responds to all normal Start Stop Estop Lock and Reset Commands Initiate a Start Command Both contactors should energize for a normal machine run condition Verify proper machine status indication and RSLogix 5000 safety application program indication Initiate a Stop Command Both contactors should de energize for a normal machine Stop condition Verify proper machine status indication and RSLogix 5000 safety application program indication While Running press the E Stop pushbutton2. Performance Level d Cat 3 PLd per ISO 13849 1 and SIL3 per IEC 62061 and control reliable operation per ANSI B11 19 Throughout this manual when necessary we use notes to make you aware of safety considerations WARNING Identifies infomation about practices or circumstances hat can cause an explosion in a hazardous environment which may lead to personal injury or death property damage or economic loss Identifies information thal is critical for successful IMPORTANT applicalion and understanding of the product ATTENTION Identifies information aboul practices or circumstances that can lead to personal injury or death property damage or economic loss Aitentons help you identify a hazard avoid a hazard and recognize the CONSEQUETIOR SHOCK HAZARD Labels may be on or inside the equipment for example a drive or motor to alert people that dangerous voltage may be present BURN HAZARD Labels may be on or inside the equipment for example a drive or motor to alert people that surfaces may reach dangerous temperatures General Safety Information Contact Rockwell Automation to find out more about our safety risk assessment services This application example is for advanced users and assumes thal you are trained and experienced in safety system requirements IMPORTANT ATTENTION A risk assessment should be performed to make sure all task and hazard combinations have been identified and addressed Th
3. Function Realization Risk Assessment The required performance level is the result of a risk assessment and refers to the amount of the risk reduction to be carried out by the safety related parts of the control system Part of the risk reduction process is to determine the safety functions of the machine For the purposes of this document the assumed required performance level is Category 3 PLd Identification of safety functions Specification of characteristics of each safety function 3 Determination of required PL PLr for each safety function To Realization and PL Evaluation Emergency Stop Safety Function Emergency stop by actuation of an emergency stop push button Safety Function Reguirements Pressing of any one of the series wired E Stops will stop and pre vent hazardous motion by removal of power to the motor Upon resetting the E Stop pushbutton hazardous motion and power to the motor will not resume until a secondary action start button depressed occurs Faults at the E Stop button wiring terminals or safety controller will be detected before the next safety demand This Emergency Stop function is complementary to any other safeguards on the machine and shall not reduce the performance of other safety related functions The safety function in this example is capable of connecting and interrupt ing power to motors rated up to 9A 600VAC The safety function will meet the reguirements for Category 3
4. must create a new project and add the I O modules Then configure the I O modules for the correct input and output types A detailed description of each step is beyond the scope of this document Knowledge of the RSLogix programming environment is assumed Configure the Controller and Add I O Modules Follow these steps 1 In RSLogix 5000 software create a new project cich Pu napi rw See Crete In f Ages e LL a 2 Inthe Controller Organizer add the 1768 ENBT module to the 1768 Bus some ome mme om e e gt e o e a HO ZZ Trends 5 8 1 O Configuration 1 NHP Safety Reference Guide gt Safety Function Documents GSR 6A 130 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Configure the Controller and Add I O Modules 6 Select the 1734 AENT adapter and click OK cont 3 Select the 1768 ENBT module and click OK 1TH there idane 2 F r Tepes Pr Meda ITI Etharegt Adair Twegbed Far Meda 1732 Etheret Ariannir 2Fort Terini Par Mechs 1756 10 100 bep Ptheret Bridge 2 Part Tested ae 175 Eng Dom rrr briefs 17y iher onion Interface alge pcey fe Arh eet fer bryn yH bred il 7 Name the module type its IP address and click OK We used 192 168 1 11 for this application example Yours may be different 4 Name the module type its IP address and cli
5. Both contactors should remain de energized and open for a normal safe condition Verify proper machine status indication and RSLogix 5000 safety application program indication Repeat for all E Stop pushbuttons While Stopped press the E Stop pushbutton and initiate a Start Command Both contactors should remain de energized and open for a normal safe condition Verify proper machine status indication and RSLogix 5000 safety application program indication Repeat for all E Stop pushbuttons Initiate Reset Command Both contactors should remain de energized Verify proper machine status indication and RSLogix 5000 safety application program indication NHP Safety Reference Guide gt Safety Function Documents GSR 6A 138 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Verification and Validation Checklist Abnormal Operation Verification The GuardLogix safety system properly responds to all foreseeable faults with corresponding diagnostics E Stop Input Tests While Running remove the Channel 1 wire from the Safety 1 0 Both contactors should de energize Verify proper machine status 1 indication and RSLogix 5000 safety application program indication Restore Channel 1 and repeat for Channel 2 While Running short the Channel 1 of the Safety 1 0 to 24VDC Both contactors should de energize Verify proper
6. GuardLogix SAFETY FUNCTION DOCUMENTS L L a L L T L L C L L L L L L C gt L L L L lt L 7 Emergency Stop Q JS AB wy Authorised Distributor Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 LEIKR Introduction NHP Safety Reference Guide gt Safety Function Documents GSR 6A 126 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Introduction This Safety Function application note explains how to wire configure and program a Compact GuardLogix controller and POINT Guard I O module to monitor a series of dual channel safety E stop devices If any of the E stops is actuated or a fault is detected in the monitoring circuit the GuardLogix controller de energizes the final control device in this case a redundant pair of 100S contactors This example uses a Compact GuardLogix controller but is applicable to any GuardLogix controller Important User Information Solid state eguipment has operational characteristics differing from those of electromechanical eguipment Safety Guidelines for the Application Installation and Maintenance of Solid State Controls publication SGI 1 1 available from your loca
7. L Er rae ie Ionel BiEZDl Ionel MB 2lz_Zome1 Etip ll IrpuloR Zonei KIE2FF F se cd inel ub AE ebe LROLIT COnfigurekile Fesundant Oui CROUT Zoe KIRKE oT Fesdkack Tyne HES ATE Feedkack Reaction Time Meeci 5m os Aca Td fone AiE Tahle Dn FP Feecbsck 1 AVERT 1 LAO Dela Dn Feedbsck 2 LET LOY Geta 0 Inout Stelus AENT Ll CombinedinpuiSia TLE LE Durlpi Status BENT LG mte iui iot LES n Res Cmna_Jnne _Fauteeset 0FHT 1 Pisa ee g BERT 200 FEIDDei s 4 16E l LERT 200 PHO Data Enc NHP Safety Reference Guide gt Safety Function Documents GSR 6A 134 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Falling Edge Reset ISO 13849 1 stipulates that instruction reset functions must occur on falling edge signals To comply with this requirement add a One Shot Falling instruction to the rung immediately preceding the Cmd_Zone1_OutputEnable rung Then use the OSF instruction Output Bit tag as the reset bit for the following rung The Cmd_Zone1_OutputEnable is then used to Enable the CROUT instruction Modify the reset code as shown below a aei Fadbrygf je Tori TERMCOH fei HTHJFP wer gee ee L j i i F Sete Fiore eaaa pr mi LE a d p iir mws Fred wleb ind rr CROUT Drai EHO tri Fines Timi MES TE Petits Frac Tee glee SO eit ACB Cad Teri D
8. RM095 Safety Accelerator Toolkit for GuardLogix Systems Ouick Start Guide Publication IASIMP 0S005 Safety Products Catalog Description Provides information on configuring operating and maintaining Compact GuardLogix controllers Provides information on installing configuring and operating POINT Guard 1 0 Modules Contains detailed requirements for achieving and maintaining safety ratings with the GuardLogix controller system Provides detailed information on the GuardLogix Safety Application Instruction Set Provides a step by step guide to using the design programming and diagnostic tools in the Safety Accelerator Toolkit You can view or download publications at http www rockwellautomation com literature To order paper copies of technical documentation contact your local Allen Bradley distributor or Rockwell Automation sales representative NHP Safety Reference Guide gt Safety Function Documents GSR 6A 140 Safety Function Document Disclaimer The information contained in this and any related publications is intended as a guide only Every care has been taken to ensure that the information given is accurate at time of publication Neither NHP nor any of the manufacturers portrayed in this and any related publications accept responsibility for any errors or omissions contained therein nor any misapplications resulting from such errors or omissions Risk assessments should be conducted by authorized
9. Status to Combined Status Power and click OK Michie Defaite 14 Close the Module Properties dialog box by clicking OK 15 Repeat steps 10 14 to add the 1734 OB8S safety output module NHP Safety Reference Guide gt Safety Function Documents GSR 6A 132 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Configure the I O Modules Follow these steps to configure the POINT Guard I O modules 1 In the Controller Organizer right click the 1734 IB8S module and choose Properties 2 Click Input Configuration and configure the module as shown et are ere rt el aa T Th Th Hu i i 1 u i UN e a hymn quays i heey es ew il rear u k m a me dwb i un ol Ua as a r mni ha a ral chris r 1 y E P LCi a y db _ Em 4 Click OK In the Controller Organizer right click the 1734 OB8S module and choose Properties 6 Click Output Configuration and configure the module as shown 7 Click OK NHP Safety Reference Guide gt Safety Function Documents GSR 6A 133 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Programming The Dual Channel Input Stop DCS instruction monitors dual input safety devices whose main function is to stop a ma
10. chine safely for example an E stop light curtain or safety gate This instruction can only energize Output 1 when both safety inputs Channel A and Channel B are in the active state as determined by the Input Type parameter and the correct reset actions are carried out The DCS instruction monitors dual input channels for consistency Equivalent Active High and detects and traps faults when the inconsistency is detected for longer than the configured Discrepancy Time ms The Configurable Redundant Output CROUT instruction controls and monitors redundant outputs The reaction time for output feedback is configurable The instruction supports positive and negative feedback signals The safety application code in the safety output routine prevents outputs from restarting if the input channel resets automatically providing anti tiedown functionality for the Circuit Reset The Input OK status is used as a permissive in the safety output routines nos A g Dua channa npt Siop DCs Forel Egoi KET niety Function EMERGENCY STOP nait Type EGU ALENT 4AcTVEHGH FF O Ditrapancy Tite Tie 500 Resta Tyge ALT Ott ATi Cod Start Type ALT Ot ATK Channel A SEM 1 AOD sta Dn Channel El SEM 1 LAO Dota nl mpi Stsius SENT 1 1 CombinedinpuiSia iLrz nl Fed Cmd_tonel_Fauth set AENT 1 AHUS g Zone _Extop ot Sts _ Toned Ezbon 1 Wig Lc 1 J egaj z5AENTL LFEDADRIee Wik darned _SatetyRecel one 2 E ns ma Zonal ATA
11. ck OK We used 192 168 1 8 for this application example Yours may be different A Add the 1734 AENT adapter by right clicking the 1768 ENBT module in the Controller Organizer and choosing New Module 8 Click Change a a 1 1220 ENBTjAENBT Bok NHP Safety Reference Guide gt Safety Function Documents GSR 6A 131 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Configure the Controller and Add I O Modules cont 9 Set the Chassis Size as 3 for the 1734 AENT adapter and click OK Chassis size is the number of modules that will be inserted in the chassis The 1734 AENT adapter is considered to be in slot 0 so for one input and one output module the chassis size is 3 10 In the Controller Organizer right click the 1734 AENT adapter and choose New Module Ul Treads A LO Confguranon E Gl ise E B i 1768 2674 Bert haa Etna L76B ENBT A ENEIT 1734 AFNT fe AENT 11 Expand Safety select the 1734 IB8S module and click OK i Fw i DE ee Fyn i Peer de Y Poe Gor o ee 12 In the New Module dialog box name the device CellGuard_1 and click Change CUT EW j Gaeau eect Sates mean mne rys Center bm Sama hae EAR MYW ad GY Y bei pas 13 When the Module Definition dialog box opens change the Input
12. e risk assessment may require additional circuitry to reduce the risk to a tolerable level Safety circuits must take into consideration safety distance calculations which are not part of the scope of this document NHP Safety Reference Guide gt Safety Function Documents GSR 6A 128 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Functional Safety Description Hazardous motion is interrupted or prevented by actuation of any emergency stop pushbutton ES1 ES2 or ES3 Each E Stop is considered a separate safety function The E stop pushbuttons are connected in series to a pair of safety inputs of a Safety Input module SI1 The safety contactors K1 amp K2 are connected to a pair of safety outputs of a Safety Output module SO1 The I O modules are connected via CIP Safety over an EtherNet IP network to the Safety Controller SC1 The safety code in SC1 monitors the status of the E Stop pushbuttons using a pre certified safety instruction named Dual Channel Input Stop DCS When all conditions are satisfied no faults are detected on the input modules and the reset push button is pressed a second certified function block called Configurable Redundant Output CROUT checks the status of the final control devices a pair of 100S redundant contactors The controller then issues an output signal to
13. l Rockwell Automation sales office or online at http www rockwellautomation com literature describes some important differences between solid state eguipment and hard wired electromechanical devices Because of this difference and also because of the wide variety of uses for solid state eguipment all persons responsible for applying this eguipment must satisfy themselves that each intended application of this eguipment is acceptable In no event will Rockwell Automation Inc be responsible or liable for indirect or conseguential damages resulting from the use or application of this eguipment The examples and diagrams in this manual are included solely for illustrative purposes Because of the many variables and reguirements associated with any particular installation Rockwell Automation Inc cannot assume responsibility or liability for actual use based on the examples and diagrams No patent liability is assumed by Rockwell Automation Inc with respect to use of information circuits eguipment or software described in this manual Reproduction of the contents of this manual in whole or in part without written permission of Rockwell Automation Inc is prohibited NHP Safety Reference Guide gt Safety Function Documents GSR 6A 127 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Safety
14. machine 2 status indication and RSLogix 5000 safety application program indication Verify unable to reset and restart with fault Restore Channel 1 and repeat for Channel 2 While Running short the Channel 1 of the Safety 1 0 to OVDC Both contactors should de energize Verify proper machine Mi 3 status indication and RSLogix 5000 safety application program indication Restore Channel 1 and repeat for Channel 2 While Running short the Channels 1 amp 2 of the Safety 1 0 Both contactors should de energize Verify proper machine status 4 indication and RSLogix 5000 safety application program indication Restore Channel 1 amp 2 wiring GuardLogix Controller and Network Tests While Running remove the Ethernet network connection between the Safety 1 0 and the controller 1 All contactors should de energize Verify proper machine status indication and 1 0 Connection Status in the RSLogix 5000 safety application program Restore the Safety 1 0 module network connection and allow time to reestablish communication 2 Verify the Connection Status Bit in the RSLogix 5000 safety application program Repeat for all Safety 1 0 connections While Running switch the controller out of Run Mode All contactors should de energize Return key switch back to Run Mode 3 all contactors should remain de energized Verify proper machine status indication and RSLogix 5000 safety application program indication Safety Contactor Output Tests Initia
15. persons The purchaser and installer are responsible for ensuring the safety system s incorporating these products complies with all current regulations and applicable standards Products are subject to change without notice and may differ from any illustration s provided All products offered for sale are subject to NHP standard Conditions of Sale a copy of which is available on application NHP Safety Reference Guide gt Safety Function Documents GSR 6A 141
16. rding but are required due to intended use or reasonably foreseeable misuse of the machine The circuit is tested by using test pulses TO and T1 on the inputs lO and 11 These test pulses source the 24V DC for the circuit By periodically dropping the 24V DC to OV DC it is possible to detect cross channel faults and shorts to an external 24V DC Shorts to OV DC will be seen as an open circuit by the input and will be detected by either the hardware if configured to detect discrepancy errors or by the appropriate safety function block in the application code The final control device in this case is a pair of 100S safety contactors K1 and K2 The contactors are controlled by a 1734 OBS safety output module These are wired in a redundant configuration and are tested on start up for faults The start up test is accomplished by using a CROUT instruction to monitor the feedback circuit into input 7 I7 before the contactors are energized The system is reset by means of the momentary push button PB1 NHP Safety Reference Guide gt Safety Function Documents GSR 6A 129 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Electrical Schematic Pout Pew i 1 FM cae Qe Configuration The Compact GuardLogix controller is configured by using RSLogix 5000 software version 17 or later You
17. rocess must be done when implementing this example Cat 100 High DCavg ZZ 60 Low CCF 65 fulfilled PL PFH 1 h _ 2 Ca MT TFd a araea MTTFd a ERT i f DCava PAN neva i i L p i CEE Eu fe i dol Vn Safety 1 0 1734 0B85 Cat 100 High 99 High 65 fulfilled NHP Safety Reference Guide gt Safety Function Documents GSR 6A 136 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Verification and Validation Plan Verification and Validation play an important role in the avoidance of faults throughout the safety system design and development process ISO EN 13849 2 sets the requirements for verification and validation It calls for a documented plan to confirm all the Safety Functional Requirements have been met Verification is an analysis of the resulting safety control system The Performance Level PL of the safety control system is calculated to confirm it meets the Required Performance Level PLr specified The SISTEMA software tool is typically utilized to perform the calculations and assist with satisfying the requirements of ISO 13849 1 Validation is a functional test of the safety control system to demonstrate that it meets the specified requirements of the safety function The safety control system is tested to confirm all of the safet
18. te a Start Command Both contactors should energize for a normal machine run condition Verify proper machine status indication and RSLogix 5000 safety application program indication While Running remove the contactor feedback from the Safety 1 0 All contactors should remain energized Initiate a Stop 2 command and attempt a Reset command The system should not Restart or Reset Verify proper machine status indication and RSLogix 5000 safety application program indication While Running short the contactor feedback to the Safety 1 0 All contactors should remain energized Initiate a Stop command 3 and attempt a Reset command The system should not Restart or Reset Verify proper machine status indication and RSLogix 5000 safety application program indication NHP Safety Reference Guide gt Safety Function Documents GSR 6A 139 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Additional Resources For more information about the products used in this example refer to these resources Resource Compact GuardLogix Controllers User Manual Publication 1768 UM002 POINT Guard 1 0 Safety Modules Installation and User Manual Publication 1734 UM013 GuardLogix Controller Systems Safety Reference Manual Publication 1756 RM093 GuardLogix Safety Application Instruction Set Reference Manual Publication 1756
19. the safety output module SO1 to switch ON a pair of outputs to energize the safety contactors Bill of Material This application example uses these components EI dQ S00FM 800F Non illuminated Mushroom Operators Twist MT34MX02 To Release 30 mm Round Metal Red Metal Latch 3 Mount 2 N C Contact S 800F Reset Push Button Metal Guarded Blue R Metal Latch Mount 1 N 0 Contact S Standard Bulletin 100S C Safety Contactors 2 CompactLogix EtherNet IP Bridge Module Ea eee SON cha eo E safety memory 1734 1885 POINT Guard Safety Input Module 1734 0885 POINT Guard Safety Output Module 1783 US05T Stratix 2000 Unmanaged Ethernet Switch ty 1 800FM G611MX10 100S C09ZJ23C 1768 ENBT Setup and Wiring For detailed information on installing and wiring refer to the product manuals listed in the Additional Resources System Overview The 1734 IB8S input module monitors the inputs from the E stops which are connected in series This method conserves the number of inputs that are used but reduces the granularity of system diagnostics Typically E stops are not operated as often as a safety gate for example therefore the need to connect each E stop contact into its own dedicated input is reduced An E stop is considered to be a complementary safety device EN 12100 2 5 5 1 provides details on complementary protective measures These are measures which are neither inherently safe design nor safegua
20. umumi si F Calculation of the Performance Level When configured correctly the safety system can achieve a safety rating of PLd Cat 3 according to EN ISO 13849 1 2008 The Functional Safety Specifications of the project call for a Performance Level on PLd minimum and a structure of Cat 3 minimum A PFHd of less than 1 0 E 06 for the overall safety function is required for PLd i Moule Pr perlis AENT 1 i THIS Wy When modeled in SISTEMA each safety E stop string is treated as an individual safety function and can be modeled as follows This diagram shows a single E stop safety function l I Sub Syslim 1 NHP Safety Reference Guide gt Safety Function Documents GSR 6A 135 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Calculations are based on 1 operation of the E stop per month with 12 operations per year therefore 36 operations of contactors per year The Diagnostic Coverage Dcavg is reduced to 60 for the E stops because they are connected in series The measures against Common Cause Failure CCF are quantified using the scoring process outlined in Annex F of ISO 13849 1 For the purposes of the PL calculation the required score of 65 needed to fulfill the CCF requirement is considered to be met The complete CCF scoring p
21. y related outputs respond appropriately to their corresponding safety related inputs The functional test should include normal operating conditions in addition to potential fault inject of failure modes A checklist is typically used to document the validation of the safety control system Validation of software development is a process in which similar methodologies and techniques that are used in hardware development are deployed Faults created through poor software development process and procedure are systemic in nature rather than faults associated with hardware which are considered as random Prior to validating the GuardLogix Safety System it is necessary to confirm the safety system and safety application program have been designed in accordance with the GuardLogix System Safety Reference Manual 1756 RM093 and the GuardLogix Application Instruction Safety Reference Manual 1756 RM095 NHP Safety Reference Guide gt Safety Function Documents GSR 6A 137 Safety Function Documents GuardLogix Safety Function Emergency Stop Products GuardLogix Series Connection of E stops Safety Rating PLd Cat 3 to EN ISO 13849 1 2008 Verification and Validation Checklist GENERAL MACHINERY INFORMATION Machine Name Model Number Machine Serial Number Customer Name Test Date Tester Name s Schematic Drawing Number Controller Name Safety Signature ID Safety Network Number s RSLogix5000 Software Version
Download Pdf Manuals
Related Search