SAFETY-AT018A-EN-P, Using a Guard Locking …...Safety Application Example Using a Guard Locking Interlock Switch and Light Curtains with DeviceNet Guard I/O and a GuardLogix Controller

Safety Application Example

Using a Guard Locking Interlock Switch and Light Curtains with DeviceNet Guard I/O and a GuardLogix Controller Safety Rating: Category 3, according to EN954-1

Introduction…………………………………………………………………... 1Important User Information…………………………………………………. 2General Safety Information…………………………………………………. 3Description……………………………………………………………………. 3Example Bill of Materials……………………………………………………. 4 Setup and Wiring…………………………………………………………….. 4Configure……………………………………………………………………... 7Programming………………………………………………………………... 14Performance Data…………………………………………………………... 21Additional Resources……………………………………………………….. 23

Introduction This safety application example describes how to connect the TLS1-GD2 guard locking switch, a light curtain and an emergency stop button into a GuardLogix controller using Guard I/O on a DeviceNet network.

Features and Benefits • On-machine installation with quick-disconnect wiring. • Guard locking interlocks. • Programmable safety logic. • Integration of light curtains into a GuardLogix safety system.

2

Publication SAFETY-AT018A-EN-P – September 2008

Important User Information Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety Guidelines for the Application, Installation and Maintenance of Solid State Controls (publication SGI-1.1 available from your local Rockwell Automation sales office or online at http://literature.rockwellautomation.com) describes some important differences between solid state equipment and hard-wired electromechanical devices. Because of this difference, and also because of the wide variety of uses for solid state equipment, all persons responsible for applying this equipment must satisfy themselves that each intended application of this equipment is acceptable.

In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment.

The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and diagrams.

No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this manual.

Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited.

Throughout this manual, when necessary, we use notes to make you aware of safety considerations.

Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury or death, property damage, or economic loss.

Identifies information that is critical for successful application and understanding of the product.

Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.

Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.

Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures.

3


General Safety Information

This application example is for advanced users and assumes that you are trained and experienced in safety system requirements.

A risk assessment should be performed to make sure all task and hazard combinations have been identified and addressed. The risk assessment may require additional circuitry to reduce the risk to a tolerable level. Safety circuits must take into consideration safety distance calculations which are not part of the scope of this document.

Contact Rockwell Automation to find out more about our safety risk assessment services.

Description This application shows how to control two safety contactors via a GuardLogix controller and two DeviceNet Guard I/O safety modules. These modules are wired into an emergency stop, a light curtain, and a guard locking interlock switch.

Safety Function The TLS1-GD2 interlock is a solenoid-operated guard locking switch which is used to maintain a gate in a locked state until a signal is received from the machine control. The TLS1 interlock switch has two normally-closed contacts that monitor the status of the actuator and one normally-closed and one normally-open contact that monitor the status of the solenoid. In this example the normally-closed contact is used for monitoring purposes. Internally, there is a jumper between terminals 12 and 41of the TLS1-GD2 switch. This jumper is installed in the factory and must be removed for the application described in this document. This wiring configuration lets the solenoid monitoring contact be wired to the GuardLogix controller. With this configuration, the safety system can prevent startup when the door is open or unlocked.

The safety gate remains closed and locked while the machine is running. Access to the hazardous area is accomplished by applying a signal to the solenoid in the TLS1-GD2 interlock. While the TLS1-GD2 interlock is unlocked or the gate is open, the hazards cannot start. For this example, the hazards are controlled by two 100S safety control relays. Also controlling the two safety contactors are a light curtain and an emergency stop button.

4


Example Bill of Material This safety application example uses these components.

Catalog Number Description Quantity 1756-L61S GuardLogix safety controller 1 1756-LSP GuardLogix safety partner 1 1756-A4 4-slot chassis 1 1756-ENBT/A Ethernet communication module 1 1756-PA72 ControlLogix power supply 1 1756-DNB DeviceNet communication module 1 1791DS-IB8XOB8 DeviceNet safety module with 8 inputs and 8

outputs 1

1791DS-IB12 DeviceNet safety module with 12 Inputs 1 800FM-MT44 E-stop button 40mm, maintained, twist-to-

release trigger action 1

800FP-F0 800F pushbutton, red 1 800FP-F0 800F pushbutton, amber 1 TLS1-GD2 Guard locking switch 1 889M-F12AH-2 Cord set 1 440L-P4K0160YD Pair of GuardShield light curtains 1 100S-C Safety contactors 2

Setup and Wiring For detailed information on installing and wiring, refer to the product

manuals listed in the Additional Resources on page 18.

System Overview

5


Wiring The following diagrams show the input and output wiring to the Guard I/O modules.

Input Circuit

6


Output Circuit

7


See the additional wiring information on the TLS1-GD2 below.

Contact Configuration – Red Switches A Safety A (N.C.)

B Safety B (N.C.)

C Aux A (N.O.)

D Solenoid Power

E Solenoid A (N.C.)

F Solenoid B (N.O.)

The jumper between terminals 12 and 41 has been removed for this application.

Brown Gray

Solenoid Power

Pink Green

Safety A

White Red/Blue

Safety B

Black Violet

Aux A

Gray/Pink Yellow

Solenoid A

12-pin, 12-wire Cordset 889M-F12AH-*

Blue Red

Solenoid B

Configure Follow these procedures to configure the Guard I/O modules.

Set the MAC ID Use the rotary switches to set the MAC ID. The MAC ID is set to 63 by default.

When you change the Node Address switch settings while power is on, an electrical arch can occur. This could cause an explosion in hazardous location installations. Be sure that power is removed or the area is nonhazardous before proceeding.

Set the 1791DS-IB8XOB8 rotary switches to address 2 and the 1791-DS-IB12 to address 3.

8


Add the 1791DS-IB8XOB8 Module to the RSLogix 5000 Project

In the RSLogix 5000 project, add the 1791DS-IB8X0B8 module to the I/O Configuration under the 1756-DNB DeviceNet bridge module.

Set the Module Properties

1. On the General tab of the 1791DS-IB8XOB8 Module Properties dialog, fill in these fields:

Name: unique module name Node number

9


2. Click Change to open the Module Definition dialog box. 3. Configure the module as shown.

Combined status consolidates all eight input status bits into a single status signal. The same is true for the output data. For status bits for individual input, output, and test points, choose an alternative data format.

4. Make edits on the Connection and Safety tabs to match your application requirements.

This application uses the default data in the Connection and Safety tabs as shown. Change this data based on the throughput requirements of your system.

10


Edit the Module’s Input Configuration 1. Click the Input Configuration tab. 2. Select one of the following for point operation type:

Standard – inputs are not internally tested. Safety – inputs circuits are tested internally. Safety Pulse Test – input circuits are tested internally and a

wired pulse-test source is connected.

3. Configure the test outputs.

11


4. Set up the outputs.

Add the 1791DS-IB12 Module to the RSLogix 5000 Project In the RSLogix 5000 project, add the 1791DS-IB12 module to the I/O Configuration under the 1756-DNB DeviceNet bridge module.

12


Set the Module Properties 1. On the General tab of the 1791DS-IB12 Module Properties dialog,

fill in these fields: Name: unique module name Node number

2. Click Change to open the Module Definition dialog box . 3. Configure the module as shown.

-

13


Edit the Module’s Input Configuration 1. Click the Input Configuration tab. 2. Select one of the following for point operation type:

Standard – inputs are not internally tested. Safety – inputs circuits are tested internally. Safety Pulse Test – input circuits are tested internally and a

wired pulse-test source is connected.

14


3. Configure the test outputs.

Programming This section describes how to program your GuardLogix project based

on the wiring and configuration detailed in the previous sections. The programming code for this application example was generated using the Safety Accelerator Toolkit for GuardLogix Systems, SAFETY-CL002A-EN-C, This toolkit provides easy-to-use system design, programming, and diagnostic tools to assist you in the rapid development and deployment of your safety systems using Rockwell Automation’s GuardLogix controller, Guard I/O modules, and safety devices.

15


Safety Tags The safety logic within this document requires the creation and use of the

following safety tags.

16


Safety Logic

The code shown in this document should be programmed in routines within your safety task. Here is an example of the layout.

Control of the Program – the Main Routine

To help simplify the code, each area of the machine control has been broken into separate routines. The following code is needed to call these routines.

Emergency Stop Safety Logic - Zone1 E-Stop

The emergency stop safety logic is created in the Zone1_Estop routine.

The E-stop instruction provides SIL 3 level diagnostics for a dual-channel emergency stop function. The E-stop monitors input channels for consistency and detects and traps faults with inconsistencies greater than 500 ms.

17


The Reset Type is configured as Automatic for continuous monitoring of input device states. Using automatic reset functionally moves the Safety Output Reset function from the E-stop instruction (Circuit Reset) to the Safety Output logic. Because the Circuit Reset function is not performed within this instruction, a dummy tag named None is used as a placeholder.

Input status is not monitored because the input data will go LO if the channel faults. The safety code in the safety output routine will prevent outputs from restarting if the E-stops reset automatically.

The Input OK status is used as one of the permissives in the safety output routines.

Light Curtain Safety Logic - Zone1 Light Curtain

The light curtain safety logic should be created within the Zone1_Light_Curtain routine.

The LC instruction provides SIL3 diagnostics for a dual-channel light curtain function. The LC instruction monitors dual input channels for consistency and will detect and trap (with inconsistencies greater than 500 ms).

The Reset Type is configured as Automatic for continuous monitoring of input device states. Using automatic reset functionally moves the Safety Output Reset function from the LC instruction (Circuit Reset) to the Safety Output logic. Because the Circuit Reset function is not performed within this instruction, a dummy tag named None is used as a placeholder.

18


TLS1-GD2 Door Interlock Switch Safety Logic - Zone1 Door Interlock Switch

The door interlock Switch Safety Logic should be created in the Zone1_Door_Interlock_Switch routine.

The TLS1-GD2 door-locking circuit contains two elements, a gate switch and a locking solenoid with feedback contact. This routine shows how to use instructions within RSLogix 5000 software to restrict access until a configured time period has elapsed.

Gate Switch Safety Logic

The RIN instruction provides SIL 3 level diagnostics for a channel redundant input function. The RIN monitors input channels for consistency and detects and traps faults (inconsistencies greater than 500 ms). In this circuit, the RIN instruction monitors the status of the two channels from the TLS1-GD2 interlock switch.

If the Zone 1 safety circuit is deactivated, this circuit starts a timer. This time is used to restrict access to the machine until the timer has completed.

19


When the timer expires, the Solenoid Enable is activated. The solenoid is turned off once the output enable is turned on.

Once the solenoid enable is activated, the ROUT instruction is enabled and turns on safety output tags O1 and O2. These tags activate the solenoid and the solenoid feedback contact is the monitored by the ROUT instruction.

Control of the Safety Contactors – Zone 1 Contactors

Safety Input Interlock Rung

This rung includes the safety device input interlocks, with tag names InputOK from the light curtain, E-stop, and door interlock switch routines. If these are all on, they energize the InputsOK OTE instruction to confirm that all the devices are in the correct state.

These interlock tags are driven by the individual safety device input logic rungs shown earlier. The Sts_Zone1_InputsOK tag is then included in the Output Enable Rung which drives the ROUT instruction.

Output Enable Rung This rung provides the operator action required to reset or enable the safety zone output. The operator action is a HI transition of Cmd_Zone1_Reset_PB. It latches the output enable until either a demand is placed on a safety input, there is an input channel or output channel fault, or a feedback fault on the output circuit. The Sts_Zone1_InputsOK will go LO in the event of a demand on any safety input or fault on any safety input channel within the zone.

20


The CombinedOutputStatus, InputStatus or OutputStatus signal goes LO if any output channel on the 1791DS Guard I/O module faults or there is a connection timeout to the I/O module. The FP feedback fault present drops out the output enable in the event of a feedback fault of either the contactors or the solenoid locking switch. In that case, reset or enable cannot occur without operator action.

Safety Output Rungs This rung controls the dual outputs on the 1791DS Guard I/O module named Zone1_Safety_Node_IB8XOB8. The ROUT instruction outputs, O1 and O2, are used to drive the safety outputs 01 and 02 (Tags: Zone1_Safety_Node_IB8XOB8:O.Pt01Data and Zone1_Safety_Node_IB8XOB8:O.Pt02Data) which are wired to the safety contactors.

Reassignment of the feedback and output channels must be made to match your unique safety wiring configuration.

21


Performance Data Worst Case Reaction Time Based on Safety System

Typically, both channels are HI coming from the interlock switch and the E-stop. If any one channel goes LO, the corresponding filter timer configured in the 1791DS-IB8OBV4 module starts. If the channel is still LO when the filter times out, the output is turned OFF.

Worst-case, the time it takes to occur is the sum of the A to E path as described below.

A – Input Module Delay – 16 ms + on/off delay filters B – Input Connection Reaction Time Limit (CTRL) The Connection Reaction Time Limit is configured in the 1791ES Module Properties dialog box within RSLogix 5000 software. The Input Connection defaults to 4 x RPI. C – GuardLogix Delay The maximum delay for the GuardLogix controller is: Period + Task Watchdog D – Output Connection Reaction Time Limit E – Output Module Delay = 6ms

Worst Case Reaction Time = A + B + C + D + E

22


Typical Reaction Time of Safety System Typically, both channels are HI coming from the interlock switch and the E-stop. If any one channel goes LO, the corresponding filter timer configured in the 1791DS-IB8OBV4 module starts. If the channel is still LO when the filter times out, the output is turned off.

Typically, the time it takes to occur is the sum of the A to E path as described below.

A – Input Module delay / (max/2) = 8ms + on/off delay filters B – Input Connection Reaction Time / Input RPI C – GuardLogix Delay The typical delay time for the GuardLogix controller is: (Period / 2) + Task Scan Time D – Output Connection Reaction Time / Output RPI = Task Period E – Output Module Delay / (max / 2) = 3ms

Typical Reaction Time = A + B + C + D + E

23


Additional Resources For more information about the products used in this example, refer to these resources.

Resource Description

Guard I/O DeviceNet Safety Modules User Manual, publication 1791DS-UM001

Provides general safety guidelines on using Guard I/O DeviceNet Safety modules.

GuardLogix Safety Application Instruction Set Reference Manual, publication 1756-RM095

Describes the safety application instruction set for the GuardLogix Controller.

Safety Accelerator Toolkit for GuardLogix Systems Quick Start, publication IASIMP-QS005

Describes how to use GuardLogix safety system design tools on the Safety-CL002 CD.

Safety Products Catalog S116-CA001A Provides an overview of safety product information.

GuardLogix Controller Systems Safety Reference Manual, publication 1756-RM093

Explains how the GuardLogix Controller can be used in safety applications.

You can view or download publications at http://literature.rockwellautomation.com. To order paper copies of technical documentation, contact your local Rockwell Automation distributor or sales representative.

http://literature.rockwellautomation.com/idc/groups/literature/documents/um/1791ds-um001_-en-p.pdf

http://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm095_-en-p.pdf

http://literature.rockwellautomation.com/idc/groups/literature/documents/qs/iasimp-qs005_-en-p.pdf

http://literature.rockwellautomation.com/idc/groups/literature/documents/ca/s116-ca001_-en-p.pdfhttp:/literature.rockwellautomation.com/idc/groups/literature/documents/ca/s116-ca001_-en-p.pdf

http://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm093_-en-p.pdf

http://literature.rockwellautomation.com

24


Allen-Bradley, ControlLogix, DeviceNet, GuardLogix, GuardShield, Rockwell Automation, and RSLogix5000 are trademarks of Rockwell Automation, Inc. Trademarks not belonging to Rockwell Automation are property of their respective companies.

Publication SAFETY-AT018A-EN-P – September 2008 Copyright © 2008 Rockwell Automation, Inc. All rights reserved. Printed in U.SA

Documents

SAFETY-AT018A-EN-P, Using a Guard Locking …...Safety Application Example Using a Guard Locking Interlock Switch and Light Curtains with DeviceNet Guard I/O and a GuardLogix Controller