The Guardmaster™ 440C-CR30 Software …...The Guardmaster 440C-CR30 Software Configurable Safety Relay Training Demo Lab For Classroom Use Only! Important User Information This documentation,

The Guardmaster™ 440C-CR30 Software Configurable Safety Relay Training Demo Lab

For Classroom Use Only!

Important User Information

This documentation, whether, illustrative, printed, “online” or electronic (hereinafter “Documentation”) is intended for use only as a learning aid when using Rockwell Automation approved demonstration hardware, software and firmware. The Documentation should only be used as a learning tool by qualified professionals. The variety of uses for the hardware, software and firmware (hereinafter “Products”) described in this Documentation, mandates that those responsible for the application and use of those Products must satisfy themselves that all necessary steps have been taken to ensure that each application and actual use meets all performance and safety requirements, including any applicable laws, regulations, codes and standards in addition to any applicable technical documents. In no event will Rockwell Automation, Inc., or any of its affiliate or subsidiary companies (hereinafter “Rockwell Automation”) be responsible or liable for any indirect or consequential damages resulting from the use or application of the Products described in this Documentation. Rockwell Automation does not assume responsibility or liability for damages of any kind based on the alleged use of, or reliance on, this Documentation. No patent liability is assumed by Rockwell Automation with respect to use of information, circuits, equipment, or software described in the Documentation.

Except as specifically agreed in writing as part of a maintenance or support contract, equipment users are responsible for:

• properly using, calibrating, operating, monitoring and maintaining all Products consistent with all Rockwell Automation

or third-party provided instructions, warnings, recommendations and documentation;

• ensuring that only properly trained personnel use, operate and maintain the Products at all times;

• staying informed of all Product updates and alerts and implementing all updates and fixes; and • all other factors affecting the Products that are outside of the direct control of Rockwell Automation.

Reproduction of the contents of the Documentation, in whole or in part, without written permission of Rockwell Automation is prohibited. Throughout this manual we use the following notes to make you aware of safety considerations:

Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury or death, property damage, or economic loss.

Identifies information that is critical for successful application and understanding of the product.

Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions help you: • identify a hazard • avoid a hazard • recognize the consequence

Labels may be located on or inside the drive to alert people that dangerous voltage may be present.

Labels may be located on or inside the drive to alert people that surfaces may be dangerous temperatures.

3 of 74

The Guardmaster 440C-CR30 Software Configurable Safety Relay Lab

Contents

Before you begin ........................................................................................................................................... 4

About this lab .................................................................................................................................................................................... 4

Tools & prerequisites ........................................................................................................................................................................ 4

E-Stop Application ......................................................................................................................................... 5

Build and Download the Configuration File to the CR30 ................................................................................................................. 12

Operation of the Configured Safety Circuit ..................................................................................................................................... 14

Gate Switch and E-Stop Application ........................................................................................................... 17

Configuring the Indicator LEDs ....................................................................................................................................................... 27

Build and Download the Configuration File to the CR30 ................................................................................................................. 28

Operation of the Configured Safety Circuit ..................................................................................................................................... 29

Verification and Validation, Including Fault Detection and Visualization ......................................................................................... 32

I/O Expansion via Single Wire Safety ......................................................................................................... 38

Guard Locking Application .......................................................................................................................... 42

Operating the Guard Lock Application ............................................................................................................................................ 50

Zone Control Application (Optional – Time Permitting) .............................................................................. 52

Operating the Safety Zone Control Application............................................................................................................................... 57

Maintenance Mode Application (Optional – Time Permitting) ..................................................................... 59

Operating the Maintenance Mode Application ................................................................................................................................ 70

4 of 74

Before you begin

About this lab

The Guardmaster™ 440C-CR30 Software Configurable Safety Relay (CR30) is a new safety logic device from Rockwell

Automation™. In the context of a machine safety application, the CR30 fills the same purpose as a safety monitoring relay or

safety PLC – it monitors the status of several safety input devices and through simple logic configuration can control multiple

independent outputs. It is certified for use in safety applications up to and including Safety Integrity Level (SIL) 3 and

Performance Level (PL) e in which the de-energized state is the safe state.

The CR30 is based on the Micro800™ platform. The housing is red to signify it as a ‘safety device’ and to distinguish it from the

gray-colored ‘standard controllers’.

The CR30 has 22 embedded safety rated inputs and outputs and accepts up to two plug-in modules, each of which has 4

standard inputs and 4 standard outputs. The CR30 must be configured using a personal computer (PC) running the Allen-

Bradley™ Connected Components Workbench™ (CCW).

This lab provides an introduction to the CR30 and includes several example applications.

This lab takes approximately 80 minutes to complete.

Tools & prerequisites

For this Hands-On lab, you will need the following hardware and software.

� Connected Component Workbench Standard Edition, Revision 8 (released September , 2015)

� The CR30 Training Demo

� All CR30 configuration files will be built from scratch in this lab

� The PanelView Component program is pre-loaded onto the c400 in the demo – configuration of that device is beyond the

scope of this lab

5 of 74

E-Stop Application

We will start with the implementation of a simple E-Stop circuit. The CR30 detects when the E-Stop is pushed and immediately

removes power from the actuators, causing the hazardous motion to stop. Furthermore, as long as the E-Stop is engaged, the

safety circuit will prevent any hazardous motion. The safety circuit must be manually reset after the E-Stop has been released.

We will use a simple push button with N.O. contacts for the reset.

1. Double click the Connected Components Workbench icon to open the software.

2. In the Device Toolbox, expand the Catalog section, expand the Safety folder, and then double click the 440C-

CR30 to add this safety relay to the project.

The default position of the device toolbox is on the right, but it could be anywhere on the workspace

depending on how your preferences are set in CCW. If you don’t see the Device Toolbox on the workspace,

click View and then select Device Toolbox from the dropdown menu.

3. Click “OK”.

6 of 74

4. In the Project Organizer, double click on the Guardmaster 440C-CR30. The device will open on the

workspace.

5. In the Device Toolbox, click the small X to close this window. This gives us more screen real estate for

seeing our project in the other CCW windows.

6. On the graphical image of the CR30 on the main workspace, right click on the right-hand plug-in slot, hover

the mouse pointer over Digital IO, then click on the 2080-IQ4OB4 that appears to add it to the configuration.

One key feature of the CR30 is the ability to add standard I/O through the use of Micro800 plug-in modules

(bulletin 2080). These I/O can be used for signals in the safety circuit that are not safety rated, such as the

reset input, feedback monitoring, muting sensors, auxiliary outputs, etc. The CR30 in the demo includes one

2080-IQ4OB4 with four inputs and four outputs in plug-in slot 2 (the right-hand slot).

7 of 74

The plug-in module appears on the graphic:

7. Just above the large graphic of the CR30, click on “Edit Logic” to open the function block editor.

In order to build up the logic configuration of the CR30, we select Safety Monitoring Functions, Logic Blocks, and

Safety Output Functions from the Toolbox. The function block logic editor gives a visual representation of the

logic configuration.

8 of 74

8. Click and drag an Emergency Stop Safety Monitoring Function (SMF) from the Toolbox to the upper left hand

Safety Monitoring target block on the logic editor. (Another option is to double click on Emergency Stop in

the toolbox – it will automatically load this SMF to the green highlighted function target block on the editor.)

Note: The default position of the Toolbox is on the right, but it could be anywhere on the workspace

depending on the preferences set on your computer. Throughout this lab the Toolbox is shown on the left. If

you don’t see the Toolbox, click View (at the top of the screen) and select Toolbox from the dropdown menu.

Note that CCW has automatically assigned the next available terminals for both the inputs and the test sources.

Not only is terminal assignment automatic, but any necessary configuration of those I/O points is done

automatically by the software. Changing the terminals for each function is also easy as we will see in later labs.

Note that CCW has automatically “named” this “Emergency_Stop_1”. The name may be changed.

Right click near the E-Stop. Select “Rename”.

Rename this E-Stop “Operator_Station_1”

Names must begin with a character “F” or an underscore”_”. A valid name can contain both characters, numbers and

underscores. There can be no spaces or double underscores. CCW indicates naming errors with a red box.

9 of 74

The name above has two errors. A double underscore and a space. CCW will not force a name correction, but will

NOT allow download with incorrect names.

Correction is done by correctly naming the SMF.

This lab will not ask that inputs or outputs be renamed from here on. But feel free to do so if you prefer. It is a good,

recommended practice for real applications.

8. Next we will add a Reset Safety Monitoring Function (SMF). In the Toolbox, double click Reset to add a

Reset SMF to the logic editor (or click and drag it to the target block below the Emergency Stop SMF).

9. On the Reset SMF 2, click on the input terminal EI_02. A simple selection table appears.

When we add the Reset SMF CCW automatically assigns the next available terminal, EI_02 (Embedded

Input 02). In the demo case the reset button is wired into the plug-in module, so we need to change the

input terminal. The simple selection table that appears when we click on the input terminal shows all of the

inputs that could be used as the Reset input (and none of the terminals that can NOT be used for a reset

input). If a given terminal is already being used for something else, it is grayed out – for example,

Embedded Safety Inputs 00 and 01 (being used for the E-Stop inputs) and Multi-Purpose Terminals 12 and

13 (the test sources for the E-Stop).

10 of 74

10. On the input terminal selection table, click on Plug-in 2 Inputs 2080-IQ4OB4 terminal 00 to select that input

for the Reset SMF. The input terminal will now be labeled P2_00 (Plug-in slot 2, input 00).

11. Now we will add the Safety Output Function (SOF) to our configuration. In the Toolbox under Safety Output

Function Blocks, click and drag Immediate OFF to the first Safety Output function target on the logic editor.

(The Safety Output Function (SOF) can be renamed, in the same way the SMF was renamed).

12. Click on the output connection of the E-Stop SMF – the blue dot on the right of the block. The dot will turn

light gray, indicating that it is selected.

13. Click on the input connection (blue dot on the left) of the Immediate OFF SOF block to connect it to E-Stop

SMF block. A connection line will appear and both connection dots will turn dark gray. Also, Pass Through

blocks will automatically appear in the Logic Level A and B columns.

11 of 74

Note that CCW has automatically assigned the first two available safety output terminals of the CR30, EO_18

and EO_19 (Embedded Safety Outputs 18 and 19, respectively). When these outputs turn ON, the white LED

indicators on the CR30 demo labeled Safety Outputs 18 and 19 will turn ON. These outputs also drive the two

700HPS control relays to the right of the CR30 on the DIN rail. The “PT” to the right of the terminal assignment

stands for Pulse Testing, a technique used to detect if the output terminal is short circuited to 24V or another

safety output terminal. Other output terminals have additional options for configuration besides Pulse Testing,

but for terminals 18 and 19 this is the only possible configuration.

14. This SOF (Safety Output Function) will use the Reset SMF (Safety Monitoring Function) that we set up as

SMF 2. In the SOF block, click the drop down menu next to Reset Input and select SMF 2.

15. We have now completed our logic configuration. Compare your logic to the below image to confirm that it is

set up correctly.

12 of 74

Build and Download the Configuration File to the CR30

1. Click the Project tab to bring up the main overview window.

2. The next step is to have CCW check our configuration. Click the Build button above the CR30 graphic.

An Output window appears at the bottom of the screen. You should see the message “Build Succeeded”. If

there were any errors in the configuration file, they would be listed in this window. (If there are any errors,

compare your logic setup to the image on the previous page of this lab.)

3. Save the project by clicking File, then Save Project As…

4. Name the project “Lab 1” and click OK to save the project.

5.

6. Saving the project with a new name tends to close the workspace window(s). In the Project Organizer window,

double click Guardmaster_440C_CR30 to open the workspace.

7. Confirm that the demo case is plugged in and turned on.

8. Connect a USB cable from your computer to the CR30 USB port.

13 of 74

9. In CCW, click the Download button to download the configuration file to the CR30.

10. This brings up the Connection Browser. Click on Guardmaster CR30 to select it and then click OK. You may

need to expand the Virtual Chassis AB_VBP-1… by clicking the ‘+’ next to it in order to see the CR30.

11. A pop up window will ask if you want to change the relay to program mode; or, if there is a verified configuration

loaded on the CR30, the pop-up will include a warning that the project (on the relay) will be deleted. Either way,

click Yes.

12. A Download Complete message will pop up. Click Yes to change the CR30 back to Run mode.

OR

14 of 74

Operation of the Configured Safety Circuit

1. Confirm that all of the selector switches on the demo panel are in the default left position.

2. Confirm that there are no cables or wires connected to any of the panel receptacles or jacks.

3. Twist the E-Stop button clockwise to confirm that it is released / clear.

4. In CCW, click on the Edit Logic button (just above the large CR30 graphic) to show the Logic editor.

15 of 74

5. Confirm that the E-Stop SMF block and its input terminals are highlighted green, indicating that they are ON. (If

not, push the E-Stop and then twist to release it.)

6. The E-Stop SMF is ON, so the conditions for the Safety Output Function are true, but because it is configured for

manual reset it does not turn its outputs on yet. This “Ready for Reset” state is indicated by the SOF block

flashing green.

7. Press and release the blue Reset push button (labeled ‘R’).

A key feature of the CR30 is that when an SOF is configured for Manual reset mode, the reset signal must be

between 0.5 and 3 seconds long – otherwise that signal is ignored. This prevents the reset button from being

tied down. This also reduces the risk of an accidental bump of the reset button causing hazardous motion. The

key is that the reset button must be intentionally pushed and briefly held to be acknowledged as a reset signal.

16 of 74

8. After you push the reset button, you should see the white indicators for Safety Outputs 18 and 19 turn ON,

indicating that the machine can run. You will also see the SOF block in CCW change from flashing green to

solid green, and the output terminals highlighted green to indicate that they are ON.

9. Push the E-Stop button. This action opens the N.C. contacts of the E-Stop, which is detected by the CR30.

The safety outputs of the CR30 turn OFF. In CCW, observe that the Emergency Stop function block is no longer

highlighted green, along with all blocks and terminals to the right.

In a real application, the CR30 outputs turning OFF would cause the safety contactors to open, thus removing

power from the motor. (In the demo the safety contactors are simulated by the 700HPS safety control relays.)

The hazardous motion will coast to a stop. Stopped is considered a safe state in most machine safety

applications.

10. Twist the E-Stop clockwise to release it.

11. Press and release the blue Reset button to reset the safety circuit. (Remember that the reset signal must be

between 0.5 and 3 seconds long or it will be ignored.) The safety output indicators will turn ON.

We have now configured a CR30 for an Emergency Stop Safety Function and performed a basic functional test

of our safety circuit in just a few simple steps.

17 of 74

SensaGuard and E-Stop Application

We will now expand our safety circuit to include the monitoring of a moveable gate. Our system will consist of two safety

functions:

� Emergency Stop – If the E-Stop is pushed, power should be immediately removed from the actuators.

� SensaGuard – If the movable gate is opened, the safety system should detect it and immediately remove power from the

actuators.

As with most machine safety applications, removal of power will result in a safe state within a short period of time. It would be

appropriate to do safety distance calculations in determining the position of the moveable gate, as we want to make sure that the

machine would be in the safe state before a person could reach the hazard after opening the gate. It is assumed that the

moveable gate is the only way to access the hazard.

We will use a standard 800B E-Stop and a SensaGuard™ interlock switch as input devices for the two safety functions,

respectively. These devices are included in the demo and already wired to the CR30. When either of these devices turns off,

the CR30 will turn off its safety outputs. These safety outputs are connected to the coils of the 700HPS control relays. These

control relays disconnect line power from the actuators. (In an application with a larger electrical draw we would use safety

contactors instead of safety control relays.) The contacts of the two control relays are wired in series – either device dropping

out will disconnect line power. This way if one device fails, the other device will still cause the hazardous motion go to a safe

state. The CR30 monitors the status of the output device (the 700HPS) to detect unsafe device failures. (If a device failure is

detected, the CR30 will not turn on its outputs, thus reducing the risk of this device fault from leading to an unsafe condition.)

Here is a basic wiring diagram of this circuit. The E-Stop is connected to CR30 inputs I-00 and I-01. Multipurpose terminals 12

and 13 provide test pulses so that the CR30 can detect cross faults between the two e-stop channels. OSSD outputs A and B of

the SensaGuard are connected to CR30 inputs I-02 and I-03. (These signals turn OFF when the gate opens.) Additional

commentary on the circuit is included throughout the lab steps. CR30 outputs 18 and 19 drive the coils of the control relays K1

and K2 (the 700HPS relays in the demo).

18 of 74

1. In CCW, click on the main 440C-CR project tab to return to the view with the large graphic of the CR30.

2. In the upper right hand corner of the project tab, click the dropdown by “Connected” and select Go Offline.


4. Right click on the Reset block (SMF 2) and click delete.

5. Right click on each Pass Through logic block and click delete.

6. Click on the block under the Emergency Stop SMF to select it. The block will turn green.

19 of 74

7. In the Toolbox, double click the Gate Switch SMF to add it to the configuration as SMF 2, just below the

Emergency Stop SMF.

8. In the Toolbox, double click Reset to add it to the configuration as SMF 3. (Alternatively you can click and drag

the reset to the block under the gate switch in the logic editor.)

9. Click on the input terminal EI_04. A simple selection table appears.

10. Click on Plug-in 2 Inputs 2080-IQ4OB4 terminal 00 to select that input for the Reset SMF. The input terminal will

now be labeled P2_00 (Plug-in slot 2, input 00). This is the terminal to which the blue Reset button on the demo

panel is connected.

20 of 74

11. Next we will configure the logic. In the Toolbox under the Logic Functions, click and drag an AND logic block

onto the first Logic Level A function target.

In this application we want the act of pushing the Emergency Stop to disconnect power from the motor. We also

want the act of opening the moveable gate to disconnect power from the motor. People often incorrectly assume

that we would use OR logic to combine the two input devices for this type of application; however, we actually

use AND logic. This is easy to remember if we keep in mind that the job of the safety input device is to indicate

that “it is OK to run” – the device turns its outputs ON when it is OK to run, then turns its outputs OFF (or opens

its contacts) when the machine should go to a safe state. Therefore, if we want the safety outputs of the CR30

to turn ON, the E-Stop must be closed (e.g. N.C. E-Stop button is released / clear) AND the SensaGuard must

be ON (indicating that the moveable gate is closed).

12. Click on the output connection of the E-Stop SMF – the blue dot on the right of the block. The dot will turn light

gray, indicating that it is selected.

13. Click on the first input connection (blue dot) of the AND block to connect it to the E-Stop. A connection line will

appear and both connection dots will turn dark gray.

21 of 74

14. Click on the output connection of the SensaGuard SMF – the blue dot on the right of the block. The dot will turn

light gray, indicating that it is selected.

15. Click on the second input connection (blue dot) of the AND block to connect it to the Gate Switch SMF. A

connection line will appear and both dots will turn dark gray.

22 of 74

16. Click on the output connection (blue dot on the right) of the AND logic block to select it. The dot will turn light

gray.

17. Click on the input connection (blue dot on the left) of the Immediate OFF Safety Output Function (SOF) block to

connect it to the AND block. A connection line will appear and both connection dots will turn dark gray. Also, a

Pass Through block will automatically appear in the Logic Level B column.

18. This SOF (Safety Output Function) will use the Reset SMF (Safety Monitoring Function) that we set up as SMF

3. In the SOF block, click the drop down menu next to Reset Input and select SMF 3.

23 of 74

Next we will set up Feedback Monitoring for this safety circuit. Feedback is the act of monitoring the output

device to confirm that it is off when the CR30 output driving that device is off. Safety rated output devices such

as safety contactors and the 700HPS safety control relay in this demo utilize mechanically linked contacts so

that an external device can monitor their status. Mechanical linkage means that all of the contacts are

mechanically linked so that when an N.O. contact is closed, the “linked” N.C. contact is mechanically held open.

A 24V signal sent through the N.C. contact will only get to the CR30 input if the N.C. contact is closed.

Therefore, if the CR30 detects 24V on inputs P02 and P03, the CR30 knows that the main motor contacts (the

N.O. channels) are OPEN, and therefore no power is reaching the motor (which is considered a safe state).

Review the circuit diagram below for additional clarification of this concept.

Top illustration – CR30 Outputs OFF, 24V through N.C. of K1 and K2 to CR30 P02 and P03 Lower left – CR30 Outputs ON Lower right – CR30 Outputs OFF, K1 welded, no signal on P02, 24V on P03 �� CR30 detects failure of K1.

24 of 74

In traditional safety monitoring relay circuits, the N.C. auxiliary channels of the safety output devices were wired in series to the feedback monitoring input of the relay – either output device failing would still be detected; we just wouldn’t know which device had failed. While this technique would certainly be possible with the CR30, we would typically take advantage of having more inputs by independently monitoring each output device as shown in the circuit diagram. This means that the CR30 would know exactly which input device had failed, therefore reducing the time necessary to troubleshoot the issue.

19. For the CR30, Feedback Monitoring is configured as a Safety Monitoring Function (SMF) that we subsequently

associate with a Safety Output Function (SOF). On the Logic editor, click on the next available Safety

Monitoring function block (just under SMF 3 Reset block). It will turn green to indicate that it is selected. You

may need to scroll the Logic window to the left and/or down to get this function target into the visible area.

20. In the Toolbox under Safety Monitoring Functions, double click on the Feedback Monitoring SMF to add this

function to the logic editor in the selected target block.

21. In the Feedback SMF, click on the dropdown next to Inputs and select 2 so that there are two input terminals.

In our circuit, we are independently monitoring two output devices (the two 700HPS relays). These output

devices will always be used in conjunction with each other – they are controlled by the same Safety Output

Function. (If two safety output devices were controlled by two separate Safety Output Functions, they would

utilize separate Feedback Monitoring SMFs.)

25 of 74

22. CCW automatically assigns the next available terminals. In the demo, the feedback monitoring circuits are wired

into plug-in inputs 02 and 03. Click on the Feedback input terminals EI_04 and EI_05, and change them to Plug-

in 2 Inputs 02 and 03, respectively.

23. Now we will associate this Feedback SMF with the Safety Output Function. On the Immediate OFF SOF, click

the drop down menu next to Feedback and change it from None to SMF 4 (the Feedback Monitoring SMF that

we just configured).

26 of 74

24. We have now completed our logic configuration. Compare your logic to the below diagram to confirm that it is

set up correctly.

27 of 74

Configuring the Indicator LEDs

1. The LEDs on the CR30 can be easily configured per the user’s preference to show more information than typical

status LEDs. Click on the main CR30 Project tab on the workspace.

2. Click on LED Configuration towards the lower left.

3. Select the Type Filter and Value for each LED per the table below the image.

Input LEDs Type Filter Value Notes

0 Terminal Status Terminal 00 E-Stop Channel 1

1 Terminal Status Terminal 01 E-Stop Channel 2

2 Terminal Status Terminal 02 Gate Switch OSSD A

3 Terminal Status Terminal 03 Gate Switch OSSD B

4 Not Used Not Used

5 Safety Monitoring Function Status SMF1 E-Stop SMF

6 Safety Monitoring Function Status SMF2 Gate Switch SMF

7 Safety Monitoring Function Status SMF3 Reset SMF

8 Safety Monitoring Function Status SMF4 Feedback Monitoring SMF

9 Not Used Not Used

Output LEDs

0 Safety Output Function SOF1 Safety Outputs 18 and 19

1-5 Not Used Not Used

28 of 74

Build and Download the Configuration File to the CR30

1. The next step is to have CCW check our configuration file. Click the Build button above the CR30 graphic.

An Output window appears at the bottom of the screen. You should see the message “Build Succeeded”. If

there were any errors in the configuration file, they would be listed in this window. (If there are any errors,

compare your logic to the logic configuration shown on the previous page.)

2. Save the project by clicking File, then Save.

3. In CCW, click the Download button to download the configuration file to the CR30.

29 of 74



5. A pop up window will ask if you want to change the relay to program mode. Click Yes.


Operation of the Configured Safety Circuit

The safety circuit should now be fully operational. In order for the safety circuit to allow the potentially hazardous

motion, all of the safety devices must be clear and then the safety circuit must be reset. The following steps walk

through that process.



30 of 74

3. Twist the E-Stop button clockwise to confirm that it is released / clear.

4. On the CCW software, click on the Logic tab to show the Logic editor. Confirm that the E-Stop SMF block and

its input terminals are highlighted green, indicating that they are ON. (If not, push the E-Stop and then twist to

release it.)

5. Back in the demo case, slide the SG-1 SensaGuard

actuator to the left (towards the sensor) until the

SensaGuard LED indicator turns green, indicating that

the actuator is detected (and therefore that the

moveable gate is closed, thus preventing access to the

hazard). When the SensaGuard LED is solid green, its

OSSD outputs are ON. (The SensaGuard indicator

LED is red if it does not detect the actuator.)

6. On the CCW software, confirm that the Gate Switch

SMF block is highlighted green, indicating that it is ON.

Because both this SMF and the E-Stop SMF are ON,

the AND block should also be ON (highlighted in green). The conditions for the Safety Output Function are true,

but because it is configured for manual reset it does not turn its outputs on yet. This “Ready for Reset” state is

indicated by the SOF block flashing green.

7. Press and release the blue Reset push button (labeled ‘R’). Remember that the reset signal must be between

0.5 and 3 seconds long.

31 of 74

After you push the reset button, you should see the white indicators for Safety Outputs 18 and 19 turn ON,

indicating that the machine can run. You will also see the SOF block in CCW change from flashing green to

solid green, and the output terminals highlighted green to indicate that they are ON.

8. Slide the SensaGuard actuator away from the sensor until the SensaGuard’s LED changes from green to red.

The safety outputs of the CR30 turn OFF. In CCW, observe that the Gate Switch function block is no longer

highlighted green, along with all blocks and terminals to the right. (The E-Stop function should still be highlighted

green, as that SMF is ON.)

9. Slide the SensaGuard actuator back to the left towards the sensor until the SensaGuard LED changes from red

to green.


between 0.5 and 3 seconds long or it will be ignored.) The safety output indicators will turn ON. (The green

highlighting around the function blocks and terminals should also be ON.)

11. Push the E-Stop button. This action opens the N.C. contacts of the E-Stop, which is detected by the CR30. The

CR30 will turn OFF safety outputs 18 and 19. (In a real application this would cause the system to go to a safe

state.)



between 0.5 and 3 seconds long or it will be ignored.) The safety output indicators will turn ON.

32 of 74

14. We configured the indicator LEDs on the CR30. LEDs 0 and 1 correspond to safety input terminals 00 and 01,

while LED 5 indicates the status of SMF 1, the E-Stop SMF. Output LED 0 indicates the status of Safety Output

Function (SOF) 1. Observe the LEDs as you push the E-Stop button and then twist to release the E-Stop. (You

will need to push the reset button to turn the output ON.)

15. LEDs 2 and 3 correspond to safety input terminals 02 and 03 while LED 6 indicates the status of SMF 2, the

Gate Switch SMF. Observe these LEDs as you slide the SensaGuard actuator away from and then towards the

sensor.

16. Press and release the blue Reset button to reset the safety circuit.

Verification and Validation, Including Fault Detection and Visualization

One critical step in the implementation of safety design is the physical verification and validation of the safety system

design. This process starts fairly basic, for example, push the E-Stop button and confirm that the system goes to a

safe state (typically stopped). Basic functional testing is very important because it will occasionally uncover issues

with the safety system implementation, from simple wiring issues to system components not behaving as originally

expected. That said, basic functional testing alone is not enough. If the system is intended to detect and react to

certain faults, during validation those faults should be introduced into the circuit so that it is possible to confirm the

intended system reaction. For example, in a dual channel E-Stop circuit arrangement the purpose of pulse testing

the input channels is to be able to detect a cross-fault between those channels. During validation we temporarily

introduce that short circuit between the channels. We then confirm that the safety logic device (the CR30 in this

application) both detects the fault and correctly reacts by going to the safe state. In this section we will walk through

some examples of system validation.

1. Confirm that Safety Outputs 18 and 19 are ON. (If not, twist the E-Stop to confirm that it is released, confirm that

the SensaGuard actuator is close enough to the sensor for it to turn ON, and then push and release the reset

button. The CR30 outputs should turn ON.)

33 of 74

2. In the demo to the right of the E-Stop and Reset buttons there are a couple of selector switches that can be used

to simulate faults on the E-Stop circuitry. Rotate the selector switch labeled “Open Wire Fault IN 01” from the

default left position to the right position.

This disconnects channel 2 of the E-Stop from CR30 input I-01. In the simplified schematic below, we see the

CR30 multipurpose terminals (MP12 and MP13) on the left that generate the pulse tested signals. These signals

travel through the N.C. contacts of the E-Stop to the CR30 input terminals I-00 and I-01. The Open Wire fault

simulator selector switch opens the second channel.

Because one of the input channels of the E-Stop turns OFF (opens), the E-Stop SMF turns OFF, thus turning

OFF safety outputs 18 and 19. Furthermore, the CR30 expects both input channels of the E-Stop to change

state at the same time. Since only one channel changes state, this causes the E-Stop SMF to fault. This type of

fault is referred to as a discrepancy fault – two related conditions did not follow the expected behavior relative to

one another.

3. In CCW, note that the E-Stop SMF block is now highlighted RED, indicating a fault. Mouse over the block and

an explanation of the fault is displayed.

4. Clear the wiring fault by turning the Open Wire Fault selector switch back to the left. This reconnects the second

E-Stop channel.

5. Try to reset the safety circuit by pushing the blue reset button. Are you able to reset the safety circuit?

Most faults require some type of testing procedure so that the CR30 can confirm that the fault has truly been

corrected before it will resume normal operation. In the case of a discrepancy fault, we must perform a

functional test of the safety input device.

34 of 74

6. To perform a function test of the E-Stop device, push the E-Stop and then twist to release it.

The CR30 detects that both channels turn OFF at the same time and then they both turn ON at the same time.

This provides confirmation to the CR30 that the wiring fault has been cleared. In CCW, note that the E-Stop

SMF block is now highlighted green, indicating that it is ON.

7. Press and release the reset button to reset the safety circuit. (Remember that the button must be engaged for at

least 0.5 seconds, but less than 3 seconds.) Safety outputs 18 and 19 should turn ON.

8. Next we will simulate a cross fault between the two channels of the E-Stop. Rotate the Cross Fault selector

switch from the default left position to the right position. This short circuits the two channels together – reference

the simplified circuit schematic.

This timing diagram shows how the CR30 uses test pulses on the terminals MP12 and MP13 to detect a cross

fault. These terminals are configured as test outputs that carry 24V with very short “OFF” pulses. These signals

pass through the E-Stop contacts and return to CR30 inputs I-00 and I-01. When the CR30 briefly turns the test

output off (pulse), it checks the status of that terminal – it should be OFF. If channel 1 is shorted to channel 2,

the terminal will show 24V instead of OFF. The CR30 detects this and causes the system to go to a safe state.

9. Note that in CCW the E-Stop SMF block is now highlighted red, indicating the fault. Mouse over the block and

an explanation of the fault is shown. Test Source A and B are also highlighted red because this wiring fault is

actually detected by the Test Source (this is not shown in the image).

MP12 - Ch. 1

MP13 - Ch. 2

Cross Fault at vertical line

I-00 Input Ch. 1

I-01 Input Ch. 2

Test pulses “overwritten” by 24V from other channel

35 of 74

10. Rotate the selector switch back to the left to clear the wiring fault. Does this clear the SMF fault in the CR30?

While the SMF is still faulted, notice that Test Sources A and B are no longer highlighted red. The Test Source

terminals are no longer individually faulted because they are no longer shorted together; however, the overall

SMF requires a functional test of the safety input device in order for the CR30 to confirm that the wiring fault has

been cleared.

11. Push the E-Stop and then twist to release it. The CR30 detects that both channels turn OFF at the same time

and then they both turn ON at the same time, thus confirming that the wiring fault has been cleared. In CCW,

note that the E-Stop SMF block is now highlighted green, indicating that it is ON.

12. Push the reset button to reset the safety circuit. Safety outputs 18 and 19 should turn ON.

36 of 74

Now we will simulate a potential output device failure to confirm the reaction of the CR30. As we described in

the previous section as we set up the Feedback Monitoring SMF, the CR30 monitors the status of safety output

device via the N.C. auxiliary contact that is mechanically linked to main N.O. contact. If the CR30 can detect a

signal through the N.C. contact it confirms that the N.O. contact is OPEN, and thus there is no power to the

motor (and therefore no hazardous motion). Reference the circuit illustration below. (Additional details are

shown in the illustrations in the previous section on page 23).

One potential failure of safety output device is for the main contacts to become welded shut. If this happens, this

device cannot open and disconnect the main motor power. For this reason we have redundant output devices –

if K1 welds shut, K2 can still open, thus disconnecting the motor power. If an N.O. contact welds shut, the

mechanically linked N.C. auxiliary contact is mechanically held open, even if power is removed from the

contactor coil. With the N.C. contact open, the 24V signal does not reach the CR30 input (P02), thus allowing

the CR30 to detect this fault. Note that this method for detecting the fault only works if the safety outputs of the

CR30 are OFF, thus de-energizing the coil and opening the N.O. contacts. If the CR30 outputs are ON, the coils

of K1 and K2 are energized, and the N.C. auxiliary contacts are supposed to be open.

13. In this demo we can simulate this fault with the selector switch under the 2080 Plug-In label near the middle of

the demo. Rotate this selector switch from the left hand position (labeled Output Feedback) to the right hand

position (labeled External Sensors). This disconnects the feedback channels of both 700HPS relays, simulating

the condition of the N.C. channel being open (which in a real application would be the result of the N.O. channel

being welded shut).

Do you notice any reaction by the CR30? The fault we are simulating is not detectable when the safety outputs

of the CR30 are ON, so this fault is not yet detected and therefore there is no reaction by the CR30.

14. Push the E-Stop. This causes the outputs to turn OFF, thus de-energizing the coils of each contactor.

15. Twist the E-Stop to release it. In CCW, the E-Stop SMF block highlights green to show that it is ON.

37 of 74

16. Push the blue reset button. Does the safety circuit reset?

At this point the CR30 has its Safety Outputs OFF; therefore, under normal conditions it should detect 24V on

the feedback monitoring input terminals that are monitored by the Feedback SMF. While we are simulating this

fault, there is no 24V signal and therefore the Feedback Monitoring SMF is OFF. On the Safety Output Function,

note that the input terminal is ON (green) but the SAF is not flashing green. Since the associated Feedback

SMF is OFF, the SOF cannot be reset (and therefore the safety outputs stay OFF). In a real application the

solution to this device failure would be the replacement of the failed device. Once the failed device has been

replaced, the N.C. channel would be closed, thus allowing the safety circuit to be reset.

17. Clear the fault simulation by rotating the selector switch back to the left hand position (labeled Output Feedback).

This reconnects the N.C. monitoring channels of the 700HPS relays (K1 and K2 in the schematic on the previous

page). In CCW the input terminals of the Feedback SMF will highlight green to indicate that they are ON.

18. Push the blue reset button to reset the safety circuit.

We have now completed a functional test of the safety system as well as validating the reaction of the system to

several potential faults. A thorough validation and verification plan would include additional fault testing, but at

least you now have a basic understanding of the purpose of this process along with a few examples. In a real

application it would be important to document the testing that we have completed and include it in the machine’s

documentation files.

19. Once the initial verification and validation testing is complete we confirm the verification on the CR30. In CCW,

click on the main CR30 project tab (the one with the larger graphical image of the CR30 and its plug-ins).

20. Click on the Verify button just above the CR30 image.

21. A pop-up window appears. Read the questions to further develop your understanding of the system verification

process and then check each checkbox.

22. Click Generate to create the unique verification ID.

This process is the feedback to the CR30 that the functional testing has been completed. The verification ID can

be used to check if any later changes have been made to a configuration file. The verification ID is displayed in

CCW. In a real application, this ID would be recorded in the machine’s documentation.

Please note that every individual application MUST be finalized with the Verify command. If the CR30 is not

verified, it will fault after 24 hours of operation and will NOT operate. It is easy to know whether or not the

application running on the CR30 has been verified – if the RUN LED is green, the CR30 is running a verified

project. If the RUN LED is flashing green, the CR30 is running a configuration that is not verified.

23. On the CR30 itself, push the small Verification ID button just below the USB receptacle. The Verification ID is

displayed on the LEDs. The input LEDs display the digit, while the output LEDs display the position of that digit

within the four digit ID. This process can be used to check the Verification ID of a CR30 at any time. (If the

current configuration file running on the CR30 has not been verified, output LEDs 1-4 all turn ON along with input

LED 0, i.e. ID = ‘0000’.)

You have now finished a complete implementation of a basic safety application using the CR30 Software

Configurable Safety Relay.

38 of 74

I/O Expansion via Single Wire Safety

The CR30 features up to ten safety rated outputs (four embedded safety outputs plus up to six multi-purpose terminals

configured as outputs). Some applications may require more safety rated outputs. Other applications may require the use of dry

contact relay outputs instead of the embedded solid state outputs. Both of these situations can be addressed by using the Single

Wire Safety (SWS) capability of the CR30 in combination with the GSR family of safety monitoring relays. SWS is a simple,

dynamic signal that allows one safety device to safely indicate the status of its safety outputs to another safety device over a

single signal wire. SWS is rated PLe (with a Category 4 architecture) per ISO 13849-1 and SIL 3 per IEC 62061.

The CR30 can use an output configured as SWS to control a GSR Expansion Module (EM) with four sets of dry contacts. When

the CR30 turns its SWS output on, the connected GSR EM closes its output contacts. Up to ten GSR EM modules can be driven

by a single SWS output of the CR30.

This capability represents an easy and efficient method of expanding the I/O count of the CR30. The demo includes a GSR EM

to show this functionality.


2. In the upper right hand corner of the project tab, click the dropdown by “Connected” and select Go Offline. The

field will update to Disconnected.

39 of 74


4. On the existing Safety Output Function (SOF), we will add an additional output and configure it for Single Wire

Safety (SWS). Note that there is a third, blank output terminal. Click on this terminal and selected Embedded

Safety Outputs terminal 20 to add it as a third output terminal of this SOF.

5. Next we will change the configuration of this output terminal from Pulse Tested (PT) to Single Wire Safety

(SWS). Click on the “PT” next to the output terminal EO_20 and select SWS from the drop down menu.

40 of 74

We have successfully added a SWS output to our CR30 circuit. Output terminal 20 is connected to the SWS

input of the GSR EM. When the CR30 output terminal 20 turns ON (generating the SWS signal), the GSR EM

will close its contacts.

6. Now we will download the configuration file to the CR30 and show this feature in operation. Click on the CR30

Project tab to bring up the overview (with the large CR30 graphic).

7. Click on Download. Note that clicking the download button causes CCW to first Build the project and (hopefully)

indicate a successful build before bringing up the connection browser.



9. A pop up window will ask if you want to change the relay to program mode; or, if there is a verified configuration

loaded on the CR30, the pop-up will include a warning that the project (on the relay) will be deleted. Click Yes.

OR

41 of 74


11. Twist the E-Stop clockwise to confirm that it is released.

12. Slide the SG-1 SensaGuard actuator to the left until the SensaGuard indicator LED turns green, indicating that

its outputs are ON.

13. Push the blue reset button to reset the safety circuit. Remember that the signal must be between 0.5 and 3 s.

The safety outputs turn ON. Note that the GSR EM Logic IN and OUT LEDs turn ON, the latter indicating that

the output contacts are closed (ON).

14. Push the E-Stop. Note that the GSR EM turns its outputs OFF (open) as indicated by its OUT LED.


16. Push the reset button to reset the safety circuit. The GSR EM turns ON.

Single Wire Safety (SWS) is a convenient way to expand the safety I/O count of the CR30. In addition to two

SWS outputs, two of the CR30 safety inputs can be configured as SWS inputs, allowing them to respond to SWS

outputs generated by GSR safety monitoring relays. This can be useful for adding a few additional safety input

devices to a CR30 project, or to take advantage of specialty functionality in the GSR relays (such as speed

monitoring using proximity sensor inputs with the GSR GLP). Furthermore, two CR30 units can be

interconnected using SWS for a project that cannot fit onto a single CR30.

42 of 74

Guard Locking Application

If it is not possible to stop the hazardous motion in a particular application very quickly it might be possible for a person to open a

monitored gate and get into the hazard before it has stopped. One potential solution is guard locking, the practice of locking the

access gate until the system is in a known safe state, then releasing the lock and allowing access. A typical guard locking switch

will also provide the interlock function – confirming that the gate is closed. In this demo we feature the new 440G-LZ guard

locking switch for partial body access applications. Many guard locking applications today utilize electromagnetic technology for

locking the access gate. This solution has two drawbacks – one, the electromagnet constantly draws a relatively large amount of

power to hold the gate locked, and two, if the switch loses power, the gate unlocks, but the hazardous motion may still be moving

(either because of a separate source of power or just due to simple inertia). The 440G-LZ solves both of these challenges. This

switch features a bi-stable solenoid which does not require power to hold either state (locked or unlocked). Switching the

solenoid from locked to unlocked is powered by capacitors in the switch, meaning that there is never a large inrush from the

external power supply. The second challenge is solved inherently – if the switch loses power while it is in the locked state, the

bi-stable solenoid still holds the bolt in the locked position. Thus a power loss does not lead to the loss of the locking function.

The 440G-LZ also solves a challenge of tongue interlock based guard locking switches. In that type of switch it is not possible to

know if the locking mechanism is broken unless one actually opens the monitored gate. (Some guard locking switches might not

even be able to detect the break at that point.) The 440G-LZ solves this challenge by utilizing the actuator to actively monitor the

locking bolt. If the bolt were to break (highly unlikely), the switch would detect it and immediately go to the safe state, as

opposed to not detecting it until someone opened the door while the machine was running.

In this application we will set up a simple guard locking circuit with delayed access. Through testing and analysis, we have

determined that the hazardous motion will always come to a safe state within 2 seconds of the safety outputs turning OFF,

therefore we will allow the 440G-LZ switch to unlock two seconds after turning OFF the safety outputs.


2. In the upper right hand corner of the project window, click the dropdown by “Connected” and select Go Offline.

3. Click on the Edit Logic button or the Logic tab to return to the logic editor.

4. Right click on SMF 4 (Feedback) and delete it. Note that this also changes the Feedback in the Safety Output

Function from SMF 4 to None. (In a normal application you would perform feedback monitoring, we are only

deleting it for clarity of the logic layout.)

43 of 74

5. On the output terminals of SOF 1, mouse over the third output (EO_20) and then click the X that appears to

delete that output terminal.

6. Confirm that your SOF is configured like this.

We will use a single channel N.C. selector switch (SS) as an input device to tell the CR30 that the system should

be in the run mode (with the gate locked). Turning this SS to the right hand N.O. position will turn OFF this

CR30 input and initiate a machine shutdown. For this function we will use the SS labeled “Unlock Request” in

the IN 4/5 area of the panel. The N.C. channel connects 24V to the CR30 input I-11.

44 of 74

7. In order to add this input to our safety circuit, we will add a single channel N.C. input device to our logic. In the

Toolbox, click Alternative Device and drag it to the next available SMF target block (under the reset). It should

then show up as SMF 4.

8. Click on the + next to Advanced Settings to view the options for this type of SMF.

The Alternative Device is the SMF we use for functions not covered by the other types of SMF. In addition to

single channel inputs, complementary contact (N.O. / N.C.) devices as well as three channel input devices are

covered by the Alternative Device SMF.

9. Under Advanced Settings next to Inputs, click the dropdown and select 1 N.C. for a single channel N.C. device.

10. Next to Pulse Testing, click the dropdown and select Disabled to turn off pulse testing. Note that Test Source A

and B go away.

11. Click the ‘-‘ next to Advanced Settings to minimize that area.

45 of 74

12. Note that the SMF block now only has one input terminal. Click that terminal and select Embedded Input 11.

13. Rename the device “Unlock_Request”. Fully configured, the Unlock Request SMF should look like this.

14. We need to update our SensaGuard SMF 2. Change the inputs from EI-02 and EI-03 to Embedded Safety

Inputs 04 and 05 (EI_04 and EI_05), the terminals that the 440G-LZ outputs are connected to.

In this application, the 440G-LZ guard locking interlock switch is our Gate Switch input. (The SensaGuard is not

a part of this application.) For the purposes of gate monitoring, the function and operation of the 440G-LZ is the

same as a SensaGuard – the two OSSDs are ON when the gate is closed. (For the 440G-LZ, the gate must

also be locked for the OSSD to be ON.) With regards to the SensaGuard SMF, the only change necessary is to

update the input terminals.

46 of 74

15. Next we will add the “Unlock Request” input to our AND block. On the AND block, click the dropdown next to

Inputs and select 3.

16. The AND block now has a third input connection (blue dot). Click this third terminal to select it and it will turn

light gray.

17. Click the output connection of the Output Request SMF to create a connection to the AND block.

47 of 74

With this logic, the safety outputs are on as long as the E-Stop is clear, the 440G-LZ OSSDs are ON (indicating

that the gate is closed and locked), and the Unlock Request SS is in the N.C. (left) position. If any of these

devices turn OFF or drop out, the safety circuit will initiate a stop of the hazardous motion.

Based on the risk assessment of this application it was determined that the hazardous motion could take up to

two seconds to stop after the CR30 safety outputs turn OFF. Therefore we want to unlock the gate no sooner

than two seconds after turning off the safety outputs. We are using a Power-to-Release model of the 440G-LZ,

which means that it must receive a 24V signal to unlock the gate. If there is no signal on the unlock pin, the gate

is locked. In order to generate this signal we will use a NOT logic block to invert the AND block status.

18. In the Toolbox under Logic blocks, click a NOT block and drag it to the next available Logic Level B function

target (under the Pass Through).

19. Click the blue input connection of the NOT block and then the output connection of the AND block. The

connection line appears.

The output of the NOT will be the invert of the AND. In other words, in normal run mode (E-Stop clear, gate

closed, unlock request closed), the NOT block will be OFF. As soon as any input device turns OFF, the NOT

block will turn ON.

48 of 74

20. Now we will configure the Safety Output Function (SOF) that will drive the unlock signal to the 440G-LZ. On the

Toolbox under Safety Output Functions, click ON Delay and drag it to the next available SOF function target.

This safety output will turn ON output terminals a configured period of time after its input turns ON.

21. Click the output connection of the NOT block and the input connection of the ON Delay block to create the

connection.

22. The Time Delay is set in increments of 50ms. We want a time delay of 2 seconds, so enter 40 in the Time Delay

box (40 x 50 ms = 2000 ms = 2 seconds).

23. Change the Reset Type from Manual to Automatic. (Keep in mind that when this SOF turns ON its output, it is

possible to unlock the 440G-LZ. As soon as the 440G-LZ is unlocked, its outputs turn OFF, causing the system

to go to a safe state if it was not already safe. Hence there is no need to worry about a manual reset for this

SOF.)

49 of 74

24. On the first output terminal of the ON Delay SOF, change the terminal to Plug-in 2 Output 02 (P2_02).

This will be the source of the unlock signal to the 440G-LZ. We can use an output of the plug-in module

because it only requires a standard 24V signal to unlock. In the demo we are using plug-in output 02.

Whenever the unlock command of a Power-to-Release 440G-LZ is ON, it is unlocked, and therefore its safety

outputs are OFF. If the 440G-LZ outputs are OFF, the CR30 is turning OFF its primary outputs to stop the

hazardous motion. Therefore we must have an external method for disconnecting the ON Delay SOF output

from the 440G-LZ unlock input. We accomplish this by connecting the signal through the N.O. channel of the

Unlock Request Selector Switch. When we want to start the machine, we rotate the selector switch back to the

left position (locked). The N.O. channel opens, disconnecting the unlock signal, which cause the 440G-LZ to

attempt to lock. The 440G-LZ can only lock if the gate is closed. It monitors the actuator to determine if the gate

is closed. Once the 440G-LZ locks, it turns its outputs ON, allowing the machine to start.

25. On the ON Delay SOF, click the second output terminal and select Plug-in output 00.

We want to know when the system will allow the gate to be unlocked. This output is connected to the Amber

indicator labeled 2080 Plug-in O-00. This indicator will turn ON when it is possible to unlock the gate by rotating

the “Unlock Request” SS to the right (N.O.) position.

50 of 74

26. Our safety logic is now complete. Compare your logic to the screenshot below to confirm the configuration.

Operating the Guard Lock Application

1. On the main project tab, click Download to build your project and download it to the CR30.

2. Click Yes to change the relay to program mode.

3. Once the download is complete, click Yes to change the relay back to run mode.

4. Click on the Logic tab to observe the online diagnostic information. (For example, SMF and input terminals

highlighted green to indicate that they are ON.)



7. Twist the E-Stop clockwise to confirm that it is clear.

51 of 74

8. Confirm that the 440G-LZ actuator is locked in position and cannot slide up the track. This mechanism would

hold the gate locked.

9. Push the reset button to reset the safety circuit. The safety outputs should turn ON.

10. Rotate the Unlock Request SS (under the IN 4/5 label) to the right hand N.O. position to request access and

initiate a machine stop.

11. The CR30 immediately turns its safety outputs OFF, initiating a stop of the hazardous motion.

12. After two seconds, the ON Delay SOF will turn ON. The locking bolt will retract into the 440G-LZ switch and it is

possible to open the gate (slide the actuator up and away from the switch). The LED turns red.

13. While you are physically holding the actuator up, rotate the Unlock Request SS back to the left. Notice that the

LEDs on the 440G-LZ change to flashing green, indicating that the switch has been instructed to lock, but the

actuator is not in range. The switch will not attempt to fire the bolt unless it detects the actuator.

14. Allow the actuator to slide back down into the closed position. You will see and hear the bolt fire into the

actuator. Confirm that it is no longer possible to slide the actuator up and down.

This completes the Guard Locking Application.

Congratulations – you have completed the CR30 Hands-On Lab. Time permitting, you can continue on to the following optional labs to learn even more about the capabilities of this product.

52 of 74

Zone Control Application (Optional – Time Permitting)

In some applications it is possible to improve productivity by splitting the machine or production line into separate safety zones.

This allows one part of the machine to continue operating while another part of the machine is in a safe state. From a safety

perspective it is possible to do this as long as we determine that an access point in safety zone A does not allow access to a

hazard in safety zone B. Therefore zone B can continue running when zone A is in a safe state and a user can access zone A.

This may require physical guarding between the zones. Safety input devices for zone A will only cause zone A to go to a safe

state. Safety input devices for zone B will only cause zone B to go to a safe state. There may also be global safety input

devices that cause all zones to go to a safe state, such as a global E-Stop.

The overall benefit of utilizing safety zones is increased productivity. It is possible to implement a multi-zone safety circuit with

the CR30. This lab walks through the steps, building on the safety logic we have developed over the previous labs.


2. In the upper right hand corner of the project tab, click the dropdown by “Connected” and select Go offline.

3. Click on the Edit Logic button or the Logic tab to return to the logic editor.

53 of 74

4. We will continue building on our existing project by adding the SensaGuard labeled SG-1 on the demo. On the

Toolbox, click the SensaGuard and drag it to the next available Safety Monitoring function target block on the

logic editor, under the Safety_Device_1 SMF 4.

CCW automatically assigns the next available input terminals, EI_02 and EI_03. Conveniently, these are the

terminals that the local SensaGuard is connected to.

54 of 74

5. On the Toolbox under Logic Functions, click the AND block and drag it to the Logic Level A block to the right of

the reset SMF. (We are skipping one function target in the LLA column to keep a clean look.)

Safety zone B will evaluate both the Global E-Stop as well as the SensaGuard which is monitoring access to

zone B via a moveable gate. The first input of this AND LLA 3 block will be the E-Stop (SMF 1).

6. Click the first blue input connection dot of the AND block LLA 3 to select it. The dot will turn light gray.

7. Click the output connection of the Emergency Stop SMF to connect it to the second AND block. The connection

line will appear.

55 of 74

8. The second input of the AND block LLA 3 will be the SensaGuard_2, SMF 5. Click the output terminal of SMF 5

and the second input terminal of the LLA 3 AND block to connect them.

9. In the Toolbox under Safety Output Functions, click Immediate OFF and drag it to the next available Safety

Output function target block. This will become SOF 3.

CCW automatically assigned the next available output terminals, EO_20 and EO_21. These are the outputs we

want to use. These outputs drive the clear indicator LEDs on the demo panel near the middle of the demo

(labeled Safety Outputs 20 and 21).

10. In the SOF 3 block next to Reset Input, click the dropdown menu and select SMF 3 (the reset SMF).

We are using the same Reset SMF for this Safety Output Function (SOF) as for SOF 1. In a real application this

would be acceptable if the reset button was positioned such that the operator would have complete visibility to

both safety zones before pressing the button. (Other zoning application might require separate reset inputs.)

56 of 74

11. Click the blue input connection dot of SOF 3 to select it.

12. Click the blue output connection dot of the LLA 3 AND block to connect it to SOF 3. A Pass Through block and

the connection lines appear.

13. Compare your configuration to the image to confirm the correct settings. The logic is complete.

57 of 74

Operating the Safety Zone Control Application

1. Click on the Save icon to save your project.

2. On the main project tab, click Download to build your project and download it to the CR30.

3. Click on the Logic tab to observe the online diagnostic information (green and red highlighting for ON and fault

indications).

4. Confirm that all selector switches are in the default left position.

5. Confirm that no cables are connected to any of the receptacles or jacks.

6. Twist the E-Stop clockwise to confirm that it is clear.

7. Confirm that the Unlock Request selector switch is in the left position (Locked).

8. Confirm that the 440G-LZ actuator is locked in position and cannot slide up the track. The indicator LED on this

switch should be green, confirming that the OSSD outputs are ON.

9. Slide the SensaGuard actuator to the left until the LED turns green, indicating the OSSD outputs are ON.

10. In CCW confirm that the Emergency Stop SMF 1, Gate Switch SMF 2 (440G-LZ), Alternative Device SMF 4, and

Gate Switch SMF 5 should all be highlighted green, indicating that they are ON.

11. Both SOF 1 and SOF 3 should be flashing green, indicating that they are ready to be reset.

12. Press the reset button. (Remember the signal must be between 0.5 and 3 s.) Safety outputs 18-21 turn ON as

indicated by the terminals highlighting green in CCW and the clear indicator LEDs on the panel turning ON.

58 of 74

13. Slide the SensaGuard actuator to the right away from the sensor. Safety outputs 20 and 21 turn OFF. This

would cause the hazardous motion in Zone B to go to a safe state.

In this application safety outputs 18 and 19 would control Safety Zone A. Safety outputs 20 and 21 would control

Safety Zone B. The SensaGuard is monitoring a moveable gate that provides access to Safety Zone B. It is not

possible for a person to reach Safety Zone A from this gate.

14. Does this have any effect on safety zone A (safety outputs 18 and 19)?

15. Slide the actuator back to the SensaGuard. Its OSSD outputs turn ON and its indicator LED turns green.

16. Push the reset button to reset the safety circuit for zone B. Outputs 20 and 21 turn ON.

17. Rotate the Unlock Request SS to the right to request access to zone A via the moveable gate that is locked and

monitored by the 440G-LZ guard locking switch. Safety outputs 18 and 19 turn OFF immediately. After two

seconds the 440G-LZ unlocks, allowing access to zone A. Does this have any effect on zone B (outputs 20 and

21)?

18. Rotate the Unlock Request SS back to the left. Confirm that the 440G-LZ actuator is in the closed position (all

the way down). When the actuator is detected by the 440G-LZ switch, it attempts to lock by firing the bolt. If the

lock is successful it turns its OSSD outputs ON and changes the indicator LED to green.

19. Push the blue reset button to reset the safety circuit for zone A.

20. The E-Stop is configured as a global E-Stop. It controls both zones. Push the E-Stop button. Safety outputs 18,

19, 20, and 21 turn OFF. This would cause both zone A and zone B to go to the safe state.

21. After two seconds it is possible to unlock the gate. This requires rotating the Unlock Request SS back to the

right (connecting output P2_02 to the unlock pin of the 440G-LZ). You will hear the 440G-LZ retract its bolt,

unlocking the gate. Confirm that you can move the actuator up and down.

22. Lock the 440G-LZ by rotating the Unlock Request SS back to the left and sliding the actuator down (simulating

the closing of the moveable gate). The switch locks the gate.

23. Once you have observed the behavior of this safety circuit, click the project tab in CCW.

24. In the upper right hand corner of the project view, click the down arrow next to “Connected” and select Go offline

to disconnect from the CR30.

59 of 74

Maintenance Mode Application (Optional – Time Permitting)

In some application we want our safety system to behave differently in different circumstances. In this section of the lab we will

work through an example. We have a moveable gate that allows access to hazardous motion. There is a SensaGuard

monitoring this access gate. When an operator opens the gate, the hazardous motion should stop. However, during our Risk

Assessment we determined that a properly trained maintenance person could safely access this hazard, even while it is running,

as long as that individual is holding an enabling switch (sometimes called a “grip switch” or “live man switch”). We would not

want an operator to use the enabling switch in an attempt to bypass the SensaGuard gate monitoring, so the safety logic only

includes the enabling switch when a key switch is in the “Maintenance Mode” position (labeled “Alt. Mode” on our demo). Only

properly trained maintenance personnel have access to this key.

When the “Alt. Mode” key switch is in the Run Mode position (to the left), it turns ON CR30 inputs 6 and 7 with its 2 N.C.

contacts. When it is in the “Alt. Mode” position (to the right) it turns OFF 6 and 7 and turns ON inputs 8 and 9 with its 2 N.O.

contacts. Multipurpose terminals 12 and 13 will provide test pulses for both channels.

We only have two levels of logic in the CR30, so applications like this sometimes require a bit of creativity to implement. The

safety outputs should turn ON for either of the following conditions:

� When the key switch is in the Run Mode position, safety outputs = E-Stop AND SensaGuard

� When the key switch is in the Alt. Mode position, safety outputs = E-Stop AND [SensaGuard OR Enabling switch]

We know that the key switch can only be in one position at a time; therefore, if input 6 and 7 are ON, inputs 8 and 9 will be OFF,

and vice versa. This allows us to change how we set up our logic. If the E-Stop is ON; AND [the SensaGuard OR “Alt.Mode”

inputs are ON]; AND [the SensaGuard OR “Run Mode” OR Enabling Switch inputs are ON it is OK to run. This certainly appears

confusing on first glance, but as we set up the application in CCW and operate it using the demo you will see how it works.

1. In CCW, we are going to start from scratch with a new project. Click File and then New.

2. In the Device Toolbox, expand the Catalog section, expand the Safety folder, and then double click the 440C-

CR30 to add this safety relay to the project. (If you don’t see the Device Toolbox on the workspace, click View

and then select Device Toolbox from the dropdown menu.)

60 of 74

3. In the Project Organizer, double click on the Guardmaster 440C-CR30. The device will open on the workspace.

4. On the graphical image of the CR30 on the main workspace, right click on the right-hand plug-in slot, hover the

mouse pointer over DigitalIO, then click on the 2080-IQ4OB4 that appears to add this plug-in module to the

configuration.

61 of 74

5. Confirm that the gray plug-in module appears on the graphic.

62 of 74


7. Click and drag an Emergency Stop Safety Monitoring Function (SMF) from the Toolbox to the upper left hand

Safety Monitoring target block on the logic editor. Another option is to double click on Emergency Stop in the

toolbox – it will automatically load this SMF to the green highlighted block on the editor. (If you don’t see the

Toolbox on the workspace, click View and then select Toolbox from the dropdown menu.)

The default input terminals and test sources align with the demo wiring. No changes are necessary for this SMF.

63 of 74

8. In the Toolbox, double click on Enabling Switch to add it to the logic as SMF 2.

The default input terminals are correct, but we do need to change some of the other settings.

9. On the Enabling Switch block, expand the Advanced Settings by clicking the plus next to it.

10. For Pulse Testing, change the configuration from 2 Sources to Disabled. Test Sources A and B disappear.

This is strictly a reflection of how the demo case is wired. In a real application it would be recommended to use

Pulse Testing.

11. Hide the Advanced Settings by clicking the minus next to it.

12. In the Toolbox, double click on SensaGuard to add it to the logic as SMF 3.

13. In the Toolbox, double click Alternative Device to add it to the logic as SMF 4.

This SMF will monitor the N.C. channels of our mode key switch. When these inputs are ON, the safety circuit

will be in “Run Mode” (as opposed to “Maintenance Mode”). The N.C. channels are wired to the default input

terminals of this SMF, inputs 6 and 7. The N.C. channels are sourced from multipurpose terminals 12 and 13.

These are the same terminals that the E-Stop uses for Test Pulsing – these terminals can be shared for multiple

electromechanical devices; therefore, these default settings are also fine. Altogether we do not have to make

any changes to the default settings of this block.

64 of 74

14. In the Toolbox, double click on Alternative Device to add another to our logic as SMF 5.

This SMF will monitor the N.O. channels of our mode key switch. When these inputs are ON, the safety circuit

will be in the “Maintenance Mode” (labeled “Alt. Mode” on the key switch). Again, all of the default settings of

this block are correct for our application. It is perhaps confusing that we are connecting N.O. channels to a block

configured for N.C., but keep in mind that the purpose of this block is to put the CR30 into the “Maintenance

Mode”, and we want to do that when these inputs are ON, hence we treat it as N.C. inputs for the purpose of this

SMF. As before, the default Test Sources are shared with the E-Stop � terminals 12 and 13.

15. In the Toolbox under Safety Monitoring Functions, double click Reset to add one to the logic as SMF 6.

The Reset button in the demo is wired to Plug-in terminal 00, so click on the input terminal of the Reset SMF and

change it to Plug-in 2 Input 00.

65 of 74

16. Next we will configure our logic. Let’s start with the Logic Level B AND block that will combine all of the other

logic. In the Toolbox under Logic Functions, click an AND block and drag it to the first Logic Level B function

target block, skipping the Logic Level A column.

17. Connect the first blue dot input connection of the AND block and then the output connection dot of the

Emergency Stop function to connect them. The connection lines and Pass Through block appear.

Whenever the E-Stop is pushed, the Emergency Stop SMF will turn OFF. This will turn OFF the LLB 1 AND

block, thus turning OFF any Safety Output Functions driven by this logic block.

18. In the Toolbox under Logic Functions, click OR and drag it to the Logic Level A target block next to the Enabling

Switch SMF (skipping an LLA block – for this application, this makes the end logic more clear).

SKIP

SKIP

66 of 74

19. Change the number of inputs from 2 to 3.

20. Connect the first input connection of the OR block to the Enabling Switch SMF 2.

21. Connect the second input connection of the OR block to the SensaGuard SMF 3.

22. Connect the third input connection of the OR block to the Safety Device SMF 4.

Altogether, this OR block turns ON if either the Enabling Switch OR the SensaGuard are ON. Furthermore, this

OR block is ON if the key switch is in the Run Mode position. Therefore, when the Key Switch is in the Run

Mode position, the other two input devices are effectively ignored by this block. When the Key Switch is NOT in

the Run Mode position, and therefore IS in the Alt. Mode position, either the Enabling Switch or the SensaGuard

must be ON for this OR block to be ON. Think of this as the “Maintenance Mode Logic”.

“Maintenance Mode Logic” - Always ON when the Key Switch in Run Mode

position.

- If the Key Switch is in Alt. Mode (therefore Run Mode OFF), either the SensaGuard OR Enabling Switch must be ON to turn ON this

block

Run Mode

67 of 74

23. In the Toolbox under Logic Functions, click OR and drag it to the next Logic Level A function target block.

24. Connect the first input connection of the OR block to the Gate Switch SMF 3.

25. Connect the second input connection of the OR block to the Alternative Device SMF 5 (Key Switch in “Alt. Mode”

position).

When the Key Switch is in the Alt. Mode position, this OR block is always ON. When the Key Switch is in the

Run Mode position (and therefore Alt. Mode inputs are OFF), the SensaGuard must be ON (indicating that the

gate is closed) for this OR block to turn ON. Think of this as the “Run Mode Logic.”

“Run Mode Logic” - Always ON when Key Switch in Alt.

Mode position.

- If Key Switch is in Run Mode (therefore Alt. Mode OFF), the Gate Switch must be ON to turn ON this block

Run Mode

Alt. Mode

68 of 74

26. On the Logic Level B AND block LLB 1, change the number of inputs from 2 to 3.

27. Connect the second input terminal of the LLB 1 AND block to the LLA 2 OR block.

28. Connect the third input terminal of the LLB 1 AND block to the LLA 3 OR block.

Altogether the LLB 1 AND block turns ON if the E-Stop SMF 1 is ON, the “Maintenance Mode Logic” LLA 2 OR

block is ON, and the “Run Mode Logic” LLA 3 OR block is ON. Because the Mode selection Key Switch is

always in either the Run Mode position (inputs 6 and 7 ON) OR the Alt. Mode position (inputs 8 and 9 ON),

either LLA 2 OR LLA 3 will always be ON. This creative logic implementation allows us to accomplish more

complex logic even though we only have two levels of logic in the CR30.

29. In the Toolbox under Safety Output Functions, click an Immediate OFF and drag it to the first Safety Output

function target.

30. Connect the SOF 1 to the LLB 1 AND block.

31. On SOF 1, change the Reset Input to SMF 6.

69 of 74

32. The Logic is now complete. Compare your logic to the below screen shot.

70 of 74

34. In the upper left hand corner of the logic editor, click the Collapse All Function Blocks button, the middle of the

three buttons.

The ability to minimize all of the function blocks is a useful feature of the CR30 function block because it makes it

easier to visualize everything that is going on. There are shortcuts to minimize and maximize all of the function

blocks in the upper left corner of the logic editor. The Maximize All shows everything, including Advanced

Settings, and can be very helpful when finishing a project as a means of documenting all of the details.

Operating the Maintenance Mode Application

1. Click on the main project tab.

2. Click Build to build the project. Confirm that the project successfully builds. (If necessary, correct any errors by

reviewing the logic diagram on the previous page and the messages in the Output window.)

3. Click File in the upper left corner and then Save Project As…

4. Name your project “Maintenance Mode Application” and click OK.

5. In the Project Organizer window, double click Guardmaster_440C_CR30 to reopen the workspace.

6. Confirm that the demo case is plugged in and turned on.

7. Confirm that a USB cable is connecting your computer to the CR30 USB (programming) port.

8. Click the Download button.

71 of 74

9. On the Connection Browser, expand the Virtual Chassis and select the CR30.

10. Click Yes to change the relay to program mode.

11. After the download is complete, click Yes to change the relay back to Run mode.

12. Click Edit Logic to open the logic editor tab and view the online diagnostics.

13. Confirm that there are no cables connected to any of the panel receptacles or jacks on the demo.

14. Confirm that all selector switches are in the default left position.

15. Rotate the Selector Switch in the IN 2/3 area from the default left hand “Local SG 1” position to the right hand

“Ext”. (External Device) position.

This disconnects the SensaGuard from CR30 inputs 2 and 3 and connects the receptacle to those inputs.

16. For this lab, we will use the loose Enabling Switch. (It may be in the lid of the demo case.) Plug the Enabling

Switch into the receptacle under IN 2/3.

17. Under IN 4/5, rotate the larger selector switch from the default left hand 440G-LZ position to the middle SG 1

position. This disconnects the 440G-LZ from inputs 4 and 5 and then connects the local SensaGuard to those

inputs.

18. Slide the SensaGuard actuator to the left so that the SensaGuard turns its outputs ON.

19. Twist the E-Stop to confirm that it is released.

20. In CCW, click the logic tab. SMF 1, 3 and 4 are ON, as well as AND block LLB 1. The SOF 1 should be

flashing, indicating that it is ready to be reset.

21. Push the reset button to reset the safety circuit. Safety outputs 18 and 19 turn ON.

22. Move the SensaGuard actuator away from the sensor. The safety outputs turn OFF.

23. Slide the actuator back to the left until the SensaGuard LED turns green.

24. Reset the safety circuit.

25. Under the panel label IN 6/7 AND 8/9, rotate the Key Switch from the default left hand “Run Mode” position to

the right hand “Alt. Mode” position.

72 of 74

We are now in the alternative mode of operation, the “Maintenance Mode”. Only a properly trained maintenance

person would have access to this key.

26. Squeeze the Enabling Switch to the middle position.

Don’t squeeze too hard – this would also OPEN the Enabling Switch contacts. There is a distinct middle

position. Observe the status of SMF 2 in CCW to determine if you are correctly squeezing the switch.

27. While continuing to squeeze the Enabling Switch, slide the SensaGuard actuator away from the sensor until the

LED turns red, indicating that its outputs are OFF.

The Safety Outputs of the CR30 stay on, meaning that the machine could still be operating with the gate open as

long as the enabling switch is squeezed.

28. Release the Enabling Switch. The safety outputs turn OFF.

29. Squeeze the Enabling Switch to the middle position and push the reset button. The safety outputs turn ON.

30. Slide the SensaGuard actuator back to the sensor.

31. Experiment with the Run Mode and Alt. Mode to confirm that the safety system behaves as expected. While the

system is in Run Mode, the Enabling Switch should have no effect on the Safety Outputs.

32. After you have completed testing this application, please disconnect the Enabling Switch from the IN 2/3

receptacle and rotate all selector switches back to the default left hand position.

Congratulations! You have completed this lab.

Notes

73 of 74

For more information on

Safety Function Capabilities, visit:

discover.rockwellautomation.com/safety

Rockwell Automation, Allen-Bradley, Rockwell Software, Connected Components Workbench, Micro800, Guardmaster, and SensaGuard are trademarks of

Rockwell Automation, Inc. Trademarks not belonging to Rockwell Automation are property of their respective companies.

74 of 74

Publication — CE-DM266A-EN-P May 2014 Copyright© 2014 Rockwell Automation, Inc. All rights reserved.

Documents

The Guardmaster™ 440C-CR30 Software …...The Guardmaster 440C-CR30 Software Configurable Safety Relay Training Demo Lab For Classroom Use Only! Important User Information This documentation,