psc-fb library-manual v1 1

Programmable Small Safety PLCPROTECT-PSC Safety Function Blocks

Description of Safety Function Blocks PROTECT-PSC | Version 1.1 2

Table of contents

Table of contents (1)

1 General 4

2 Safety information 2.1 Hardware 5

2.2 Software 5

2.3 Features of the PROTECT-PSCsw 5

3 Protected ELAN functional modules within the PROTECT-PSCsw library function

3.0.1 True_False FB (to generate a safe 1 and a safe 0) 6

3.0.2 Description of the True_False auxiliary function block 6

3.1 Emergency Stop FB 7

3.1.1 Application 8

3.1.2 Features 8

3.1.3 Description of inputs/outputs 8

3.1.4 Connection example 8

3.1.5 Example program 9

3.2 Guard Locking FB 11

3.2.1 Application 11

3.2.2 Features 11




3.3 Guard Locking FB (guard monitoring with spring force interlocking device)

15


3.3.2 Features 15




3.4 Enable Switch FB 19


3.4.2 Features 19


3.4.4 Connection example 1 21

3.4.5 Example program 1 22



3.5 Two Hand Control FB 25


3.5.2 Features 25






Linked


Table of contents

3 Protected ELAN functional modules within the PROTECT-PSCsw library function (continued)

3.6 Sequential Muting FB 31


3.6.2 Features 31

3.6.3 Process of sequential muting 31




3.7 Parallel Muting FB 37


3.7.2 Features 37

3.7.3 Process of parallel muting 37




3.8 Flip-Flop FBs 41


3.8.2 Features 41






3.9 Turn off delay R FB (drop off delayed, retriggerable) 48


3.9.2 Features 48




3.10 Turn off delay NR FB (drop off delayed, not retriggerable) 51


3.10.2 Features 51




Table of contents (2)

Linked


General

1 General

The functional blocks described in this doc-ument (also referred to below as FB or FBs) are deployed in the library function of the PROTECT-PSCsw programming software used to program the PROTECT-PSC safety control system in operating mode 3.

A precise description of the PROTECT-PSC safety control system, the PROTECT-PSCsw programming software and incorporation of the library function into this software can be found in the PROTECT-PSC instruction manual.


Safety information

2.2 SoftwareAll FBs described below support the pro-grammer of the PROTECT-PSCsw program-ming software to prepare a program for the PROTECT-PSC safety control system that satisfies the requirements of Performance Level e in accordance with EN ISO 13 849-1 or SIL 3 in accordance with EN IEC 62 061.

NB: All FBs serve to support the creation of a program. The functions programmed in the FBs are based on the ladder diagram (LD) graphic programming language in accord-ance with EN IEC 61 131-3 and can also be individually replicated in PROTECT-PSCsw using discrete LD programming. The FBs represent just one possibility for creating the function described.

The programmer himself must bring about additional constraints within the overall pro-gram. An example here is the incorporation of the feedback loop as an additional RESET condition (or for the auto reset condition).

All functional modules from the Elan PSC Library are protected, i.e. they cannot be changed by the programmer. Protected FBs are labelled protected or geschtzt (in a German programming environment) and have date and seal identifier (checksum). The programmer has the possibility starting from software version PROTECT-PSCsw V1.2R01 to protect the FBs he has created himself using a password. This is done by selecting and actuating the Settings for FB protection button from the Properties screen after the FB has been saved and then entering a name and password in the Set-ting FB protection screen (see Figure 2-1).

2.3 Features of the PROTECT-PSCswDue to the special programming structure of PROTECT-PSCsw, the inputs, outputs or flags used are evaluated with respect to safety and labelled with an S (assessed as safe) or U (assessed as unsafe). This labelling is primarily based on the assess-ment of the input signals which are only as-sessed to be safe if they represent a safe 1 or safe 0.

2 Safety information

Use of the FBs does not release the user from the need to perform a careful safety check of the overall program. All sub-functions realised using the FBs should in particular be inspected for safety-critical effects in the overall program.

2.1 HardwareThe safety of the entire application depends on the selection and wiring of hardware components (e.g. emergency stop control devices, guard monitoring etc.), as has been determined in line with the risk assessment in accordance with EN ISO 13 849-1 or EN IEC 62 061.

The minimum pulse duration for safe detec-tion of the input signal is 15 ms.

With two-channelled input/output wiring, the PROTECT-PSC safety control system by itself (without the upstream sensor technol-ogy and downstream actuating elements) satisfies all requirements of Performance Level (PL) e in accordance with EN ISO 13 849-1 or SIL 3 in accordance with EN IEC 62 061. More details of this can be found in the PROTECT-PSC instruction manual.

Caution: If a safety-critical setting has been performed on an FB, for example no monitoring of the feedback loop (deselect EDM), auto reset or start reset, a procedure must be performed at a different point in the overall programme in order to prevent a faulty or unexpected restart or to achieve a higher PL or SIL.

The significance of a safe or an unsafe contact is set out in Chapter 7.10.4 of the PROTECT-PSC instruction manual.

NB: The True_False FB can be used to generate a safe 1 or safe 0. This generates a safe 1 and a safe 0 on its outputs if the input is wired with a safe contact. The safe 1 and safe 0 output signals generated can be used as flags in the rest of the program. See chapter 3.0.1 and also the example programs provided in the following chapters in this respect.

Fig. 2-1: Screens to protect own created FBs with a password.


Protected Elan functional modules within the PROTECT-PSCsw library function

3 Protected ELAN functional modules within the PROTECT-PSCsw library function

3.0.1 True_False FB (to generate a safe 1 and a safe 0)(Name of FB in the Elan Library: True_False in the Auxiliary directory; seal ID: 3D89)

As described in Chapter 2.3, input or output signals from PROTECT-PSCsw are evaluated with respect to their safety. All functional modules described in Chapter 3 are designed such that safe signals can be expected on their inputs to prevent outputs assessed as unsafe that are marked with a U (red, and thereafter in yellow).

According to the rules in Chapter 7.10.4 of the PROTECT-PSC instruction manual, the True_False auxiliary function block is structured so that a safe 1 (or safe high signal) is generated on the OUT1 output or a safe 0 (or safe low signal) on the OUT2 output from a safe input signal (e.g. standard A-contact of an emergency stop control de-vice) on the IN1 input. Usually the outputs are laid on flags in order to use them as safe input signals for the desired function on the FB.

The True_False FB precedes the respec-tive safe FBs in the programming examples in Chapter 3.1 to 3.7.

3.02 Description of the True_False auxiliary function block

Input/output Name Description

IN1 Safe input signal; e.g. A-contact (| |)

OUT1 Output safe 1:On flag; for further use

OUT2 Output safe 0:On flag; for further use

Tab. 3-1: Description of I/O of True_False FB

Fig. 3-1: True_False FB



3.1.1 Application The Emergency Stop FB is used to monitor emergency stop control devices.

Emergency stop control devices are gener-ally incorporated in the safety circuit of a machine or system and have special significance as part of the machine and system control. The safe function and rapid accessibility of emergency stop control devices can have a crucial effect on the lives of people and the degree of personal injury in the event of a disturbance or accident or on the extent of damage to a machine in case of a fault.

New requirements apply to the operating mode of these control devices with the coming into force of the new harmonised European standard EN ISO 13 850 on func-tional aspects and principles for design for emergency stop equipment.

All emergency stop control devices from SCHMERSAL or ELAN satisfy the require-ments of this standard. The Emergency Stop FB described in this chapter helps to implement these requirements into the PROTECT-PSC safety control system.

Caution: The possibility for programming the Emergency Stop FB in a function that contradicts the requirements of EN ISO 13 850 (e.g. without feedback loop) may only be applied if the overall function is executed as stipulated by the standard mentioned at a different point of the program.

3.1.2 Features The Emergency Stop FB has been created on the basis of programming guidelines from PLCopen, the organisation for the industrial control technology field. This programming structure is described in Chapter 6.4 Emer-gency Stop of the document PLCopen Technical Committee 5 Safety Software Technical Specification, Part 1: Concepts and Function Blocks dated 31.01.2006.

3.1.3 Description of Emergency Stop FB inputs/outputs

3.1 Emergency Stop FB (1) (Name of FB in the Elan Library: EmergencyStop; seal ID: 5236)


IN1

S_EStopIn

Safety request:TRUE: emergency stop not actuatedFALSE: emergency stop actuated

IN2

S_StartReset

Power on reset:TRUE: emergency stop not actuatedFALSE: emergency stop actuated

IN3

S_AutoReset

Automatic reset:TRUE: automatic reset (input IN4 without function)FALSE: manual reset (input IN4 active)

IN4

Reset

Reset:TRUE: with edge change low highOtherwise FALSE

OUT1

S_EStopOut

Safety enabling output: TRUE: safety output clearedFALSE: safety output blocked

OUT2

Error

Error message:TRUE: error (error reset function)FALSE: no error (reset function OK)

Tab. 3-2: Description of I/Os of Emergency Stop FB

Fig. 3-2: Emergency Stop FB



3.1.4 Connection example: Emergency stop with monitored reset (rising or falling edge)

Fig. 3-3: Connection of PSC-CPU-MON for example programs 3.1.5

DescriptionAn emergency stop control device and a re-set button are connected to the PROTECT-PSC-CPU-MON module as shown.

Desired function: Emergency stop with monitored reset with a) rising edge (see example program 1) orb) trailing edge (see example program 2)

After a program start or after resetting the emergency stop control device, the condi-tion (referred to in subsequent example programs as M0000 flag) required to continue the overall program is provided a) by actuating or b) by releasing the reset but-ton. The M000 flag is therefore integrated in the overall program accordingly.


3.1.4 Connection example



3.1.5 Example programs

a) Emergency stop with monitored reset (rising edge, see 3.1.4) through integration of the Emergency stop FB in the ladder diagram of the PROTECT-PSCsw

View of programming environment Comment

Link to library takes place

Program start

Wiring of the True_False functional module:Generation of a safe 1 (here: M7F1) to OUT1 and a safe 0 (here: M7F0) to OUT2 with the help of a safe input contact (here: I000 and I001) to IN1. The True_False FB from the Auxiliary folder is used for this.

Wiring of the Emergency Stop function block:IN1: Connection for the contacts to be monitored; here: two-channelled monitoring of the emergency stop contacts with the addresses I000 and I001.IN2: Possibility of automatic restart after switching on if IN2 is wired with safe 1. If this is not desired, wire with safe 0.IN3: If automatic reset is desired, wire with safe 1, otherwise safe 0.IN4: If reset with rising edge is desired, link IN4 with the address of the reset switch (here: I007). Otherwise wire with safe 0.OUT1: Safe output Addressed output or flag (here: M000) is TRUE where the se-lected input function (IN1 IN4) is TRUE.OUT2: Error report Addressed output or flag (here: M001) is TRUE where the se-lected input function (IN1 IN4) is faulty.

End of program

Fig. 3-4: PROTECT-PSCsw programming environment example program a: True_False and Emergency Stop FBs


3.1.5 Example programs (1)



b) Emergency stop with monitored reset (trailing edge, see 3.1.4) through integration of the Emergency Stop function block in the ladder diagram of the PROTECT PSCsw

View of programming environment Comment


Program start


Wiring of the Emergency Stop function block:IN1: Connection for the contacts to be monitored; here: two-channelled monitoring of the emergency stop contacts with the addresses I000 and I001.IN2: Possibility of automatic restart after switching on if IN2 is wired with safe 1. If this is not desired, wire with safe 0.IN3: If automatic reset is desired, wire with safe 1, otherwise safe 0.IN4: If reset with trailing edge is desired, link IN4 with the address of the reset switch (here: I007) and pointer F6 (here: P000). Other-wise wire with safe 0.OUT1: Safe output Addressed output or flag (here: M000) is TRUE where the se-lected input function (IN1 IN4) is TRUE.OUT2: Error report Addressed output or flag (here: M001) is TRUE where the se-lected input function (IN1 IN4) is faulty (when programming to trailing edge without function).

End of program

Fig. 3-5: PROTECT-PSCsw programming environment example program b: True_False and Emergency Stop FBs





3.2 Guard Monitoring FB (1) (Name of FB in the Elan Library: GuardMonitoring; seal ID: B73D)

3.2.1 ApplicationThe Guard Monitoring FB is used during the monitoring of guards that are secured by safety switching elements such as position switches with fixed or separate actuators, AOPDs (safety light barriers, safety light curtains, safety laser scanners) and tactile safety equipment such as safety edges, safety mats etc.

NB: Physical suitability in connection with the PROTECT-PSC safety control system is the prerequisite for connecting the above mentioned safety switching elements. Appli-cation-related features, in particular require-ments of standards for specific products (the so-called C standards) are not taken into consideration in this documentation.

3.2.2 Features The Guard Monitoring FB has been cre-ated on the basis of programming guidelines from PLCopen, the organisation for the industrial control technology field. This pro-gramming structure is described in Chap-ter 6.8 Safety Guard Monitoring of the document PLCopen Technical Committee 5 Safety Software Technical Specifica-tion, Part 1: Concepts and Function Blocks dated 31.01.2006.

3.2.3 Description of Guard Monitoring FB inputs/outputs


IN1

G_SW_1 Safety requirement 1:TRUE: 1 st contact guard monitoring closed FALSE: 1 st contact guard monitoring not closed

IN2

G_SW_2 Safety requirement 2TRUE: 2 nd contact guard monitoring closedFALSE: 2 nd contact guard monitoring not closed

NB: In the case of single channelled monitoring IN2 and IN3 are wired to the same contact.

IN3

Auto_ Res Automatic reset:TRUE: automatic reset (input IN5 without function)FALSE: manual reset (input IN5 active)

IN4

Start_Res Power on reset:TRUE: reset after power on (autostart after power on)FALSE: no reset after power on (reset must be actuated after power on)

IN5 Reset Reset: TRUE: during edge change low high;Otherwise FALSE

OUT1

G_Monitor FB OK; state of guard monitoring:TRUE: safe stateFALSE: guard door open or no reset

OUT2 Error Error report:TRUE: fault reset function or time window IN1, IN2 > 5 sFALSE: no error

Tab. 3-3: Description of I/Os of GuardMonitoring FB

Fig. 3-6: GuardMonitoring FB



3.2.4 Connection example: Guard monitoring with monitored reset (rising edge) or with autoreset

Fig. 3-7: Connection of PSC-CPU-MON for example programs 3.2.5

DescriptionGuard monitoring contacts and a reset button are connected to the PROTECT-PSC-CPU-MON module as shown.

Desired function: Guard monitoring witha) monitored reset with rising edge (see

example program 1) orb) autostart, without reset button (see exam-

ple program 2)

After a program start or following resetting of guard monitoring, the condition (referred to in subsequent example programs as M0000 flag) required to continue the over-all program is provided a) by actuating the reset button or b) without the reset button. The M000 flag is therefore integrated in the overall program accordingly.





3.2.5 Example programsa) Guard monitoring with monitored reset (rising edge, see 3.2.4) through integration of the Guard Monitoring function block in the ladder diagram of the PROTECT PSCsw

View of the programming environment Comment


Program start

Wiring of the True_False functional module:Generation of a safe 1 (here: M7F1) to OUT1 and a safe 0 (here: M7F0) to OUT2 with the help of a safe input contact (here: I000) to IN1. The True_False FB from the Auxiliary folder is used for this.

Wiring of the Guard Monitoring function block:IN1: Connection for the first contact to be monitored; here: single channelled monitoring of the contact with the address I000.IN2: Connection for the second contact to be monitored; here: single channelled monitoring of the contact with the address I001.IN3: If automatic reset is desired, wire with safe 1, otherwise safe 0.IN4: Possibility of automatic restart after switching on if IN4 is wired with safe 1. If not desired, wire with safe 0.IN5: If reset with rising edge is desired, link IN5 with the address of the reset button (here: I007). Otherwise wire with safe 0.OUT1: Safe output Addressed output or flag (here: M000) is TRUE where the se-lected input function (IN1, IN2 + reset condition) is TRUE.OUT2: Error report Addressed output or flag (here M001) is TRUE where the selected reset condition is faulty or the time window IN1, IN2 > 5 s

End of program

Fig. 3-8: PROTECT-PSCsw programming environment example program a: True_False and GuardMonitoring FBs





b) Guard monitoring with automatic reset (see 3.2.4) through integration of the Guard Monitoring function block in the ladder diagram of the PROTECT PSCsw



Program start

Wiring of the True_False function block:Generation of a safe 1 (here: M7F1) to OUT1 and a safe 0 (here: M7F0) to OUT2 with the help of a safe input contact (here: I000) to IN1. The True_False FB from the Auxiliary folder is used for this.

Wiring of the Guard Monitoring function block:IN1: Connection for the first contact to be monitored; here: single channelled monitoring of the contact with the address I000.IN2: Connection for the second contact to be monitored; here: single channelled monitoring of the contact with the address I001.IN3: If automatic reset is desired, wire with safe 1, otherwise safe 0.IN4: Possibility of automatic restart after switching on if IN4 is wired with safe 1. If not desired, wire with safe 0.IN5: If reset with rising edge is desired, link IN5 with the address of the reset switch. Here automatic reset desired, therefore wired with safe 0 (M7F0).OUT1: Safe output Addressed output or flag (here: M000) is TRUE where the se-lected input function (IN1, IN2 + reset condition) is TRUE.OUT2: Error report Addressed output or flag (here: M001) is TRUE where the se-lected reset condition is faulty or the time window IN1, IN2 > 5 s

End of program

Fig. 3-9: PROTECT-PSCsw programming environment example program b: True_False and GuardMonitoring FBs





3.3 Guard Locking FB (guard monitoring with spring force interlocking device) (1)

(Name of FB in the Elan Library: GuardLocking; seal ID: 3D4E)

3.3.1 ApplicationThe Guard Locking FB is used during the monitoring of interlocking devices on guards that are locked with spring force and opened by feeding current to the solenoid coil.

NB:a) For the monitoring of interlocking devices

at guard doors which are locked using magnetic force the GuardLocking FB can be used, too. In this case the signal OUT2 must be inverted. In fault case the guard is unlocked

b) Physical suitability in connection with the PROTECT-PSC safety control system is the prerequisite for connecting the above-mentioned safety switching elements. Application-related features, in particular requirements of standards for specific products (the so-called C standards) are not taken into consideration in this docu-mentation.

3.3.2 Features The Guard Locking FB has been created on the basis of programming guidelines from PLCopen, the organisation for the industrial control technology field. This program-ming structure is described in Chapter 6.12 Safety Guard Interlocking with locking of the document PLCopen Technical Committee 5 Safety Software Technical Specification, Part 1: Concepts and Function Blocks dated 31.01.2006.

3.3.3 Description of Guard Locking FB inputs/outputs (1)

Fig. 3-10: Guard Locking FB (associated table see next page)



3.3.3 Description of Guard Locking FB inputs/outputs (2)


IN1

S_Active Safety in hazard area:TRUE: current may be fed to magnet (OUT2)FALSE: no feeding of current to magnet permitted

IN2

G_Monitor Monitoring of actuator:TRUE: guard closed FALSE: guard not closed

IN3

G_Lock Monitoring of magnet:TRUE: magnet contact lockedFALSE: magnet contact unlocked

IN4

Reset Reset:FALSE TRUE: reset (>OUT1)

IN5 Unlock_R Request unlocking: TRUE: unlocking requestedFALSE: no unlocking requested

NB: During IN5 = TRUE IN1 must be TRUE.

IN6 Start_Res Power-On reset:TRUE: reset after power on (Autostart after Power on)FALSE: no reset after power on (reset IN4 must be actuated after power on)

IN7 Auto_Res Automatic reset:TRUE: automatic reset (input IN4 without function)FALSE: manual reset (input IN4 with function)

OUT1 Locked (safe signal for further processing)

FB OK; condition for IN5 (current may be fed to magnet):TRUE: guard door and magnet contact closed, magnet not poweredFALSE: no >Unlocked (OUT2) possible

OUT2 Unlocked Current fed to solenoid coil:TRUE: power to magnet FALSE: power not to magnet

OUT3 Error Error:TRUE: error (fault: reset function)FALSE: no error (reset function OK)

Tab. 3-4: Description of I/Os of Guard Locking FB



3.3.3 Description of inputs/outputs



3.3.4 Connection example: Monitoring and driving of a spring force interlocking device

DescriptionThe connecting contacts of a spring force interlocking device (actuator contact, mag-net contact, control coil), button to request unlocking and a contact for an additional condition for unlocking are connected to the PROTECT-PSC-CPU-MON module as shown.

Desired function: monitoring of actuator and magnet contacts and unlocking of the actuator. Monitoring of the actuator and magnet con-tacts must take place immediately when the program starts. The unlocking of the guard is only possible if a further condition has been satisfied (e.g. signal motor zero speed).

Fig. 3-11: Connection of PSC-CPU-MON for example program 3.3.5






3.3.5 Example program: Guard monitoring with automatic reset (see 3.3.4) through integration of the Guard Locking function block in the ladder diagram of the PROTECT PSCsw



Program start


Wiring of the Guard Locking function block:IN1: Connection for the Additional condition; entry to danger zone permitted contact; here: contact with address I004.IN2: Connection for the actuator contact to be monitored; here: single channelled monitoring of monitoring contact with the ad-dress I000.IN3: Connection for the magnet contact to be monitored; here: single channelled monitoring of the contact with the address I001.IN4: If reset with rising edge to activate OUT1 is desired, assign IN4 to the address of the reset switch. Otherwise wire with safe 0 (recommended).IN5: Connecting contact for the Unlock button; here: address I007.IN6: If immediate activation of OUT1 is desired after Power on, wire with safe 1 (recommended).IN7: If immediate activation from OUT1 is desired after opening and closing the actuator contact, wire with safe 1, otherwise with safe 0.OUT1: Output Locked; Unlock possible NB: Output (here: M000) for further use; output high where the contacts to be monitored + reset (or auto reset) OKOUT2: Control of solenoid coilOUT3: Error; input condition error

End of program

Fig. 3-12: Programming environment PROTECT-PSCsw example program: True_False and GuardLocking FBs



3.3.5 Example program



3.4 Enable Switch FB (1) (Name of FB in the Elan Library: EnableSwitch; seal ID: 831D)

3.4.1 ApplicationThe Enable Switch FB is used for monitor-ing a three-step enable switch which is not actuated in Position (Pos) 1, is in mid-posi-tion in Pos2 and is pressed down completely in Pos3. Enabling mode should be effected when Pos2 is pressed. Pos3 of the enable switch initiates a shutdown of the function, which, depending on the selected condition, either is resetted manually by pressing the reset button or automatically.

It is also possible to use this FB to monitor a two-step enable switch in which case Pos3 is disregarded.

Enable switches are used, possibly in con-junction with other safety-related measures, to protect people from potentially hazard-ous states, where the effect of protective devices must be partially or completely suspended during special operating modes of a machine.

These typically include the setting up of a machine, servicing work or the observation of work processes, the so-called process observation. If the operator releases the button or presses it down beyond the mid-position, the control command is interrupted for safety reasons.

NB: Physical suitability in connection with the PROTECT-PSC safety control system is the prerequisite for connecting the enable switch. Application-related features, in par-ticular requirements of standards for specific products (the so-called C standards) are not taken into consideration in this documenta-tion

3.4.2 FeaturesThe Enable Switch FB has been created on the basis of programming guidelines from PLCopen, the organisation for the industrial control technology field. This programming structure is described in Chapter 6.17 En-able Switch of the document PLCopen Technical Committee 5 Safety Software Technical Specification, Part 1: Concepts and Function Blocks dated 31.01.2006.

3.4.3 Description of Enable Switch FB inputs/outputs

Fig. 3-13: EnableSwitch FB (associated table see next page)



3.4.3 Description of Enable Switch FB inputs/outputs (2)


IN1

S_Active Safety in the hazard area:TRUE: enabling mode permitted.FALSE: enabling mode not permitted.

IN2

S_EnabSw1 Monitoring of NO contact (Pos2) of enable switch:TRUE: enable switch in Pos2 FALSE: enable switch not in Pos2

IN3

S_EnabSw2 Monitoring of NC contact (Pos1 + 2) of enable switch:TRUE: enable switch in Pos1 or 2 FALSE: enable switch not in Pos1 or 2

IN4

S_AutoRes Auto reset; after switching enable switch Pos3 Pos2 Pos1 or Pos2 after power on; further operation without actuation of reset switch:

TRUE: auto reset False: no auto reset

IN5 Reset Reset; after switching enable switch Pos3 Pos2 Pos1 or Pos2 after power on; further operation only after actuating the reset switch:

FALSE TRUE: resetOUT1 S_Enable

(safe signal for further processing)

Enable switch Pos2; FB OK:TRUE: enable switch Pos2 and reset condition OKFALSE: enable switch not Pos2 or reset condition has not been satisfied.

OUT2 ErrorOut Enable switch Pos2; FB not OK:TRUE: switch Pos3 Pos2 or Pos2 after power on at enable switch NB: Position of switch Pos2 must send signal for at least 15 ms (observe the specifica-tion of the manufacturer).FALSE: reset condition not OK

Tab. 3-5: Description of I/Os of Enable Switch FB





3.4.4 Connection example 1: Monitoring of a three-step enable switch with NC-NO contacts


DescriptionThe connecting contacts of a three-step enable switch with NC-NO contacts, a reset button and an additional condition (e.g. con-tact of operating mode selector switch) are connected to the PROTECT-PSC-CPU-MON module as shown.

The 3-step enable switch (e.g. ZSD1, ZSD2, DTAN from SCHMERSAL/ELAN) has the fol-lowing positions (Pos):

Pos1 (not actuated): NC contact closed and NO contact open;Pos2 (middle position): NC contact closed and NO contact closed; Pos3 (pushed down): NC contact open and NO contact closed

Desired functions:Additional condition (operating mode selector switch): enabling mode is only possible when the corresponding operat-ing mode is selected.Enabling mode: the enable switch is switched from Pos1 to Pos2 after program start. Enabling mode can then be imple-mented.Error: Enable switch is switched from Pos3 to Pos2 or is on Pos2 when the program starts. Enabling mode is not possible.Reset: resetting the error. Enabling mode can then be implemented again.





3.4.5 Example program 1: Enabling mode with 3-step enable switch (NC/NO contacts), additional condition (operating mode se-lector switch) and reset button (see 3.4.4) through integration of the Enable Switch function block in the ladder diagram of the PROTECT PSCsw



Program start


Wiring of the Enable Switch function block:IN1: Connection for the additional condition contact; e.g. oper-ating mode selector switch, here: contact with address I004.IN2: Connection for the NO contact to be monitored on the en-able switch; here: contact with address I001.IN3: Connection for the NC contact to be monitored on the en-able switch; here: contact with address I000.IN4: If auto reset after error (see OUT2) is desired, wire IN4 with safe 1, otherwise with safe 0.IN5: If reset with rising edge to reset error (see OUT2) is desired, link IN5 with the address of the reset switch. Otherwise wire with safe 0.OUT1: Output S_Enable; enabling mode OK output (here: M000) for further use.OUT2: Error enabling mode not desired; either enable switch moved from Pos3 to Pos2 or enable switch in Pos2 when pro-gram starts.

End of program

Fig. 3-15: Programming environment PROTECT-PSCsw example program 1: True_False and EnableSwitch FBs





3.4.6 Connection example 2: Monitoring of a three-step enable switch with 2 NO contacts

Important information: Enable switches should be selected that positively suppress switch-ing from Pos3 to Pos2 (e.g. ZSD5 or ZSD6 from Schmersal/Elan)


DescriptionThe connecting contacts of a three-step en-able switch with 2 NO contacts, a reset but-ton and an additional condition (e.g. contact from operating mode selector switch) are connected to the PROTECT-PSC-CPU-MON module as shown.

The 3-step enable switch has the following positions (Pos):

Pos1 (not actuated): both NO contacts are open;Pos2 (middle position): both NO contacts are closed; Pos3 (pushed down): both NO contacts are open.

Desired functions:Additional condition (operating mode selector switch): enabling mode is only possible when the corresponding operat-ing mode has been selected.Enabling mode: the enable switch is switched from Pos1 to Pos2 after program start. Enabling mode can be implemented.Error: enable switch is on Pos2 when the program starts. Enabling mode is not possible.Reset: resetting the error. Enabling mode can then be implemented again.





3.4.7 Example program 2: Enabling mode with 3-step enable switch (2 NO contacts), additional condition (operating mode se-lector switch) and reset button (see 3.4.6) through integration of the Enable Switch function block in the ladder diagram of the PROTECT PSCsw



Program start


Wiring of the Enable Switch function block:IIN1: Connection for the additional condition contact; e.g. oper-ating mode selector switch, here: contact with address I004.IN2: Connection for the NO contacts to be monitored on the en-able switch; here: contacts with the addresses I000 and I001.IN3: No NC contact present; wire with safe 1.IN4: If auto reset after error (see OUT2) is desired, wire IN4 with safe 1, otherwise with safe 0.IN5: If reset with rising edge is desired, link IN5 with the address of the reset switch. Otherwise wire with safe 0.OUT1: Output S_Enable; enabling mode OK, output (here: M000) for further use.OUT2: Error enabling mode not desired; enable switch in Pos2 on program start.

End of program

Fig. 3-17: Programming environment PROTECT-PSCsw example program 2: True_False and EnableSwitch FBs





3.5 Two Hand control FB (1) (Name of FB in the Elan Library: Two_Hand_safe_4sensors; seal ID: 603B)

3.5.1 ApplicationThe Two_Hand_safe_4sensors FB is used in the monitoring of two-handed start solu-tions (THS).

A THS is usually understood to refer to a protective device that requires the simulta-neous use of both hands for its actuation in order to initiate and maintain operation of a machine as long as a hazard exists. The fixed location means that the operator is kept outside the danger area.

Generally all safety-related requirements stipulated in EN 574 must be complied with.

Safety using a two-handed start solution as location fixing protective device basically only protects the person who actuates the actuating elements of the two-handed start solution.

Adequate protection is only achieved if there is sufficient distance between the start device and the hazardous movement.The distance can be calculated in accord-ance with EN 999 as follows:

S [mm] = 1,600 [mm/s] tN [s] + 250 [mm]

S = Distance from two-handed start solu-tion to the first hazardous movement.

tN = Time the overall system continues running after completion of the start command.

250 mm should be applied as additional dis-tance if the actuating elements of the THS can be actuated such that one hand may be closer to the danger point than the start but-ton. The actuation can be 250 mm closer to the hazard area than the result indicated by the above equation if protective hoods are mounted around the start button.

The actuating elements of the THS or the start console should be tightly assembled to an area with sufficient space.

If the actuating elements of the THS are not in a fixed place, other measures must be deployed to ensure that the minimum distance is maintained, e.g. using a spacer (see EN 574 Ch. 9).

Attention is directed to the manipulation safe arrangement of the actuating elements, e.g. using actuating elements covered by the protective hood (see EN 574 Ch. 8).

There must be labelling for the actuation of actuating elements which describes the type of THS solution (e.g. EN 574 Type IIIC).

A check must be performed to ensure the system is working correctly after install-ing the hardware and software and before releasing the two-handed start solution. 3.5.2 FeaturesThe module complies with the functionalities in accordance with EN 574 Type IIIC if wiring corresponds to Example 1 in Chapter 3.5.4.

Each operating element has non-overlap-ping NC/NO contacts.

Both operating elements must be actuated simultaneously and synchronously within 500ms in order to activate the output signals OUT1 and OUT2 of the Two_Hand_safe_4sensors FB. These output signals are deactivated as soon as at least one operat-ing element is reset.

The output signals OUT1 and OUT2 from the Two_Hand_safe_4sensors FB can be used optionally as flag for further

processing within the program or to activate a redundantly constructed actuator directly (e.g. contactor level) via two outputs. In the latter case the NC contacts of the positively driven contactors must be led back seri-ally to an input of the PROTECT-PSC. The Feed_loop FB input of the Two_Hand_safe_4sensors FB evaluates the state of the NC contacts.

New output signals OUT1 and OUT2 are then only generated if neither actuating ele-ment has been actuated (in normal position) and if the NC contacts of the activated actor were closed before actuation.

If no direct activation of an actuator (contac-tor) with feedback contacts is used, this checking process must be deactivated via the S_NO_EDM FB input.

Caution: If no monitoring of the feedback loop has been selected on the Two_Hand_safe_4sensors FB (IN5 = high selection no EDM), this monitoring must be performed at a different point (at a different point of the overall program or by a higher ranking control device) in order to guarantee the functionalities of the two-handed wiring in accordance with EN 574 Type IIIC.

The safety function does not apply without monitoring of the feedback loop in accord-ance with EN ISO 13 849-1, EN 954-1 or EN IEC 62 061.

In order to facilitate cross-wire detection of both contacts of an operating element, the contacts must be wired to neighbour-ing inputs with different potentials on the PROTECT-PSC.

The Diagnosis output signal becomes ac-tive when there is only one contact within an operating element with NC/NO contacts.

Connection and programming of the 2-hand-ed function should be completed according to the following chapter.



3.5.3 Description of Two_Hand_safe_4sensors FB inputs/outputs

Input/output

Name Description

IN1

NO_1 Contact with NO function operating element 1:TRUE: NO contact operating element 1 actuatedFALSE: NO contact operating element 1 not actuated

IN2

NC_1 (B-contact)

Contact with NC function operating element 1:TRUE: NC contact operating element 1 actuatedFALSE: NC contact operating 1 not actuated

IN3

NO_2 Contact with NO function operating element 2:TRUE: NO contact operating element 2 actuatedFALSE: NO contact operating element 2 not actuated

IN4

NC_2 (B-contact)

Contact with NC function operating element 2:TRUE: NC contact operating element 2 actuated FALSE: NC contact operating element 2 not actuated

IN5 S_No-EDM Selection of no EDM (External Device Monitoring):TRUE: deactivation of EDM FALSE: no deactivation of EDM

IN6 Feed_Loop Monitoring of feedback loop (for start condition):TRUE: feedback loop OKFALSE: feedback loop not OK

OUT1 OUT1 FM OK; output signal 1:TRUE: signal sequence inputs IN1 IN4 correct.FALSE: signal sequence inputs IN1 IN4 not correct.

OUT2 OUT2 FM OK; output signal 2:TRUE: signal sequence inputs IN1 IN4 correct.FALSE: signal sequence IN1 IN4 not correct.

OUT3 diagnose Monitoring of overlapping of operating element contacts (IN1 IN2 or IN3- In4) for > 1 s_

TRUE: overlapping of control element contactsFALSE: no overlapping of control element contacts

Tab. 3-6: Description of I/Os of Two_Hand_safe_4sensors FB



Fig. 3-18: Two_Hand_safe_4sensors FB



3.5.4 Connection example 1: Monitoring of 2-handed operating elements each with NC-NO contacts through the PROTECT-PSC under consideration of the connected feedback loop


DescriptionThe operating elements of a 2-handed oper-ation solution with NC-NO contacts and the feedback loop (NC contacts of the actuated contactors) are connected to the PROTECT-PSC-CPU-MON module as shown.

Operation of the operating elements causes the NO contact to close and the NC contact to open.

Desired functionOnly if the feedback loop is closed and both two-handed operating elements are actu-ated simultaneously (within 500 ms) are the output signals OUT1 and OUT2 of the Two_Hand_safe_4sensors FB active until at least one operating element is released.





3.5.5 Example program 1: Monitoring of 2-handed operation and feedback loop (see 3.5.5) through integration of the Two_Hand_safe_4sensors function block in the ladder diagram of the PROTECT PSCsw



Program start

Wiring of the True_False function block:Generation of a safe 1 (here: M7F1) to OUT1 and a safe 0 (here: M7F0) to OUT2 with the help of an input contact (here: I010) to IN1. The True_False FB from the Auxiliary folder is used for this.

Wiring of the Two_Hand_safe_4sensors function block:IN1: Connection of the NC contact from operating element 1; here: contact with address I000.IN2: Connection of the NO contact from operating element 1; here: contact with the address I001.IN3: Connection of the NC contact from operating element 2; here: contact with the address I004.IN4: Connection of the NO contact from operating element 2; here: contact with the address I005.IN5: If monitoring of the feedback loop is desired, wire IN5 with safe 0. Otherwise wire with safe 1.IN6: If monitoring of the feedback loop is required, wire IN6 with feedback loop; hier: contact with the address I009. Otherwise do not connect.OUT1: Output signal 1; 2-handed operation OK; output (here: M001) for further use.OUT2: Output signal 2; 2-handed operation OK; Output (here: M002) for further use.OUT3: Diagnosis; at least 1 operating element not OK; output (here: M003) for further use.

End of program

Fig. 3-20: Programming environment PROTECT-PSCsw example program 1: True_False and Two_hand_safe_4sensors FBs





3.5.6 Connection example 2: Monitoring of 2-handed operating elements each with NC-NO contacts by PROTECT-PSC without feedback loop


DescriptionThe operating elements of a 2-handed op-eration with NC-NO contacts without feed-back loop are connected to the PROTECT-PSC-CPU-MON module as shown.

Actuation of the operating elements causes the NO contact to close and the NC contact to open.

Desired functionOnly if both two-handed operating elements are actuated simultaneously (within 500 ms) are the output signals OUT1 and OUT2 of the Two_Hand_safe_4sensors FB ac-tive until at least one operating element is released.





3.5.7 Example program 2: Monitoring of 2-handed operation without feedback loop (see 3.5.6) through integration of the Two_Hand_safe_4sensors function block in the ladder diagram of the PROTECT PSCsw



Program start


Wiring of the Two_Hand_safe_4sensors function block:IN1: Connection of the NC contact from operating element 1; here: contact with the address I000.IN2: Connection of the NO contact from operating element 1; here: contact with the address I001.IN3: Connection of the NC contact from operating element 2; here: contact with the address I004.IN4: Connection of the NO contact from operating element 2; here: contact with the address I005.IN5: If monitoring of the feedback loop is desired, wire IN5 with safe 0. Otherwise wire with safe 0.IN6: If monitoring of the feedback loop is desired, wire IN6 with feedback loop. Otherwise do not connect. OUT1: Output signal 1; 2-handed operation OK; output (here: M001) for further use.OUT2: Output signal 2; 2-handed operation OK; output (here: M002) for further use.OUT3: Diagnosis; at least 1 operating element not OK; output (here: M003) for further use.

End of program

Fig. 3-22: Programming environment PROTECT-PSCsw example program 2: True_False and Two_hand_safe_4sensors FBs





3.6 Sequential Muting FB (1) (Name of FB in the Elan Library: Seq_Muting; seal ID: 416E)

3.6.1 ApplicationThe Seq_Muting function block represents the function for sequential muting.

The principle is based on the reliable bridg-ing of electro-sensitive protective equipment (ESPE). Here it is ensured that the series (sequentially) arranged sensors realise a defined sequence of signal status changes (see Figure 3-18). The first faulty signal status change of a muting sensor results in interruption of the ESPE bridging. No special safety sensors are required for the sensors.

The mechanical arrangement of the two reflection light barriers (muting sensors) must guarantee that no people are able to enter the danger area during muting or can themselves trigger muting.

The Seq_Muting FB can be used within PROTECT-PSC up to SIL 3 in accordance with EN IEC 61 508, PL e in accordance with EN ISO 13 849-1 and SC 4 in accordance with EN 954-1 when using electro-sensitive protective equipment in accordance with Type 4 to EN 61 496-1:2004 and under con-sideration of the specifications set out here.

Caution: If no monitoring of the feedback loop has been selected on the Seq_Mut-ing FB (IN10 = high EDM_func disable), then this monitoring must be performed at a different place (at a different point in the overall program or from a higher ranking control device) in order to achieve PL e, SIL 3 or SC 4.

The safety function does not apply without monitoring of the feedback loop in accord-ance with EN ISO 13 849-1, EN 954-1 and EN IEC 62 061.

NB: ESPE of Type 2 in accordance with EN 61 496-1:2004 likewise functions on the muting module. The safety integrity is not present here, however. The periodical testing of the Type 2 ESPE system is not supported by the Seq_Muting FB.

3.6.2 Features Sequential muting in both movement directionsOverride function to clear the ESPE after faulty switching off Possibility to actuate a muting indicator (LED or light bulb)

Option of monitoring the muting indicator for interruption (lamp monitoring) Option of actuating a contactor switch-off level with feedback (feedback loop) of the contactor NC contacts or use of the module output internally without contactor switch-off levelComprehensive diagnosis

3.6.3 Process of sequential mutingThe Seq_Muting FB supports muting in both transport directions. It is possible to transport material forwards or backwards through the muting sequences. With refer-ence to Figure 3-18 the sequence of sensors is 1, 2, 3 and 4 during forwards operation and 4, 3, 2 and 1 during reverse operation.A change of direction is only possible when a muting sequence has been concluded.

See the Muting process figure and De-scription of FB Seq_Muting Input/Outputs in Chapter 3.5.3 below for the following process description.

1. The FB switches to MUTING when the muting sensors Sensor 1 and Sensor 2 are consecutively activated by the trans-portation of material. The outputs OUT 1 and OUT 2 (to bridge the ESPE) and Mut_Lamp (to actuate the muting lamp) are set (high signal). When activating the muting lamp monitoring (low signal on Mute_lamp input) a high signal must be read back on the M_Lamp_in input. When deactivating the muting lamp moni-toring (high signal on the Mute_lamp input) the M_Lamp input is without function.

2. The FB outputs OUT 1, OUT 2 and Mut_Lamp are set (high signal) as long as Sensor 1 and Sensor 2 remain activat-ed by the transportation of materials. The FB inputs AOPD 1 and AOPD 2 (safety outputs from the ESPE) are switched to inactive (low signal).

Fig. 3-23: Muting process

(The material travels through the ESPE (light curtains) without the machine being stopped in the danger zone).

3. The muting sensors Sensor 3 and Sensor 4 must be activated before muting sen-sors Sensor 1 and Sensor 2 are switched to inactive. FB inputs AOPD 1 and AOPD 2 (safety outputs from the ESPE) must remain inactive (low signal) before switching Sensor 3. This enables the FB to maintain the MUTING function (OUT 1 = high, OUT 2 = high, Mut_Lamp = 1).

4. If the FB inputs AOPD 1 and AOPD 2 are switched to active (light curtains not interrupted) and subsequently Sensor 3 is switched to inactive, the MUTING func-tion is ended (OUT 1 = low, OUT 2 = low, Mut_Lamp = low).

5. Only once Sensor 4 has also been switched to inactive (low signal) can a new muting sequence be started.

6. Fault in muting function (OUT4 = high): To remedy the fault all sensors must be free and the error must first be acknowl-edged using a button (input ErrorQuit = low high). A muting sequence is then possible again.

7. Fault in muting function (OUT4 = high) and transportation of materials in the muting area: It is possible to deliberately bridge safety using the Override function. This action may only be performed by trained per-sonnel. It involves laying a two-channelled key switch with NC/NO contacts on in-puts Override1 (NO contact) and Over-ride2 (NC contact). If the Override1 input is switched to active (high signal) and the Override2 input is switched to inactive (low signal), the outputs OUT1 and OUT2 are activated (high signal). After clearing the system (all sensors free) the override function is automatically reset after 3 s. Caution: The key required for the over-ride function may only be accessible to trained personnel.



Input/output

Name Description

IN1

Sensor1 Sensor 1 (NO function):TRUE: sensor 1 actuatedFALSE: sensor 1 not actuated

IN2

Sensor2 Sensor 2 (NO function):TRUE: sensor 2 actuated FALSE: sensor 2 not actuated

IN3


IN4


IN5 AOPD1 Safety output 1 AOPD (e.g. light curtains):TRUE: output AOPD 1 highFALSE: output AOPD 1 low

IN6 AOPD2 Safety output 2 AOPD (e.g. light curtains):TRUE: output AOPD 2 high FALSE: output AOPD 2 low

IN7 ErrorQuit (only possible if all sen-sors are free)

Error acknowledgement:TRUE: where edge change high lowOtherwise FALSE

IN8 Override1 (NO contact: see Ch. 3.6.2.1; point 7.)

Deliberately bridge safety function (condition 1):TRUE: key switch actuatedFALSE: key switch not actuated

IN9 Override2 (NC contact: see Ch. 3.6.2.1; point 7.)

Deliberately bridge safety function (condition 2):TRUE: key switch actuatedFALSE: key switch not actuated

IN10 EDM_func (disable):Monitoring of feed-back loop

No EDM selected (External Device Monitoring):TRUE: deactivation of EDM FALSE: no deactivation of EDM

IN11 EDM: Connection of feedback loop

Monitoring of feedback loop:TRUE: feedback loop OKFALSE: feedback loop not OK

Tab. 3-7: Description of I/Os of Seq_Muting FB (1), continuation see Table 3-6 (next page)

Left: Fig. 3-24: Seq_Muting FB (1), continuation see Fig. 3-25 page 33

3.6.4 Description of Seq_Muting FB inputs/outputs (1)





3.6.4 Description of Seq_Muting FB inputs/outputs (2)

Input/output

Name Description

IN12

M_lamp_in Monitoring of muting lamp Feedback of muting lamp:TRUE: muting lamp is illuminatedFALSE: muting lamp is not illuminated

IN13 Mute_lamp (disable)

Selection of no monitoring of muting lamp:TRUE: muting lamp is not monitored FALSE: muting lamp is monitored

OUT1 OUT1 FB OK; Muting signal 1:TRUE: signal sequence inputs IN1 IN6 correct.FALSE: signal sequence inputs IN1 IN6 not correct.

OUT2 OUT2 FB OK; Muting signal 2:TRUE: signal sequence inputs IN1 IN6 correct.FALSE: signal sequence inputs IN1 IN6 not correct.

OUT3 Mut_Lamp FB OK; Actuation of muting lamp:TRUE: Signal sequence inputs IN1 IN6 correct.FALSE: Signal sequence inputs IN1 IN6 not correct.

OUT4 diagnose General fault:TRUE: signal sequence inputs IN1 IN6 not correct.FALSE: signal sequence inputs IN1 IN6 correct.

OUT5 DiagCode1 Position fault:TRUE: no position occupiedFALSE: position occupied

OUT6 DiagCode2 EDM fault dropping off of contactor:TRUE: feedback loop not OKFALSE: feedback loop OK

OUT7 DiagCode3 EDM fault connection of contactor:TRUE: feedback loop not OKFALSE: feedback loop OK

OUT8 DiagCode4 Sensor fault:TRUE: sensor sequence not OKFALSE: sensor sequence OK

OUT9 DiagCode5 Muting lamp fault:TRUE: muting lamp not OKFALSE: muting lamp OK

OUT10 DiagCode6 AOPD fault:TRUE: AOPD not OKFALSE: AOPD OK

Tab. 3-8: Description of I/Os of Seq_Muting FB (2)



Left: Fig. 3-25: Seq_Muting FB (2), continued from Fig. 3-24 page 32



3.6.5 Connection example: Monitoring of a sequential muting function

Performed with the help of a safety light barrier, 4 electromechanical sensors, a key switch with 2-channelled override function and a button for error acknowledgement the sequential muting function is monitored. Muting is displayed using a muting lamp. As additional function, there is monitoring of the lamp current of the muting lamp and the feedback loop of the connected actuator (2 contactors, not shown in Figure 3-25).

Fig. 3-26: Connection of PSC-CPU-MON and PSC-S-IN-LC for example program 3.6.6

DescriptionA safety light barrier, the four position switches Sensor 1, Sensor 2, Sen-sor 3 and Sensor 4 with NO contacts, a feedback loop with two NC contacts in series, a 2-channelled key switch override with break contact/make contact function, an ErrorQuit button to acknowledge errors and a muting lamp are connected to the PROTECT-PSC-CPU-MON and PROTECT-PSC-S-IN-LC modules as shown.

Desired functionSequential muting as described in 3.6.3. In addition with display using a muting indica-tor and monitoring of the feedback loop and lamp current.

NB: The muting lamp shown in Figure 3-25 corresponds to the input and output charac-teristics of the PROTECT-PSC in terms of its current and voltage characteristic curve.





3.6.6 Example program: Monitoring of sequential muting, feedback loop and lamp current (see 3.6.5) through integration of the Seq_Muting function block in the ladder diagram of the PROTECT PSCsw


Link to the library takes place

Program start

Wiring of the True_False function block:Generation of a safe 1 (here: M7F1) to OUT1 and a safe 0 (here: M7F0) to OUT2 with the help of safe input contact (here: I010) to IN1. The True_False FB from the Auxiliary folder is used for this.

Wiring of the Seq_Muting function block:IN1: Connection of NO contact Sensor l; here: contact with ad-dress I000.IN2: Connection of NO contact Sensor 2; here: contact with ad-dress I001.IN3: Connection of NO contact Sensor 3; here: contact with ad-dress I004.IN4: Connection of NO contact Sensor 4; here: contact with ad-dress I005.IN5: Connection of AOPD safety output l (OSSD 1); here: contact with address I010.IN6: Connection of AOPD safety output 2 (OSSD 1); here: contact with address I011.IN7: Connection of NO contact Error Quit button; here: contact with address I008.IN8: Connection of NO contact Override key switch; here: con-tact with address I006. IN9: Connection of NC contact Override key switch; here: con-tact with address I007.OUT1: Output signal 1; Muting OK; output (here M001) for further use.OUT2: Output signal 2; Muting OK; output (here M002) for further use.OUT3: Output signal for muting lamp; here: output Q00DOUT4 OUT9: Diagnosis outputs; see Table 3 6 for description; outputs (here M003 M008) for further use.

Fig. 3-27: Programming environment PROTECT-PSCsw example program: True_False and Seq_Muting FB (1)





3.6.6 Example program: Monitoring of sequential muting, feedback loop and lamp current (see 3.6.5) through integration of the Seq_Muting function block in the ladder diagram of the PROTECT PSCsw (continued)


Wiring of the Seq_Muting function block (continued):IN10: If monitoring of feedback loop is desired, wire IN10 with safe 0, otherwise with safe 1.IN11: If monitoring of feedback loop is desired, wire IN11 with input series connection of NC contacts of the actuated contac-tors (here: contact I009). Otherwise do not connect.IN12: If monitoring of the muting lamp is desired, wire IN12 with 0 V contact of the muting lamp (here: contact I012); otherwise do not connect.IN13: If monitoring of the muting lamp is desired wire IN13 with safe 0. Otherwise wire with safe 1.OUT10: Diagnosis output; see Table 3 6 for description; output (here: M009) for further use.

End of program

Fig. 3-28: Programming environment PROTECT-PSCsw example program True_False and Seq_Muting FBs (2)





3.7 Parallel Muting FB (1) (Name of FB in the Elan Library: Muting_2Sensors; seal ID: 8AD5)

3.7.1 ApplicationThe Muting_2Sensors function block rep-resents the function for parallel muting.

The principle relies on the reliable bridging of electro-sensitive protective equipment (ESPE) using two fixed wired sensors, usu-ally reflection light barriers. Muting is used for the transportation of material from a safe area to a danger area. Here an ESPE is run through without disconnection taking place.

The mechanical arrangement of the two reflection light barriers (muting sensors) must guarantee that no people are able to enter the danger area during muting or can themselves trigger muting.

The Muting_2Sensors FB can be used within PROTECT-PSC up to SIL 3 in accord-ance with EN IEC 61 508, PL e in accordance with EN ISO 13 849-1 and SC 4 in accord-ance with EN 954-1 when using electro-sen-sitive protective equipment in accordance with Type 4 to EN 61 496-1:2004 and under consideration of the specifications set out here.

NB: ESPE of Type 2 in accordance with EN 61 496-1:2004 likewise functions on the muting module. The safety integrity is not present here, however. The periodical test-ing of the Type 2 ESPE system is not sup-ported by the Muting_2Sensors FB.

Fig. 3-29: Parallel muting process

3.7.2 Features Parallel muting in both movement direc-tionsPossibility to actuate a muting indicator (LED or light bulb)Option of monitoring the muting indicator for interruption (lamp monitoring) Simple diagnosis

The Muting_2Sensors FB has been cre-ated on the basis of programming guidelines from PLCopen, the organisation for the industrial control technology field. This pro-gramming structure is described in Chapter 6.16 Parallel Muting with 2 Sensors of the document PLCopen Technical Committee 5 Safety Software Technical Specifica-tion, Part 1: Concepts and Function Blocks dated 31.01.2006.

3.7.3 Parallel muting processThe Muting_2Sensors function block supports muting in both transportation directions. It is possible to transport material forwards or backwards through the muting sequences. Usually with parallel muting two diagonally arranged reflection light barriers are used which cross at the danger zone, i.e. lie behind the ESPE to be bridged (see Figure 3-29). The transportation of mate-rial breaks through the light beams of both reflection light barriers within 4s and the muting process begins. The activation of a reflection light barrier ends the ESPE bridg-ing. The muting process is also automatical-ly ended if it lasts for longer than 10 minutes. A new muting process can only be started once both reflection light barriers have been activated.



3.7.4 Description of Muting_2Sensors FB inputs/outputs

Input/output

Name Description

IN1 S_AOPD_IN Safety output 1 and 2 ESPE (e.g. light curtains):TRUE: output 1 ESPE highFALSE: output 1 ESPE low

IN2 S_Mut_S11 Muting sensor 1 with make contact function; e.g. reflec-tion light barrier 1:

TRUE: reflection light barrier 1 energisedFALSE: reflection light barrier 1 not energised

IN3 S_Mut_S12 Muting sensor 2 with make contact function; e.g. reflec-tion light barrier 2:

TRUE: reflection light barrier 2 energisedFALSE: reflection light barrier 2 not energised

IN4 S_MUT_LAM Monitoring of muting lamp Reading back of muting lamp (where OUT3=TRUE):

TRUE: muting lamp is illuminatedFALSE: muting lamp is not illuminated

IN5 Mut_Enab Muting enable:TRUE: muting possible FALSE: muting not possible

IN6 S_Start_R Power on reset:TRUE: reset after power on (auto start after power on)FALSE: no reset after power on (reset must be actuated after power on)

IN7 Reset Reset:TRUE: where edge change low highOtherwise FALSE

OUT1 Ready FB initialised:TRUE after switching on (power on) or after reset on PSC-CPU-MON

OUT2 S_AOPD_O Safety output:TRUE: AOPD on IN1 free or muting activeFALSE: AOPD on IN1 not free and muting not active

OUT3 S_Mut_Ak Muting active (actuation of muting lamp):TRUE: parallel muting OK: see 3.7.2.2 FALSE: parallel muting not OK

OUT4 Error Error indicator:TRUE: IN1 or OUT3 is TRUE FALSE: IN1 and OUT3 is FALSE

Tab. 3-9: Description of I/Os of Muting_2Sensors FB



Fig. 3-30: Muting_2Sensors FB



3.7.5 Connection example: Monitoring of a parallel muting function

Performed with the help of a safety light barrier, 2 reflection light barriers and a reset button a parallel muting function is moni-tored. Muting and Error are displayed with the help of 2 lamps. The feedback loop of the connected actuator (2 contactors, not illustrated in Figure 3-31) is monitored using an additional function.

Fig. 3-31: Connection of PSC-CPU-MON and PSC-S-IN-LC for example program 3.7.6

DescriptionA safety light barrier, two reflection light bar-riers, a feedback loop with two NC contacts in series, a reset button for error acknowl-edgement and a muting and error lamp are connected to the PROTECT-PSC-CPU-MON and PROTECT-PSC-S-IN-LC modules as shown.

Desired functionParallel muting as described under 3.7.3. Additionally with muting and error lamp indicator.

NB: The lamps represented in Figure 3-31 correspond to the output characteristics of the PROTECT-PSC in terms of their current and voltage characteristic curve.





3.7.6 Example program: Monitoring of parallel muting and feedback loop (see 3.7.5) through integration of the Muting_2Sensors function block in the ladder diagram of the PROTECT PSCsw



Program start


Wiring of the Muting_2Sensors function block:IN1: Connection AOPD safety outputs (OSSD 1+2); here: contact with the address I010 and I011.IN2: Connection PNP output (NO function) reflection light barrier 1; here: contact with the address I012.IN3: Connection PNP output (NO function) reflection light barrier 2; here: contact with the address I013.IN4: Connection monitoring of muting lamp, if desired. Here: no monitoring desired, therefore wiring with safe 1 (here: M7F1).IN5: Connection muting enable, if desired. Here: no extra enable switch is desired, therefore wiring with safe 1 (here: M7F1).IN6: If immediate activation of OUT2 is desired after Power on, wire with safe 1; Here: activation only desired with reset switch (IN7), therefore wiring with safe 0 (here M7F0).IN7: Reset with rising edge to reset FM; here wiring with the ad-dress of the reset switch (I008) and as additional condition link to feedback loop (I009).OUT1: Output signal Ready (FB ready); output (here: M000) for further use.OUT2: Safety output AOPD or muting OK; output (here: M001) for further use.OUT3: Output signal for muting lamp indicator; here: output Q002.OUT4: Output signal for error lamp indicator; here: output Q003.

End of program

Fig. 3-32: Programming environment PROTECT-PSCsw example program: True_False and Muting_2Sensors FBs





3.8 FBs Flip-Flop (1) (Name of FB in the Elan Library: RS_FlipFlop_prio; seal ID: 590E; (Name of FB in the Elan Library: RS_FlipFlop_no_prio; seal ID: 4D5D; (Name of FB in the Elan Library: D_FlipFlop_fallingEdge; seal ID: 515F; (Name of FB in the Elan Library: D_FlipFlop_risingEdge; seal ID: 7EE6)

3.8.1 ApplicationA flip-flop, also known as a bistable trigger circuit, is generally understood as circuitry that can take two stable states and save these.

Flip-flops are used in caches of individual, defined states or to evaluate clock frequen-cies, for example.

3.8.2 FeaturesOf all the possible flip flop permutations, only the following types will be considered here:

R-S flip-flop with priorityR-S flip-flop without priority D flip-flop with evaluation on falling edgeD flip-flop with evaluation on rising edge

An RS flip-flop is the simplest kind of state actuated flip-flop. The output Q is set to high with a high signal on the Set input (S) and reset to low with a high signal on the Reset input (R). Here the output (NOT-Q) is always complementary to (runs counter to) output Q.

Fig. 3-33: Representation of R-S flip-flop

R-S flip-flop with priorityThe R input has priority where there is a simultaneous high signal on inputs S and R, i.e. the output (NOT-Q) is set and the output Q is reset.

R-S flip-flop without priorityThe simultaneous applying of a high signal to inputs S and R here leads to an undefined state. The R-S flip-flop without priority takes on a (third) state here, however, in which both outputs Q and (NOT-Q) lead to the same level (high) which cannot be saved. While there may be a wish for this function, it is not completely clear.

D flip-flops have a data or signal input D, a clock input C (often represented as >) and an output Q. A signal applied to input D is transmitted with the next clock signal to the clock input C on output D and saved.

NB: The maximum clock frequency to input C (> or Clock) may not lie below the maxi-mum total cycle time to signal processing of the PROTECT-PSC (22 ms reaction time). This results in a maximum clock frequency of 45 Hz.

D flip-flop with rising edgeThe D flip-flop saves the logical state of the input where there is a rising (positive) cycle edge on the clock input and reads its value out in sequence on Q. If there is no rising cycle edge there is no assumption of the input value.

D flip-flop with falling edgeThe D flip-flop saves the logical state of the input where there is a falling (negative) cycle edge on the clock input and reads its value out in sequence on Q. If there is no falling cycle edge there is no assumption of the input value.

Fig. 3-34: Representation of a D flip-flop



3.8.3 Description of FlipFlop FBs inputs/outputs

3.8.3.1 FB RS_FlipFlop_prio


IN1 Set Set input:TRUE: high signalFALSE: low signal

IN2 Reset Reset input (priority with simultaneous high signal to IN1 and IN2):

TRUE: high signalFALSE: low signal

OUT1 Q Bistable state:TRUE: after high signal to IN1 FALSE: after high signal to IN2

OUT2 Qnot Bistable state:TRUE: after high signal to IN2 FALSE: after high signal to IN1

Tab. 3-10: Description of I/Os of RS_FlipFlop_prio FB

3.8.3.2 FB RS_FlipFlop_no_prio


IN1 Set Set input:TRUE: high signalFALSE: low signal

IN2 Reset Reset input:TRUE: high signalFALSE: low signal

OUT1 Q Bistable state:TRUE: (after high signal to IN1) or (after high signal to IN1 and IN2 )FALSE: after high signal to In2

OUT2 Qnot Bistable state:TRUE: (after high signal to In1) or (after high signal to IN1 and IN2)FALSE: after high signal to IN1

Tab. 3-11: Description of I/Os of RS_FlipFlop_no_prio FB


3.8.3 Description of inputs/outputs (1)

Fig. 3-35: RS_FlipFlop_prio FB

Fig. 3-36: RS_FlipFlop_no_prio FB



3.8.3.3 FB D_FlipFlop_fallingEdge


IN1 D Data or signal input:TRUE: high signalFALSE: low signal

IN2 Clock Clock input:TRUE: falling edge FALSE: no falling edge

OUT1 Q Bistable state:TRUE: next falling edge to IN2 after high signal to IN1 FALSE: always after power on; then next falling edge to IN2 after low signal to IN1

Tab. 3-12: Description of I/Os of D_FlipFlop_fallingEdge FB

3.8.3.4 FB D_FlipFlop_risingEdge


IN1 D Data or signal input:TRUE: high signalFALSE: low signal

IN2 Clock Clock input:TRUE: falling edge FALSE: no falling edge

OUT1 Q Bistable state:TRUE: next rising edge to IN2 after high signal to IN1 FALSE: always after power on; then next rising edge to IN2 after low signal to IN1

Tab. 3-13: Description of I/Os of D_FlipFlop_risingEdge FB


3.8.3 Description of inputs/outputs (2)

Fig. 3-37: D_FlipFlop_fallingEdge FB

Fig. 3-38: D_FlipFlop_risingEdge FB



3.8.4 Connection example 1: Monitoring of the direction of movement of a conveyor belt

A production process requires safe signalling of the direction of movement of a conveyor belt using a corresponding lamp indicator. The direction of the conveyor belt is controlled by actuating two buttons.

In this example only the safe lamp indicator is shown.


DescriptionTwo buttons and two lamps are connected to the PROTECT-PSC-CPU-MON module as shown. Desired functionThe direction of the conveyor belt is set to forwards by actuating button 1. This is safely displayed by lamp 1. The direction of the conveyor belt is set to backwards by actuating button 2. This is safely indicated by lamp 2. Simultaneous actuation of but-tons 1 and 2 is not defined. The preferred direction of forwards should be provided for this event.



NB: The lamps shown in Figure 3-39 represent the output characteristics of the PROTECT-PSC in terms of their current and voltage characteristic curve.



3.8.5 Example program 1: Reliable indicator of the last actuated button (see 3.8.4) through integration of the RS_FlipFlop_prio function block in the ladder diagram of the PROTECT PSCsw



Program start

Wiring of the RS_FlipFlop_prio function block:IN1: Connection button 1 to set OUT1; here: contact with the ad-dress I007.IN2: Connection button 2 to set OUT1; here: contact with the ad-dress I001. This input has priority if there is simultaneous activa-tion of IN1 and IN2.OUT1: Output signal Q to connect lamp 2; here: output Q00B; is set when IN1 is activated.OUT2: Output signal Qnot to connect lamp 1; here: output Q00B; is set when IN2 is activated, or when IN1 and IN2 are acti-vated simultaneously.

End of program

Fig. 3-40: Programming environment PROTECT-PSC example program 1: RS_FlipFlop_prio FB





3.8.6 Connection example 2: Monitoring of the state change of a contactor:A contactor in a process sequence is to be switched against an input signal of a reflection light barrier. The state change of the contactor may only take place at a defined moment. This moment is stipulated by the clock that emits a periodic signal every 30 s lasting for 500 ms.


DescriptionA reflection light barrier, a clock and a con-tactor are connected to the PROTECT-PSC-CPU-MON module as shown.



Desired functionWhen the reflection light barrier has been energised the connected contactor should be activated at the moment when a rising edge is present on the clock. If the reflection light barrier has not been energised the contactor should be turned off at this time if there is similarly a rising edge on the clock.



3.8.7 Example program 2: Reliable indicator of the last actuated button (see 3.8.6) through integration of the D_FlopFlop_risingEdge function block in the ladder diagram of the PROTECT PSCsw



Program start

Wiring of the D_FlipFlop_risingEdge function block:IN1: Connection for NO contact (reflection light barrier, here: contact with the address I007) to set OUT1 when there is a rising edge at IN2.IN2: Clock input; here: contact with the address I007.OUT1: Output signal (for control of the contactor; here: output Q00A is set when IN1 is active and rising edge is at IN2).

End of program

Fig. 3-42: Programming environment PROTECT-PSCsw example program 2: D_FlipFlop_risingEdge FB





3.9 Turn off delay R FB (drop off delayed, retriggerable) (1) (Name of FB in the Elan Library: Turn_off_delay_R; seal ID: 14E7)

3.9.1 ApplicationThe Turn_off_delay_R FB can be used in all applications in which a retriggerable drop off delayed time is desired (generally termed a Stop1 function), depending on the input condition. Retriggerable means, that the drop off delayed time starts again, if during the run of the delayed time the input condi-tion is reset and set again.

Category 1 STOP in accordance with EN 60 204-1 Section 9.2.2: Controlled stop by interrupting the power supply to the actuator level if, for example, the hazardous movement has been brought to a standstill (= time-delayed shut-down of the power supply).

Example: the controller enable of an elec-tronic drive is shut down immediately using an enable with STOP category 0 and the power contactor only after the operational braking time of the motor (= STOP cat-egory 1).

3.9.2 FeaturesThe following syntax applies in order to design drop off delay times flexibly for every programmer:

The Turn_o

psc-fb library-manual v1 1

Documents

example program

connection example

description of inputsoutputs

precise description

false fb

psc version

switch fb

psc safety control system