Application Technique Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function Products: Trojan 5 Interlock Switch, GuardLogix 5570 or Compact GuardLogix 5370 Controller, POINT Guard I/O Safety Module, PowerFlex 525 Drive with Safe Torque Off Safety Rating: Cat. 3, PLd to ISO 13849-1: 2015 Topic Page Important User Information 2 General Safety Information 3 Introduction 4 Safety Function Realization: Risk Assessment 4 Door Monitoring Safety Function 4 Safety Function Requirements 5 Functional Safety Description 5 Bill of Material 5 Setup and Wiring 6 Configuration 8 Calculation of the Performance Level 17 Verification and Validation Plan 19 Additional Resources 22
Transcript
Application Technique
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety FunctionProducts: Trojan 5 Interlock Switch, GuardLogix 5570 or Compact GuardLogix 5370 Controller, POINT Guard I/O Safety Module, PowerFlex 525 Drive with Safe Torque Off
Safety Rating: Cat. 3, PLd to ISO 13849-1: 2015
Topic Page
Important User Information 2
General Safety Information 3
Introduction 4
Safety Function Realization: Risk Assessment 4
Door Monitoring Safety Function 4
Safety Function Requirements 5
Functional Safety Description 5
Bill of Material 5
Setup and Wiring 6
Configuration 8
Calculation of the Performance Level 17
Verification and Validation Plan 19
Additional Resources 22
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and operation of this equipment before you install, configure, operate, or maintain this product. Users are required to familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws, and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).
2 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
General Safety Information
Contact Rockwell Automation to learn more about our safety risk assessment services.
Safety Distance Calculations
Non-separating safeguards provide no physical barrier to prevent access to a hazard. Publications that offer guidance for calculating compliant safety distances for safety systems that use non-separating safeguards, such as light curtains, scanners, two-hand controls, or safety mats, include the following:
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of parts of the human body)
EN ISO 13857:2008 (Safety of Machinery – Safety distances to prevent hazardous zones being reached by upper and lower limbs
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
Separating safeguards monitor a movable, physical barrier that guards access to a hazard. Publications that offer guidance for calculating compliant access times for safety systems that use separating safeguards, such as gates with limit switches or interlocks (including SensaGuard™ switches), include the following:
EN ISO 14119:2013 (Safety of Machinery – Interlocking devices associated with guards - Principles for design and selection)
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of parts of the human body)
EN ISO 13857:2008 (Safety of Machinery – Safety distances to prevent hazardous zones being reached by upper and lower limbs
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
In addition, consult relevant national or local safety standards to assure compliance.
IMPORTANT This application example is for advanced users and assumes that you are trained and experienced in safety system requirements.
ATTENTION: Perform a risk assessment to make sure that all task and hazard combinations have been identified and addressed. The risk assessment can require additional circuitry to reduce the risk to a tolerable level. Safety circuits must consider safety distance calculations, which are not part of the scope of this document.
ATTENTION: While safety distance or access time calculations are beyond the scope of this document, compliant safety circuits must often consider a safety distance or access time calculation.
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 3
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Introduction
This safety function application technique explains how to wire, configure, and program a Compact GuardLogix® controller and POINT Guard I/O™ module to monitor a Trojan™ 5 tongue switch that is mounted on a door. If the door is opened or a fault is detected in the monitoring circuit, the GuardLogix controller de-energizes the final control devices, in this case, the Safe Torque Off (STO) inputs on the PowerFlex® 525 drive.
This example is applicable to any GuardLogix controller. This example uses a Trojan 5 tongue switch, but is applicable to any dual contact device with at least two normally closed contacts. The SISTEMA software calculations that are shown later in this document must be recalculated if different products are used.
Safety Function Realization: Risk Assessment
The required performance level is the result of a risk assessment and refers to the amount of the risk reduction to be conducted by the safety-related parts of the control system. Part of the risk reduction process is to determine the safety functions of the machine. In this application, the performance level required (PLr) by the risk assessment is Category 3, Performance Level d (Cat. 3, PLd), for each safety function. A safety system that achieves Cat. 3, PLd, or higher, can be considered control reliable. Each safety product has its own rating and can be combined to create a safety function that meets or exceeds the PLr.
Door Monitoring Safety Function
This application technique includes one safety function: the removal of power from the hazard when the safety system detects that the door has been opened. This system executes a stop category 0. Power is immediately removed and motion coasts to a stop.
From: Risk Assessment (ISO 12100)
1. Identification of safety functions
2. Specification of characteristics of each function
3. Determination of required PL (PLr) for each safety function
To: Realization and PL Evaluation
4 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Safety Function Requirements
The opening of a guard door stops and prevents hazardous motion by removal of power to the motor. Upon closing the door, hazardous motion and power to the motor does not resume until a secondary action (Start button is pressed and released) occurs. Faults at the door interlock switch, wiring terminals, or safety controller are detected before the next safety demand. Faults at the STO inputs on the PowerFlex 525 drive can go undetected. There is no feedback for the STO inputs on the PowerFlex 525 drive. Wiring faults at the STO inputs are detected immediately by pulse test diagnostics.
The safety function in this application technique meets or exceeds the requirements for Category 3, Performance Level d (Cat. 3, PLd), per ISO 13849-1 and control reliable operation per ANSI B11.19.
Functional Safety Description
Hazardous motion is interrupted or prevented by opening the door. The Trojan 5 switch is wired to a pair of safety inputs of a safety input module (SI1). The STO inputs of the PowerFlex 525 drive are connected to a pair of pulse-tested safety outputs. Both safety outputs are located on a safety output module (SO1). The I/O module is connected via CIP Safety™ over an EtherNet/IP™ network to the safety controller (SC1). The safety code in SC1 monitors the status of the door by using the pre-certified safety instruction Dual Channel Input Stop with Test (DCST). When all safety-input interlocks are satisfied, no faults are detected, and the Reset button is pressed and released, a second pre-certified function block called Configurable Redundant Output (CROUT) controls the STO inputs. In summary, when the door is opened, the actuators drop out. When the door is closed, and the Reset button is pressed and released, the actuators are energized.
Bill of Material
This application technique uses these products.
Cat. No. Description Quantity
440K-T11090 Trojan 5 standard safety interlock switch 1
800FM-G611MX10 800F Reset push button, metal, guarded, blue, R, metal latch mount, one normally open contact, standard 1
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 5
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Choose either the GuardLogix 5570 hardware list or the Compact GuardLogix 5370 hardware list.
Setup and Wiring
For detailed information on how to install and wire, refer to the publications listed in the Additional Resources.
System Overview
The 1734-IB8S input module monitors the two channels of the Trojan 5 switch. If the door is opened, these two channels open, and the controller reacts by dropping out the STO inputs of the drive.
The 1734-IB8S input module can source the 24V DC for both channels to dynamically test the signal wiring for shorts to 24V DC and channel-to-channel shorts. If a fault occurs, either or both channels are set to low (0), and the controller reacts by dropping out the STO inputs of the drive. Only after the fault is cleared and the door is opened and closed, does the function block reset.
Shorts to 0V DC and wire-off are seen as an open circuit by the 1734-IB8S input module. The controller reacts by dropping out the STO inputs of the drive. If the inputs remain discrepant for longer than the discrepancy time, the function block in the controller declares a fault. Only after the fault is cleared and the door is opened and closed, does the function block reset.
The final control devices are the STO inputs of the PowerFlex 525 drive. They are controlled by a 1734-OB8S safety output module. There is no feedback for the STO inputs on the PowerFlex 525 drive.
The system has individual Reset buttons for resetting faults and safety outputs.
In this example, the Reset buttons are wired to the 1734-IB8S module. This configuration is not required for functional safety. These inputs can be wired to a standard input module.
Controller Cat. No. Description Quantity
GuardLogix 5570
1756-L71S1756-L72S1756-L73S
GuardLogix processor, 2.0 MB standard memory, 1.0 MB safety memory, orGuardLogix processor, 4.0 MB standard memory, 2.0 MB safety memory, orGuardLogix processor, 8.0 MB standard memory, 4.0 MB safety memory
1
1756-L7SP GuardLogix Safety Partner 1
1756-EN2TR ControlLogix® EtherNet/IP bridge, 10/100 Mbps, 2-port, twisted-pair media 1
1756-PA72 Power supply, 120/240V AC input, 3.5 A @ 24V DC 1
1769-PA4 Power Supply, 120V/220V AC input, 2.0 A @ 24V DC 1
6 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Electrical Schematic
24V DC
24V DC Common
Safety Reset Fault Reset
PowerFlex 525 Drive
PowerFlex 525 Drive
COM
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 7
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Configuration
The GuardLogix controller is configured by using the Studio 5000 Logix Designer® application. You must create a project and add the POINT Guard I/O safety module. A detailed description of each step is beyond the scope of this document. Knowledge of the Logix Designer application is assumed.
Create a Project with a GuardLogix Controller and a POINT Guard I/O Safety Module
1. In the Logix Designer application, create a project with a GuardLogix controller.
2. Enable Time Synchronization for the controller.
The dialog box is the same for both controllers.
Minimum Logix Designer Application Version Product
8 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
3. If you are using a Compact GuardLogix 5370 controller, skip to step 7. Otherwise, in the Controller Organizer, add the 1756-EN2TR module to the 1756 Backplane.
4. On the General tab, do the following:a. Name the module.b. Type an IP address for the module.
This example uses 192.168.1.1 as the IP address. Your IP address can differ.c. Click Change.
5. From the Time Sync Connection pull-down menu, choose Time Sync and Motion.
The Time Sync and Motion selection lets the system perform motion applications.
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 9
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
6. Click OK.
7. If you are using a Compact GuardLogix 5370 controller, set the IP address. Otherwise, skip this step.
This example uses 192.168.1.1 as the IP address. Your IP address can differ.8. To add the 1734-AENT adapter, right-click the Ethernet network and choose New Module.
10 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
10. In the New Module dialog box, do the following:a. Type a name.b. Set the IP address.c. Click OK.
This example uses 192.168.1.1 as the IP address. Your IP address can differ.11. Click Change.12. Set the Chassis Size at 3 for the 1734-AENT adapter.
Chassis size is the number of modules that are inserted in the chassis. The 1734-AENT adapter is considered to be in slot 0, so for one input and one output module, the chassis size is 3.
13. Click OK14. In the Controller Organizer, right-click the PointIO 3 Slot Chassis and choose New Module.
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 11
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
15. In the Select Module dialog box, do the following:a. Check Safety.b. Select the 1734-IB8S module.c. Click OK.
16. In the New Module dialog box, name the device CellGuard_1.17. Click Change.
12 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
18. In the Module Definition dialog box, do the following:a. From the Output Data pull-down menu, choose None.b. From the Input Status pull-down menu, choose Combined Status-Power.
Setting the output data to None means that you cannot use the test outputs as standard outputs. In this example, the test outputs are only being used to perform pulse testing, therefore, setting output data to None is acceptable. This configuration saves one controller connection because we are using only the input connection.
19. Click OK.20. Repeat steps 14…19 to add the 1734-OB8S safety output module.21. Name the 1734-OB8S module CellGuard_2 and click Change.
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 13
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
22. When the Module Definition dialog box opens, configure the module as shown.
This module is in slot 2, and Combined Status-Readback-Power is selected for Input Status.23. Click OK.
Configure the I/O Modules
Follow these steps to configure the POINT Guard I/O™ modules.
1. In the Controller Organizer, right-click the 1734-IB8S module and choose Properties.2. Click the Test Output tab, and configure the module as shown.
14 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
3. Click the Input Configuration tab for the 1734-IB8S module, and configure the module as shown:
Input Points 0 and 1 are the Trojan 5 door switch. Input Points 4 and 5 are the Reset buttons.4. Click OK.5. In the Controller Organizer, right-click the 1734-OB8S module, and choose Properties.6. Click the Output Configuration tab, and configure the module as shown.
The STO inputs of the PowerFlex 525 drive can be pulse tested without reacting to the brief low (0) pulse.7. Click OK.
Programming
The Dual Channel Input Stop with Test (DCST) instruction monitors dual-input safety devices whose main function is to stop a machine safely, for example, a safety gate. When a test function is requested, programmatically or manually, the operation of the machine is halted until a proper cycle of the safety gate occurs.
The DCST instruction monitors dual-input channels for consistency (Equivalent - Active High) and detects and traps faults when the inconsistency is detected for longer than the configured Discrepancy Time (ms).
The automatic restart type lets the DCST output (O1) reset automatically after a demand. The manual action typically required for safety is provided in rung 1 to reset the safety output enable.
Input status typically represents the channel status of the two input channels. In this example, the Combined Input Status bit goes low (0) if any of the eight input channels on the 1734-IB8S have a fault.
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 15
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
In this example, the DCST reset acts as a fault reset. Even when configured for automatic restart, a reset is required to recover from a fault.
The output (O1) of the DCST is used as a safety interlock in the seal-in rung to drive the output enable tag. If the DCST output drops out, so does the output enable, and it remains off until a manual reset action is conducted.
The Configurable Redundant Output (CROUT) instruction controls and monitors redundant outputs. Since there is no feedback from the PowerFlex 525 drive, the feedback in the instruction is the output tag of the CROUT instruction. The CROUT instruction is used only for the input and output status functionality.
The two output tags from the CROUT instruction are used to drive outputs 0 and 1 on the 1734-OB8S module. These two outputs control the PowerFlex 525 STO inputs.Program Logic
Falling Edge Reset
ISO 13849-1 stipulates that instruction reset functions must occur on falling edge signals. To comply with this requirement, a One Shot Falling (OSF) instruction is used on the reset rung. Then, the OSF instruction Output Bit tag is used as the reset bit for the STO output rung.
O1
TC
FP
Dual Channel Input Stop With TestDCST Zone1_DoorSafety Function SAFETY GATEInput Type EQUIVALENT - ACTIVE HIGHDiscrepancy Time (Msec) 250Restart Type AUTOMATICCold Start Type AUTOMATICChannel A AENT:1:I.Pt00Data 0Channel B AENT:1:I.Pt01Data 0Test Request Test_Safety_Gate 0Input Status AENT:1:I.CombinedInputStatus 0Reset AENT:1:I.Pt05Data 0
DCST
AENT:1:I.Pt04Data
SBOB
One Shot FallingStorage Bit Wrk_Zone1_OSFOutput Bit Wrk_Zone1_FallingEdge
OSF
Wrk_Zone1_FallingEdge
Cmd_Zone1_OutputEnable
Zone1_Door.O1/
Zone1_K1K2.FP Cmd_Zone1_OutputEnable
O1
O2
FP
Configurable Redundant OutputCROUT Zone1_K1K2Feedback Type POSITIVEFeedback Reaction Time (Msec) 500Actuate Cmd_Zone1_OutputEnable 0Feedback 1 Zone1_K1K2.O1 0Feedback 2 Zone1_K1K2.O2 0Input Status AENT:1:I.CombinedInputStatus 0Output Status AENT:2:I.CombinedOutputStatus 0Reset AENT:1:I.Pt05Data 0
16 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Calculation of the Performance Level
When properly implemented, this door monitoring safety function can achieve a safety rating of Category 3, Performance Level d (Cat. 3, PLd), according to ISO 13849-1: 2015, as calculated by using the Safety Integrity Software Tool for the Evaluation of Machine Applications (SISTEMA).
The functional safety specifications of the project call for a minimum structure of Cat. 3 and a minimum performance level of PLd. A PFHd of less than 1.0 E-06 for the overall safety function is required for PLd.
The overall safety function value is shown in the graphic.
The (logic) GuardLogix 5570 controller subsystem uses 1.2% of PLe bandwidth. The (logic) Compact GuardLogix 5370 controller subsystem uses 1.5% of PLe bandwidth.
The individual subsystem values are shown in the following graphic.
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 17
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
The door monitoring safety function can be modeled as follows:
Calculations are based on one operation of the safety guard door per hour, or 8760 operations of the safety function per year.
The Trojan 5 switch uses one tongue actuator for door monitoring and locking. Due to the inherent strength and simplicity of the actuator design, fault exclusion (FE) for this single mechanical actuator is applied in accordance with ISO 13849 Parts 1 & 2.
18 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Verification and Validation Plan
Verification and validation play important roles in the avoidance of faults throughout the safety system design and development process. ISO 13849-2 sets the requirements for verification and validation. The standard calls for a documented plan to confirm that all safety functional requirements have been met.
Verification is an analysis of the resulting safety control system. The Performance Level (PL) of the safety control system is calculated to confirm that the system meets the required Performance Level (PLr) specified. The SISTEMA software is typically used to perform the calculations and assist with satisfying the requirements of ISO 13849-1.
Validation is a functional test of the safety control system to demonstrate that the system meets the specified requirements of the safety function. The safety control system is tested to confirm that all safety-related outputs respond appropriately to their corresponding safety-related inputs. The functional test includes normal operating conditions and potential fault injection of failure modes. A checklist is typically used to document the validation of the safety control system.
Before you validate the GuardLogix safety system, confirm that the safety system and safety application program have been designed in accordance with the GuardLogix 5570 and Compact GuardLogix 5370 Controller Systems Safety Reference Manual, publication 1756- RM099, and the GuardLogix Safety Application Instruction Set Safety Reference Manual, publication 1756-RM095.
Verification and Validation Checklist
General Machinery Information
Machine Name/Model Number
Machine Serial Number
Customer Name
Test Date
Tester Name
Schematic Drawing Number
Controller Name
Safety Signature ID
Safety Network Number
Logix Designer Application
Safety Control System Modules GuardLogix Modules Firmware Revision
GuardLogix Safety Controller1769-L30ERMS, or 1769-L33ERMS, or 1769-L36ERMS1756-L71S, or 1756-L72S, or 1756-L73S
POINT I/O™ Ethernet Adapter 1734-AENT
POINT Guard I/O Input Modules 1734-IB8S
POINT Guard I/O Output Modules 1734-OB8S
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 19
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
GuardLogix Safety System Wiring and Configuration Verification
Test Step Verification Pass/Fail Changes/Modifications
1 Verify that the safety system is designed in accordance with the GuardLogix System Safety Reference Manual listed in the Additional Resources.
2Verify that the safety application program is designed in accordance with the GuardLogix Safety Application Instruction Set Safety Reference Manual, publication 1756-RM095.
3 Visually inspect the safety system network and verify that the I/O is wired as documented in the schematics.
4 Visually inspect the PowerFlex 525 drive and verify that it is configured as documented.
5 Visually inspect the Studio 5000® program to verify that the safety system network and I/O module configuration are configured as documented.
6Visually inspect the Studio 5000 application program to verify that suitable safety-certified instructions are used. The logic must be readable, understandable, and testable with the aid of clear comments.
7 Verify that all input devices are qualified by cycling their respective actuators. Monitor the status in the Controller Tags window.
8 Verify that all output devices are qualified by cycling their respective actuators. Monitor the status in the Controller Tags window.
Normal Operation Validation - The safety system responds properly to all normal Start, Stop, and Reset inputs.
Test Step Validation Pass/Fail Changes/Modifications
1Initiate a Start command. Both PowerFlex 525 STO inputs energize for a normal machine run condition. Verify proper machine status indication and safety application program indication.
2Initiate a Stop command. Both PowerFlex 525 STO inputs de-energize for a normal machine Stop condition. Verify proper machine status indication and safety application program indication.
3
While the system continues to run, actuate the monitored guard door. Both PowerFlex 525 STO inputs de-energize and open for a normal safe condition. Verify proper machine status indication and safety application program indication. Repeat for all guard doors.
4
While the system continues to run, actuate the monitored guard door. Both PowerFlex 525 STO inputs de-energize and open for a normal safe condition. Verify proper machine status indication and safety application program indication. Repeat for all guard doors.
5
While the system is stopped with the guard door opened, initiate a Start command. Both PowerFlex 525 STO inputs remain de-energized and open for a normal safe condition. Verify proper machine status indication and safety application program indication. Repeat for all guard doors.
6 Initiate a Reset command. Both PowerFlex 525 STO inputs remain de-energized. Verify proper machine status indication and safety application program indication.
Verification and Validation Checklist (continued)
20 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Validation of Safe Response to Abnormal Operation - The safety system responds properly to all foreseeable faults with corresponding diagnostics.
Light Curtain, Muting Sensor Input Tests
Test Step Validation Pass/Fail Changes/Modifications
1
While the system continues to run, remove the channel 1 wire from the safety I/O. Both PowerFlex 525 STO inputs de-energize. Verify proper machine status indication and safety application program indication. Verify that the system is unable to reset and restart with a fault. Restore channel 1 and repeat for channel 2.
2
While the system continues to run, short channel 1 of the safety I/O to 24V DC. Both PowerFlex 525 STO inputs de-energize. Verify proper machine status indication and safety application program indication. Verify that the system is unable to reset and restart with a fault. Restore channel 1 and repeat for channel 2.
3
While the system continues to run, short channel 1 of the safety I/O to 0V DC. Both PowerFlex 525 STO inputs de-energize. Verify proper machine status indication and safety application program indication. Verify that the system is unable to reset and restart with a fault. Restore channel 1 and repeat for channel 2.
4
While the system continues to run, short channels 1 and 2 of the safety I/O. Both PowerFlex 525 STO inputs de-energize. Verify proper machine status indication and safety application program indication. Verify that the system is unable to reset and restart with a fault. Restore channel 1 and 2 wiring.
5
While the system continues to run, short channel 1 to test source 1 of the safety I/O. Open the guard door. Both PowerFlex 525 STO inputs de-energize. Verify proper machine status indication and safety application program indication. Verify that the system is unable to reset and restart with a fault. Restore channel 1 wiring and repeat for channel 2.
Validation of Safe Response to Abnormal Operation - The safety system responds properly to all foreseeable faults with corresponding diagnostics.
GuardLogix Controller and Network Tests
Test Step Validation Pass/Fail Changes/Modifications
1
While the system continues to run, remove the Ethernet network connection between the safety I/O and the controller. All PowerFlex 525 STO inputs de-energize. Verify proper machine status indication and I/O connection status in the Studio 5000 safety application program.
2Restore the safety I/O module network connection and allow time to re-establish communication. The system does not restart. Verify the connection status bit in the safety application program. Repeat for all safety I/O connections.
3
While the system continues to run, switch the controller out of Run mode. All PowerFlex 525 STO inputs de-energize. Return the controller keyswitch to Run mode. All PowerFlex 525 STO inputs remain de-energized. Verify proper machine status indication and safety application program indication.
Validation of Safe Response to Abnormal Operation - The safety system responds properly to all foreseeable faults with corresponding diagnostics.
PowerFlex 525 STO Output Tests
Test Step Validation Pass/Fail Changes/Modifications
1Initiate a Start command. Both PowerFlex 525 STO inputs energize for a normal machine run condition. Verify proper machine-status indication and safety application program indication.
Verification and Validation Checklist (continued)
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 21
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Additional Resources
These documents contain more information about related products from Rockwell Automation.
You can view or download publications at http://www.rockwellautomation.com/global/literature-library/overview.page. To order paper copies of technical documentation, contact your local Allen-Bradley distributor or Rockwell Automation sales representative.
Resource Description
GuardLogix 5570 and Compact GuardLogix 5370 Controller Systems Safety Reference Manual, publication 1756-RM099
Describes the GuardLogix 5570 controller system. Provides instructions on how to develop, operate, or maintain a GuardLogix 5570 controller-based safety system that uses the Studio 5000 Logix Designer application.
GuardLogix 5570 Controllers User Manual, publication 1756-UM022 Provides information on how to install, configure, and program the GuardLogix 5570 controllers in the Logix Designer application.
Compact GuardLogix 5370 Controllers User Manual, publication 1769-UM022 Provides information on how to install, configure, and program the Compact GuardLogix 5370 controllers in the Logix Designer application.
GuardLogix Safety Application Instruction Set Safety Reference Manual, publication 1756-RM095
Describes the Rockwell Automation® GuardLogix Safety Application Instruction Set. Provides instructions on how to design, program, or troubleshoot safety applications that use GuardLogix controllers.
POINT Guard I/O Safety Modules User Manual, publication 1734-UM013 Provides information on how to install, configure, and operate POINT Guard I/O modules
PowerFlex 520-Series Adjustable Frequency AC Drive User Manual, publication 520-UM001
Provides information on how to install, program, and operate PowerFlex 525 drives.
Safety Accelerator Toolkit Quick Start, publication IASIMP-QS005 Provides a step-by-step guide on how to use the design, programming, and diagnostic tools in the Safety Accelerator Toolkit.
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines on how to install a Rockwell Automation industrial system.
Provides information about Rockwell Automation safety products.
Product Certifications website, http://www.rockwellautomation.com/global/certification/overview.page Provides declarations of conformity, certificates, and other certification details.
22 Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017
Stop Cat. 0 via a PowerFlex 525 Drive with an Integrated Safety Controller Safety Function
Notes:
Rockwell Automation Publication SAFETY-AT127A-EN-P - January 2017 23
Allen-Bradley, Compact GuardLogix, ControlLogix, GuardLogix, LISTEN. THINK. SOLVE, POINT Guard I/O, POINT I/O, PowerFlex, Rockwell Automation, Rockwell Software, SensaGuard, Stratix, Studio 5000, Studio 5000 Logix Designer, and Trojan are trademarks of Rockwell Automation, Inc.CIP Safety and EtherNet/IP are trademarks of ODVA, Inc.Trademarks not belonging to Rockwell Automation are property of their respective companies.
Publication SAFETY-AT127A-EN-P - January 2017
Rockwell Automation SupportUse the following resources to access support information.
Documentation FeedbackYour comments will help us serve your documentation needs better. If you have any suggestions on how to improve this document, complete the How Are We Doing? form at http://literature.rockwellautomation.com/idc/groups/literature/documents/du/ra-du002_-en-e.pdf.
Technical Support Center Knowledgebase Articles, How-to Videos, FAQs, Chat, User Forums, and Product Notification Updates. www.rockwellautomation.com/knowledgebase
Local Technical Support Phone Numbers Locate the phone number for your country. www.rockwellautomation.com/global/support/get-support-now.page
Direct Dial CodesFind the Direct Dial Code for your product. Use the code to route your call directly to a technical support engineer.
Rockwell Otomasyon Ticaret A.Ş., Kar Plaza İş Merkezi E Blok Kat:6 34752 İçerenköy, İstanbul, Tel: +90 (216) 5698400
Rockwell Automation maintains current product environmental information on its website at http://www.rockwellautomation.com/rockwellautomation/about-us/sustainability-ethics/product-environmental-compliance.page.
For more information onSafety Function Capabilities, visit:http://marketing.rockwellautomation.com/safety/en/safety_functions
