Next Generation Guardmaster Safety Relay (GSR)

Transcription

1 Wiring Diagram Next Generation Guardmaster Safety Relay (GSR) Bulletin 0R Quick Reference Page Safety Relay Modules Input Devices Output Devices SIL CL Category Number 6 SI E-stop PowerFlex d 0 SI MAB PowerFlex d 0 0 SI Trojan T 79 FLEX I/O d 0 SI, EM, EMD E-stops 00S-C, 700S-DCP d 0 SI, EMD E-stop Kinetix 6000 Guardmotion with RBM e 6 SI, EMD GuardShield Safe 00S, 700S-C e 0 SI, DI, DIS E-stops, Trojan T, Safety Mat 00S, 700S-C e 0 0 SI, MSRH GuardShield, 00Z 00S-C e 0 SI, DIS SensaGuard with Integrated Latch, E-stops PowerFlex e 0 CI Trojan T, Elf, E-stop, PLC on Ch 00S-C d 0 6 CI SensaGuard 00S-C e 0 CI MC Magnetically Coded Sensors 00S-C d 0 0 CI Ferrogard GD Non-contact Sensors 00S-C d 0 DI GuardShield 00S-C e 0 DI GuardShield 00S-C e 0 6 DI Lifeline 00S-C e 0 DI SensaGuard, Distribution Block, E-stop Kinetix K0 d 0 0 DI GuardShield, E-stop Pneumatic Safety Valve e 0 DI SensaGuard with Integrated Latch, E-stop PowerFlex d 0 GLT, EM, SI, EMD 0G-MT, MT-GD, GripSwitch 00S-C d 0 6 DI, EMD MT-GD, GripSwitch-Jog PowerFlex 70 d 0 DI, EMD TLS-GD, Trojan T, E-stop 00S-C e 0 0 DI, EMD MAB, E-stop 00S-C d 0 DI, DI, DI E-stops, GuardShield Safe, Mat, SensaGuard 00S-C / / d/e 0 DI Safety Mats PowerFlex 7 d 0 6 DI SafeZone Mini, E-stop Kinetix 0 d 0 DI SafeZone Multizone, E-stop Kinetix 0 d 0 60 DI SC00 Safety Sensor, E-stop Kinetix 0 d 0 6 DIS Galvanic Isolator 97TH, Trojan T, E-stop PowerFlex d 0 PL Stop Cat.

2 Page Safety Relay Modules Input Devices Output Devices 6 DIS Galvanic Isolator 97TH, MatGuard, E-stop PowerFlex / c/d 0 66 DIS Galvanic Isolator 97TH, Safedge, E-stop PowerFlex / c/d 0 6 DIS Trojan, MT-GD PowerFlex 70 d 0 70 DIS Trojan PowerFlex 70 d 0 7 DIS, MSR Micro 00 GuardShield, E-stop 00S-C e 0 7 DIS, MSR Micro 00 GuardShield, SensaGuard, E-stop 00S-C e 0 76 GLP 7C, TLS-GD, GLP Logic = PowerFlex 70 d 7 GLP 7C, TLS-ZR, GLP Logic = 7 POINT Guard I/O d 0 GLP, EM 7TM, 0G-MT, 700-HPS, GLP Logic = PowerFlex d GLP, SI 7TM, 0G-LZ, E-stop, GLP Logic = PowerFlex 70 d GLP 7TM, TLS-ZR, GLP Logic = Kinetix 00 d SLS 6 GLP, SI, EM 7TM, 0G-LZ, E-stop, GLP Logic = PowerFlex / / d/e SLS GLP 7C, 0G-LZ, GLP Logic = Stop Motion + Unlock Delay d 90 GLP 7C, GLP Logic = Stop Motion Only 7 POINT Guard I/O d 9 GLP 7C, GLP Logic = Status Only d 9 GLT TLS-GD, GLT Logic = PowerFlex d 0 96 GLT 0G-LZ, GLT Logic = PowerFlex d 0 9 GLT Multiple 0G-LZ or TLS-ZR, GLT Logic = PowerFlex d 0 00 GLT Multifunction Access Box (MAB) GLT Logic = PowerFlex d 0 0 GLT, SI MAB with three buttons, GLT Logic = 00S e 0 0 GLT TLS-ZR or 0G-LZ, GLT Logic = PowerFlex d 06 GLT, SI E-stop, TLS-ZR, or 0G-LZ, GLT Logic = PowerFlex d 0 GLT, EM E-stop, GLT Logic = PowerFlex, 00S,700S-C / / d/e /0 0 GLT, SI MC, E-stop, GLT Logic = 6 PowerFlex, 00S d GLT, EM E-stop, GLT Logic = 7 PowerFlex, 00S, 700S-C / / d/e /0 GLT, SI Ferrogard GD, E-stop, GLT Logic = PowerFlex, 00S e 6 ENETR DI, EM, DIS, EMD, GLT, GLT SI, EM E-stop, SI, EM 00S-D e 0 0 GLP SensaGuard with Integrated Latch PowerFlex 70 d SLS Summary of Changes This publication contains updated ratings in the SI/DIS Safety Relays, SensaGuard Interlock, E-stops, and PowerFlex Drive with Contactor section on pages and. SIL CL Category Number PL Stop Cat. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

3 Notes for Example Wiring Diagrams Note In the wiring diagrams that are shown in this publication, the type of Allen-Bradley Guardmaster device is shown as an example to illustrate the circuit principle. For special applications, the choice of device type is based on the suitability of its characteristics for its intended use. Note In most of the following examples that show dual channel applications, one interlock switch is shown switching both channels (one contact set per channel). If foreseeable damage (for example, at the actuator mounting point) could allow the guard to be opened without operating the switch, then two separate switches are required. The electrical principle of the circuit remains the same. Note In most cases, the circuits are shown with the guard door closed and ready for motor starting by operating the normal start control. It must be possible to start the machine only by voluntary actuation of the control that is provided for the purpose (see ISO 00-..). For the purposes of these examples, the use of a conventional contactor-latching circuit has been assumed. If not, then a restart interlock is required to help prevent an automatic or unintended starting of the motor when the guard is closed. For example, a Minotaur safety relay with a momentary action push button that is installed in the output to monitor the circuit can be used to achieve this protection. If the guard is designated as a Control Guard (see ISO ), these requirements do not apply. However, the use of control guards is allowed only under certain conditions including: A control guard can be used only where there is no possibility of an operator or part of their body staying in or reaching into the danger zone while the guard is closed. The control guard must be the only access to the hazardous area. The interlocking system must have the highest possible reliability. It is often advisable to use a solenoid locking switch such as the Guardmaster 0G-LZ or TLS-ZR guard locking switches. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

4 Note Safety monitoring relays are used in dual-channel circuits with infrequent operation or with multiple switching devices connected. This note applies to all monitoring devices that compare the signal at the change of state of dual channels. Certain faults are only detected at a change of state of the input switching device (interlock switch or E-stop switch). If there are long periods (for example, months as opposed to days) between switching actions, it is possible for multiple faults to accumulate, which could lead to a dangerous situation. Therefore, a regular check must be performed on the system to detect single faults before an accumulation occurs. This check can be manual or initiated by part of the control system. For example, if three interlock switches are connected to the monitoring unit, certain faults are detected only at the switch on the first-opened guard and the switch on the last-closed guard. Faults are only detected at these times because any switching between the first opening and last closing does not change the state of the monitoring unit input circuits. Therefore, in some applications it is necessary to use one monitoring device per switch. Most of the examples in this publication show an interlock switch and an emergency stop switch that are combined in the circuit. When a monitoring safety relay (for example, a GSR module) is used for fault detection, it is important to note the following: All safety-critical single faults, except for certain faults over the contact set at the E-stop, are detected at the next opening of the guard. All safety-critical single faults, except for certain faults over the contact set at the interlock switch, are detected at the next operation of the E-stop. Because the E-stop device is operated infrequently, we recommend that you check its function (with the guard closed) regularly, at the start of your shift or daily, to enable the safety monitoring relay to detect single faults. If the guard is rarely opened, the interlock switch must be checked in a similar manner. Note This symbol indicates that the associated component or device features direct opening (positive opening) operation. In the even t of a fault, welded contacts are forced open by the motion of the safety guard or E-stop device. This symbol denotes mechanically linked contacts; if one contact welds closed, all other dependent (auxiliary) contacts remain in position (that is, they cannot change state). Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

5 General Safety Information IMPORTANT The examples in this section are for advanced users and assumes that you are trained and experienced in safety system requirements. Contact your local Rockwell Automation sales office or Allen-Bradley distributor for more information about our safety risk assessment services. ATTENTION: Perform a risk assessment to make sure that all tasks and hazard combinations are identified and addressed. The risk assessment requires additional circuitry to reduce the risk to a tolerable level. Safety distance calculations are an important consideration in safety circuits, but is not part of the scope of this document. Additional Resources These documents contain additional information concerning related products from Rockwell Automation. Resource GuardShield Micro 00 Safety Light Curtains User Manual, publication L-UM00_ Industrial Automation Wiring and Grounding Guidelines, publication Product Certifications website, Description Provides an explanation of safety distance calculations. Provides general guidelines for installing a Rockwell Automation industrial system. Provides declarations of conformity, certificates, and other certification details. You can view or download publications at Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

6 SI Safety Relay with E-stop to PowerFlex Drive Circuit Components E-stop Single input (SI) safety relay PowerFlex drive Circuit Status The SI safety relay logic is set to MM (monitored manual reset). The E-stop is released. The SI safety outputs (/ and /) are off. The PowerFlex drive is powered, but disabled. The motor is off. Operating Principle STARTING: Press the Reset button to turn on the SI safety outputs. The drive in enabled and power is applied to the Start and Stop buttons. Press the Start button to start the motor. STOPPING: Press the Stop button to stop the motor for production stops. Press the E-stop to initiate a safety stop. The motor coasts to a stop. Fault Detection Upon successful completion of internal checks by the SI safety relay and PowerFlex drive, the drive awaits the closure of the safety outputs. If the SI safety relay fails, the drive does not energize the motor, and non-operation of the motor indicates the fault. The SI safety relay generates test pulses through the E-stop circuits to detect cross channel shorts and shorts to power and ground. The drive detects some faults in the safe-circuit of the drive and the drive executes a Safe Torque Off stop. The safety system does not detect a short circuit from S to S. Ratings The E-stop initiates a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLd per ISO 9-: 006. The circuit executes a Safe Torque Off stop. 6 Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

7 Figure - SI Safety Relay with E-stop to PowerFlex Drive +V DC Reset L L L PowerFlex R S T +V DC Stop E-stop 00FM-MT 00F-MX0S S S S A RESET 0 AM SI 0R-SR MM S S Y L A Start Gate control power supply Gate control circuit Status To PLC S S U V W M V DC Com Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07 7

8 SI Safety Relay with MAB Guard Locking to PowerFlex Drive Circuit Components Multifunctional Access Box (MAB) SI safety relay PowerFlex drive Circuit Status The SI safety relay logic is set to MM (monitored manual reset). The MAB is closed and locked. The SI safety outputs (/ and /) are off. The PowerFlex drive is powered but disabled. The motor is off. Operating Principle STARTING: Press the Reset button to turn on the SI safety outputs. The drive is enabled and power is applied to the Start and Stop buttons. Press the Start button to start the motor. STOPPING: Press the Stop button to stop the motor for production stops. Press the E-stop to initiate a safety stop; the motor coasts to a stop. GATE ACCESS: Rotate the Unlock Request button to apply power to unlock the gate. This action immediately opens the safety outputs of the MAB, which in turn causes the safety outputs of the SI to turn OFF. Then, the PowerFlex drive safety inputs turn OFF and the motor coasts to a stop. The stopping time of the machine must be less than the time from when the operator presses the Unlock Request to when the operator can reach the hazard. Fault Detection Upon successful completion of internal checks by the MAB, SI safety relay, and PowerFlex drive, the drive awaits the closure of the safety outputs. If the SI safety relay faults, the drive does not energize the motor, and non-operation of the motor indicates the fault. The MAB generates test pulses through its output signals to detect cross-channel shorts and shorts to power and ground. The MAB Fault Reset switch clears faults within the MAB. The drive detects a fault in the safe-circuit of the drive and the drive executes a Safe Torque Off stop. The safety system does not detect a short circuit from S to S. Ratings The E-stop initiates a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLd per ISO 9-:006. The circuit executes a Safe Torque Off stop. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

9 Figure - SI Safety Relay with MAB Guard Locking to PowerFlex Drive +V DC Reset L L L G-MABH-R + G-MABR-URM-C00 Unlock Request PowerFlex +V DC R S T Stop 9M-F9RM- Brown Violet Blue Gray/Pink Green/Black Red/Blue MAB Fault Reset S S S A RESET 0 AM SI 0R-SR MM S S Y Status To PLC L A Start Gate control power supply Gate control circuit S S U V W M V DC Com Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07 9

10 SI Safety Relay to FLEX I/O Circuit Components Trojan T GD tongue interlock switch Bulletin 00F push button SI safety relay FLEX I/O module Circuit Status The safety gate is closed. The outputs of the SI safety relay are open and the machine actuators are off. Control Relay CR is de-energized and the / contact is closed. Operating Principle The SI safety relay is chosen for this application because its thermal (non-switching) current carrying capacity is 6 A in one circuit. During the manufacturing process, the FLEX output module switches the machine actuators. The safety system enables the machine functions by providing power to the FLEX output module. One of the FLEX outputs must drive an electromechanical device (CR) whose normally closed contact is in the monitoring loop of the safety relay. The machine logic must energize this output while the machine is running, as it is used by the SI safety relay to confirm that power is removed from the output module, before restarting. STARTING: Press the Reset button to energize the output contacts / of the SI safety relay. This action connects the V supply to terminal C of catalog number 97-OB6 FLEX output module and also sends a signal to the A terminal of the catalog number 79-IB6 input module. The logic system is informed that the gate is closed and the machine is ready to run. Press the Start button to start the machine process. STOPPING: Press the Stop button to stop the machine. Then, open the gate to access the machine. While the gate is open, the machine actuators cannot operate because power is removed from the output module. If the gate is inadvertently opened while the machine is running, power is removed from output module and the machine actuators are de-energized. Fault Detection Upon successful completion of internal checks on power-up, the SI checks the input circuits. With the gates closed, the SI safety relay checks the dual circuits and then waits for the reset signal. A fault, a short from V to terminal of the SI safety relay, can lead to the loss of the safety function. When the SI safety relay and FLEX system are mounted in the same cabinet with proper validation, this fault can be excluded. If not mounted in the same cabinet, a signal from the output (A0) should be fed back into the input module (A). The logic can perform a comparison of input A and A, and turn off the machine if these signals are not in agreement. If CR is not de-energized when the gate is closed, the SI safety relay does not close its outputs. Ratings The Trojan T-GD gate interlock initiates a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLd per ISO 9-:006. This circuit executes a Stop Category 0. 0 Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

11 Figure - SI Safety Relay to FLEX I/O +V DC Trojan T GD 0K-T90 9D-FAC- V DC Com Brown Blue Black White S S A S RESET AM SI 0R-SR 0 MM S S A L Y Reset 00FM-F6MX0 Limited to 6 Amps Start 00FM- FMX0 700-HLTZ 700-TBR CR 0 Stop 00FM- EMX0 7 9 CR CR 0 Machine C B Actuators A A B C 79-TB & 79-OB6 79-TB & 79-I6 FLEX Output Module FLEX Input Module Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

12 Expansion Modules with Immediate and Delayed Outputs Circuit Components Bulletin 00F E-stops SI, expansion module (EM), expansion module time-delayed (EMD) safety relays Bulletin 00S contactor Bulletin 700S safety control relay Circuit Status The E-stops are reset. The safety outputs of the SI, EM, and EMD safety relays are de-energized. All contactors are off. The EMD Range setting is (0-second OFF Delay) and the Time setting is (0%), therefore the time delay is seconds. The reset and monitoring circuit are connected to S for monitored manual reset. Operating Principle Additional outputs are added to the SI safety relay (CI, DI, or DIS) by the EM safety relay (immediate outputs) and the EMD safety relay (delayed outputs). A single wire, safety-rated signal from terminal L of the SI communicates the output status to L of the EM and EMD safety relays. STARTING: Press and release the Reset button to energize the outputs of the SI, EM, and EMD safety relays. K K0 safety contactors or safety control relays energize to control the hazardous portion of the machine. STOPPING: When an E-stop is pressed, the safety outputs of the SI and EM safety relays turn off immediately and deenergize K K6. Two seconds later, the safety outputs of the EMD safety relay turn off and de-energize K7 K0. Fault Detection Upon power-up, the SI, EM, and EMD safety relays perform internal checks. Then, the SI safety relay looks for dual signals from the E-stop circuit. The SI safety relay detects a cross fault on the E-stop circuit. With the E-stop signals made, closing the Reset button places a voltage to the S terminal. The external devices (K K0) are checked to confirm that they are off. A fault in K K0 causes their normally closed contacts to remain open, and this fault prevents the SI safety relay from turning on outputs / and /. Ratings The series connection of the Bulletin 00F E-stop buttons initiates a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLd per ISO 9-:006. The Category rating requires the redundant usage of K K0 to de-energize the machine actuators, and the safety system must monitor the contactors. This circuit executes a Stop Category 0. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

13 Figure - Expansion Modules with Immediate and Delayed Outputs +V DC Reset 00FM-F6MX0 K6 K7 K K9 K0 K K K K K E-Stops 00FM-MTMX0L S S SI 0R-SR S S Y S A RESET 0 AM MM L A X A EM 0R-EMR L L A B B X RANGE 0 TIME A EMD 0R-EMRD L L A K 00S- CEJBC K K K K K6 00S- C09EJBC K7 K K9 700S- DCP0DZ with 99-FSMZ- K0 V DC Com Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

14 Safety Motion Delayed Braking Circuit Components Bulletin 00F E-stops SI and EMD safety relays Kinetix GuardMotion with Resistor Braking Module (RBM) Circuit Status The E-stop is reset. The outputs of the safety relay are open, and the motor is off. The EMD Range switch is set to (-second OFF Delay) and the Time is set to 0 (00%), therefore the OFF Delay time is second. Operating Principle STARTING: Press and release the Reset button to energize the outputs of the SI safety relay. This action energizes the feedback relays in the Kinetix. The Lsignal from the SI safety relay to the EMD safety relay instructs the EMD safety relay to close its safety outputs. This action energizes the Bulletin 00S contactor in the resistor braking module. The motor is now connected to the drive. When the Kinetix drive is enabled, an internal signal is sent back to its controller (not shown) to inform it that the drive is enabled. The controller then controls the motor. STOPPING: When the E-stop is pressed, the immediate outputs of the SI open and disable the drive. The motor begins to execute a stop. The L signal from the SI safety relay to the EMD safety relay turns off and the EMD safety relay begins its timing cycle. After the time delay of the EMD safety relay expires, the delayed outputs open and drop out the Bulletin 00S contactor in the RBM. This action disconnects the motor from the drive and engages the braking resistors, which rapidly stop the motor. Fault Detection Upon power-up, the Kinetix drive and SI and EMD safety relays perform internal checks. The SI safety relay then looks for dual signals from the E-stop. The E-stop has self-monitoring contacts, which open if the contact block falls off the control panel. With the E-stop signals made, the SI safety relay checks the S monitoring circuit when the Reset button is pressed. If these checks are OK, the output energizes. If the delayed outputs of the EMD safety relay fault to the ON state, the SI safety relay does not start the motor. The S monitoring circuit detects the fault on the next attempt to restart because K remains energized. If the drive faults to an ON state, the motor stops because K disconnects it. The S monitoring circuit detects this fault on the next attempt to restart because the Kinetix feedback circuit remains off. If K gets stuck or welded closed, the drive stops the motor and the S monitoring circuit of the SI safety relay detects the fault on the next attempt to restart. Ratings The Bulletin 00F E-stop initiates a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLe per ISO 9-:006. This circuit executes a Stop Category. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

15 Figure - Safety Motion Delayed Braking +V DC E-Stop 00FM-MT Reset 00F-MX0S 00FM-F6MX0 S S RESET 0 AM SI 0R-SR MM S S Y L A To PLC S A B B X RANGE 0 TIME A EMD 0R-EMRD L L A Kinetix 6000 with GuardMotion 099-BMxx-s EN+ EN- EN- EN+ FBK FBK FBK FBK R R R R Safety Monitor Gate Control Power Supply R Gate Control Circuit R Gate Control Enable L L L Resistor Braking Module COIL A U V W CONSTAT CONSTAT K COIL A T 00S-C Contactor U V W V DC Com M Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

16 Light Curtain with Immediate and Delayed Outputs Circuit Components Safe light curtain SI and EMD safety relays Bulletin 00S contactor Bulletin 700S safety control relay Circuit Status The light curtain is clear. The safety outputs of the SI and EMD are de-energized. All contactors are off. The EMD Range setting is (0-second OFF Delay) and the Time setting is (0%), therefore the time delay is seconds. The reset and monitoring circuit are connected to S for monitored manual reset. Operating Principle Additional outputs are added to the SI safety relay by the EMD (expansion module with delayed outputs) safety relay. A single wire safety rated signal from terminal L of the SI communicates the output status to L of the EMD safety relay. STARTING: Press and release the Reset button to energize the outputs of the SI and EMD safety relay. K K6 safety contactors or safety control relays energize to control the hazardous portion of the machine. STOPPING: When the light curtain is interrupted, the safety outputs of the SI safety relay turn off immediately and de-energize K K. Two seconds later, the safety outputs of the EMD safety relay turn off and de-energize K K6. Fault Detection Upon power-up, the SI and EMD safety relays perform internal checks. The SI safety relay then looks for dual signals from the light curtain. The light curtain detects a cross fault on the light curtain. With the light curtain signals made, closing the Reset button places a voltage to the S terminal. The external devices (K K6) are checked to confirm that they are off. A fault in K K6 causes their normally closed contacts to remain open, and the SI safety relay detects this fault. Ratings The light curtain initiates a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLe per ISO 9-:006. The Category rating requires the redundant usage of K K6 to de-energize the machine actuators, and the safety system must monitor the contactors. This circuit executes a Stop Category 0. 6 Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

17 Figure 6 - Light Curtain with Immediate and Delayed Outputs +V DC Transmitter Brown Blue Gray Receiver Brown POC Type Safe L-PS00YD Cordset: x 9D-FAC- Black White Blue Gray S S Reset 00FM-F6MX0 RESET 0 S A AM SI 0R-SR MM S S Y L A K K K K K K K6 B B X RANGE 0 TIME A EMD 0R-EMRD L L A K K 00S- CEJBC K K 700S- CFB0EJC K6 V DC Com Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07 7

18 Global E-stop, Cascaded Safety Functions Circuit Components Bulletin 00F E-stops Trojan T tongue interlock switch Bulletin 0F MatGuard safety mat SI, dual-input (DI), dual-input solid-state output (DIS) safety relays Bulletin 00S contactor Bulletin 700S safety control relay Circuit Status The E-stops are reset. The safety gate is closed. The safety mat is unoccupied. The outputs of all three safety relays are off. K K6 are ready to be energized. The SI is set for monitored manual reset. The DI safety relay has logic set to [(IN AND IN) AND L] with monitored manual reset because the safety gate provides full body access. The DIS safety relay has logic set to [(INAND IN) AND L] with monitored manual reset. Safety mat applications require Logic setting with IN AND IN. Operating Principle The SI safety relay provides a global E-stop function. The DI and DIS safety relays are cascaded from the SI safety relay. STARTING: Press the Reset button for the SI safety relay to energize its outputs. Then, press the Start button to energize K and K and send the L link signal to the DI safety relay that enables the DI safety relay. Press the Reset button to energize the DI safety relay and send a L link signal to the DIS safety relay. Press the Reset button to energize the outputs of the DIS safety relay. Press the respective Start buttons to energize the contactors K, K, K, and K6. STOPPING: Press the E-stop of the SI safety relay to shut down all three relays. Open the interlocked gate or press the E-stop of the DI safety relay to turn off the outputs of both the DI and DIS safety relays, while the SI safety relay is unaffected. Press the E-stop or step on the safety mat of the DIS safety relay to turn off the outputs of the DIS safety relay only. Fault Detection Upon successful completion of internal checks on power-up, the SI, DI, and DIS safety relays check their input circuits. Shorts from the inputs to power, ground, or other inputs are detected immediately and prevents energization or de-energizes the respective outputs. If one of the contactors (K K6) is stuck in an actuated state, the respective control prevents startup because the S feedback loop remains open. For fault detection purposes, all GSR modules that are used in safety mat applications must be configured for monitored manual reset. Ratings The E-stop devices and the two Trojan interlocks initiate safety functions that meet the safety performance requirements of SIL CL per IEC 606:00 and have Category structures that can be used in systems that require Performance Levels up to PLe per ISO 9-:006. The safety mat initiates a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLd per ISO 9-:006. This circuit executes a Stop Category 0. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

19 Figure 7 - Global E-stop, Cascaded Safety Functions +V DC K Start K Trojan T-GD 0K-T7 Start K K MatGuard Safety Mat & Trim 0F-M00BYNN 0F-T00 K K6 E-Stop 00FM-MT 00F-MX0S Reset 00FM- F6MX0 Stop Stop Reset 00FM- F6MX0 Reset 00FM- F6MX0 Aux. to PLC S S A S S S S S A S S S S S A A Y S RESET 0 AM SI 0R-SR MM S S A L Y LOGIC 7 0 DI 6 0R-DR S S L L A Y LOGIC 7 0 DIS 6 0R-DS S S L L Aux. to PLC E-Stop 00FM-MT 00F-MX0S Aux. to PLC E-Stop 00FM-MT 00F-MX0S K K6 Start Stop K K6 V DC Com 00S- 700S- K K K 00S- K K C09EJBC CFB0EJC CEJBC K6 Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07 9

20 GuardShield Light Curtain and Bulletin 00Z Zero-Force Touch Buttons Circuit Components GuardShield light curtain Bulletin 00Z Zero-Force Touch Buttons SI and MSRH safety relay Bulletin 00S contactor Circuit Status The hands of the operator are not on the two Bulletin 00Z Zero-Force Touch Buttons. The outputs of the MSRH are off. The light curtain is configured with the factory default settings (Guard only mode) and is unobstructed. The outputs of the SI safety relay are off. The motor is off and ready to run. The light curtain helps protect one portion of the machine. An operator, using two-hand control accesses another portion of the machine and has full view of their area. Operating Principle STARTING: Press the Reset button to energize the output of the SI safety relay. The operator places both hands on the Bulletin 00Z Zero-Force Touch Buttons simultaneously (within 0. seconds). The outputs of the MSRH (terminals and ) energize the Bulletin00S contactors, which start the motor. STOPPING: Removal of one or both hands from the Bulletin 00Z touch buttons causes the outputs of the MSRH safety relay to turn off, which drops out K and K and stops the motor. Obstructing the light curtain de-energizes the safety outputs of the SI safety relay, which in turn drops out K and K and turns off the motor. Clearing the light curtain does not restart the motor, even if the operator has their hands on the palm buttons. The Reset button must be pressed after the light curtain is cleared. Fault Detection Upon power-up, the Bulletin 00Z, GuardShield light curtain, MSRH safety relay, and SI safety relay perform internal checks. After passing internal checks, the MSRH safety relay waits for a change of state of its inputs. The MSRH safety relay detects faults (opens and shorts) at the inputs and prevent the outputs from being energized. The GuardShield light curtain also performs checks on its Output Signal Switching Device (OSSD) output signals for cross faults, shorts, and opens. The SI safety relay looks for dual signals at its inputs. It then checks the status of the contactors. If one contactor fails in the actuated state, the other contactor stops the motor. The SI safety relay detects if one of the contactors are stuck in the energized position, and prevents restart. Ratings The GuardShield light curtain provides a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLe per ISO 9-:006. This circuit executes a Stop Category 0. The safety function of the two-hand control meets Type IIIC of ISO. 0 Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

21 Figure - GuardShield Light Curtain and Bulletin 00Z Zero-Force Touch Buttons +V DC Transmitter Receiver Brown Brown 6 Pink Gray Blue Blue 7 GuardShield 0L-PJ060YD 9D-FAC- 9D-FAC- Reset 00FM-F6MX0 00Z-GLQ 9N-FAE-6F S Two-Hand Control 00Z-GLQ S 9N-FAE-6F Brown White Black Blue Gray VDC Brown White Black S SS MSRH 0R-D0 To PLC Y A S S A Y S S A S RESET 0 AM SI 0R-SR MM S S A L Y To PLC L L L K K M V DC Com Blue Gray K K 00S-C09EJBC Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

22 SI/DIS Safety Relays, SensaGuard Interlock, E-stops, and PowerFlex Drive with Contactor Circuit Components SensaGuard integrated latch interlocks Bulletin 00F E-stop SI and DIS safety relays Bulletin 00S contactor PowerFlex drive Circuit Status The DIS safety relay logic is set to : [(IN AND IN) AND L] with monitored reset. The SI is set for automatic reset. The SensaGuard integrated latch interlocks are connected in series to the SI. The two E-stops are connected to inputs (S and S) and (S and S) of the DIS. The three gates, monitored by the SensaGuard integrated latch interlocks, are closed and safety outputs of the SI (L, / and /) are ON. Both E-stops are released. The DIS safety outputs (,, and ) are off and await a reset signal. The PowerFlex drive is powered but disabled. Contactor K is de-energized. The motor is off. Operating Principle STARTING: Press the Reset button to turn on the DIS safety outputs. K is energized, which enables the drive, and also applies power to the Start and Stop buttons. Press the Start buttons to start the motor. STOPPING: Press the Stop button to stop the motor for production stops. Press either E-stop or open any safety gate to initiate a safety stop; the motor coasts to a stop. Fault Detection Upon successful completion of internal checks by the SI safety relay, DIS safety relay, SensaGuard, and PowerFlex drive, the drive awaits the closure of the safety outputs. If the DIS safety relay fails, the drive does not energize the motor, and non-operation of the motor indicates a fault. The DIS safety relay generates test pulses through the E-stop circuits to detect cross channel shorts and shorts to power and ground. The SensaGuard interlocks generate test pulses on their outputs to detect cross channel shorts and shorts to power and ground. The drive detects a fault in the safe-circuit of the drive and issues a safety stop. The DIS safety relay monitors the mechanically linked contacts of K to verify that the contactor is de-energized before resetting the safety system. Ratings The SensaGuard integrated latch interlocks and the E-stop initiate safety functions that meet the safety performance requirements of SIL CL per IEC 606:00 and a Category structure that can be used in systems that require Performance Levels up to PLe per ISO 9-: 006. The circuit executes a Stop Category 0. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

23 Figure 9 - SI/DIS Safety Relays, SensaGuard Interlock, E-stops, and PowerFlex Drive with Contactor + V DC Brown V DC Com Red Yellow Blue White SensaGuard Integrated Latches 0N-ZSSPA Gray Red Pink Yellow White Blue Gate Open Gate Open Brown Gray Pink Gate Open White Blue Red Yellow Brown Gray Pink S S A S RESET 0 AM SI MM 0R-SR S S A L Y Status To PLC E-stops 00FM-MT 00F-MX0S K K S S S S S S A S LOGIC 0 A DIS 7 6 0R-DS L L A Y Reset Status To PLC 00S-C09EJBC Gnd Gate control power supply Gate control circuit S S PowerFlex Stop Start R S T K L L L U V W M Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

24 Interlock Switch Multiple Gate Access Circuit Components Trojan T and Elf GD tongue interlock switch Bulletin 00F E-stop Compatible input (CI) safety relay Bulletin 00S contactor Circuit Status The circuit is shown with the safety gates closed and the E-stop released. The CI safety relay is de-energized. The motor is off. The monitoring circuit is connected to S for automatic reset of the CI safety relay. Operating Principle This circuit shows how to connect the second channel of the interlock switches through a standard programmable logic controller (PLC) to get status information without auxiliary contacts in the interlock switch. The PLC program must monitor the safety relay and prevent the PLC from turning the output ON if the safety relay is not OFF. STARTING: Channel input (S/S) of the CI safety relay is satisfied. Using isolated relay contacts in its output module, the PLC closes the second safety channel (/ of the CI safety relay). The safety outputs of the CI safety relay close. Press the Start button to start the motor. STOPPING: Opening any one of the safety gates or pressing the E-stop causes the motor to turn off. Closing the gate or releasing the E-stop does not cause the motor to start due to the start-stop interlocking circuit. To restart the motor, close the safety gate or release the E-stop. Then, press the Start button. Fault Detection If the PLC fails with its output closed, the safety relay detects the difference between the safety gate and the PLC and stops the motor. The safety relay detects a single fault (open or short) across one of the interlocks and the motor is turned off. The motor remains off until the fault is corrected or power is cycled. If either contactor K or K sticks ON, the motor stops on command due to the other contactor, but the CI safety relay cannot be reset (which reveals the fault). A single fault that is detected on the CI safety relay input circuits results in the lockout of the system to a safe state (OFF) at the next operation of the safety gate or E-stop device. The safety system controls contactors K and K. The machine control system and the safety system control contactor K. This configuration increases the probability of performance of the safety function because the K contacts are less likely to weld due to the diversity of expected wear out times. Ratings The Trojan T and ELF-GD safety gate interlocks and the Bulletin 00F E-stop initiate a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLd per ISO 9-:006. This circuit executes a Stop Category 0. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

25 M Next Generation Guardmaster Safety Relay (GSR) Figure 0 - Interlock Switch Multiple Gate Access +V DC Trojan T-GD 0K-T7 ELF-GD 0K-E06 E-stop 00FM- MTMX0L S S Start 00FM- FMX0 Stop 00FM- EMX0 A S K K K L L L Input 76-IB6 769-IQ6 76-IB6 7-IB 79-IB6 PLC Processor Output 76-OW6I 769-OW 76-OW 7-OW 79-OW CI AM 0R-SR S S RESET 0 MM A L 00S- K C09EJBC K K V DC Com Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

26 SensaGuard Interlock Switches Circuit Components SensaGuard non-contact interlock switches CI safety relay Bulletin 00F push buttons Bulletin 00S contactor Circuit Status The first and third gates are closed. The second gate is open. The CI safety relay S and S inputs are open due to the open gate, and therefore, the CI safety outputs are open. The machine control PLC has a V auxiliary signal at terminal I from the second gate because the gate is open. The first and third auxiliary signals are off, as their gates are closed. The PLC also has an auxiliary signal from the CI safety relay that indicates that the safety system is not ready. The motor is off. Operating Principle STARTING: Closing the second gate satisfies the input of the CI safety relay. The CI safety relay verifies that both K and K contactors are off and energizes its safety outputs. Pressing the Start button starts the motor. The machine control system (for example, a PLC) can replace the Stop/Start circuit since the circuit is not part of the safety system. STOPPING: Press the Stop button to turn off the motor, without affecting the status of the safety system. Opening any of the gates causes the safety system to stop the motor. Fault Detection Upon successful completion of internal checks on power-up, the SensaGuard interlock switches check for V at pins and. If the actuator is within range, the SensaGuard interlock switch activates its OSSD outputs. The OSSD outputs continuously check for short circuits to V, ground, and cross faults. Upon detection of a fault, the OSSD outputs turn off. The CI safety relay also performs internal checks on power-up. It then checks for input signals. If OK, the CI safety relay checks the K/K/S monitoring circuit to determine whether both contactors are off. If one of the contactors gets stuck on, the other contactor de-energizes the motor, and the CI safety relay detects the fault at the next attempt to start the motor. The contactors have mechanically linked auxiliary contacts to help verify fault detection of the contactors. Ratings The safety performance of this circuit meets the requirements of SIL CL per IEC 606:00 and has Category structure and can be used in systems that require Performance Levels up to PLe per ISO 9-:006. The SensaGuard interlocks are designed to meet Category when connected in series. The CI safety relay is rated to Category. The design and connection of the contactors meets category. This circuit performs a Stop Category 0. 6 Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

27 Figure - SensaGuard Interlock Switches +V DC mm Cylindrical Plastic SensaGuard 0N-ZS6H Cordset 9D-FAB- V DC Com Brown SensaGuard SensaGuard Green Blue White (Aux) Yellow Red Gray (OSSD) Pink (OSSD) Machine Control PLC Input (76-IB6 769-IQ6 76-IB6 79-IB6 7-IB 79-IB6 or similar) I0 I I I Com Shown Open Auxiliary Signals to Machine Control System S S L A RESET 0 RP CI AM MM 0R-SR S S S A K Start 00FM- FMX0 Stop 00FM- EMX0 K K K 00S-CEJBC K K L L L M Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07 7

28 Magnetically Coded Sensor Circuit Components MC magnetically coded non-contact interlock switch CI safety relay Bulletin 00F push buttons Bulletin 00S contactor Circuit Status The first gate is open. The second and third gates are closed. The CI safety relay S and S inputs are open due to the open gate, and therefore, the CI safety outputs are open. The machine control PLC has a V auxiliary signal at terminal I0 from the first gate because the gate is open. The second and third auxiliary signals are off, as their gates are closed. The PLC also has an auxiliary signal from the CI safety relay that indicates that the safety system is not ready. The motor is off. Operating Principle STARTING: Closing the first gate satisfies the input of the CI safety relay. The CI safety relay verifies that both K and K contactors are off and energizes its safety outputs. Pressing the Start button starts the motor. The machine control system (for example, a PLC) can replace the Stop/Start circuit since the circuit is not part of the safety system. STOPPING: Press the Stop button to turn off the motor, without affecting the status of the safety system. Opening any of the gates causes the safety system to stop the motor. Fault Detection Upon successful completion of internal checks on power-up, the CI safety relay checks for input signals. If OK, the CI safety relay checks the K/K/S monitoring circuit to determine whether both contactors are off. If one of the contactors gets stuck on, the other contactor de-energizes the motor, and the CI safety relay detects the fault at the next attempt to start the motor. The contactors have mechanically linked auxiliary contacts to help with fault detection of the contactors. Ratings This safety performance of this circuit meets the requirements of SIL CL per IEC 606:00 and has Category structure and can be used in systems that require Performance Levels up to PLd per ISO 9-:006. This circuit performs a Stop Category 0. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

29 Figure - Magnetically Coded Sensor +V DC Shown Open MC Sensor 0N-ZWPH Cordset 9D-FAB- V DC Com Brown MC MC MC Green Blue White (Aux) Yellow Red Gray Pink Machine Control PLC Input (76-IB6 769-IQ6 76-IB6 79-IB6 7-IB 79-IB6 or similar) I0 I I I Com Auxiliary Signals to Machine Control System S S L A RESET 0 RP CI AM MM 0R-SR S S S A K Start 00FM- FMX0 Stop 00FM- EMX0 K K K 00S-CEJBC K K L L L M Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07 9

30 Stainless Steel Ferrogard GD Non-contact Interlock Switch Circuit Components Ferrogard GD non-contact interlock switch CI safety relay Bulletin 00F push buttons Bulletin 00S contactor Circuit Status The first gate is open. The second and third gates are closed. The CI safety relay S and S inputs are open due to the open gate, and therefore, the CI safety outputs are open. The machine control PLC has a V auxiliary signal at terminal I0 from the first gate because the gate is open. The second and third auxiliary signals are off, as their gates are closed. The PLC also has an auxiliary signal from the CI safety relay that indicates that the safety system is not ready. The motor is off. Operating Principle STARTING: Closing the first gate satisfies the input of the CI safety relay. The CI safety relay verifies that both K and K contactors are off and energizes its safety outputs. Pressing the Start button starts the motor. The machine control system (for example, a PLC) can replace the Stop/Start circuit since the circuit is not part of the safety system. STOPPING: Press the Stop button to turn off the motor, without affecting the status of the safety system. Opening any of the gates causes the safety system to stop the motor. Fault Detection Upon successful completion of internal checks on power-up, the CI safety relay checks for input signals. If OK, the CI safety relay checks the K/K/S monitoring circuit to determine whether both contactors are off. If one of the contactors gets stuck on, the other contactor de-energizes the motor, and the CI safety relay detects the fault at the next attempt to start the motor. The contactors have mechanically linked auxiliary contacts to help with fault detection of the contactors. Ratings This safety performance of this circuit meets the requirements of SIL CL per IEC 606:00 and has Category structure and can be used in systems that require Performance Levels up to PLd per ISO 9-:006. This circuit performs a Stop Category 0. 0 Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

31 Figure - Stainless Steel Ferrogard GD Non-contact Interlock Switch +V DC Stainless Steel Ferrogard FRS GD 0N-G09 9D-FAB-0 Green Shown Open Yellow Red White Brown Gray Pink Start 00FM- FMX0 Stop 00FM- EMX0 K K Machine Control PLC Input (76-IB6 769-IQ6 76-IB6 79-IB6 7-IB 79-IB6 or similar) I0 I I I Com Auxiliary Signals to Machine Control System S S L A RESET 0 RP CI AM MM 0R-SR S S S A L L L K K M V DC Com K K 00S-CEJBC Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

32 Light Curtain Point of Operation Control Circuit Components GuardShield light curtain DI safety relay Bulletin 00F push buttons Bulletin 00S contactor Circuit Status The light curtain is clear and the motor is ready to run. The DI safety relay is set for Logic (L or IN or IN with Automatic Reset). Operating Principle STARTING: Press the Start button to energize contactors K. The motor starts with the two normally open contacts of K and K holding the circuit energized. STOPPING: Obstructing the light curtain de-energizes the safety outputs of the DI safety relay which in turn drops out K and K. The contactors disconnect the motor from its power source, and the motor coasts to a stop. Clearing the obstruction in the light curtain does not cause the motor to start. Fault Detection Upon successful completion of internal checks on power-up, the GuardShield light curtain energizes its outputs with no objects present. The successful completion of internal checks, the DI safety relay checks the signals from the light curtain. If OK, the DI safety relay then checks the status of the K and K contactors. If either K or K fails in the actuated state, the other contactor disconnects the motor. The DI safety relay detects the faulted contactor and does not allow the motor to restart until the fault is corrected. The safety system controls contactor K. The machine control system and the safety system control contactor K. Ratings The GuardShield light curtain initiates a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLe per ISO 9-:006. This circuit executes a Stop Category 0. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

33 M Next Generation Guardmaster Safety Relay (GSR) Figure - Light Curtain Point of Operation Control +V DC Transmitter Receiver Brown Red Brown Yellow Pink 6 Gray White Blue 7 Blue Green 0L-PKL0960YD 9D-FAC- 9D-FAC- Restart (not used) EDM (not used) Aux Signal to PLC S S S S DI 0R-DR LOGIC 7 6 S S L L Start 00FM- FMX0 Stop 00FM- EMX0 A 0 A S Y K K K K LL L K Aux Signal to PLC K 00S-CEJBC V DC Com Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07

34 Two Light Curtains Point of Operation Control Circuit Components GuardShield light curtains DI safety relay Bulletin 00F push buttons Bulletin 00S contactor Circuit Status The light curtains are configured with factory default settings (guard-only mode). The light curtains are unobstructed. The outputs of the safety relay are closed, and the motor is ready to run. The DI safety relay is set for Logic 6: [(IN AND IN) OR L] with Automatic Reset. Operating Principle STARTING: Press the Start button to energize contactor K. The motor starts with the two normally open contacts of K and K holding the circuit energized. STOPPING: Obstructing either light curtain de-energizes the safety outputs of the DI safety relay which in turn drops out K and K. The contactors disconnect the motor from its power source, and the motor coasts to a stop. Clearing the obstruction in either light curtain does not cause the motor to energize (the Start button must be pressed). The motor can also be turned off by pressing the Stop button. Fault Detection Upon successful completion of internal checks on power-up, the GuardShield light curtains energize their outputs with no objects present. If a cross fault is detected, the GuardShield light curtain goes to a lockout state with its outputs OFF. After successful completion of internal checks, the DI safety relay checks the signals from the light curtains. If OK, the DI safety relay then checks the status of the K and K contactors. If either K or K fails in the actuated state, the other contactor disconnects the motor. The DI safety relay detects the faulted contactor and does not allow the motor to restart until the fault is corrected. The safety system controls contactor K. The machine control system and the safety system control contactor K. This configuration increases the probability of performance of the safety function because K and K are less likely to weld simultaneously due to the diversity of expected wear out times. Ratings The GuardShield light curtains initiate a safety function that meets the safety performance requirements of SIL CL per IEC 606:00 and has a Category structure that can be used in systems that require Performance Levels up to PLe per ISO 9-:006. This circuit executes a Stop Category 0. Rockwell Automation Publication SAFETY-WD00J-EN-P - August 07