Application Technique. Products: Guardmaster 440C-CR30 Configurable Safety Relay, PowerFlex 525 AC Drive

Transcription

1 Application Technique Safety Function: Actuator Subsystems Stop Category 0 or Stop Category 1 via a Configurable Safety Relay and PowerFlex 525 Drive with Hardwired Safe Torque-off Products: Guardmaster 440C-CR30 Configurable Safety Relay, PowerFlex 525 AC Drive Safety Rating: CAT. 3, PLd to ISO : 2008 Topic Page Important User Information 2 General Safety Information 3 Introduction 4 Safety Function Realization: Risk Assessment 4 Stop Safety Function 5 Safety Function Requirements 5 Functional Safety Description 6 Bill of Material 7 Setup and Wiring 7 Configuration 10 Calculation of the Performance Level 21 Verification and Validation Plan 24 Verification of the Configuration 26 Additional Resources 29

2 Important User Information Read this document and the documents listed in the additional resources section about installation, configuration, and operation of this equipment before you install, configure, operate, or maintain this product. Users are required to familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws, and standards. Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to be carried out by suitably trained personnel in accordance with applicable code of practice. If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be impaired. In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment. The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and diagrams. No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this manual. Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited. Throughout this manual, when necessary, we use notes to make you aware of safety considerations. WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury or death, property damage, or economic loss. ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence. IMPORTANT Identifies information that is critical for successful application and understanding of the product. Labels may also be on or inside the equipment to provide specific precautions. SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present. BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures. ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE). 2 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

3 General Safety Information IMPORTANT This application example is for advanced users and assumes that you are trained and experienced in safety system requirements. Risk Assessments ATTENTION: Perform a risk assessment to make sure that all task and hazard combinations have been identified and addressed. The risk assessment can require additional circuitry to reduce the risk to a tolerable level. Safety circuits must consider safetydistance calculations, which are not part of the scope of this document. Contact Rockwell Automation to learn more about our safety-risk assessment services. Safety Distance Calculations ATTENTION: While safety distance or access time calculations are beyond the scope of this document, compliant safety circuits must often consider a safety distance or access time calculation. Non-separating safeguards provide no physical barrier to prevent access to a hazard. Publications that offer guidance for calculating compliant safety distances for safety systems that use non-separating safeguards, such as light curtains, scanners, two-hand controls, or safety mats, include the following: EN ISO 13855:2010 (Safety of Machinery Positioning of safeguards with respect to the approach speeds of parts of the human body) ANSI B11: (Machines Performance Criteria for Safeguarding) Separating safeguards monitor a moveable, physical barrier that guards access to a hazard. Publications that offer guidance for calculating compliant access times for safety systems that use separating safeguards, such as gates with limit switches or interlocks (including SensaGuard switches), include the following: EN ISO 14119:2013 (Safety of Machinery Interlocking devices associated with guards - Principles for design and selection) EN ISO 13855:2010 (Safety of Machinery Positioning of safeguards with respect to the approach speeds of parts of the human body) ANSI B11: (Machines Performance Criteria for Safeguarding) In addition, consult relevant national or local safety standards to assure compliance. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

4 Introduction This application technique explains how to configure the logic (Guardmaster 440C-CR30 configurable safety relay) and the actuator (PowerFlex 525 AC drive with safe torque-off ) subsystems of a safety function. In this application technique, the Guardmaster 440C-CR30 configurable safety relay de-energizes the final control device, in this case, the hard-wired safe torque-off (STO) inputs on the PowerFlex 525 AC drive. The final control element is de-energized immediately for a stop category 0, and a delay (or monitoring that the hazard is stopped or in a safe state) is introduced before de-energizing for a stop category 1. Use this application technique in conjunction with the input subsystem from any other safety function application technique. For example, you can use the input subsystem from Safety Function: Door-Monitoring Interlock Switch with a Configurable Safety Relay, publication SAFETY-AT133, along with the actuator subsystems from this application technique, to create the following overall safety function. Input Logic Output SensaGuard Switch Guardmaster 440C-CR30 Configurable Safety Relay PowerFlex 525 Drive with Safe Torque-off Subsystem 1 Subsystem 2 Subsystem 3 IMPORTANT You must add the probability of failure per hour (PFH) values for each subsystem together to create a PFH for the overall safety function. Depending on the sensor subsystem and devices you choose, the overall safety rating of your system could be reduced. The results of an example calculation for a complete safety function are shown in the section titled Calculation of the Performance Level on page 21. Safety Function Realization: Risk Assessment The required performance level is the result of a risk assessment and refers to the amount of the risk reduction to be carried out by the safety-related parts of the control system. Part of the risk reduction process is to determine the safety functions of the machine. In this application, the performance level required (PLr) by the risk assessment is Category 3, Performance Level d (CAT. 3, PLd), for each safety function. A safety system that achieves CAT. 3, PLd, or higher, can be considered 4 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

5 control reliable. Each safety product has its own rating and can be combined to create a safety function that meets or exceeds the PLr. From: Risk Assessment (ISO 12100) 1. Identification of safety functions 2. Specification of characteristics of each function 3. Determination of required PL (PLr) for each safety function To: Realization and PL Evaluation Stop Safety Function This application technique includes one partial safety function. The safety function is the stopping of a motor when the safety system detects that one or more sensor subsystems have placed a demand on the safety function. The stopping of the motor removes the hazard. The stop category is category 0, which is an uncontrolled coasting of the motor. If the risk assessment determines that coasting is dangerous, then a stop category 1 should be implemented. Safety Function Requirements Placing a demand on the sensor subsystem generates a stop command that prevents hazardous motion. Once the stop command is reset, a secondary action (pressing the Start button) lets hazardous motion resume. Faults within these complex subsystems are unknown and must be detected at a rate that enables the overall safety function to meet the requirements for Performance Level d (PLd), per ISO The vendor must provide probability of dangerous failure per hour (PFHd) values for these subsystems. The safety function in this application technique meets or exceeds the requirements for Category 3, Performance Level d (CAT. 3, PLd), per ISO and control reliable operation per ANSI B Considerations for Safety Distance and Stopping Performance Based on the selection of a sensor subsystem, the risk assessment determines if a safety distance calculation is required. Typically, a safety distance calculation is required if a non-separating sensor subsystem (such as a light curtain) is selected for the safety function. For moveable separating safeguard systems, the overall system stopping-performance must be calculated, measured, and compared to the calculated/measured access time. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

6 When calculating a compliant safety distance for a non-separating safeguard system, see the Guardmaster 440C-CR30 Configurable Safety Relay User Manual, publication 440C-UM001, which provides the necessary response-time data. When considering the overall system-stopping performance of a separating safeguard system, see the Guardmaster 440C- CR30 Configurable Safety Relay User Manual, publication 440C-UM001, which provides response time data necessary for calculating a theoretical overall system-stopping performance value in advance of performing tests and measurements on the actual system. The Guardmaster 440C-CR30 Configurable Safety Relay User Manual, publication 440C-UM001, also provides useful guidance regarding the calculation of the safety-system response time. Functional Safety Description The Guardmaster 440C-CR30 configurable safety relay and PowerFlex 525 drive with hard-wired safe torque-off (STO) both use 1oo2 architectures to achieve the PFHd value that is used in the PL calculation section of this document. The PowerFlex 525 drive s hard-wired STO feature is used to stop and prevent hazardous motion. The STO feature forces the drive output power transistors to a disabled state when the STO outputs from the 440C-CR30 safety relay are deenergized, resulting in a condition where the drive coasts. This feature does not provide electrical power isolation. When all safety input interlocks are satisfied, no faults are detected, and a proper reset occurs, the STO outputs of the 440C-CR30 safety relay are set to high (1), providing 24V DC to the STO inputs of the PowerFlex 525 drive. Issuing a start command starts the hazardous motion. In summary, when a demand is placed on the safety function, the STO outputs of the 440C-CR30 configurable safety relay are de-energized and the motor coasts to a stop for a stop category 0. If a stop category 1 is being used, then the demand on the safety function drives the speed to zero (using the PowerFlex 525 STOP input), and after a pre-determined delay, the STO outputs of the 440C-CR30 safety relay are de-energized. When the safety interlocks are returned to the active state (closed), and a proper reset function occurs, the PowerFlex 525 STO inputs are enabled. Hardwired Safety: Safe Torque-off Considerations for a Stop Category 1 In the event of a malfunction, it is possible that stop category 0 may occur. When designing the machine application, timing and distance must be considered for a coast to stop, as well as the possibility of the loss of control of a vertical load. The nature of a malfunction causing this condition could be if a hardwired STO input to the drive were to go low (that is, a wire falls off ) before the drive has a chance to completely stop the motor. Use additional protective measures if this occurrence might introduce unacceptable risks to personnel. 6 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

7 Bill of Material This application uses these products. Cat. No. Description Quantity 1606-XLP72E Compact power supply, 24 28V DC, 72 W, 120/240 AC 1 871A-BP18 Clamp-style mounting bracket, plastic, 18 mm diameter 1 800FP-R611PQ10V 800F reset, round plastic (type 4/4X/13, IP66), blue, R, plastic latch mount, 1 N.O. contact, 0 N.C. contact 1 800FP-U2E4F3PQ11V 440C-CR30-22BBB 800F 2 Pos. momentary multifunction - round plastic (IP66, 4/4X, IP65), Pos. A- red ext. PB, Pos. C- green flush PB, plastic latch mount, 1 N.O. contact, 1 N.C. contact, low voltage Guardmaster 440C-CR30 software-configured safety relay, PLe SIL 3, 22 safety I/O, embedded serial port, USB programming port, 2 plug-in slots, 24V DC 2080-IQ4OB4 4-channel digital input/output combination module 1 25B-V4P8N104 PowerFlex 525 AC drive, with embedded EtherNet/IP and Safety, 120V AC, 1 phase, 1.0 HP, 0.75 kw normal duty; 1.0 HP, 0.75 kw heavy duty, frame B, IP20 NEMA / open type, no filter Setup and Wiring For detailed information on installing and wiring, refer to the publications listed in the Additional Resources. System Overview The final control device is the PowerFlex 525 drive with hard-wired safe torque-off (STO), and it is intended for use in safety-related applications where the de-energized state is considered to be the safe state. The Guardmaster 440C-CR30 safety relay monitors the safety interlock circuit for faults. Loose wires, shorts to 24V, shorts to ground, contacts failed closed, and cross faults are detected. When a fault is detected, the safety relay responds by turning off its safety outputs, taking the system to a safe state. The 440C-CR30 safety relay checks itself for internal faults and turns its output off if any are detected. No single fault results in the safety system failing to perform its safety function. A single fault is detected before or upon the next demand on the safety system. The system cannot be reset until the fault is corrected. The PowerFlex 525 drive s safe torque-off (STO) function prevents gate-firing signals from reaching the Insulated Gate Bipolar Transistor (IGBT) output devices of the drive. This prevents the IGBTs from switching in the sequence necessary to generate torque in the motor. Under normal drive operation, both safety inputs (Safety 1 and Safety 2) are energized, and the drive is able to run. If either input is de-energized, the gate control circuit becomes disabled. The overall safety function must have individual reset buttons for resetting faults and for resetting safety outputs. These reset buttons can be wired to any input module, safety or standard, in your system. The safety rating of the reset button must not diminish the rating of the relevant safety function. This is accomplished by the trailing edge or falling edge of the button generating the reset command, thus tolerating faults in the reset circuit. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

8 Electrical Schematic Figure 1 - Guardmaster 440C-CR30 Configurable Safety Relay Inputs 24V DC - Class 2 DC COM Typical Safety Input Device Reset Plug-in I/O 8 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

9 Figure 2 - Guardmaster 440C-CR30 Configurable Safety Relay Outputs 24V DC - Class 2 DC COM Dedicated Stop Signal Safe Torque-off Stop Start 1 Stop 2 Start PowerFlex 525 Drive 4 Dig. Com Gate control power supply Gate control circuit Plug-in I/O Rockwell Automation Publication SAFETY-AT145A-EN-P - August

10 Configuration Configure the PowerFlex drive and the 440C-CR30 configurable safety relay as described in the following sections. Configure the PowerFlex 525 Drive The overall configuration of the PowerFlex 525 drive is application-dependent and beyond the scope of this document. However, there are six parameters that must be properly configured for the PowerFlex 525 drive to perform as this application technique requires. Table 1 lists these parameters and their required settings. Table 1 - PowerFlex 525 Drive Parameters Parameter Name Value Units Internal Value 42 Decel Time Sec Stop Mode Ramp 4 46 Start Source 1 DigIn TrmBlk 2 62 Digin TermBlk 02 3-Wire Start Digin TermBlk 03 3-Wire Dir Safe Open En FaultDisable 1 Configure the 440C-CR30 Relay The Guardmaster 440C-CR30 configurable safety relay should be running firmware revision 8.00 or later. A free firmware update is available for older units. The 440C-CR30 safety relay is configured by using Connected Components Workbench software, version 8.00 or later. A detailed description of each step is beyond the scope of this document. Knowledge of the Connected Components Workbench software is assumed. Follow these steps to configure the Guardmaster 440C-CR30 safety relay in Connected Components Workbench software. 1. In Connected Components Workbench software, choose View and then Device Toolbox. 10 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

11 2. In the Device Toolbox, expand the Catalog section, expand the Safety folder, and then double-click 440C-CR30-22BBB. 3. Select Major revision 8, and click OK to add it to the project. 4. In the Project Organizer, double-click Guardmaster_400C_CR30 relay. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

12 5. To add the I/O module called for in this sample application, right-click the right-hand plug-in slot of the relay, and choose 2080-IQ4OB4. The I/O module is shown in standard gray because it is not a safety I/O module. That is permissible in this application because it is not used to connect safety-rated signals. Inputs such as Reset buttons and Feedback are not safety-rated signals. Using the standard I/O plug-in for these non-safety signals can reserve the limited number of safety inputs and outputs for safety-rated signals. 6. Click the Edit Logic button to open the function block editor workspace. TIP If you don't see the Toolbox, click View and choose Toolbox. 12 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

13 Configure the Inputs Follow these steps to configure the input safety monitoring functions. The SensaGuard switch is used as an example input subsystem in the input configuration described in this section. 1. From the View pull-down menu, choose Toolbox and select the SensaGuard Safety Monitoring Function (SMF). 2. Click and drag the SensaGuard SMF from the Toolbox to the upper left-hand Safety Monitoring target block in the logic editor. Connected Components Workbench software automatically assigns the next available terminals for both the inputs. (Changing the terminal assignment for each function is also accomplished by clicking on them. No terminal changes are required for this application.) Any necessary configuration of the I/O points is also done automatically by the software. In this case, the default assignments are correct. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

14 3. To add a Reset safety monitoring function, click and drag a Reset from the Toolbox to the target block below the SensaGuard SMF. 4. On the Reset SMF 2, click the input terminal EI_02, and select Plug-in 2 Inputs P2_00. The PowerFlex 525 drive s safe torque-off feature requires a reset after the STO feature is initially energized. SMF 2 accomplishes this reset. The Safe Torque-off (STO) output is energized if the safety interlock is satisfied, there are no faults, and there is a falling edge on the reset button. 14 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

15 Configure the Outputs Follow these steps to configure the Safety Output Function (SOF). 1. In the Toolbox, under Safety Output Function Blocks, select Immediate OFF from the Safety Output Function Blocks. 2. Click and drag Immediate OFF to the first Safety Output function target on the logic editor. Connected Components Workbench software automatically assigns output terminals EO_18 and EO_19 (embedded safety outputs 18 and 19, respectively). These outputs drive the Safe Torque-off (STO) of the PowerFlex 525 drive. The PT to the right of the terminal assignment stands for pulse testing, a technique used to detect if the output terminal is short-circuited to 24V DC or another safety output terminal. Other output terminals have additional options for configuration besides pulse testing, but for terminals 18 and 19, it is the only possible configuration. 3. Add Multi-Purpose terminal 17 as the third output. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

16 4. Choose SMF 2 from the Reset Input pull-down menu. 5. Click the input connection (blue dot) of the SOF1 block to connect it to the SensaGuard block. A connection line appears and both connection dots turn dark gray. Also, Pass Through blocks automatically appear in the Logic Level A and B Logic Level columns. The resulting logic is shown in the graphic. Configure the Logic The following configuration is an example of a stop category 0. When a demand is placed on the safety interlock, and 'SMF 1' goes to low (0), then the PowerFlex 525 STO output immediately goes to low (0) as well. Figure 3 - Stop Category 0 Logic 16 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

17 The following configuration is an example of a stop category 1. When a demand is placed on the safety interlock, then the PowerFlex 525 STO output goes to low (0) after a three-second delay. This is accomplished by using the OFF Delay Function Block with a Time Delay setting = 60 (60 x 50 ms = 3000 ms). The length of the delay is determined by the risk assessment. During the three-second delay, the 'MP_17' output is used to initiate a stop command to the motor. Figure 4 - Stop Category 1 Logic Configure the Status Indicators The LED status indicators on the 440C-CR30 relay can easily be configured, according to your preference, to show more information than typical status indicators. To configure LED status indicators, follow these steps: 1. Click the Guardmaster_440C_CR30 Project tab on the Workspace. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

18 2. Click LED Configuration in the lower-left pane. 3. Configure the Input and Output LED status indicators as shown. Confirm the Validity of the Build Follow these steps to confirm the validity of the logic by using the Build feature in Connected Components Workbench software. 1. Click Guardmaster_440C_CR30 in the bar above the Workspace. 18 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

19 2. Click Build. A Build Succeeded message confirms that the configuration is valid. If an error or omission is discovered during a build, a message is displayed which details the error so that it may be corrected. After you correct the error, you need to perform the build again. Save and Download the Project Follow these steps to save and download the project. 1. From the File menu, choose Save as to save the project. IMPORTANT Saving the project with a new name closes the workspace window(s). 2. In the Project Organizer window, double-click Guardmaster_440C_CR30 to open the workspace. 3. Power up the 440C-CR30 safety relay. 4. Connect the USB cable to the 440C-CR30 safety relay. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

20 5. Click Download. 6. In the Connection Browser, expand the AB_VBP-1 Virtual Chassis and select the Guardmaster 440C-CR30-22BBB. 7. Click OK. 8. Click Yes to change from Run to Program mode. 9. When the download is complete, click Yes to change from Program to Run mode. 20 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

21 10. Click Edit Logic to see the online diagnostics. Green indicates that a block is True or that an input or output terminal is ON. Flashing green indicates that a Safety Output Function is ready to be Reset. The complete safety system must be installed and powered up to fully utilize the online diagnostics mode. The online diagnostics mode of the 440C-CR30 safety relay can be very helpful during the verification process. 11. Review the information in Calculation of the Performance Level on page 21 and Verification and Validation Plan on page 24 before proceeding with Verification of the Configuration on page 26. Calculation of the Performance Level When properly implemented, the Guardmaster 440C-CR30 configurable safety relay and PowerFlex 525 drive with safe torque-off (STO) can be used in a safety function that achieves a safety rating of Category 3, Performance Level d (CAT. 3, PLd), according to ISO : 2008, as calculated by using the Safety Integrity Software Tool for the Evaluation of Machine Applications (SISTEMA). IMPORTANT To calculate the PL of your entire safety function, you must include the sensor subsystems along with the logic and actuator subsystems shown here. Depending on the sensor subsystems and devices you choose, the overall safety rating of your system could be reduced. An example that describes how to calculate the safety rating for a complete safety function appears in the section titled Complete Safety Function PL Calculation Example on page 22. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

22 Logic and Actuator Subsystem Calculation The 440C-CR30 safety relay subsystem (logic) has a PFH of 1E-8, and is suitable for applications up to Cat. 4, PLe. The PowerFlex 525 STO subsystem (actuator) has a PFH of 8.13E-10, and is suitable for applications up to Cat. 3, PLd. The logic and actuator subsystems can be modeled as follows. Sensor Logic Actuator Determined by the safety function sensor subsystem you choose Guardmaster 440C-CR30 Configurable Safety Relay PowerFlex 525 Drive with Safe Torque-off Subsystem 1 Subsystem 2 Subsystem 3 Complete Safety Function PL Calculation Example This example takes the actuator subsystems from this document and combines them with the sensor subsystems from Safety Function: Door-Monitoring Interlock Switch with a Configurable Safety Relay, publication SAFETY-AT133, to illustrate how any sensor subsystems can be added to the output subsystems within this publication. Here are the actuator subsystems described in this publication. 22 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

23 Here are the subsystems from Safety Function: Door-Monitoring Interlock Switch with a Configurable Safety Relay, publication SAFETY-AT133: sensor, logic, and actuator. The sensor subsystem from Safety Function: Door-Monitoring Interlock Switch with a Configurable Safety Relay, publication SAFETY-AT133, is the SensaGuard interlock switch. The overall safety function is shown here, combining the sensor subsystem from publication SAFETY-AT133, and the logic and actuator subsystems from this document. Sensor Logic Actuator SensaGuard Switch Guardmaster 440C-CR30 Configurable Safety Relay PowerFlex 525 Drive with Safe Torque-off Subsystem 1 Subsystem 2 Subsystem 3 The PFH values for each subsystem in the safety function modeled above are taken from their respective publications and combined. IMPORTANT The PFH for this complete safety function, with the sensor, logic, and actuator subsystems, is 1.19E-08. The PL for the complete safety function is PLd as shown on page 24. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

24 Verification and Validation Plan Verification and validation play important roles in the avoidance of faults throughout the safety system design and development process. ISO sets the requirements for verification and validation. The standard calls for a documented plan to confirm that all of the safety functional requirements have been met. Verification is an analysis of the resulting safety control system. The Performance Level (PL) of the safety control system is calculated to confirm that the system meets the required Performance Level (PLr) specified. The SISTEMA software is typically used to perform the calculations and assist with satisfying the requirements of ISO Validation is a functional test of the safety control system to demonstrate that the system meets the specified requirements of the safety function. The safety control system is tested to confirm that all of the safety-related outputs respond appropriately to their corresponding safety-related inputs. The functional test includes normal operating conditions in addition to potential fault injection of failure modes. A checklist is typically used to document the validation of the safety control system. Prior to validating the system, confirm that the Guardmaster 440C-CR30 configurable safety relay has been wired and configured in accordance with the installation instructions. For detailed information on installing and wiring, refer to the publications listed in the Additional Resources. IMPORTANT The following plan assumes a stop category 0 is being used. You must make appropriate adaptations to the plan if your safety function requires a stop category Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

25 Verification and Validation Checklist General Machinery Information Machine Name/Model Number Machine Serial Number Customer Name Test Date Tester Name(s) Schematic Drawing Number Configurable Safety Relay Safety Verification ID Guardmaster 440C-CR30 Safety System Configuration and Wiring Verification Test Step Verification Pass/Fail Changes/Modifications 1 Verify that the safety system is designed in accordance with the instructions provided in the Guardmaster 440C-CR30 Configurable Safety Relay User Manual, publication 440C-UM Visually inspect the safety system connections and verify that the I/O is wired as documented in the schematics. 3 Visually inspect the Connected Components Workbench program to verify that the safety system network and I/O module configuration is configured as documented. 4 Visually inspect the Connected Components Workbench application program to verify that suitable safety-certified instructions are used. 5 Verify that all input devices are qualified by cycling their respective actuators. Monitor the status in the Connected Components Workbench software. 6 Verify that all output devices are qualified by cycling their respective actuators. Monitor the status in the Connected Components Workbench software. Normal Operation Verification - The Guardmaster 440C-CR30 safety system responds properly to all normal Start, Stop, and Reset commands. Test Step Verification Pass/Fail Changes/Modifications 1 Initiate a Start Command. The PowerFlex 525 drive safe torque-off (STO) feature should energize for a normal machine run condition. Verify proper machine status indication and Connected Components Workbench safety application program indication. 2 Initiate a Stop command. The PowerFlex 525 drive safe torque-off (STO) feature should de-energize for a normal machine Stop condition. Verify proper machine status indication and Connected Components Workbench safety application program indication. 3 While the system continues to run, place a demand on the sensor subsystem. The PowerFlex 525 drive safe torque-off (STO) feature should de-energize for a normal machine Stop condition. Verify proper machine status indication and Connected Components Workbench safety application program indication. Repeat for all sensor subsystems, if installed. 4 While the system is stopped with the sensor subsystem in a safe state, initiate a Start command. The PowerFlex 525 drive STO feature should remain de-energized for a normal safe condition. Verify proper machine status indication and Connected Components Workbench safety application program indication. Repeat for all sensor subsystems, if installed. 5 While the system is stopped with the sensor subsystem in a safe state, initiate a Reset command. The PowerFlex drive 525 STO feature should remain de-energized. Verify proper machine status indication and Connected Components Workbench safety application program indication. Repeat for all sensor subsystems, if installed. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

26 Validation of Safe Response to Abnormal Operation - The safety system responds properly to all foreseeable faults with corresponding diagnostics. Safety Input Tests Test Step Validation Pass/Fail Changes/Modifications 1 To find a safety function application technique that uses the type of input device you plan to use along with a Guardmaster 440C-CR30 configurable safety relay, refer to: MachineSafety/OurSafetySolutions/safety_functions Use the input section of that validation procedure as a guide to test your input device. Validation of Safe Response to Abnormal Operation - The safety system responds properly to all foreseeable faults with corresponding diagnostics. Safety Output Tests Test Step Validation Pass/Fail Changes/Modifications 1 Initiate a Safety Reset command. The PowerFlex 525 drive STO feature should energize for a normal machine run condition. Verify proper machine status indication and Connected Components Workbench safety application program indication. 2 While the system continues to run, short the Guardmaster 440C-CR30 configurable safety relay output STO channel 1 wiring to 24V DC. The PowerFlex 525 drive safe torque-off (STO) feature should de-energize for a normal machine stop condition. Verify proper machine status indication and Connected Components Workbench safety application program indication. Restore channel 1 and repeat for channel 2 3 While the system continues to run, short the 440C-CR30 safety relay s output STO channel 1 wiring to 0V DC. The PowerFlex 525 drive safe torque-off (STO) feature should de-energize for a normal machine stop condition. Verify proper machine status indication and Connected Components Workbench safety application program indication. Restore channel 1 and repeat for channel 2 4 While the system continues to run, short the 440C-CR30 safety relay output STO channels 1 and 2 together. The PowerFlex 525 drive safe torque-off (STO) feature should de-energize for a normal machine stop condition. Verify proper machine status indication and Connected Components Workbench safety application program indication. Restore channel 1 and 2 wiring. IMPORTANT In addition to the verification and validation steps that are provided here, consult the application technique for your input subsystem for the steps that are required to validate the input device. Safety function application techniques are available at /marketing.rockwellautomation.com/safety/en/safety_functions. Verification of the Configuration You must confirm the verification of the Guardmaster 440C-CR30 configurable safety relay s configuration for each individual application by using the Verify command in the configuration software. If the configuration of the 440C-CR30 safety relay is not verified, it will fault after 24 hours of operation. ATTENTION: The verification process should be documented in the safety system's technical file. Follow these steps to confirm the verification of the configuration. 1. Make sure the 440C-CR30 safety relay is powered up and connected to your workstation via the USB cable. 26 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

27 2. Confirm that the upper right-hand corner of the Connected Components Workbench Project tab shows that the 440C-CR30 safety relay is connected. If it is not, click Connect to Device to establish the software connection. 3. Click Verify. 4. Answer all the questions and check each box, if completed. IMPORTANT All of the boxes must be marked in order to Generate the Verification ID. 5. Click Generate. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

28 6. Click Yes to proceed with the verification. After about ten seconds, a pop-up window appears to confirm that the Verify process was successful. 7. Click Yes to change to Run mode. 8. Record the Safety Verification ID in the machine's documentation. This process is the feedback to the 440C-CR30 safety relay that the system verification and functional tests have been completed. The unique verification ID can be used to check if changes have been made to a configuration file. Any change to the configuration removes the Safety Verification ID. Subsequent Verify actions generate a different verification ID. The Safety Verification ID is displayed in Connected Components Workbench software only when you are connected to the 440C-CR30 relay. The Safety Verification ID can be displayed on the IN and OUT input and output status indicators of the 440C-CR30 safety relay at any time by pushing and holding the MEM/ID button below the USB receptacle. 28 Rockwell Automation Publication SAFETY-AT145A-EN-P - August 2015

29 Additional Resources These documents contain more information about related products from Rockwell Automation. Resource Guardmaster 440C-CR30 Software Configurable Safety Relay Quick Start Guide, publication 440C-QS001 Guardmaster 440C-CR30 Configurable Safety Relay User Manual, publication 440C-UM001 PowerFlex 520-Series Adjustable Frequency AC Drive User Manual, publication 520-UM001 Industrial Automation Wiring and Grounding Guidelines, publication Safety Products Catalog, publication S117-CA001 website Product Certifications website, available from the Product Certifications link on Description Provides information on how to configure a Guardmaster 440C-CR30 configurable safety relay to communicate with a PanelView Component terminal via Modbus communication protocol. Provides detailed information on how to install, configure, operate, and troubleshoot a Guardmaster 440C-CR30 configurable safety relay. Provides detailed information on how to install, configure, operate, and troubleshoot a PowerFlex 520-series adjustable frequency AC drive. Provides general guidelines on how to install a Rockwell Automation industrial system. Provides information about Rockwell Automation safety products. Provides declarations of conformity, certificates, and other certification details. You can view or download publications at http0:// To order paper copies of technical documentation, contact your local Allen-Bradley distributor or Rockwell Automation sales representative. Rockwell Automation Publication SAFETY-AT145A-EN-P - August

30 Documentation Feedback Your comments will help us serve your documentation needs better. If you have any suggestions on how to improve this document, complete this form, publication RA-DU002, available at For more information on Safety Function Capabilities, visit: Rockwell Automation maintains current product environmental information on its website at Allen-Bradley, Connected Components Workbench, Guardmaster, LISTEN. THINK. SOLVE, PowerFlex, Rockwell Automation, Rockwell Software, and SensaGuard are trademarks of Rockwell Automation, Inc. Trademarks not belonging to Rockwell Automation are property of their respective companies. EtherNet/IP is a trademark of ODVA, Inc. Rockwell Otomasyon Ticaret A.Ş., Kar Plaza İş Merkezi E Blok Kat: İçerenköy, İstanbul, Tel: +90 (216) Publication SAFETY-AT145A-EN-P - August 2015 Copyright 2015 Rockwell Automation, Inc. All rights reserved. Printed in the U.S.A.