Safety Application Note

Safety Application Note MSR310 to ControlLogix with RS232 Bidirectional Communications IMPORTANT: A risk assessment should be performed to ensure that all task-hazard combinations have been identified and addressed. The risk assessment may require additional circuitry to reduce the risk to a tolerable level. Safety circuits must take into consideration safety distance calculations which are not part of the scope of this document. This application note is targeted for advanced users and assumes knowledge of safety systems. Please contact Rockwell Automation Global Manufacturing solutions to find out more about our safety risk assessment services capabilities. 1) Purpose 1. This application note provides an example of bidirectional communications from the MSR300 Minotaur Safety Relay to a ControlLogix controller. 2. The ControlLogix will be setup as the master. The MSR300 comes setup as a slave. Only one MSR300 can be connected to a ControlLogix. 2) References 1. 95302171/3 MSR300 Safety System Manual 2. CIG-AP129A-EN-P: Using Logix5000 Controllers as Masters or Slaves on Modbus 3) MSR300 System i) Types of Communication 1. The MSR310 base module, 440R-W23219, incorporates RS232 communications capability. There are two types of communications: unidirectional and bi directional. (a) Unidirectional The MSR310 issues periodic (every 820ms) status update from the TxD2 terminal.. The RS232-2 LED blinks when unidirectional communications takes place. (b) Bidirectional The MSR310 issues a status update from terminal TxD1, when a request is received on RxD1. The RS232-1 LED blinks when bidirectional communications takes place. 2. This Application Note only addresses bdirectional communications. ii) Bidirection communications 1. The MSR310 uses the MODBUS RTU protocol for communications. 2. There are 17 parameters that can be read from the MSR310. These parameters are listed in the MSR300 System Manual and reproduced in Annex A. MSR310 RS232 Bi-Directional to ControlLogix Page 1 of 18 July 13, 2006

SERCOS inter CP OK Tx (rear) Rx (front) face TM iii) Example Schematic 1. This schematic was used for the purposes of this Application Note. +24VDC Pin 2 Pin 5 Pin 3 1756 ControlLogix System S12 S22 S32 G2 F2 Group 2 MSR320P 440R-W23218 S42 S52 S62 S12 S22 S32 G2 F2 Group 2 MSR320P 440R-W23218 S42 S52 S62 S11 A2 S21 A1 Y31 Y32 Y33 Y40 Y41 Y42 TxD1 RxD1 GND Minotaur MSR310P 440R-W23219 Y34 Y10 Y11 Y12 Y13 13 23 33 41 14 24 34 42 Group2 MSR330P 440R-W23222 Extension Module #1 24V DC Com Extension Module #2 2. When identifiying extension modules, module number 1 is closet to the base module. Extension module 2 is the module next to EM1. The module number counts up going from right to left. MSR310 RS232 Bi-Directional to ControlLogix Page 2 of 18 July 20, 2006

4) ControlLogix Setup a) ACD File 1. The RSLogix 5000 project files associated with this solution use version 13 or higher. 2. The ModbusMaster.ACD file is included with Version 13 or higher. 3. This Application Note is based on ModbusMaster and has been saved as ModbusMaster_msr310.ACD. This file can be opened separately to become comfortable with the settings. It must be copied into the users RSLogix 5000 project - see publication CIG-AP129A-EN-P for instructions. 4. Right click on the Controller and select Properties. 5. Set the Serial Port Properties according the following screen shot. MSR310 RS232 Bi-Directional to ControlLogix Page 3 of 18 July 20, 2006

6. Set the User Protocol settings: (a) The important setting is the Protocol being set to ASCII. NOTE that once this is done, DF1 communications is no longer available. (b) The terminating and append characters are not used. MSR310 RS232 Bi-Directional to ControlLogix Page 4 of 18 July 20, 2006

Edit the Program (aka Controller) Tags (a) In the Scope field under Program Tags, select Modbus_Master(controller). (b) Set the Mod_Comm_Index to 19. (c) Expand the ModbusCommands[x] fields and enter the appropriate values. See Annex B for the description of each field. Commands 1-19 are used. Each command requests information from each of the MSR310 addresses. The ModCommand[x].Starting Address begins at 0 and increments to 18. Each command requests 1 datapoint. MSR310 RS232 Bi-Directional to ControlLogix Page 5 of 18 July 20, 2006

5) Ladder Logic 1. No changes to the ladder logic are required, when the ModbusMaster.ACD file is added to the project. To start the communications, go to the Main Routine, right click on the Mod_Active Contact and select Toggle input. 6) Example Review of Response 1. Change the Scope to Modbus Interface. 2. Click on the + of the Mod_Status tags to review the data received. Remember that status 0 is not used in this application. 3. The data returned does not correlate exactly with the descriptions in the Modbus.ACD file. The high byte of the data is stored in the tag LowStart Address. The HiNumOfPoints contains the low byte. The tag names have been modified by adding HighByte and LowByte for clarity. MSR310 RS232 Bi-Directional to ControlLogix Page 6 of 18 July 20, 2006

a) Device Status 1. The Device Status is returned from Address 0 of the MSR300 and stored in ModStatus[1]. 2. From above we see the returned messages is: 01 03 02 10 05 75. The data is 10 05, which translates into bit values of 0001 0000 0000 0101. Plugging these values in the table below, we see that Group 2 output is energized and the Group 2 EDM loop is open. Both of these status are in agreement with each other when an output is energized, its EDM loop should be open. Byte Bit Bit Value Interpretation High 7 + 6 00 Jumpers exist between Y40 Y41 and Y42s High 5 0 Group 3 outputs are not energized (ie, not active) High 4 1 Group 2 outputs are not energized High 3 0 Group 1 outputs are not energized High 2 0 Group 3 is not ready High 1 0 Group 2 is not ready High 0 0 Group 1 is not ready Low 7 0 No faults exist Low 6 0 No cross loop exist Low 5 0 Group 3 is not interrupted Low 4 0 Group 2 is not interrupted Low 3 0 Group 1 is not interrupted Low 2 1 Group 3 EDM Loop (Y10 to Y13) is closed Low 1 0 Group 2 EDM Loop (Y10 to Y12) is closed Low 0 1 Group 1 EDM Loop (Y10 to Y11) is closed MSR310 RS232 Bi-Directional to ControlLogix Page 7 of 18 July 20, 2006

b) Input Status 1 1. The Input Status 1 is returned from Address 1 of the MSR300 and stored in ModStatus[2]. 2. From above we see the returned messages is: 01 03 02 ff f0 f9. The data is ff f0, which translates into bit values of 1111 1111 1111 0000. Plugging these values in the table below, we see that the Inputs 1 and 2 of Extension Modules 1 and 2 are not interrupted. Extension Modules 3 8 are not being used and assume a default value of 1. Byte Bit Bit Value Function High 7 1 Extension module 8 Input 2 interrupted High 6 1 Extension module 8 Input 1 interrupted High 5 1 Extension module 7 Input 2 interrupted High 4 1 Extension module 7 Input 1 interrupted High 3 1 Extension module 6 Input 2 interrupted High 2 1 Extension module 6 Input 1 interrupted High 1 1 Extension module 5 Input 2 interrupted High 0 1 Extension module 5 Input 1 interrupted Low 7 1 Extension module 4 Input 2 interrupted Low 6 1 Extension module 4 Input 1 interrupted Low 5 1 Extension module 3 Input 2 interrupted Low 4 1 Extension module 3 Input 1 interrupted Low 3 0 Extension module 2 Input 2 interrupted Low 2 0 Extension module 2 Input 1 interrupted Low 1 0 Extension module 1 Input 2 interrupted Low 0 0 Extension module 1 Input 1 interrupted MSR310 RS232 Bi-Directional to ControlLogix Page 8 of 18 July 20, 2006

c) Input Status 2 1. The Input Status 2 is returned from Address 2 of the MSR300 and stored in ModStatus[3]. 2. From above we see the returned messages is: 01 03 02 0f 00 bd. The data is 0f 00, which translates into bit values of 0000 1111 0000 0000. Plugging these values in the table below, we see that the Reserved values default to 0, the Extension Modules 9 and 10 default to 1 as they are not used, and the fault values are all 0, as the MSR300 is working properly. Byte Bit Bit Value Function High 7 0 Reserved High 6 0 Reserved High 5 0 Reserved High 4 0 Reserved High 3 1 Extension module 10 Input 2 interrupted High 2 1 Extension module 10 Input 1 interrupted High 1 1 Extension module 9 Input 2 interrupted High 0 1 Extension module 9 Input 1 interrupted Low 7 0 Reserved Low 6 0 Fault: Different switch settings of input modules between the two channels Low 5 0 Fault: Invalid configuration of extension modules Low 4 0 Fault: Reserve Muting lamp 2 Low 3 0 Fault: Muting lamp 2 Low 2 0 Fault: Reserve Muting lamp 1 Low 1 0 Fault: Muting lamp 1 Low 0 0 Fault: at least one Input (lock-out-release, no synchrony activity) MSR310 RS232 Bi-Directional to ControlLogix Page 9 of 18 July 20, 2006

d) Configuration Status of EM1 1. Extension Module 1 status is returned from Address 3 and stored in ModStatus[4]. 2. The data returned is 22 22 hex which converts to binary: 0010 0010 0010 0010. Mapping these values into the table below reveals the configuration. As we can see from the table, the data tells us the switch settings and the values stored in the EEPROM. If the MSR300 is operating properly, then the low byte must be equal to the high byte. This also makes for an easy translation into the Function and Group settings. A 22 means Function 2 and Group 2. Byte Bit Bit Valve Function High 7 0 Switch settings of function bit 3 High 6 0 Switch settings of function bit 2 High 5 1 Switch settings of function bit 1 High 4 0 Switch settings of function bit 0 High 3 0 Switch settings of group bit 3 High 2 0 Switch settings of group bit 2 High 1 1 Switch settings of group bit 1 High 0 0 Switch settings of group bit 0 Low 7 0 Stored EEPROM settings of function bit 3 Low 6 0 Stored EEPROM settings of function bit 2 Low 5 1 Stored EEPROM settings of function bit 1 Low 4 0 Stored EEPROM settings of function bit 0 Low 3 0 Stored EEPROM settings of group bit 3 Low 2 0 Stored EEPROM settings of group bit 2 Low 1 1 Stored EEPROM settings of group bit 1 Low 0 0 Stored EEPROM settings of group bit 0 3. The configuration status for the other modules can be found in ModStatus[4] to ModStatus[13] and is not shown in this app note. MSR310 RS232 Bi-Directional to ControlLogix Page 10 of 18 July 20, 2006

e) Input Error With Monitoring EM1-8 1. Input Error With Monitoring on EM 1-8 is returned from Address 13 and is stored in ModStatus[14]. 2. The data returned is 00 08 hex which converts to binary: 0000 0000 0000 1000. Mapping these values into the table below reveals the configuration. As we can see from the table, the data tells us that an input errors exist on input #2 of module #2.. Byte Bit Bit Value Function High 7 0 Input error monitoring, extension module 8, input 2 High 6 0 Input error monitoring, extension module 8, input 1 High 5 0 Input error monitoring, extension module 7, input 2 High 4 0 Input error monitoring, extension module 7, input 1 High 3 0 Input error monitoring, extension module 6, input 2 High 2 0 Input error monitoring, extension module 6, input 1 High 1 0 Input error monitoring, extension module 5, input 2 High 0 0 Input error monitoring, extension module 5, input 1 Low 7 0 Input error monitoring, extension module 4, input 2 Low 6 0 Input error monitoring, extension module 4, input 1 Low 5 0 Input error monitoring, extension module 3, input 2 Low 4 0 Input error monitoring, extension module 3, input 1 Low 3 1 Input error monitoring, extension module 2, input 2 Low 2 0 Input error monitoring, extension module 2, input 1 Low 1 0 Input error monitoring, extension module 1, input 2 Low 0 0 Input error monitoring, extension module 1, input 1 MSR310 RS232 Bi-Directional to ControlLogix Page 11 of 18 July 20, 2006

f) Input Error With Monitoring EM9-10 3. Input Error With Monitoring on EM 9-10 is returned from Address 14 and is stored in ModStatus[15]. 4. The data returned is 00 00 hex which converts to binary: 0000 0000 0000 0000. Mapping these values into the table below reveals the configuration. As we can see from the table, the data tells us that no input errors exist. Byte Bit Bit Value Function High 7 0 Reserved High 6 0 Reserved High 5 0 Reserved High 4 0 Reserved High 3 0 Reserved High 2 0 Reserved High 1 0 Reserved High 0 0 Reserved Low 7 0 Reserved Low 6 0 Reserved Low 5 0 Reserved Low 4 0 Reserved Low 3 0 Input error monitoring, extension module 10, input 2 Low 2 0 Input error monitoring, extension module 10, input 1 Low 1 0 Input error monitoring, extension module 9, input 2 Low 0 0 Input error monitoring, extension module 9, input 1 MSR310 RS232 Bi-Directional to ControlLogix Page 12 of 18 July 20, 2006

g) Error Status 1 1. The Error Status 1 is returned from Address 15 and is stored in ModStatus[16]. 2. The data returned is 00 00 hex which converts to binary: 0000 0000 0000 0000. Mapping these values into the table below reveals that no errors exist. Byte Bit Bit Value Function High 7 0 Faulty input switch, extension module 8, input 2 High 6 0 Faulty input switch, extension module 8, input 1 High 5 0 Faulty input switch, extension module 7, input 2 High 4 0 Faulty input switch, extension module 7, input 1 High 3 0 Faulty input switch, extension module 6, input 2 High 2 0 Faulty input switch, extension module 6, input 1 High 1 0 Faulty input switch, extension module 5, input 2 High 0 0 Faulty input switch, extension module 5, input 1 Low 7 0 Faulty input switch, extension module 4, input 2 Low 6 0 Faulty input switch, extension module 4, input 1 Low 5 0 Faulty input switch, extension module 3, input 2 Low 4 0 Faulty input switch, extension module 3, input 1 Low 3 0 Faulty input switch, extension module 2, input 2 Low 2 0 Faulty input switch, extension module 2, input 1 Low 1 0 Faulty input switch, extension module 1, input 2 Low 0 0 Faulty input switch, extension module 1, input 1 MSR310 RS232 Bi-Directional to ControlLogix Page 13 of 18 July 20, 2006

h) Error Status 2 1. The Error Status 2 is returned from Address 16 and is stored in ModStatus[17]. 2. The data returned is 00 52 hex which converts to binary: 0000 0000 0101 0010. Mapping these values into the table below reveals that we have two extension modules and the firmware revision is 5. Byte Bit Bit Value Function High 7 0 Faulty input switch, extension module 10, input 2 High 6 0 Faulty input switch, extension module 10, input 1 High 5 0 Faulty input switch, extension module 9, input 2 High 4 0 Faulty input switch, extension module 9, input 1 High 3 0 Internal fault High 2 0 Adjusted configuration is not equal like the stored one High 1 0 The configuration changed during operation High 0 0 Terminal connector is missing Low 7 0 Version number of Base Module firmware bit 3 Low 6 1 Version number of Base Module firmware bit 2 Low 5 0 Version number of Base Module firmware bit 1 Low 4 1 Version number of Base Module firmware bit 0 Low 3 0 Number of extension modules bit 3 Low 2 0 Number of extension modules bit 2 Low 1 1 Number of extension modules bit 1 Low 0 0 Number of extension modules bit 0 MSR310 RS232 Bi-Directional to ControlLogix Page 14 of 18 July 20, 2006

i) Bus Status 1. The error status 1 is returned from Address 18 and is stored in ModStatus[18]. 2. The data returned is 00 01 hex which converts to binary: 0000 0000 0000 0001. Mapping these values into the table below reveals the meaning of the message. The baud rate is 4800. Byte Bit Bit Value Function High -- 0 Reserved. Low -- 1 0: 2400 Baud 1: 4800 Baud 2: 9600 Baud 3: 19200 Baud MSR310 RS232 Bi-Directional to ControlLogix Page 15 of 18 July 20, 2006

Annex A MSR310 Paramters Parameter R/W Name Size Value Address 1 R Device status 2 bytes 0x0000 0xFFFF 0x0000 2 R Input status 1 2 bytes 0x0000 0xFFFF 0x0001 3 R Input status 2 2 bytes 0x0000 0xFFFF 0x0002 4 R Configuration status EM 1 2 bytes 0x0000 0xFFFF 0x0003 5 R Configuration status EM 2 2 bytes 0x0000 0xFFFF 0x0004 6 R Configuration status EM 3 2 bytes 0x0000 0xFFFF 0x0005 7 R Configuration status EM 4 2 bytes 0x0000 0xFFFF 0x0006 8 R Configuration status EM 5 2 bytes 0x0000 0xFFFF 0x0007 9 R Configuration status EM 6 2 bytes 0x0000 0xFFFF 0x0008 10 R Configuration status EM 7 2 bytes 0x0000 0xFFFF 0x0009 11 R Configuration status EM 8 2 bytes 0x0000 0xFFFF 0x000A 12 R Configuration status EM 9 2 bytes 0x0000 0xFFFF 0x000B 13 R Configuration status EM 10 2 bytes 0x0000 0xFFFF 0x000C 14 R Input with error monitoring: 2 bytes 0x0000 0xFFFF 0x000D extension modules 1 to 8 15 R Input with error monitoring: 2 bytes 0x0000 0xFFFF 0x000E extension modules 9 to 10 16 R Input switch error status 2 bytes 0x0000 0xFFFF 0x000F 17 R Input switch error status, other 2 bytes 0x0000 0xFFFF 0x0010 faults, version number, number of input modules 18 R/W Bus status (Baud rate) 2 bytes 0x0000 0x0300 0x0011 MSR310 RS232 Bi-Directional to ControlLogix Page 16 of 18 July 20, 2006

Annex B Modbus Command Descriptions The table below show those tags that have been set in the MSR300_RS232_Modubs.ACD file. This table is a subset of the tags found in CIG-AP129A-EN-P. Tag Name: Tag Type: Description: Valid Values App Note Value (Decimal) Mod_Active BOOL This tag determines whether your project runs the new program in a Logix5000 controller Mod_Cmd _Number DINT Number of command elements 9i.e., Mod_Commands tag) scanned. For example, if you set theis tag=5, then controller only scans command elements 0 through 4 and ignores command elements 5-39 This number should match the number of command elements used in your project. Mod_Commands Command[40] Command file that contains multiple user-defined configurable paramteres described below: Mod_Command[x].Enable INT Determines if the command element is enabled. Mod_Command[x].EchoReceived INT The master controller writes a number in this fiell if the comand element was successfully executed. The number written matchces that iused in the Mod_Commands[x].Enable tag. For example, if you set the Mod_Commands[x].Enable tag = 3, then controller writes a 3 in this field if the comand element was executed successfully. Mod_Command[x].ScanNumber INT Determines at which scan the slanve exetuers the command element. Fro example, if you type a 3 in this tag, the slave only executes this comand element on scan 3 (out of 10). 0=Do not urn program 1= Run the program Any valure from 1-40 19 0 = Command Element disabled 1 = Command element enabled alsways 2 = Command element enabled when controller reaches the scan number listed in the Mod_Command[x].Scannumber tage. 3 = Command elemnent enabled only on the 1 st scan. 0 =- Comand element was either disabled or did not exeute scuuessfully. 1, 2, or 3 = Command element was successufully executed; typically this value is 1 because the Mod_Command[x].Enable tag is typically 1. Write 0 in this field before enableing the instructions to minitor the change after the Command element executes. Any value from 0 12. Default = 12 1 1 1 1 Mod_Command[x].AddressOffsetin Master INT This tag is only used if the Mod_Commands[x].Enable tag = 2. If the Mod-Commands[x].Enable tag = 0 or 1, this tag is ignored. Sets a word-level offeset iun the controller;s data talbe when ta read oir wirte is exeutesd./ 0 No offset Positive nonzero number = Offset 1 This values is added to the value of the Mod_Commands[ /Starting address tag to thjdetermine where the master beigns reading or writing data in its data table. MSR310 RS232 Bi-Directional to ControlLogix Page 17 of 18 July 20, 2006

Mod_Command[x].SlaveAddress INT Designates the node number of the slave where the controller writes data to and reads data from. Mod_Command[x].FunctionCode INT Designates the function coe of the service commanded. Mod_Command[x].StartingAddress INT This value is added to the address offset (i.e., Mod_Commands[x]. AddressOffsetinMaster tag) to determine the starting address when the master reads or writes data in its data table. 0-255 1 Bit level function codes 01 = Read Coil Status 02 = Read Input Status 05 = Write Single Coil 15 = Write Multiple Coils 03 Word level function codes 03 Read holding registers 04 = Read input registers 06 = Write singel register 16 = Write multiple registers Application Specific 0 to 18 (decimal) 00 to 11 (Hex) Depending on the command element s function code, this value may be in bits or words. For example, if this tag = 5 in a command element that uses function code 01 (bit level code - Read Coils), the address offset is increased by 5 bits. However, if the command element uses function code 03 (word level code - read holding registers), the address offset is increased by 5 words. Mod_Command[x].Numberofpoints INT Designates the number of points Application Specific 1 that the controller should read or write. Depending on the command element s function code, this value may be in bits or words. For example, if this tag = 10 in a command element that uses function code 03 (word level code - Read Holding Registers), the controller reads 10 words. Mod_Command[x].Spare1 INT Not used. 0 Mod_Command[x].Spare2 INT Not used. 0 MSR310 RS232 Bi-Directional to ControlLogix Page 18 of 18 July 20, 2006