guardlogix safety application instruction set

8/18/2019 GuardLogix Safety Application Instruction Set

1/397

GuardLogix Safety Application Instruction SetCatalog Numbers 1756-L61S, 1756-L62S, 1756-L63S, 1756-LSP, 1756-L72S, 1756-L73S, 1756-L7SP, 1756-L72SXT, 1756-

L7SPXT, 1768-L43S, 1768-L45S

Safety Reference Manual


2/397

Important User Information

Solid-state equipment has operational characteristics differing from those of electromechanical equipment. SafetyGuidelines for the Application, Installation and Maintenance of Solid State Controls (publication SGI-1.1 available from your local Rockwell Automation® sales office or online at http://www.rockwellautomation.com/literature/ ) describes someimportant differences between solid-state equipment and hard-wired electromechanical devices. Because of this difference,and also because of the wide variety of uses for solid-state equipment, all persons responsible for applying this equipmentmust satisfy themselves that each intended application of this equipment is acceptable.

In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from theuse or application of this equipment.

The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables andrequirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility orliability for actual use based on the examples and diagrams.

No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or

software described in this manual.

Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,Inc., is prohibited.

Throughout this manual, when necessary, we use notes to make you aware of safety considerations.

Allen-Bradley, Rockwell Automation, GuardLogix, Guard I /O, CompactBlock Guard I/O, ControlLogix, Logix5000, and TechConnect are trademarks of Rockwell Automation, Inc.

Trademarks not belonging to Rockwell Automation are property of their respective companies.

WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,

which may lead to personal injury or death, property damage, or economic loss.

ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property

damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.

SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous

voltage may be present.

BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may

reach dangerous temperatures.

IMPORTANT Identifies information that is critical for successful application and understanding of the product.

http://literature.rockwellautomation.com/idc/groups/literature/documents/in/sgi-in001_-en-p.pdfhttp://www.rockwellautomation.com/literature/http://www.rockwellautomation.com/literature/http://literature.rockwellautomation.com/idc/groups/literature/documents/in/sgi-in001_-en-p.pdf


3/397

Rockwell Automation Publication 1756-RM095E-EN-P - February 2012 3

Summary of Changes

This manual contains new and updated information. Changes throughout thisrevision are marked by change bars, as shown to the right of this paragraph.

New and UpdatedInformationThis table contains the changes made to this revision.

Topic Page

Added information on changing parameters while in Run mode to eachinstruction

Throughout

Dual-channel Analog Input (DCA) instruction 91

Corrected diagnostic signal code for Actuate input 136

Clarified the operational description of the Output 1 (O1) and Fault Present (FP)parameters of the Cam Shaft Monitor (CSM) instruction

248

Updated execution times Appendix B


4/397

4 Rockwell Automation Publication 1756-RM095E-EN-P - February 2012

Summary of Changes

Notes:


5/397


Table of Contents

PrefaceGuardLogix Controller Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Terminology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Chapter 1

General Safety Application

Instructions

Dual-channel Input Start (DCSRT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18DCSRT – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18DCSRT – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21DCSRT – Input Status Fault Operation. . . . . . . . . . . . . . . . . . . . . . . . 22DCSRT – Discrepancy Fault Operation. . . . . . . . . . . . . . . . . . . . . . . . 23DCSRT– False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . 23DCSRT – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . 24DCSRT – Wiring and Programming Example . . . . . . . . . . . . . . . . . . 25

Dual-channel Input Monitor (DCM). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28DCM – Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28DCM – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31DCM – Input Status Fault Operation. . . . . . . . . . . . . . . . . . . . . . . . . . 32DCM – Discrepancy Fault Operation. . . . . . . . . . . . . . . . . . . . . . . . . . 33DCM – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33DCM – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . 34DCM – Wiring and Programming Example . . . . . . . . . . . . . . . . . . . . 35

Dual-channel Input Stop (DCS). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38DCS – Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38DCS – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

DCS – Input Status Fault (Manual Cold Start) . . . . . . . . . . . . . . . . . 46DCS – Cycle Inputs Fault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48DCS – Discrepancy Fault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49DCS – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49DCS – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50DCS – Wiring and Programming Example . . . . . . . . . . . . . . . . . . . . . 51

Dual-channel Input Stop with Test (DCST) . . . . . . . . . . . . . . . . . . . . . . . 54DCST – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54DCST – Functional Test Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . 57DCST – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58DCST – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . 59

DCST – Wiring and Programming Example. . . . . . . . . . . . . . . . . . . . 60Dual-channel Input Stop with Test and Lock (DCSTL). . . . . . . . . . . . . 64DCSTL – Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65DCSTL – Start-up Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68DCSTL – Device Not Tested After Unlock Fault . . . . . . . . . . . . . . . 70DCSTL – Functional Test After Fault Operation. . . . . . . . . . . . . . . 71DCSTL – False Rung State Behavior. . . . . . . . . . . . . . . . . . . . . . . . . . . 72DCSTL – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . 72DCSTL – Wiring and Programming Example . . . . . . . . . . . . . . . . . . 74


6/397


Table of Contents

Dual-channel Input Stop with Test and Mute (DCSTM) . . . . . . . . . . . 79DCSTM – Instruction Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80DCSTM – Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83DCSTM – Muting Lamp Status Fault Operation . . . . . . . . . . . . . . . 84DCSTM – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . 84

DCSTM – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . 85DCSTM – Wiring and Programming Example . . . . . . . . . . . . . . . . . 86Dual-channel Analog Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91[(DCA) - integer version][(DCAF) - floating point version] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

DCA(F) – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91DCA(F) – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94DCA(F) – Input Status Fault. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98DCA(F) – Discrepancy Fault. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100DCA(F) – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . 100DCA(F) – Fault and Diagnostic Codes. . . . . . . . . . . . . . . . . . . . . . . . 101

DCA(F) – Wiring and Programming Example. . . . . . . . . . . . . . . . . 101Safety Mat (SMAT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106SMAT – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106SMAT – Circuit Verification Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108SMAT – Manual Restart Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 109SMAT – Automatic Restart Operation. . . . . . . . . . . . . . . . . . . . . . . . 110Safety Mat Occupied Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111Safety Mat Unoccupied Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . 112SMAT – Fault Detection Operation . . . . . . . . . . . . . . . . . . . . . . . . . . 113SMAT – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . 113SMAT – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . 114

SMAT – Wiring and Programming Example . . . . . . . . . . . . . . . . . . 115Two-hand Run Station – Enhanced (THRSe) . . . . . . . . . . . . . . . . . . . . . 118THRSe – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Disconnecting the Two-hand Run Station. . . . . . . . . . . . . . . . . . . . . 120Connecting the Two-hand Run Station . . . . . . . . . . . . . . . . . . . . . . . 120THRSe – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121THRSe – Button Held Down Diagnostic Operation . . . . . . . . . . . 122THRSe – Button Glitch Diagnostic Operation . . . . . . . . . . . . . . . . 123THRSe – Button Discrepancy Fault (Channel-to-Channel)Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124THRSe – Run Station Disconnected (Station Bypassed)

Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125THRSe – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . 126THRSe – Fault and Diagnostic Codes. . . . . . . . . . . . . . . . . . . . . . . . . 126THRSe – Wiring and Programming Example. . . . . . . . . . . . . . . . . . 127

Configurable Redundant Output (CROUT). . . . . . . . . . . . . . . . . . . . . . 131CROUT – Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . 131CROUT – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134CROUT – Feedback Fault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135CROUT – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . 135


7/397


Table of Contents

CROUT – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . 136CROUT – Wiring and Programming Example . . . . . . . . . . . . . . . . 137

Two-sensor Asymmetrical Muting (TSAM) . . . . . . . . . . . . . . . . . . . . . . . 141TSAM – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142TSAM – Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

TSAM – Invalid Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146TSAM – Tolerated Sequence. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147TSAM – Dangerous Portion of Cycle . . . . . . . . . . . . . . . . . . . . . . . . . 148TSAM – Override Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149TSAM – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . 149TSAM – Fault Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150TSAM – Diagnostic Codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153TSAM – Wiring and Programming Example . . . . . . . . . . . . . . . . . . 154

Two-sensor Symmetrical Muting (TSSM). . . . . . . . . . . . . . . . . . . . . . . . . 159TSSM – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160TSSM – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

TSSM – Invalid Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165TSSM – Tolerated Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166TSSM – Dangerous Portion of Cycle. . . . . . . . . . . . . . . . . . . . . . . . . . 167TSSM – Override Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168TSSM – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . 168TSSM – Fault Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169TSSM – Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172TSSM – Wiring and Programming Example . . . . . . . . . . . . . . . . . . . 172

Four-sensor Bidirectional Muting (FSBM) . . . . . . . . . . . . . . . . . . . . . . . . 177FSBM – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178FSBM – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181

FSBM – Invalid Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184FSBM – Tolerated Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185FSBM – Dangerous Portion of Cycle. . . . . . . . . . . . . . . . . . . . . . . . . . 186FSBM – Override Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187FSBM – False Rung State Behavior. . . . . . . . . . . . . . . . . . . . . . . . . . . . 188FSBM – Fault Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188FSBM – Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200FSBM – Wiring and Programming Example . . . . . . . . . . . . . . . . . . . 200

Chapter 2

Metal Form Instructions Clutch Brake Inch Mode (CBIM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206CBIM – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207CBIM – Energizing Output 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209CBIM – De-energizing Output 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211CBIM – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . 212CBIM – Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213

Clutch Brake Single Stroke Mode (CBSSM). . . . . . . . . . . . . . . . . . . . . . . 215CBSSM – Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216CBSSM – Energizing Output 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218CBSSM – De-energizing Output 1. . . . . . . . . . . . . . . . . . . . . . . . . . . . 220


8/397


9/397


Table of Contents

AVC – Wiring and Programming Example . . . . . . . . . . . . . . . . . . . . 284Main Valve Control (MVC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

MVC – Instruction Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289MVC – Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291MVC – Feedback Fault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

MVC – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292MVC – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . 293MVC – Wiring and Programming Example . . . . . . . . . . . . . . . . . . . 294

Maintenance Manual Valve Control (MMVC) . . . . . . . . . . . . . . . . . . . . 298MMVC – Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299MMVC – Normal Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301MMVC – Actuate in Non-permissive State. . . . . . . . . . . . . . . . . . . . 302MMVC – Fault After Output 1 Energized. . . . . . . . . . . . . . . . . . . . . 303MMVC – False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . 303MMVC – Fault and Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . 304MMVC – Wiring and Programming Example . . . . . . . . . . . . . . . . . 305

Appendix A

RSLogix 5000 Software, Version 14

and Later, Safety Application

Instructions

General Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311De-energize to Trip System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311System Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312False Rung State Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315I/O Point Mapping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

Diverse Input (DIN) Instruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319Operation with Inconsistent Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

Operation with Circuit Reset Held On - Manual Reset Only. . . . 321Cycle Inputs Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321Diverse Input with Manual Reset Wiring Example . . . . . . . . . . . . . 322Diverse Input with Manual Reset Programming Example . . . . . . . 322Diverse Input with Automatic Reset Wiring Example . . . . . . . . . . 323Diverse Input with Automatic Reset Programming Example . . . . 324

Redundant Input (RIN) Instruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327Operation with Inconsistent Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . 328Operation with Circuit Reset Held On - Manual Reset Only. . . . 329Cycle Inputs Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329Redundant Input with Manual Reset Wiring Example. . . . . . . . . . 330Redundant Input with Manual Reset Programming Example. . . . 330Redundant Input with Automatic Reset Wiring Example . . . . . . . 331Redundant Input with Automatic Reset Programming Example. 332

Emergency Stop (ESTOP) Instruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335Operation with Inconsistent Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . 336


10/397


Table of Contents

Operation with Circuit Reset Held On - Manual Reset Only. . . . 337Cycle Inputs Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337Emergency Stop with Manual Reset Wiring Example . . . . . . . . . . . 338Emergency Stop with Manual Reset Programming Example . . . . . 338Emergency Stop with Automatic Reset Wiring Example . . . . . . . . 339

Emergency Stop with Automatic Reset Programming Example . . 340Enable Pendant (ENPEN) Instruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343Operation with Inconsistent Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . 344Operation with Circuit Reset Held On - Manual Reset Only. . . . 345Cycle Inputs Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345Enable Pendant with Manual Reset Wiring Example . . . . . . . . . . . 346Enable Pendant with Manual Reset Programming Example . . . . . 346Enable Pendant with Automatic Reset Wiring Example . . . . . . . . 347Enable Pendant with Automatic Reset Programming Example . . 348

Light Curtain (LC) Instruction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352Light Curtain Muting Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352Inputs Inconsistent Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354Circuit Reset Held On Operation - Manual Reset Mode Only . . 355Cycle Inputs Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355Input Filter Time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356Light Curtain with Manual Reset Wiring Example . . . . . . . . . . . . . 356Light Curtain with Manual Reset Programming Example . . . . . . . 357Light Curtain with Automatic Reset Wiring Example . . . . . . . . . . 359

Light Curtain with Automatic Reset Programming Example . . . . 360Five-position Mode Selector (FPMS) Instruction . . . . . . . . . . . . . . . . . . 362Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363Five-position Mode Selector Wiring Example . . . . . . . . . . . . . . . . . . 364Five-position Mode Selector Programming Example. . . . . . . . . . . . 364

Redundant Output with Continuous Feedback Monitoring(ROUT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366

Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 366Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367Redundant Output with Negative Feedback Wiring Example . . . 370

Redundant Output with Negative Feedback ProgrammingExample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370Redundant Output with Positive Feedback Wiring Example . . . . 372Redundant Output with Positive Feedback ProgrammingExample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372

Two-hand Run Station (THRS) Instruction . . . . . . . . . . . . . . . . . . . . . . 374Instruction Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375Normal Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377Button Tie-down Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 378


11/397


Table of Contents

Cycle Buttons Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379Button Fault Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380Two-hand Run Station with Active Pin Disabled WiringExample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381Two-hand Run Station with Active Pin Disabled Programming

Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382Two-hand Run Station with Active Pin Enabled WiringExamples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383Two-hand Run Station with Active Pin Enabled ProgrammingExample . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384

Appendix B

Execution Times for Safety

Application Instructions

Index


12/397


Table of Contents


13/397


Preface

This reference manual is intended to describe the Rockwell AutomationGuardLogix® Safety Application Instruction Set which is type-approved andcertified for safety-related function in applications up to and including SafetyIntegrity Level (SIL) 3 according to IEC61508, and Performance Level, PLe(Cat.4), according to ISO13849-1.

For the latest information and safety certificates, see http:// www.rockwellautomation.com/products/certification/safety/.

The timing diagrams presented in the manual are for illustrative purposes only.The actual response times will be determined by the performance characteristicsof your application.

Use this manual if you are responsible for designing, programming, ortroubleshooting safety applications that use GuardLogix controllers.

You must have a basic understanding of electrical circuitry and familiarity withrelay ladder logic. You must also be trained and experienced in the creation,operation, programming, and maintenance of safety systems.

GuardLogix ControllerOperation

The GuardLogix Safety controller is part of a de-energize to trip system. Thismeans that all of its outputs are set to zero when a fault is detected.

Topic Page

GuardLogix Controller Operation 13

Terminology 14

Additional Resources 15

http://www.rockwellautomation.com/products/certification/safety/http://www.rockwellautomation.com/products/certification/safety/http://www.rockwellautomation.com/products/certification/safety/http://www.rockwellautomation.com/products/certification/safety/


14/397


Preface

Terminology The following table defines abbreviations used in this manual.

Abbreviation Description

AOPD Active Opto-electronic Protective Device

BCAM Brake Cam

BDC Bottom Dead Center

CVT Circuit Verification Test

DCAM Dynamic Cam

ESPE Electro-sensitive Protective Equipment

TCAM Takeover Cam

Version 17 and Later Metal Form and General Instructions

AVC Auxiliary Valve Control

CBCM Clutch Brake Continuous Mode

CBIM Clutch Brake Inch Mode

CBSSM Clutch Brake Single Stroke Mode

CPM Crankshaft Position Monitor

CROUT Configurable Redundant Output

CSM Camshaft Monitor

DCM Dual Channel Input Monitor

DCS Dual Channel Input Stop

DCSRT Dual Channel Input Start

DCST Dual Channel Input Stop with Test

DCSTL Dual Channel Input Stop with Test and Lock

DCSTM Dual Channel Input Stop with Test and Mute

DCA Dual Channel Analog Input

EPMS Eight Position Mode Selector

FSBM Four Sensor Bidirectional Muting

MMVC Maintenance Manual Valve Control

MVC Main Valve Control

SMAT Safety Mat

THRSe Two Hand Run Station – Enhanced

TSAM Two Sensor Asymmetrical Muting

TSSM Two Sensor Symmetrical Muting

Version 14 and Later General Instructions

DIN Diverse Input

ENPEN Enable Pendant

ESTOP Emergency Stop

FPMS Five-position Mode Selector

LC Light Curtain

RIN Redundant Input

ROUT Redundant Output

THRS Two-hand Run Station


15/397


Preface

Additional Resources These documents contain additional information concerning related productsfrom Rockwell Automation.

You can view or download publications athttp://www.literature.rockwellautomation.com . To order paper copies oftechnical documentation, contact your local Allen-Bradley® distributor orRockwell Automation sales representative.

Resource Description

GuardLogix Controllers User Manual, publication 1756-UM020 Provides information on installing, configuring, and programming the 1756 GuardLogixcontroller

CompactLogix Controllers Installation Instructions,

publication 1768-IN004

Provides information on installing Compact GuardLogix controllers

1768 Compact GuardLogix Controllers User Manual,publication 1768-UM002

Provides information on configuring and programming the1768 Compact GuardLogix controller

GuardLogix Controller Systems Safety Reference Manual, publication 1756-RM093 Contains detailed requirements for achieving and maintaining SIL 3 with the GuardLogixcontroller system

CompactBlock Guard I/O DeviceNet Safety Module Installation Instructions, publication1791DS-IN002

Provides information on installing CompactBlock™ Guard I/O™ DeviceNet Safety modules

Guard I/O DeviceNet Safety Modules User Manual,publication 1791DS-UM001

Provides information on using Guard I/O DeviceNet Sa fety modules

Guard I/O EtherNet/IP Safety Modules Installation Instructions, publication1791ES-IN001

Provides information on installing CompactBlock Guard I/O EtherNet/IP Safety modules

Guard I/O EtherNet/IP Safety Modules User Manual,publication 1791ES-UM001

Provides information on using Guard I/O EtherNet/IP Safety modules

Using ControlLogix in SIL2 Applications S afety Reference Manual, publication1756-RM001

Describes requirements for using ControlLogix® controllers, and GuardLogix standard tasks, inSIL2 safety control applications

Logix5000 General Instruction Set Reference Manual,publication 1756-RM003

Provides information on the Logix5000™ Instruction Set

Logix Common Procedures Programming Manual,publication 1756-PM001

Provides information on programming Logix5000 controllers, including managing project files,organizing tags, programming and testing routines, and handling faults

ControlLogix System User Manual, publication 1756-UM001 Provides information on using ControlLogix in non-safety applications

DeviceNet Modules in Logix5000 Control Systems User Manual, publicationDNET-UM004

Provides information on using the 1756-DNB module in a Logix5000 control system

EtherNet/IP Modules in Logix5000 Control Systems User Manual, publicationENET-UM001

Provides information on using the 1756-ENBT module in a Logix5000 control system

ControlNet Modules in Logix5000 Control Systems User Manual, publication

CNET-UM001

Provides information on using the 1756-CNB module in Logix5000 control systems

Logix5000 Controllers Execution Time and Memory Use Reference Manual, publication1756-RM087

Provides information on estimating the execution time and memory use for instructions

Logix Import Export Reference Manual, publication 1756-RM084 Provides information on using RSLogix™ 5000 Import/Export utility

Product Certifications website, http://ab.com Provides declarations of conformity, certificates, and other certification details

http://www.literature.rockwellautomation.com/http://literature.rockwellautomation.com/idc/groups/literature/documents/um/1756-um020_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/in/1768-in004_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1768-um002_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm093_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/in/1791ds-in002_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1791ds-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/in/1791es-in001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1791es-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm003_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/pm/1756-pm001_-en-e.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1756-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1756-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/dnet-um004_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/enet-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/cnet-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm087_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm084_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm084_-en-p.pdfhttp://ab.com/http://www.literature.rockwellautomation.com/http://ab.com/http://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm084_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm087_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/cnet-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/enet-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/dnet-um004_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1756-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/pm/1756-pm001_-en-e.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm003_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1791es-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/in/1791es-in001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1791ds-um001_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/in/1791ds-in002_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm093_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1768-um002_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/in/1768-in004_-en-p.pdfhttp://literature.rockwellautomation.com/idc/groups/literature/documents/um/1756-um020_-en-p.pdf


16/397


Preface

Notes:


17/397


Chapter 1

General Safety Application Instructions

Topic Page

Dual-channel Input Start (DCSRT) 18

Dual-channel Input Monitor (DCM) 28

Dual-channel Input Stop (DCS) 38

Dual-channel Input Stop with Test (DCST) 54

Dual-channel Input Stop with Test and Lock (DCSTL) 64

Dual-channel Input Stop with Test and Mute (DCSTM) 79

Dual-channel Analog Input 91

Safety Mat (SMAT) 106

Two-hand Run Station – Enhanced (THRSe) 118

Configurable Redundant Output (CROUT) 131

Two-sensor Asymmetrical Muting (TSAM) 141

Two-sensor Symmetrical Muting (TSSM) 159

Four-sensor Bidirectional Muting (FSBM) 177


18/397


Chapter 1 General Safety Application Instructions

Dual-channel Input Start(DCSRT)

The Dual-channel Input Start instruction is for safety devices whose main

function is to start a machine safely, for example, an enable pendant. Thisinstruction will energize its output (O1) only if the Enable input is ON (1), andboth safety inputs, Channel A and Channel B, transition to the active state within the Discrepancy Time.

DCSRT – Instruction Parameters

IMPORTANT Do not use the same tag name for more than one instruction in the same

program. Do not write to any instruction output tag under any circumstances.

IMPORTANT Make sure your safety input points are configured as single, not Equivalent orComplementary. These instructions provide all dual-channel functionality

necessary for PLd (Cat. 3) or PLe (Cat. 4) safety functions.

ATTENTION: If you change instruction parameters while in Run mode, you

must accept the pending edits and cycle the controller mode from Program to

Run for the changes to take effect.


19/397


General Safety Application Instructions Chapter 1

The following table provides the parameters that are used to configure theinstruction. These parameters cannot be changed at runtime.

The following table explains instruction inputs. The inputs may be field devicesignals from input devices or derived from user logic.

Table 1 - DCSRT Configuration Parameters

Parameter Data Type Description

Safety Function List This parameter provides a text name for how this instruction is being used. Choices inclu de enable pend ant, start bu tton, and user-

defined.This does not affect instruction behavior. It is for information/documentation purposes only.

Input Type List This parameter selects input channel behavior.

Equivalent - Active High: Inputs are in the active state when Channel A and Channel B inputs are 1.Complementary: Inputs are in the active state when Channel A is 1 and Channel B is 0.

Discrepancy Time (ms) Integer The amount of time that the inputs are allowed to be in an inconsistent state before an instruction fault is generated. Theinconsistent state depends on the Input Type.

Equivalent: Inconsistent state is when either is true:

• Channel A = 0 and Channel B = 1• Channel A = 1 and Channel B = 0

Complementary: Inconsistent state is when either is true:


The valid range is 5...3000 ms.

Table 2 - DCSRT Inputs

Name Data Type Description

Enable Boolean This input enables or disables the instruction.

ON (1): The instruction is enabled. Output 1 is energized when Channel A and Channel B transition to the active state within theDiscrepancy Time.OFF (0): The instruction is disabled. Output 1 is not energized.

Channel A(1) Boolean This input is one of the two safety inputs to the instruction.

Channel B(1) Boolean This input is one of the two safety inputs to the instruction.

Input Statu s Bool ean If instr uction inputs are from a safety I/O mo dul e, this is the status fro m the I/O mo du le or mo du les (Connect ion Status orCombined Status). If instruction inputs are derived from internal logic, it is the application programmer’s responsibility todetermine the conditions.

ON (1): The inputs to this instruction are valid.OFF (0): The inputs to this instruction are invalid.

Reset(2) Boolean This input clears instruction and circuit faults provided the fault condition is not present.

OFF (0) -> ON (1): The Fault Present and Fault Code outputs are reset.

(1) If this input is from a Guard I/O input module, make sure the input is configured as single, not Equivalent or Complementary.

(2) ISO 13849-1 stipulates instruction reset functions must occur on falling edge signals. To comply with ISO 13849-1 requirements, add

this logic immediately before this instruction. Rename the ‘Reset _Signal’ tag in this example to your reset signal tag name. Then use

the OSF instruction Output Bit tag as the instruction’s reset source.


20/397



The following table explains instruction outputs. The outputs may be used todrive external tags (safety output modules) or internal tags for use in other logicroutines.

Table 3 - DCSRT Outputs


Output 1 (O1) Boolean This output is energized when the input conditions have been satisfied.The output becomes de-energized when:• either Channel A or Channel B transitions to the safe s tate.• the Input Status input is OFF (0).• the Enable input turns OFF (0).

Fault Present (FP) Boolean ON (1): A fault is present in the instruction.OFF (0): The instruction is operating normally.

Fault Code Integer This output indicates the type of fault that occurred. See Table 4 on page 24 for a list of fault codes.

This parameter is not safety-related.

Diagnostic Code Integer This output indicates the diagnostic status of the instruction. See Table 5 on page 24 for a list of diagnostic codes.


IMPORTANT Do not write to any instruction output tag under any circumstances.

http://-/?-http://-/?-


21/397



DCSRT – Normal Operation

The timing diagram in Figure 1 illustrates the normal operation for a start device,for example, an enable pendant. At (A), Output 1 is not energized because theEnable input is OFF (0). At (B), Output 1 is not energized because the transitionof the Enable signal ON (1) can never enable Output 1. At (C), Output 1 isenergized 50 ms after the safety inputs transition through the safe state and to theactive state with the Enable input ON (1). At (D), Output 1 is de-energized when either one of the safety inputs transition to the safe state. At (E), Output 1is energized 50 ms after the safety inputs return to the active state. At (F), Output1 is de-energized because the Enable input has transitioned to OFF (0).

Figure 1 - Normal Operation (Equivalent Inputs) Timing Diagram

Figure 2 demonstrates the same behavior as in the previous timing diagramexcept that the Input Type is Complementary.

Figure 2 - Normal Operation (Complementary Inputs) Timing Diagram

1

0

1

0

1

0

1

0

A B C D E F

50 ms 50 ms

Channel A

Channel B

Enable

Output 1

Input Type = Equivalent - Active High Discrepancy Time = 250 ms

If the Input Status input is not shown, it is assumed that the input status is valid (ON = 1) for the entire timing diagram.

1

0

1

0

1

0

10

A B C D E F

50 ms50 ms

Input Type = Complementary Discrepancy Time = 250 ms

Channel A

Channel B

Enable

Output 1

If the Input Status input is not s hown, it is assumed that the input status is valid (ON = 1) for the entire timingdiagram.

http://-/?-http://-/?-


22/397



DCSRT – Input Status Fault Operation

Figure 3 illustrates fault behavior when the Input Status becomes invalid. At (A),Output 1 is not energized because the Input Status has not become active for thefirst time. At (B), with the Input Status active and after a 50 ms delay, Output 1 isenergized because the safety inputs have transitioned through the safe state to theactive state. At (C), the Input Status becomes invalid, which immediately de-energizes Output 1 and generates a fault. At (D), the fault cannot be reset becausethe Input Status is still inactive. At (E), the fault is reset because the Input Statusis now active and a reset is triggered. At (F), Output 1 is active.

Figure 3 - Input Status Fault Timing Diagram

1

0

1

0

1

0

1

0

1

0

A B C

1

0

1

0

D E F

50 ms 50 ms

Channel A

Channel B

Enable

Input Status

Reset

Fault Present

Output 1

Input Type = Equivalent - Active High

Discrepancy Time = 250 ms


23/397



DCSRT – Discrepancy Fault Operation

Figure 4 illustrates a discrepancy fault occurring when Channel A and Channel Bare in an inconsistent state for longer than the configured Discrepancy Time. At(A), a fault is generated when the safety inputs are in an inconsistent state forlonger than the Discrepancy Time, for example, 250 ms. At (B), the fault iscleared because both safety inputs are inactive and the Reset input went active. At(C), Output 1 is energized 50 ms after both safety inputs transition to the activestate together within the Discrepancy Time. At (D), Output 1 is de-energized when Channel B transitions to the safe state. At (E), a fault is generated becausethe safety inputs are again in an inconsistent state for longer than theDiscrepancy Time. At (F), the fault is cleared, but Output 1 will not be energizeduntil both safety inputs transition to the active state together.

Figure 4 - Discrepancy Fault Timing Diagram

DCSRT– False Rung State Behavior

When the instruction is executed on a false rung, all instruction outputs are de-energized.

1

0

1

0

1

0

1

0

1

0

A C

1

0

D E F

250ms 250ms

B

50ms

Channel A

Channel B

Enable

Reset

Fault Present

Output 1



If the Input Status input is not shown, it is assumed that the input status is valid (ON = 1) for the entire timingdiagram.


24/397



DCSRT – Fault and Diagnostic Codes

Table 4 - DSCRT Fault Codes and Corrective Actions

Fault Code Description Corrective Action

00H No fault. None.

2 0H The Inpu t Statu s inp ut transitioned fro m ON (1) to OFF (0) whil e the instructionwas executing.

• Check the I/O module connection or the internal logic used to sourceinput status.

• Reset the fault.

4000H Channel A and Channel B were in an inconsistent state for longer than theDiscrepancy Time. At the time of the fault, Channel A was in the active s tate.Channel B was in the safe state.

• Check the wiring.• Perform a functional test of the device

(put Channel A and Channel B in a safe state).• Reset the fault.

4001H Channel A and Channel B were in an inconsistent state for longer than theDiscrepancy Time. At the time of the fault, Channel A was in the safe state.Channel B was in the ac tive state.

4002H Channel A went to the safe state and back to the active state while Channel Bremained active.

4003H Channel B went to the safe state and back to the active state while Channel Aremained active.

Table 5 - DSCRT Diagnostic Codes and Corrective Actions

Diagnostic Code Description Corrective Action

00H No fault. None.

20H The Input Status input was OFF (0) when the instructionstarted.

Check the I/O module connection or the internal logic used to source inputstatus.

4000H The device is not in a safe state at startup. Release the start device (put Channel A and Channel B in a safe state).

4060H The device is not enabled. Enable the device (set Enable to 1).


25/397



DCSRT – Wiring and Programming Example

This example complies with ISO 13849-1, Category 4 operation. The standardcontrol portion of the application is not shown.

Figure 5 - Wiring Diagram

This programming diagram shows the instruction with inputs and test outputs.

Figure 6 - Programming Diagram

1

V

G

I0 I1

3 4

11

T0

13

T1

14

I11

24

24V DC

24V Ground

Module 1

MomentaryPush Button


(reset)

1791-DS-IB12 D e v i c e

N e t

Equivalent Active High

TBD ms

Module1:I.Pt06Data

Module1:I.Pt07Data

Input Type

Input Status

Reset

Discrepancy Time

Channel A

Channel B

Enable

Fault Present

Output 1DCSRT

MomentaryPushButton

See Note 2

Note 1: This is an internal Boolean tag that has its value determined by other parts of the user application not shown in this

example.

Note 2: This is an internal Boolean tag used by other parts of the user application not shown in this example.

Note 3: The source can be mapped or safety data.

See Note 1

Module1:I.Combined Status

See Note 3

Configuration Constant/Value

Safety Input Safety Output

Standard Output

Internal Safety Variable

Tag-mapped Variable

Key: Color code represents data or value typically used.


26/397



Figure 7 - Ladder Logic

RSLogix 5000 software is used to configure the input and output parameters of

the Guard I/O module, as illustrated.

Figure 8 - Module Definition

Rockwell Automation suggests using Exact Match, as shown. However, settingElectronic Keying to Compatible Match is allowed.

Note 1: This is an internal Boolean tag that has its value determined by other parts of the user application not shown in

this example.

O1

FP

Dual Channel Input StartDCSRT MomentaryPushButtonSafety Function START BUTTONInput Type EQUIVALENT - ACTIVE HIGHDiscrepancy Time (Msec) 500Enable SeeNote1

0Channel A Module1:I.Pt00Data1

Channel B Module1:I.Pt01Data1

Input Status Module1:I.CombinedStatus1

Reset Module1:I.Pt11Data0

DCSRT


27/397



Figure 9 - Module Input Configuration

Figure 10 - Module Test Output Configuration


28/397



Dual-channel Input Monitor(DCM)

The Dual-channel Input Monitor instruction monitors dual-input safety devicesand sets Output 1 based on the Input Type parameter and the combined state ofChannel A and Channel B.

DCM – Instruction Parameters



IMPORTANT Make sure your safety input points are configured as single, not Equivalent or

Complementary. These instructions provide all dual-channel functionality

necessary for PLd (Cat. 3) or PLe (Cat. 4) safety functions.





29/397





Table 6 - DCM Configuration Parameters


Safety Funct ion List T his parameter p rovides a tex t name for how this instruction is being used. Choices includ e cam switch, position limit switch, and

user-defined.This does not affec t instruction behavior. It is for information/documentation purposes only.


Equivalent - Active High: Inputs are in the active state when Channel A and Channel B inputs are 1.Equivalent - Active Low: Inputs are in the active state when Channel A and Channel B inputs are 0.Complementary: Inputs are in the active state when Channel A is 1 and Channel B is 0.






If this parameter is 0, the Discrepancy Time checking is disabled (0 = infinite).The valid range is 0...3000 ms.

Table 7 - DCM Inputs


Channel A(1) Boolean This input is one of the two inputs being monitored. When either input is in the safe state, Output 1 is de-energized.

Channel B(1) Boolean This input is one of the two inputs being monitored. When either input is in the safe state, Output 1 is de-energized.

Inpu t Status Boo lean If instr uction inputs are from a safety I/O mod ule, this is the status from the I/O modu le or mod ules (Co nnection Status orCombined Status). If instruction inputs are derived from internal logic, it is the application programmer’s responsibility todetermine the conditions.


Reset(2) Boolean This input clears instruction and circuit faults provided the fault condition is not present.




this logic immediately before this instruction. Rename the ‘Reset _Signal’ tag in this example to your reset signal tag name. Then use

the OSF instruction output Bit tag as the instruction’s reset source.


30/397



The following table explains instruction outputs. The outputs may be externaltags (safety output modules) or internal tags for use in other logic routines.

Table 8 - DCM Outputs


Output 1 (O1) Boolean This output is energized when the input conditions are satisfied.

The output becomes de-energized when:

• either Channel A or Channel B transitions to the safe s tate.• the Input Status input is OFF (0).

Instru ct ion Status (IS) Bool ean This output is ON (1 ) when Outpu t 1 of this instru ct ion is valid (no faults o r diagnostics are present).

Fault Present (FP) Boolean ON (1): A fault is present in the instruction.OFF (0): This instruction is operating normally.






http://-/?-http://-/?-http://-/?-


31/397



DCM – Normal Operation

The timing diagram in Figure 11 illustrates the normal monitoring of a dual-channel input with the Input Type configured as Equivalent - Active High.Output 1 is ON (1) initially because the safety inputs are in the active state. At(A), Channel A transitions to the safe state, which causes Output 1 to go to thesafe state. At (B), both of the safety inputs have transitioned to the active state, which energizes Output 1. At (C), Output 1 is de-energized and energized againat (D).

The Instruction Status output is ON (1) the entire time because no faults ordiagnostics occur.

Figure 11 - Normal Operation Timing Diagram

A B C D

1

0

1

0

1

0

1

0

Channel A

Channel B

Instruction Status

Output 1





32/397



DCM – Input Status Fault Operation

Figure 12 illustrates instruction behavior with fault conditions. At (A), Output 1turns ON (1) when the Input Status becomes valid. This also energizes Output 1because the safety inputs are in the active state. At (B), a fault is generated whenthe Input Status becomes invalid. This also turns OFF (0) the Instruction Statusoutput. At (C), the fault cannot be reset because the Input Status is still invalid.At (D), the fault is cleared when a reset is triggered with the Input Status being valid. This also turns the Instruction Status output ON (1).

Figure 12 - Input Status Fault Timing Diagram

A B C D

1

0

1

0

1

0

1

0

1

0

1

0

1

0

Channel A

Channel B

Reset

Input Status

Instructions Status

Fault Present

Output 1




33/397



DCM – Discrepancy Fault Operation

Figure 13 illustrates a discrepancy fault occurring when Channel A and ChannelB are in an inconsistent state for longer than the configured Discrepancy Time.At (A), a fault is generated when the safety inputs are in an inconsistent state forlonger than the Discrepancy Time. This also turns Output 1 OFF (0). At (B), thefault is cleared because a Reset is triggered when the safety inputs are no longer inan inconsistent state. At (C), a fault is generated when the safety inputs are againin an inconsistent state for longer than the Discrepancy Time. At (D), the fault isreset.


DCM – False Rung State Behavior

When the instruction is executed on a false rung, all instruction outputs are de-

energized.

1

0

1

0

1

0

1

0

1

0

1

0

A B C

250ms 250ms

D

Channel A

Channel B

Reset

Instruction Status

Fault Present

Output 1





34/397



DCM – Fault and Diagnostic Codes

Table 9 - DCM Fault Codes and Corrective Actions


00H No fault. None.






(put Channel A and Channel B in a safe state).• Reset the fault.




Table 10 - DCM Diagnostic Codes and Corrective Actions


00H No fault. None.

20H The Input Status input was OFF (0) when the instructionstarted.

Check the I/O module connection or the internal logic used to source inputstatus.


35/397



DCM – Wiring and Programming Example

This example complies with ISO 13849-1, Category 4 operation. The standardcontrol portion of the application is not shown.

Figure 14 - Wiring Diagram

This programming diagram shows the instruction with inputs and outputs.

Figure 15 - Programming Diagram

1

V

G

I11I0 I1

3 4 24

11

T1

14

T0

13

24V DC

24V Ground

Module 1

Cam Switch


(reset)

1791-DS-IB12

D e v i c e N e t

Equivalent Active HighTBD ms

Module1:I.Pt00DataModule1:I.Pt01Data

Input Type

Input Status

Reset

Discrepancy Time

Channel A

Channel B

Fault Present

Output 1

DCMCamSwitch

See Note 1

Note 1: This is an internal Boolean tag used by other parts of the user application not shown in t his example.

Module1:I.Combined Status

Module1:I.Pt11Data

Instruction Status

Configuration Constant/Value

Safety Input Safety Output

Standard Output

Internal Safety Variable

Tag-mapped Variable

Key: Color code represents data or value typically used.


36/397



Figure 16 - Ladder Logic

RSLogix 5000 software is used to configure the input and output parameters ofthe Guard I/O module, as illustrated.

Figure 17 - Module Definition

Rockwell Automation suggests using Exact Match, as shown. However, settingElectronic Keying to Compatible Match is allowed.

O1

IS

FP

Dual Channel Input Monitor DCM CamSwitchSafety Function CAM SWITCHInput Type EQUIVALENT - ACTIVE HIGHDiscrepancy Time (Msec) 500Channel A Module1:I.Pt00Data

1Channel B Module1:I.Pt01Data1

Input Status Module1:I.CombinedStatus1

Reset Module1:I.Pt11Data0

DCM


37/397



Figure 18 - Module Input Configuration

Figure 19 - Module Test Output Configuration


38/397



Dual-channel Input Stop(DCS)

The Dual-channel Input Stop instruction monitors dual-input safety devices whose main function is to stop a machine safely, for example, an E-stop, light

curtain, or safety gate. This instruction can only energize Output 1 when bothsafety inputs, Channel A and Channel B, are in the active state as determined bythe Input type parameter, and the correct reset actions are carried out.

DCS – Instruction Parameters



IMPORTANT Make sure your safety input points are configured as single, not Equivalent or

Complementary. These instructions provide all dual-channel functionalitynecessary for PLd (Cat. 3) or PLe (Cat. 4) safety functions.





39/397




Table 11 - DCS Configuration Parameters


Safety Funct ion List This parameter provides a tex t name for ho w this instruction is being used. Choices includ e E -sto p, safety gate, light cur tain, area

scanner, safety mat, cable (rope) pull switch, and user-defined.This does not affec t instruction behavior. It is for information/documentation purposes only.


Equivalent - Active High: Inputs are in the active state when Channel A and Channel B inputs are 1.Complementary: Inputs are in the active state when Channel A is 1 and Channel B is 0.





• Channel A = 0 and Channel B = 0

• Channel A = 1 and Channel B = 1The valid range is 5...3000 ms.

Restart Type List This input configures Output 1 for either Manual or Automatic Restart.

Manual A transition of the Reset input from OFF (0) to ON (1), while all of the Output1 enabling conditions aremet, is required to energize Output 1.

Automatic Output 1 is energized 50 ms after all of the enabling conditions are met.

ATTENTION: Automatic Restart may be used only in application situations where you can prove

that no unsafe conditions can occur as a result of its use, or the reset function is being performed

elsewhere in the safety circuit (for example, output function).

Cold Star t Type Lis t This para meter specifies the Output 1 behavior when applying controller power or mode change to Run.

Manual Output 1 is not energized when the Input Status becomes valid or when the Input Status fault is cleared.

(The device must be tested before Output 1 can be energized.)Automatic Output 1 is energized immediately when the Input Status becomes valid or when the Input Status fault is

cleared and both inputs are in their active state.

!


40/397




The following table explains instruction outputs. The outputs may be externaltags (safety output modules) or internal tags for use in other logic routines.

Table 12 - DCS Inputs


Channel A(1) Boolean This is one of the two safety inputs to the instruction.

Channel B(1) Boolean This is one of the two safety inputs to the instruction.

Input Status Boo lean If instr uction inputs are from a safety I/O mod ule, this is the status from the I/O modu le or modu les (Connect ion Status orCombined Status). If instruction inputs are derived from internal logic, it is the application programmer’s responsibility todetermine the conditions.


Reset(2) Boolean If Restart Type = Manual, this input is used to energize Output 1 once Channel A and Channel B are both in the active state.If Restart Type = Automatic, this input is not used to energize Output 1.

This input clears instruction and circuit faults provided the fault condition is not present.




this logic immediately before this instruction. Rename the ‘Reset_Signal’ tag in this example to your reset signal tag name. Then usethe OSF instruction Output Bit tag as the instruction’s reset source.

Table 13 - DCS Outputs


Output 1 (O1) Boolean The output is energized when the input conditions are satisfied.

The output becomes de-energized when the following occurs:

• Either Channel A or Channel B transitions to the safe state.• The Input Status input is OFF (0).

Fault Preset (FP) Boolean ON (1): A fault is present in the instruction.OFF (0): This instruction is operating normally.






http://-/?-http://-/?-http://-/?-


41/397



DCS – Normal Operation

The timing diagram in Figure 20 illustrates normal operation with Restart Typeconfigured for Manual and Cold Start Type configured for Manual. At (A),Output 1 will not be energized because the safety inputs have not been throughthe safe state (0 in this case). At (B), Output 1 is energized because the safetyinputs have been cycled through the safe state and are in the active state when thereset is triggered. At (C), Output 1 is de-energized because one of the safetyinputs (Channel A) has transitioned to a safe state. At (D), Output 1 is onceagain energized when a reset is triggered with both safety inputs in the activestate.

Figure 20 - Normal Operation (Manual Restart, Manual Cold Start) Timing Diagram

1

0

1

0

1

0

1

0

A B C D

Channel A

Channel B

Reset

Output 1


Cold Start Type = ManualDiscrepancy Time = 250 ms

Restart Type = Manual



42/397



Figure 21 demonstrates the same behavior as in the previous timing diagramexcept that the Input Type is Complementary.

Figure 21 - Normal Operation (Manual Restart, Manual Cold Start, Complementary) TimingDiagram

1

0

1

0

1

0

1

0

A B C D

Channel A

Channel B

Reset

Output 1

Input Type = Complementary

Cold Start Type = Manual





43/397



Figure 22 illustrates normal operation with Cold Start Type configured forAutomatic. When Cold Start Type is Automatic, Output 1 will be energized assoon as the Input Status becomes valid [OFF (0) to ON (1) transition] for thefirst time, such as when power is applied to a PLC controller. At (A), Output 1 isenergized when the Input Status becomes valid with the safety inputs in theactive state. At (B), Output 1 is de-energized when one of the safety inputs

transitions to the safe state. Output 1 will not be energized again until (C), whenthe reset is triggered with the safety inputs in the active state.

The Automatic Cold Start only has effect the first time the Input Status becomes valid.

Figure 22 - Normal Operation (Manual Restart, Automatic Cold Start) Timing Diagram

1

0

1

0

1

0

1

0

A B C

1

0

Channel A

Channel B

Reset

Input Status

Output 1


Cold Start Type = Automatic




44/397



Figure 23 illustrates normal operation with Automatic Restart and Manual ColdStart. Because Cold Start Type is Manual, both safety inputs must go through thesafe state before Output 1 can be energized. At (A), Output 1 is energizedautomatically 50 ms after the safety inputs transition to the active state (1 in thiscase). At (B), Output 1 is de-energized when one of the safety inputs transitionsto the safe state. At (C), Output 1 is automatically energized 50 ms after both

safety inputs transition back to the active state.

Figure 23 - Normal Operation (Automatic Restart, Manual Cold Start)Timing Diagram

1

0

1

0

1

0

A B C

50 ms 50 ms




Restart Type = Automatic

Channel A

Channel B

Output 1

If the Input Status input is not shown, it i s assumed that the input status is valid (ON = 1) for the entire timingdiagram.

There is always a 50 ms delay before energizing Output 1 when it is configured to be energized automatically(Restart Type = Automatic).


45/397


46/397



DCS – Input Status Fault (Manual Cold Start)

The timing diagram in Figure 25 illustrates a fault occurring when the InputStatus becomes invalid. When Cold Start Type is configured for Manual, thesafety inputs must go through the safe state after a fault has been cleared. At (A),Output 1 is energized when a reset is triggered with the safety inputs in the activestate. At (B), a fault occurs because the Input Status becomes invalid, which de-energizes Output 1. At (C), the fault cannot be cleared because the Input Status isstill invalid. At (D), the fault is cleared, but Output 1 cannot yet be energizedbecause the safety inputs must transition through the safe state when Cold StartType is Manual. At (E), the safety inputs have gone through the safe state. At (F),Output 1 is once again energized when the reset is triggered.

Figure 25 - Input Status Fault (Manual Cold Star t) Timing Diagram

1

0

1

0

1

0

1

0

1

0

1

0

A B C D E F





Channel A

Channel B

Reset

Input Status

Output 1

Fault Present


47/397



Figure 26 illustrates a fault occurring when the Input Status becomes invalid. When Cold Start Type is configured for Automatic, the safety inputs are notrequired to go through the safe state after a fault has been cleared. At (A), Output1 is energized when the Input Status becomes valid because the Cold Start Type isAutomatic. At (B), a fault occurs because the Input Status becomes invalid, whichde-energizes Output 1. At (C), the fault cannot be cleared because the Input

Status is still invalid. At (D), the fault is cleared because the Input Status is validand a reset occurred. Output 1 is then energized because the Cold Start Type isAutomatic.

It is not necessary for the Safety Inputs to go through the safe state after an InputStatus fault is cleared when the Cold Start Type is Automatic.

Figure 26 - Input Status Fault (Automatic Cold Start) Timing Diagram

1

0

1

0

1

0

1

0

1

0

1

0

A B C D


Cold Start Type = Automatic



Channel A

Channel B

Reset

Input Status

Output 1

Fault Present

If the Input Status input is not shown, it is assumed that the input status is valid (=1) for the entire timing diagram.


48/397



DCS – Cycle Inputs Fault

Figure 27 illustrates one of the two safety inputs transitioning to the safe stateand back to the active state while Output 1 is energized. At (A), Output 1 isenergized in the normal way. At (B), Channel A transitions to the safe state, which immediately de-energizes Output 1. At (C), Channel A transitions back tothe active state before the 250 ms Discrepancy Time causes a fault. At (D),Output 1 is energized because the safety inputs have cycled through the safe state,and a reset has been triggered.

Figure 27 - Cycle Inputs Fault Timing Diagram

1

0

1

0

1

0

1

0

1

0

A B C D


Cold Start Type = ManualDiscrepancy Time = 250 ms


Channel A

Channel B

Reset

Fault Present

Output 1



49/397



DCS – Discrepancy Fault

Figure 28 illustrates a fault occurring when Channel A and Channel B are in aninconsistent state for longer than the configured Discrepancy Time. At (A), aDiscrepancy fault occurs because Channel A has been in the active state andChannel B has been in the safe state for 250 ms (Discrepancy Time). At (B), thefault is reset, but Output 1 is not energized because the safety inputs must cyclethrough the safe state after a Discrepancy fault is cleared, in order to energizeOutput 1. At (C), Output 1 is energized because the safety inputs havetransitioned through the safe state and a reset has been triggered. At (D), anotherDiscrepancy fault occurs when the safety inputs are again in an inconsistent statefor longer than 250 ms.


DCS – False Rung State Behavior

When the instruction is executed on a false rung, all instruction outputs are de-energized.

1

0

1

0

1

0

1

0

A C

1

0

D

250ms

B

250ms





Channel A

Channel B

Reset

Fault Present

Output 1

If the Input Status input is not shown, it i s assumed that the input status is valid (ON = 1) for the entire timing diagram.


50/397



DCS – Fault and Diagnostic Codes

Table 14 - DCS Fault Codes and Corrective Actions


00H No fault. None.






(bring Channel A and Channel B to the safe state).• Reset the fault.




Table 15 - DCS Diagnostic Codes and Corrective Actions


00H No fault. None.

05H The Reset input is held ON (1). Set the Reset input to OFF (0).

20H The Input Status input was OFF (0) when the instructi

guardlogix safety application instruction set

Documents