PSC-FB Library-Manual V1 1

Programmable Small Safety PLC
PROTECT-PSC
Safety Function Blocks
Table of contents
Table of contents (1)
Linke
d
1 General
2 Safety information
3Protected ELAN functional modules within

the PROTECT-PSCsw library function
4
2.1
Hardware
2.2
Software
2.3
Features of the PROTECT-PSCsw
3.0.1 True_False FB (to generate a safe 1 and a safe 0)
3.0.2 Description of the True_False auxiliary function block
3.1
Emergency Stop FB
3.1.1
Application
3.1.2 Features
3.1.3 Description of inputs/outputs
3.1.4 Connection example
3.1.5 Example program
3.2
Guard Locking FB
11
3.2.1 Application
11
3.2.2 Features
11
11
12
13
3.3

Guard Locking FB
(guard monitoring with spring force interlocking device)
15
3.3.1 Application
15
3.3.2 Features
15
15
17
18
3.4
Enable Switch FB
19
3.4.1 Application
19
3.4.2 Features
19
19
3.4.4 Connection example 1
21
3.4.5 Example program 1
22
23
24
3.5
Two Hand Control FB
3.5.1 Application
25
25
3.5.2 Features
25
26
27
28
29
30
Description of Safety Function Blocks PROTECT-PSC | Version 1.1
Table of contents
Table of contents (2)
Linke
d
3Protected ELAN functional modules within
the PROTECT-PSCsw library function
(continued)
3.6
Sequential Muting FB
31
3.6.1 Application
31
3.6.2 Features
31
3.6.3 Process of sequential muting
31
32
34
35
3.7
Parallel Muting FB
37
3.7.1
Application
37
3.7.2 Features
37
3.7.3 Process of parallel muting
37
38
39
40
3.8
Flip-Flop FBs
41
3.8.1 Application
41
3.8.2 Features
41
42
44
45
46
47
3.9
Turn off delay R FB (drop off delayed, retriggerable)
48
3.9.1 Application
48
3.9.2 Features
48
48
49
50
3.10
Turn off delay NR FB (drop off delayed, not retriggerable)
51
3.10.1 Application
51
3.10.2 Features
51
51
52
53
General
1 General
The functional blocks described in this document (also referred to below as FB or FBs)
are deployed in the library function of the
PROTECT-PSCsw programming software
used to program the PROTECT-PSC safety
control system in operating mode 3.
A precise description of the PROTECT-PSC
safety control system, the PROTECT-PSCsw
programming software and incorporation
of the library function into this software can
be found in the PROTECT-PSC instruction
manual.
Safety information
2 Safety information
Use of the FBs does not release the user

from the need to perform a careful safety
check of the overall program. All subfunctions realised using the FBs should in
particular be inspected for safety-critical
effects in the overall program.
2.1 Hardware
The safety of the entire application depends
on the selection and wiring of hardware
components (e.g. emergency stop control
devices, guard monitoring etc.), as has been
determined in line with the risk assessment
in accordance with EN ISO 13849-1 or EN
IEC 62061.
The minimum pulse duration for safe detection of the input signal is 15 ms.
With two-channelled input/output wiring,
the PROTECT-PSC safety control system by
itself (without the upstream sensor technology and downstream actuating elements)
satisfies all requirements of Performance
Level (PL) e in accordance with EN ISO
13849-1 or SIL 3 in accordance with EN IEC
62061. More details of this can be found in
the PROTECT-PSC instruction manual.
Caution: If a safety-critical setting has

been performed on an FB, for example no
monitoring of the feedback loop (deselect
EDM), auto reset or start reset, a procedure
must be performed at a different point in
the overall programme in order to prevent a
faulty or unexpected restart or to achieve a
higher PL or SIL.
2.2 Software
All FBs described below support the programmer of the PROTECT-PSCsw programming software to prepare a program for the
PROTECT-PSC safety control system that
satisfies the requirements of Performance
Level e in accordance with EN ISO 13849-1
or SIL 3 in accordance with EN IEC 62061.
NB: All FBs serve to support the creation of
a program. The functions programmed in the
FBs are based on the ladder diagram (LD)
graphic programming language in accordance with EN IEC 61131-3 and can also be
individually replicated in PROTECT-PSCsw
using discrete LD programming. The FBs
represent just one possibility for creating the
function described.
The programmer himself must bring about
additional constraints within the overall program. An example here is the incorporation
of the feedback loop as an additional RESET
condition (or for the auto reset condition).
All functional modules from the Elan PSC
Library are protected, i.e. they cannot be
changed by the programmer. Protected FBs
are labelled protected or geschtzt (in
a German programming environment) and
have date and seal identifier (checksum).
The programmer has the possibility starting
from software version PROTECT-PSCsw
V1.2R01 to protect the FBs he has created
himself using a password. This is done by
selecting and actuating the Settings for
FB protection button from the Properties
screen after the FB has been saved and then
entering a name and password in the Setting FB protection screen (see Figure 2-1).
2.3 Features of the PROTECT-PSCsw
Due to the special programming structure
of PROTECT-PSCsw, the inputs, outputs
or flags used are evaluated with respect to
safety and labelled with an S (assessed
as safe) or U (assessed as unsafe). This
labelling is primarily based on the assessment of the input signals which are only assessed to be safe if they represent a safe
1 or safe 0.
Fig. 2-1: Screens to protect own created FBs

with a password.
The significance of a safe or an unsafe

contact is set out in Chapter 7.10.4 of the
PROTECT-PSC instruction manual.
NB: The True_False FB can be used to
generate a safe 1 or safe 0. This generates
a safe 1 and a safe 0 on its outputs if the
input is wired with a safe contact. The safe
1 and safe 0 output signals generated can
be used as flags in the rest of the program.
See chapter 3.0.1 and also the example
programs provided in the following chapters
in this respect.
Protected Elan functional modules within the PROTECT-PSCsw library function
Protected ELAN functional modules

within the PROTECT-PSCsw library function
3.0.1 True_False FB (to generate a

safe 1 and a safe 0)
(Name of FB in the Elan Library:
True_False in the Auxiliary directory;
seal ID: 3D89)
3.02 Description of the True_False auxiliary function block
As described in Chapter 2.3, input or

output signals from PROTECT-PSCsw are
evaluated with respect to their safety. All
functional modules described in Chapter 3
are designed such that safe signals can be
expected on their inputs to prevent outputs
assessed as unsafe that are marked with a
U (red, and thereafter in yellow).
According to the rules in Chapter 7.10.4
of the PROTECT-PSC instruction manual,
the True_False auxiliary function block is
structured so that a safe 1 (or safe high
signal) is generated on the OUT1 output or
a safe 0 (or safe low signal) on the OUT2
output from a safe input signal (e.g. standard
A-contact of an emergency stop control device) on the IN1 input. Usually the outputs
are laid on flags in order to use them as safe
input signals for the desired function on the
FB.
Fig. 3-1: True_False FB

Input/output
Name
Description
IN1
Safe input signal; e.g. A-contact (| |)
OUT1
Output safe 1:
On flag; for further use
OUT2
Output safe 0:
On flag; for further use
Tab. 3-1: Description of I/O of True_False FB
The True_False FB precedes the respective safe FBs in the programming examples
in Chapter 3.1 to 3.7.
3.1 Emergency Stop FB (1)

(Name of FB in the Elan Library: EmergencyStop; seal ID: 5236)
3.1.1 Application
The Emergency Stop FB is used to monitor
emergency stop control devices.
3.1.3 Description of Emergency Stop FB inputs/outputs
Emergency stop control devices are generally incorporated in the safety circuit of
a machine or system and have special
significance as part of the machine and
system control. The safe function and rapid
accessibility of emergency stop control
devices can have a crucial effect on the lives
of people and the degree of personal injury
in the event of a disturbance or accident
or on the extent of damage to a machine in
case of a fault.
New requirements apply to the operating
mode of these control devices with the
coming into force of the new harmonised
European standard EN ISO 13850 on functional aspects and principles for design for
emergency stop equipment.
All emergency stop control devices from
SCHMERSAL or ELAN satisfy the requirements of this standard. The Emergency
Stop FB described in this chapter helps
to implement these requirements into the
PROTECT-PSC safety control system.
Caution: The possibility for programming

the Emergency Stop FB in a function that
contradicts the requirements of EN ISO
13850 (e.g. without feedback loop) may only
be applied if the overall function is executed
as stipulated by the standard mentioned at a
different point of the program.
3.1.2 Features
The Emergency Stop FB has been created
on the basis of programming guidelines from
PLCopen, the organisation for the industrial
control technology field. This programming
structure is described in Chapter 6.4 Emergency Stop of the document PLCopen
Technical Committee 5 Safety Software
Technical Specification, Part 1: Concepts
and Function Blocks dated 31.01.2006.
Fig. 3-2: Emergency Stop FB

Input/output
Name
Description
IN1
S_EStopIn
Safety request:
TRUE: emergency stop not actuated
FALSE: emergency stop actuated
IN2
S_StartReset
Power on reset:
TRUE: emergency stop not actuated
FALSE: emergency stop actuated
IN3
S_AutoReset
Automatic reset:
TRUE: automatic reset (input IN4 without function)
FALSE: manual reset (input IN4 active)
IN4
Reset
Reset:
TRUE: with edge change low high
Otherwise false
OUT1
S_EStopOut
Safety enabling output:

TRUE: safety output cleared
FALSE: safety output blocked
OUT2
Error
Error message:
TRUE: error (error reset function)
FALSE: no error (reset function OK)
Tab. 3-2: Description of I/Os of Emergency Stop FB

3.1.4 Connection example: Emergency stop with monitored reset (rising or falling
edge)
Description
An emergency stop control device and a reset button are connected to the PROTECTPSC-CPU-MON module as shown.
Desired function: Emergency stop with
monitored reset with
a) rising edge (see example program 1) or
b) trailing edge (see example program 2)
After a program start or after resetting the
emergency stop control device, the condition (referred to in subsequent example
programs as M0000 flag) required to
continue the overall program is provided a)
by actuating or b) by releasing the reset button. The M000 flag is therefore integrated
in the overall program accordingly.
Fig. 3-3: Connection of PSC-CPU-MON for example programs 3.1.5

3.1.5 Example programs (1)
3.1.5 Example programs

a) Emergency stop with monitored reset (rising edge, see 3.1.4) through integration of the Emergency stop FB in the ladder
diagram of the PROTECT-PSCsw
View of programming environment
Comment
Link to library takes place
Program start
Wiring of the True_False functional module:

Generation of a safe 1 (here: M7F1) to OUT1 and a safe 0
(here: M7F0) to OUT2 with the help of a safe input contact (here:
I000 and I001) to IN1. The True_False FB from the Auxiliary
folder is used for this.
Wiring of the Emergency Stop function block:

IN1: Connection for the contacts to be monitored; here: twochannelled monitoring of the emergency stop contacts with the
addresses I000 and I001.
IN2: Possibility of automatic restart after switching on if IN2 is
wired with safe 1. If this is not desired, wire with safe 0.
IN3: If automatic reset is desired, wire with safe 1, otherwise
safe 0.
IN4: If reset with rising edge is desired, link IN4 with the address
of the reset switch (here: I007). Otherwise wire with safe 0.
OUT1: Safe output
Addressed output or flag (here: M000) is TRUE where the selected input function (IN1 IN4) is TRUE.
OUT2: Error report
Addressed output or flag (here: M001) is TRUE where the selected input function (IN1 IN4) is faulty.
End of program
Fig. 3-4: PROTECT-PSCsw programming environment example program a: True_False and Emergency Stop FBs

b) Emergency stop with monitored reset (trailing edge, see 3.1.4) through integration of the Emergency Stop function block in
the ladder diagram of the PROTECT PSCsw
View of programming environment
Comment
Program start

Wiring of the Emergency Stop function block:

IN1: Connection for the contacts to be monitored; here: twochannelled monitoring of the emergency stop contacts with the
addresses I000 and I001.
wired with safe 1. If this is not desired, wire with safe 0.
safe 0.
IN4: If reset with trailing edge is desired, link IN4 with the address
of the reset switch (here: I007) and pointer F6 (here: P000). Otherwise wire with safe 0.
OUT1: Safe output
Addressed output or flag (here: M000) is TRUE where the selected input function (IN1 IN4) is TRUE.
OUT2: Error report
Addressed output or flag (here: M001) is TRUE where the selected input function (IN1 IN4) is faulty (when programming to
trailing edge without function).
End of program
Fig. 3-5: PROTECT-PSCsw programming environment example program b: True_False and Emergency Stop FBs
10
3.2 Guard Monitoring FB (1)

(Name of FB in the Elan Library: GuardMonitoring; seal ID: B73D)
3.2.1 Application
The Guard Monitoring FB is used during
the monitoring of guards that are secured by
safety switching elements such as position
switches with fixed or separate actuators,
AOPDs (safety light barriers, safety light
curtains, safety laser scanners) and tactile
safety equipment such as safety edges,
safety mats etc.
3.2.3 Description of Guard Monitoring FB inputs/outputs
NB: Physical suitability in connection with

the PROTECT-PSC safety control system is
the prerequisite for connecting the above
mentioned safety switching elements. Application-related features, in particular requirements of standards for specific products
(the so-called C standards) are not taken
into consideration in this documentation.
3.2.2 Features
The Guard Monitoring FB has been created on the basis of programming guidelines
from PLCopen, the organisation for the
industrial control technology field. This programming structure is described in Chapter 6.8 Safety Guard Monitoring of the
document PLCopen Technical Committee
5 Safety Software Technical Specification, Part 1: Concepts and Function Blocks
dated 31.01.2006.
Fig. 3-6: GuardMonitoring FB

Input/output
Name
Description
IN1
G_SW_1
Safety requirement 1:
TRUE: 1st contact guard monitoring closed
FALSE: 1st contact guard monitoring not closed
IN2
G_SW_2
Safety requirement 2
TRUE: 2nd contact guard monitoring closed
FALSE: 2nd contact guard monitoring not closed
NB: In the case of single channelled monitoring IN2 and
IN3 are wired to the same contact.
IN3
Auto_ Res
Automatic reset:
FALSE: manual reset (input IN5 active)
IN4
Start_Res
Power on reset:
TRUE: reset after power on (autostart after power on)
FALSE: no reset after power on (reset must be actuated
after power on)
IN5
Reset
Reset:
TRUE: during edge change low high;
Otherwise FALSE
OUT1
G_Monitor
FB OK; state of guard monitoring:

TRUE: safe state
FALSE: guard door open or no reset
OUT2
Error
Error report:
TRUE: fault reset function or time window IN1, IN2 >5s
FALSE: no error
Tab. 3-3: Description of I/Os of GuardMonitoring FB
11

3.2.4 Connection example: Guard monitoring with monitored reset (rising edge) or
with autoreset
Description
Guard monitoring contacts and a reset
button are connected to the PROTECT-PSCCPU-MON module as shown.
Desired function: Guard monitoring with
a) monitored reset with rising edge (see
example program 1) or
b) autostart, without reset button (see example program 2)
After a program start or following resetting
of guard monitoring, the condition (referred
to in subsequent example programs as
M0000 flag) required to continue the overall program is provided a) by actuating the
reset button or b) without the reset button.
The M000 flag is therefore integrated in
the overall program accordingly.
Fig. 3-7: Connection of PSC-CPU-MON for example programs 3.2.5
12

3.2.5 Example programs

a) Guard monitoring with monitored reset (rising edge, see 3.2.4) through integration of the Guard Monitoring function block in
View of the programming environment
Comment
Program start

I000) to IN1. The True_False FB from the Auxiliary folder is
used for this.
Wiring of the Guard Monitoring function block:

IN1: Connection for the first contact to be monitored; here: single
channelled monitoring of the contact with the address I000.
IN2: Connection for the second contact to be monitored; here:
single channelled monitoring of the contact with the address I001.
safe 0.
wired with safe 1. If not desired, wire with safe 0.
of the reset button (here: I007). Otherwise wire with safe 0.
OUT1: Safe output
Addressed output or flag (here: M000) is TRUE where the selected input function (IN1, IN2 + reset condition) is TRUE.
OUT2: Error report
Addressed output or flag (here M001) is TRUE where the selected
reset condition is faulty or the time window IN1, IN2 >5s
End of program
Fig. 3-8: PROTECT-PSCsw programming environment example program a: True_False and GuardMonitoring FBs
13

b) Guard monitoring with automatic reset (see 3.2.4) through integration of the Guard Monitoring function block in the ladder
diagram of the PROTECT PSCsw
Comment
Program start
Wiring of the True_False function block:

used for this.
Wiring of the Guard Monitoring function block:

IN1: Connection for the first contact to be monitored; here: single
channelled monitoring of the contact with the address I000.
IN2: Connection for the second contact to be monitored; here:
safe 0.
wired with safe 1. If not desired, wire with safe 0.
of the reset switch. Here automatic reset desired, therefore wired
with safe 0 (M7F0).
OUT1: Safe output
Addressed output or flag (here: M000) is TRUE where the selected input function (IN1, IN2 + reset condition) is TRUE.
OUT2: Error report
Addressed output or flag (here: M001) is TRUE where the selected reset condition is faulty or the time window IN1, IN2 >5s
End of program
Fig. 3-9: PROTECT-PSCsw programming environment example program b: True_False and GuardMonitoring FBs
14
3.3 Guard Locking FB

(guard monitoring with spring force interlocking device) (1)

(Name of FB in the Elan Library: GuardLocking; seal ID: 3D4E)
3.3.1 Application
The Guard Locking FB is used during the
monitoring of interlocking devices on guards
that are locked with spring force and opened
by feeding current to the solenoid coil.
3.3.3 Description of Guard Locking FB inputs/outputs (1)
NB:
a) For the monitoring of interlocking devices
at guard doors which are locked using
magnetic force the GuardLocking FB
can be used, too. In this case the signal
OUT2 must be inverted. In fault case the
guard is unlocked
b) Physical suitability in connection with the
PROTECT-PSC safety control system is
the prerequisite for connecting the abovementioned safety switching elements.
Application-related features, in particular
requirements of standards for specific
products (the so-called C standards) are
not taken into consideration in this documentation.
3.3.2 Features
The Guard Locking FB has been created
control technology field. This programming structure is described in Chapter 6.12
Safety Guard Interlocking with locking
of the document PLCopen Technical
Committee 5 Safety Software Technical
Specification, Part 1: Concepts and Function
Blocks dated 31.01.2006.
Fig. 3-10: Guard Locking FB (associated table see next page)
15


3.3.3 Description of Guard Locking FB inputs/outputs (2)

Input/output
Name
Description
IN1
S_Active
Safety in hazard area:

TRUE: current may be fed to magnet (OUT2)
FALSE: no feeding of current to magnet permitted
IN2
G_Monitor
Monitoring of actuator:
TRUE: guard closed
FALSE: guard not closed
IN3
G_Lock
Monitoring of magnet:
TRUE: magnet contact locked
FALSE: magnet contact unlocked
IN4
Reset
Reset:
FALSE TRUE: reset (>OUT1)
IN5
Unlock_R
Request unlocking:
TRUE: unlocking requested
FALSE: no unlocking requested
NB: During IN5 = TRUE IN1 must be TRUE.
IN6
Start_Res
Power-On reset:
TRUE: reset after power on (Autostart after Power on)
FALSE: no reset after power on (reset IN4 must be actuated after power on)
IN7
Auto_Res
Automatic reset:
FALSE: manual reset (input IN4 with function)
OUT1
Locked
(safe signal for further
processing)
FB OK; condition for IN5 (current may be fed to magnet):

TRUE: guard door and magnet contact closed, magnet not powered
FALSE: no >Unlocked (OUT2) possible
OUT2
Unlocked
Current fed to solenoid coil:

TRUE: power to magnet
FALSE: power not to magnet
OUT3
Error
Error:
TRUE: error (fault: reset function)
FALSE: no error (reset function OK)
Tab. 3-4: Description of I/Os of Guard Locking FB
16


3.3.4 Connection example: Monitoring and driving of a spring force interlocking

device
Description
The connecting contacts of a spring force
interlocking device (actuator contact, magnet contact, control coil), button to request
unlocking and a contact for an additional
condition for unlocking are connected to
the PROTECT-PSC-CPU-MON module as
shown.
Desired function: monitoring of actuator
and magnet contacts and unlocking of the
actuator.
Monitoring of the actuator and magnet contacts must take place immediately when the
program starts. The unlocking of the guard
is only possible if a further condition has
been satisfied (e.g. signal motor zero speed).
Fig. 3-11: Connection of PSC-CPU-MON for example program 3.3.5
17


3.3.5 Example program: Guard monitoring with automatic reset (see 3.3.4) through integration of the Guard Locking function
block in the ladder diagram of the PROTECT PSCsw
Comment
Program start

used for this.
Wiring of the Guard Locking function block:

IN1: Connection for the Additional condition; entry to danger
zone permitted contact; here: contact with address I004.
IN2: Connection for the actuator contact to be monitored; here:
single channelled monitoring of monitoring contact with the address I000.
IN3: Connection for the magnet contact to be monitored; here:
IN4: If reset with rising edge to activate OUT1 is desired, assign
IN4 to the address of the reset switch. Otherwise wire with safe
0 (recommended).
IN5: Connecting contact for the Unlock button; here: address
I007.
IN6: If immediate activation of OUT1 is desired after Power on,
wire with safe 1 (recommended).
IN7: If immediate activation from OUT1 is desired after opening
and closing the actuator contact, wire with safe 1, otherwise
with safe 0.
OUT1: Output Locked; Unlock possible
NB: Output (here: M000) for further use; output high where the
contacts to be monitored + reset (or auto reset) OK
OUT2: Control of solenoid coil
OUT3: Error; input condition error
End of program
Fig. 3-12: Programming environment PROTECT-PSCsw example program: True_False and GuardLocking FBs
18
3.4 Enable Switch FB (1)

(Name of FB in the Elan Library: EnableSwitch; seal ID: 831D)
3.4.1 Application
The Enable Switch FB is used for monitoring a three-step enable switch which is not
actuated in Position (Pos) 1, is in mid-position in Pos2 and is pressed down completely
in Pos3. Enabling mode should be effected
when Pos2 is pressed. Pos3 of the enable
switch initiates a shutdown of the function,
which, depending on the selected condition,
either is resetted manually by pressing the
reset button or automatically.
3.4.3 Description of Enable Switch FB inputs/outputs
It is also possible to use this FB to monitor a

two-step enable switch in which case Pos3
is disregarded.
Enable switches are used, possibly in conjunction with other safety-related measures,
to protect people from potentially hazardous states, where the effect of protective
devices must be partially or completely
suspended during special operating modes
of a machine.
These typically include the setting up of a
machine, servicing work or the observation
of work processes, the so-called process
observation. If the operator releases the
button or presses it down beyond the midposition, the control command is interrupted
for safety reasons.
Fig. 3-13: EnableSwitch FB (associated table see next page)
NB: Physical suitability in connection with

the PROTECT-PSC safety control system is
the prerequisite for connecting the enable
switch. Application-related features, in particular requirements of standards for specific
products (the so-called C standards) are not
taken into consideration in this documentation
3.4.2 Features
The Enable Switch FB has been created
control technology field. This programming
structure is described in Chapter 6.17 Enable Switch of the document PLCopen
Technical Committee 5 Safety Software
Technical Specification, Part 1: Concepts
and Function Blocks dated 31.01.2006.
19

3.4.3 Description of Enable Switch FB inputs/outputs (2)

Input/output
Name
Description
IN1
S_Active
Safety in the hazard area:

TRUE: enabling mode permitted.
FALSE: enabling mode not permitted.
IN2
S_EnabSw1
Monitoring of NO contact (Pos2) of enable switch:

TRUE: enable switch in Pos2
FALSE: enable switch not in Pos2
IN3
S_EnabSw2
Monitoring of NC contact (Pos1 + 2) of enable switch:

TRUE: enable switch in Pos1 or 2
FALSE: enable switch not in Pos1 or 2
IN4
S_AutoRes
Auto reset; after switching enable switch Pos3 Pos2 Pos1 or Pos2 after power on;
further operation without actuation of reset switch:
TRUE: auto reset
False: no auto reset
IN5
Reset
Reset; after switching enable switch Pos3 Pos2 Pos1 or Pos2 after power on;
further operation only after actuating the reset switch:
FALSE TRUE: reset
OUT1
S_Enable
(safe signal for further
processing)
Enable switch Pos2; FB OK:

TRUE: enable switch Pos2 and reset condition OK
FALSE: enable switch not Pos2 or reset condition has not been satisfied.
OUT2
ErrorOut
Enable switch Pos2; FB not OK:

TRUE: switch Pos3 Pos2 or Pos2 after power on at enable switch
NB: Position of switch Pos2 must send signal for at least 15 ms (observe the specification of the manufacturer).
FALSE: reset condition not OK
Tab. 3-5: Description of I/Os of Enable Switch FB
20

3.4.4 Connection example 1: Monitoring of a three-step enable switch with NC-NO

contacts
Description
The connecting contacts of a three-step
enable switch with NC-NO contacts, a reset
button and an additional condition (e.g. contact of operating mode selector switch) are
connected to the PROTECT-PSC-CPU-MON
module as shown.
The 3-step enable switch (e.g. ZSD1, ZSD2,
DTAN from SCHMERSAL/ELAN) has the following positions (Pos):
Pos1 (not actuated): NC contact closed
and NO contact open;
Pos2 (middle position): NC contact closed
and NO contact closed;
Pos3 (pushed down): NC contact open
and NO contact closed
Desired functions:
Additional condition (operating mode
selector switch): enabling mode is only
possible when the corresponding operating mode is selected.
Enabling mode: the enable switch is
switched from Pos1 to Pos2 after program
start. Enabling mode can then be implemented.
Error: Enable switch is switched from Pos3
to Pos2 or is on Pos2 when the program
starts. Enabling mode is not possible.
Reset: resetting the error. Enabling mode
can then be implemented again.
21

3.4.5 Example program 1: Enabling mode with 3-step enable switch (NC/NO contacts), additional condition (operating mode selector switch) and reset button (see 3.4.4) through integration of the Enable Switch function block in the ladder diagram of the
PROTECT PSCsw
Comment
Program start

Generation of a safe 1 (here: M7F1) to OUT1 and a safe 0 (here:
M7F0) to OUT2 with the help of a safe input contact (here: I000) to
IN1. The True_False FB from the Auxiliary folder is used for this.
Wiring of the Enable Switch function block:

IN1: Connection for the additional condition contact; e.g. operating mode selector switch, here: contact with address I004.
IN2: Connection for the NO contact to be monitored on the enable switch; here: contact with address I001.
IN3: Connection for the NC contact to be monitored on the enable switch; here: contact with address I000.
IN4: If auto reset after error (see OUT2) is desired, wire IN4 with
safe 1, otherwise with safe 0.
IN5: If reset with rising edge to reset error (see OUT2) is desired,
link IN5 with the address of the reset switch. Otherwise wire with
safe 0.
OUT1: Output S_Enable; enabling mode OK output (here: M000)
for further use.
OUT2: Error enabling mode not desired; either enable switch
moved from Pos3 to Pos2 or enable switch in Pos2 when program starts.
End of program
Fig. 3-15: Programming environment PROTECT-PSCsw example program 1: True_False and EnableSwitch FBs
22

3.4.6 Connection example 2: Monitoring of a three-step enable switch with 2 NO

contacts
Important information: Enable switches should be selected that positively suppress switching from Pos3 to Pos2 (e.g. ZSD5 or ZSD6 from Schmersal/Elan)
Description
The connecting contacts of a three-step enable switch with 2 NO contacts, a reset button and an additional condition (e.g. contact
from operating mode selector switch) are
module as shown.
The 3-step enable switch has the following
positions (Pos):
Pos1 (not actuated): both NO contacts are
open;
Pos2 (middle position): both NO contacts
are closed;
Pos3 (pushed down): both NO contacts
are open.
Desired functions:
Additional condition (operating mode
selector switch): enabling mode is only
possible when the corresponding operating mode has been selected.
Enabling mode: the enable switch is
switched from Pos1 to Pos2 after program
start. Enabling mode can be implemented.
Error: enable switch is on Pos2 when the
program starts. Enabling mode is not
possible.
Reset: resetting the error. Enabling mode
can then be implemented again.
23

3.4.7 Example program 2: Enabling mode with 3-step enable switch (2 NO contacts), additional condition (operating mode selector switch) and reset button (see 3.4.6) through integration of the Enable Switch function block in the ladder diagram of the
PROTECT PSCsw
Comment
Program start

used for this.
Wiring of the Enable Switch function block:

IIN1: Connection for the additional condition contact; e.g. operating mode selector switch, here: contact with address I004.
IN2: Connection for the NO contacts to be monitored on the enable switch; here: contacts with the addresses I000 and I001.
IN3: No NC contact present; wire with safe 1.
IN4: If auto reset after error (see OUT2) is desired, wire IN4 with
of the reset switch. Otherwise wire with safe 0.
OUT1: Output S_Enable; enabling mode OK, output (here: M000)
for further use.
OUT2: Error enabling mode not desired; enable switch in Pos2
on program start.
End of program
Fig. 3-17: Programming environment PROTECT-PSCsw example program 2: True_False and EnableSwitch FBs
24
3.5 Two Hand control FB (1)

(Name of FB in the Elan Library: Two_Hand_safe_4sensors; seal ID: 603B)
3.5.1 Application
The Two_Hand_safe_4sensors FB is used
in the monitoring of two-handed start solutions (THS).
A THS is usually understood to refer to a
protective device that requires the simultaneous use of both hands for its actuation in
order to initiate and maintain operation of
a machine as long as a hazard exists. The
fixed location means that the operator is
kept outside the danger area.
Generally all safety-related requirements
stipulated in EN 574 must be complied with.
Safety using a two-handed start solution as
location fixing protective device basically
only protects the person who actuates the
actuating elements of the two-handed start
solution.
Adequate protection is only achieved if
there is sufficient distance between the start
device and the hazardous movement.
The distance can be calculated in accordance with EN 999 as follows:
S [mm] = 1,600 [mm/s] tN [s] + 250 [mm]
S = Distance from two-handed start solution to the first hazardous movement.
tN = Time the overall system continues
running after completion of the start
command.
250 mm should be applied as additional distance if the actuating elements of the THS
can be actuated such that one hand may be
closer to the danger point than the start button. The actuation can be 250 mm closer to
the hazard area than the result indicated by
the above equation if protective hoods are
mounted around the start button.
The actuating elements of the THS or the
start console should be tightly assembled to
an area with sufficient space.
If the actuating elements of the THS are
not in a fixed place, other measures must
be deployed to ensure that the minimum
distance is maintained, e.g. using a spacer
(see EN574 Ch. 9).
Attention is directed to the manipulation safe
arrangement of the actuating elements, e.g.
using actuating elements covered by the
protective hood (see EN 574 Ch. 8).
There must be labelling for the actuation of
actuating elements which describes the type
of THS solution (e.g. EN 574 Type IIIC).
A check must be performed to ensure the
system is working correctly after installing the hardware and software and before
releasing the two-handed start solution.
3.5.2 Features
The module complies with the functionalities
in accordance with EN 574 Type IIIC if wiring
corresponds to Example 1 in Chapter 3.5.4.
processing within the program or to activate

a redundantly constructed actuator directly
(e.g. contactor level) via two outputs. In the
latter case the NC contacts of the positively
driven contactors must be led back serially to an input of the PROTECT-PSC. The
Feed_loop FB input of the Two_Hand_
safe_4sensors FB evaluates the state of the
NC contacts.
New output signals OUT1 and OUT2 are
then only generated if neither actuating element has been actuated (in normal position)
and if the NC contacts of the activated actor
were closed before actuation.
If no direct activation of an actuator (contactor) with feedback contacts is used, this
checking process must be deactivated via
the S_NO_EDM FB input.
Caution: If no monitoring of the feedback

loop has been selected on the Two_Hand_
safe_4sensors FB (IN5 = high selection
no EDM), this monitoring must be performed
at a different point (at a different point of
the overall program or by a higher ranking
control device) in order to guarantee the
functionalities of the two-handed wiring in
accordance with EN 574 Type IIIC.
The safety function does not apply without
monitoring of the feedback loop in accordance with EN ISO 13849-1, EN 954-1 or EN
IEC 62061.
Each operating element has non-overlapping NC/NO contacts.

Both operating elements must be actuated
simultaneously and synchronously within
500ms in order to activate the output signals
OUT1 and OUT2 of the Two_Hand_
safe_4sensors FB. These output signals are
deactivated as soon as at least one operating element is reset.
The output signals OUT1 and OUT2
from the Two_Hand_safe_4sensors FB
can be used optionally as flag for further
In order to facilitate cross-wire detection

of both contacts of an operating element,
the contacts must be wired to neighbouring inputs with different potentials on the
PROTECT-PSC.
The Diagnosis output signal becomes active when there is only one contact within an
operating element with NC/NO contacts.
Connection and programming of the 2-handed function should be completed according
to the following chapter.
25

3.5.3 Description of Two_Hand_safe_4sensors FB inputs/outputs

Input/
output
Name
Description
IN1
NO_1
Contact with NO function operating element 1:

TRUE: NO contact operating element 1 actuated
FALSE: NO contact operating element 1 not actuated
IN2
NC_1
(B-contact)
Contact with NC function operating element 1:

TRUE: NC contact operating element 1 actuated
FALSE: NC contact operating 1 not actuated
IN3
NO_2
Contact with NO function operating element 2:

TRUE: NO contact operating element 2 actuated
FALSE: NO contact operating element 2 not actuated
IN4
NC_2
(B-contact)
Contact with NC function operating element 2:

TRUE: NC contact operating element 2 actuated
FALSE: NC contact operating element 2 not actuated
IN5
S_No-EDM
Selection of no EDM (External Device Monitoring):

TRUE: deactivation of EDM
FALSE: no deactivation of EDM
IN6
Feed_Loop
Monitoring of feedback loop (for start condition):

TRUE: feedback loop OK
FALSE: feedback loop not OK
OUT1
OUT1
FM OK; output signal 1:

TRUE: signal sequence inputs IN1 IN4 correct.
FALSE: signal sequence inputs IN1 IN4 not correct.
OUT2
OUT2
FM OK; output signal 2:

FALSE: signal sequence IN1 IN4 not correct.
OUT3
diagnose
Monitoring of overlapping of operating element contacts (IN1

IN2 or IN3- In4) for >1 s_
TRUE: overlapping of control element contacts
FALSE: no overlapping of control element contacts
Tab. 3-6: Description of I/Os of Two_Hand_safe_4sensors FB
Fig. 3-18: Two_Hand_safe_4sensors FB
26

3.5.4 Connection example 1: Monitoring of 2-handed operating elements each with

NC-NO contacts through the PROTECT-PSC under consideration of the connected
feedback loop
Description
The operating elements of a 2-handed operation solution with NC-NO contacts and the
feedback loop (NC contacts of the actuated
contactors) are connected to the PROTECTPSC-CPU-MON module as shown.
Operation of the operating elements causes
the NO contact to close and the NC contact
to open.
Desired function
Only if the feedback loop is closed and both
two-handed operating elements are actuated simultaneously (within 500 ms) are the
output signals OUT1 and OUT2 of the
Two_Hand_safe_4sensors FB active until
at least one operating element is released.
27

3.5.5 Example program 1: Monitoring of 2-handed operation and feedback loop (see 3.5.5) through integration of the Two_Hand_
safe_4sensors function block in the ladder diagram of the PROTECT PSCsw
Comment
Program start

(here: M7F0) to OUT2 with the help of an input contact (here: I010)
to IN1. The True_False FB from the Auxiliary folder is used for
this.
Wiring of the Two_Hand_safe_4sensors function block:

IN1: Connection of the NC contact from operating element 1;
here: contact with address I000.
IN2: Connection of the NO contact from operating element 1;
here: contact with the address I001.
IN5: If monitoring of the feedback loop is desired, wire IN5 with
safe 0. Otherwise wire with safe 1.
IN6: If monitoring of the feedback loop is required, wire IN6 with
feedback loop; hier: contact with the address I009. Otherwise do
not connect.
OUT1: Output signal 1; 2-handed operation OK; output (here:
M001) for further use.
OUT2: Output signal 2; 2-handed operation OK; Output (here:
OUT3: Diagnosis; at least 1 operating element not OK; output
(here: M003) for further use.
End of program
Fig. 3-20: Programming environment PROTECT-PSCsw example program 1: True_False and Two_hand_safe_4sensors FBs
28

3.5.6 Connection example 2: Monitoring of 2-handed operating elements each with

NC-NO contacts by PROTECT-PSC without feedback loop
Description
The operating elements of a 2-handed operation with NC-NO contacts without feedback loop are connected to the PROTECTPSC-CPU-MON module as shown.
Actuation of the operating elements causes
the NO contact to close and the NC contact
to open.
Desired function
Only if both two-handed operating elements
are actuated simultaneously (within 500ms)
are the output signals OUT1 and OUT2
of the Two_Hand_safe_4sensors FB active until at least one operating element is
released.
29

3.5.7 Example program 2: Monitoring of 2-handed operation without feedback loop (see 3.5.6) through integration of the Two_
Hand_safe_4sensors function block in the ladder diagram of the PROTECT PSCsw
Comment
Program start

used for this.
Wiring of the Two_Hand_safe_4sensors function block:

feedback loop. Otherwise do not connect.
OUT3: Diagnosis; at least 1 operating element not OK; output
End of program
Fig. 3-22: Programming environment PROTECT-PSCsw example program 2: True_False and Two_hand_safe_4sensors FBs
30
3.6 Sequential Muting FB (1)

(Name of FB in the Elan Library: Seq_Muting; seal ID: 416E)
3.6.1 Application
The Seq_Muting function block represents
the function for sequential muting.
The principle is based on the reliable bridging of electro-sensitive protective equipment
(ESPE). Here it is ensured that the series
(sequentially) arranged sensors realise a
defined sequence of signal status changes
(see Figure 3-18). The first faulty signal
status change of a muting sensor results in
interruption of the ESPE bridging. No special
safety sensors are required for the sensors.
The mechanical arrangement of the two
reflection light barriers (muting sensors)
must guarantee that no people are able to
enter the danger area during muting or can
themselves trigger muting.
The Seq_Muting FB can be used within
PROTECT-PSC up to SIL 3 in accordance
with EN IEC 61508, PL e in accordance with
EN ISO 13849-1 and SC 4 in accordance
with EN 954-1 when using electro-sensitive
protective equipment in accordance with
Type 4 to EN 61496-1:2004 and under consideration of the specifications set out here.
Caution: If no monitoring of the feedback

loop has been selected on the Seq_Muting FB (IN10 = high EDM_func disable),
then this monitoring must be performed at
a different place (at a different point in the
overall program or from a higher ranking
control device) in order to achieve PL e, SIL
3 or SC 4.
The safety function does not apply without
monitoring of the feedback loop in accordance with EN ISO 13849-1, EN 954-1 and EN
IEC 62061.
NB: ESPE of Type 2 in accordance with

EN 61496-1:2004 likewise functions on
the muting module. The safety integrity is
not present here, however. The periodical
testing of the Type 2 ESPE system is not
supported by the Seq_Muting FB.
3.6.2 Features
Sequential muting in both movement
directions
Override function to clear the ESPE after
faulty switching off
Possibility to actuate a muting indicator
(LED or light bulb)
Fig. 3-23: Muting process

Option of monitoring the muting indicator
for interruption (lamp monitoring)
Option of actuating a contactor switchoff level with feedback (feedback loop) of
the contactor NC contacts or use of the
module output internally without contactor
switch-off level
Comprehensive diagnosis
3.6.3 Process of sequential muting
The Seq_Muting FB supports muting in
both transport directions. It is possible to
transport material forwards or backwards
through the muting sequences. With reference to Figure 3-18 the sequence of sensors
is 1, 2, 3 and 4 during forwards operation
and 4, 3, 2 and 1 during reverse operation.
A change of direction is only possible when
a muting sequence has been concluded.
See the Muting process figure and Description of FB Seq_Muting Input/Outputs
in Chapter 3.5.3 below for the following
process description.
1. The FB switches to MUTING when the
muting sensors Sensor 1 and Sensor 2
are consecutively activated by the transportation of material. The outputs OUT
1 and OUT 2 (to bridge the ESPE) and
Mut_Lamp (to actuate the muting lamp)
are set (high signal). When activating the
muting lamp monitoring (low signal on
Mute_lamp input) a high signal must
be read back on the M_Lamp_in input.
When deactivating the muting lamp monitoring (high signal on the Mute_lamp
input) the M_Lamp input is without
function.
2. The FB outputs OUT 1, OUT 2 and
Mut_Lamp are set (high signal) as long
as Sensor 1 and Sensor 2 remain activated by the transportation of materials. The
FB inputs AOPD 1 and AOPD 2 (safety
outputs from the ESPE) are switched to
inactive (low signal).
(The material travels through the ESPE

(light curtains) without the machine being
stopped in the danger zone).
3. The muting sensors Sensor 3 and Sensor
4 must be activated before muting sensors Sensor 1 and Sensor 2 are switched
to inactive. FB inputs AOPD 1 and
AOPD 2 (safety outputs from the ESPE)
must remain inactive (low signal) before
switching Sensor 3. This enables the FB
to maintain the MUTING function (OUT 1
= high, OUT 2 = high, Mut_Lamp = 1).
4. If the FB inputs AOPD 1 and AOPD 2
are switched to active (light curtains not
interrupted) and subsequently Sensor 3
is switched to inactive, the MUTING function is ended (OUT 1 = low, OUT 2 = low,
Mut_Lamp = low).
5. Only once Sensor 4 has also been
switched to inactive (low signal) can a
new muting sequence be started.
6. Fault in muting function (OUT4 = high):
To remedy the fault all sensors must be
free and the error must first be acknowledged using a button (input ErrorQuit =
low high). A muting sequence is then
possible again.
7. Fault in muting function (OUT4 = high) and
transportation of materials in the muting
area:
It is possible to deliberately bridge safety
using the Override function. This action
may only be performed by trained personnel. It involves laying a two-channelled
key switch with NC/NO contacts on inputs Override1 (NO contact) and Override2 (NC contact). If the Override1
input is switched to active (high signal)
and the Override2 input is switched to
inactive (low signal), the outputs OUT1
and OUT2 are activated (high signal).
After clearing the system (all sensors free)
the override function is automatically
reset after 3 s.
Caution: The key required for the override function may only be accessible to
trained personnel.
31

3.6.4 Description of Seq_Muting FB inputs/outputs (1)

Input/
output
Name
Description
IN1
Sensor1
Sensor 1 (NO function):

TRUE: sensor 1 actuated
FALSE: sensor 1 not actuated
IN2
Sensor2

IN3
Sensor3

IN4
Sensor4

IN5
AOPD1
Safety output 1 AOPD (e.g. light curtains):

TRUE: output AOPD 1 high
FALSE: output AOPD 1 low
IN6
AOPD2
Safety output 2 AOPD (e.g. light curtains):

TRUE: output AOPD 2 high
FALSE: output AOPD 2 low
IN7
ErrorQuit (only
possible if all sensors are free)
Error acknowledgement:
TRUE: where edge change high low
Otherwise FALSE
IN8
Override1 (NO
contact: see Ch.
3.6.2.1; point 7.)
Deliberately bridge safety function (condition 1):

TRUE: key switch actuated
FALSE: key switch not actuated
IN9
Override2 (NC
contact: see Ch.
3.6.2.1; point 7.)
Deliberately bridge safety function (condition 2):

TRUE: key switch actuated
FALSE: key switch not actuated
IN10
EDM_func (disable): No EDM selected (External Device Monitoring):

Monitoring of feed- TRUE: deactivation of EDM
back loop
FALSE: no deactivation of EDM
IN11
EDM: Connection
of feedback loop
Monitoring of feedback loop:

TRUE: feedback loop OK
FALSE: feedback loop not OK
Tab. 3-7: Description of I/Os of Seq_Muting FB (1), continuation see Table 3-6 (next page)
Left: Fig. 3-24: Seq_Muting FB (1), continuation see Fig. 3-25 page 33
32

3.6.4 Description of Seq_Muting FB inputs/outputs (2)

Input/
output
Name
Description
IN12
M_lamp_in
Monitoring of muting lamp Feedback of muting lamp:

TRUE: muting lamp is illuminated
FALSE: muting lamp is not illuminated
IN13
Mute_lamp
(disable)
Selection of no monitoring of muting lamp:

TRUE: muting lamp is not monitored
FALSE: muting lamp is monitored
OUT1
OUT1
FB OK; Muting signal 1:

OUT2
OUT2
FB OK; Muting signal 2:

OUT3
Mut_Lamp
FB OK; Actuation of muting lamp:

TRUE: Signal sequence inputs IN1 IN6 correct.
FALSE: Signal sequence inputs IN1 IN6 not correct.
OUT4
diagnose
General fault:
TRUE: signal sequence inputs IN1 IN6 not correct.
FALSE: signal sequence inputs IN1 IN6 correct.
OUT5
DiagCode1
Position fault:
TRUE: no position occupied
FALSE: position occupied
OUT6
DiagCode2
EDM fault dropping off of contactor:

TRUE: feedback loop not OK
FALSE: feedback loop OK
OUT7
DiagCode3
EDM fault connection of contactor:

TRUE: feedback loop not OK
FALSE: feedback loop OK
OUT8
DiagCode4
Sensor fault:
TRUE: sensor sequence not OK
FALSE: sensor sequence OK
OUT9
DiagCode5
Muting lamp fault:

TRUE: muting lamp not OK
FALSE: muting lamp OK
OUT10
DiagCode6
AOPD fault:
TRUE: AOPD not OK
FALSE: AOPD OK
Tab. 3-8: Description of I/Os of Seq_Muting FB (2)
Left: Fig. 3-25: Seq_Muting FB (2), continued from Fig. 3-24 page 32
33

Fig. 3-26: Connection of PSC-CPU-MON and PSC-S-IN-LC for example program 3.6.6
3.6.5 Connection example: Monitoring of

a sequential muting function
Performed with the help of a safety light
barrier, 4 electromechanical sensors, a key
switch with 2-channelled override function
and a button for error acknowledgement
the sequential muting function is monitored.
Muting is displayed using a muting lamp.
As additional function, there is monitoring
of the lamp current of the muting lamp and
the feedback loop of the connected actuator
(2contactors, not shown in Figure 3-25).
Description
A safety light barrier, the four position
switches Sensor 1, Sensor 2, Sensor 3 and Sensor 4 with NO contacts,
a feedback loop with two NC contacts in
series, a 2-channelled key switch override
with break contact/make contact function,
an ErrorQuit button to acknowledge errors
and a muting lamp are connected to the
PROTECT-PSC-CPU-MON and PROTECTPSC-S-IN-LC modules as shown.
Desired function
Sequential muting as described in 3.6.3. In
addition with display using a muting indicator and monitoring of the feedback loop and
lamp current.
NB: The muting lamp shown in Figure 3-25
corresponds to the input and output characteristics of the PROTECT-PSC in terms of its
current and voltage characteristic curve.
34

3.6.6 Example program: Monitoring of sequential muting, feedback loop and lamp current (see 3.6.5) through integration of the
Seq_Muting function block in the ladder diagram of the PROTECT PSCsw
Comment
Link to the library takes place
Program start

(here: M7F0) to OUT2 with the help of safe input contact (here:
used for this.
Wiring of the Seq_Muting function block:

IN1: Connection of NO contact Sensor l; here: contact with address I000.
IN2: Connection of NO contact Sensor 2; here: contact with address I001.
IN5: Connection of AOPD safety output l (OSSD 1); here: contact
with address I010.
IN6: Connection of AOPD safety output 2 (OSSD 1); here: contact
with address I011.
IN7: Connection of NO contact Error Quit button; here: contact
with address I008.
IN8: Connection of NO contact Override key switch; here: contact with address I006.
IN9: Connection of NC contact Override key switch; here: contact with address I007.
OUT1: Output signal 1; Muting OK; output (here M001) for further
use.
OUT2: Output signal 2; Muting OK; output (here M002) for further
use.
OUT3: Output signal for muting lamp; here: output Q00D
OUT4 OUT9: Diagnosis outputs; see Table 3 6 for description;
outputs (here M003 M008) for further use.
Fig. 3-27: Programming environment PROTECT-PSCsw example program: True_False and Seq_Muting FB (1)
35

3.6.6 Example program: Monitoring of sequential muting, feedback loop and lamp current (see 3.6.5) through integration of the
Seq_Muting function block in the ladder diagram of the PROTECT PSCsw (continued)
Comment
Wiring of the Seq_Muting function block (continued):
IN10: If monitoring of feedback loop is desired, wire IN10 with
IN11: If monitoring of feedback loop is desired, wire IN11 with
input series connection of NC contacts of the actuated contactors (here: contact I009). Otherwise do not connect.
IN12: If monitoring of the muting lamp is desired, wire IN12 with
0V contact of the muting lamp (here: contact I012); otherwise do
not connect.
IN13: If monitoring of the muting lamp is desired wire IN13 with
OUT10: Diagnosis output; see Table 3 6 for description; output
End of program
Fig. 3-28: Programming environment PROTECT-PSCsw example program True_False and Seq_Muting FBs (2)
36
3.7 Parallel Muting FB (1)

(Name of FB in the Elan Library: Muting_2Sensors; seal ID: 8AD5)
3.7.1 Application
The Muting_2Sensors function block represents the function for parallel muting.
The principle relies on the reliable bridging
of electro-sensitive protective equipment
(ESPE) using two fixed wired sensors, usually reflection light barriers. Muting is used
for the transportation of material from a safe
area to a danger area. Here an ESPE is run
through without disconnection taking place.
The mechanical arrangement of the two
reflection light barriers (muting sensors)
must guarantee that no people are able to
enter the danger area during muting or can
themselves trigger muting.
The Muting_2Sensors FB can be used
within PROTECT-PSC up to SIL 3 in accordance with EN IEC 61508, PL e in accordance
with EN ISO 13849-1 and SC 4 in accordance with EN 954-1 when using electro-sensitive protective equipment in accordance
with Type 4 to EN 61496-1:2004 and under
consideration of the specifications set out
here.
NB: ESPE of Type 2 in accordance with
EN 61496-1:2004 likewise functions on the
muting module. The safety integrity is not
present here, however. The periodical testing of the Type 2 ESPE system is not supported by the Muting_2Sensors FB.
Fig. 3-29: Parallel muting process
3.7.2 Features
Parallel muting in both movement directions
Possibility to actuate a muting indicator
(LED or light bulb)
Option of monitoring the muting indicator
for interruption (lamp monitoring)
Simple diagnosis
The Muting_2Sensors FB has been created on the basis of programming guidelines
from PLCopen, the organisation for the
industrial control technology field. This programming structure is described in Chapter
6.16 Parallel Muting with 2 Sensors of the
document PLCopen Technical Committee
5 Safety Software Technical Specification, Part 1: Concepts and Function Blocks
dated 31.01.2006.
3.7.3 Parallel muting process

The Muting_2Sensors function block
supports muting in both transportation
directions. It is possible to transport material
forwards or backwards through the muting
sequences. Usually with parallel muting two
diagonally arranged reflection light barriers
are used which cross at the danger zone,
i.e. lie behind the ESPE to be bridged (see
Figure 3-29). The transportation of material breaks through the light beams of both
reflection light barriers within 4s and the
muting process begins. The activation of a
reflection light barrier ends the ESPE bridging. The muting process is also automatically ended if it lasts for longer than 10 minutes.
A new muting process can only be started
once both reflection light barriers have been
activated.
37

3.7.4 Description of Muting_2Sensors FB inputs/outputs
Fig. 3-30: Muting_2Sensors FB
Input/
output
Name
Description
IN1
S_AOPD_IN
Safety output 1 and 2 ESPE (e.g. light curtains):

TRUE: output 1 ESPE high
FALSE: output 1 ESPE low
IN2
S_Mut_S11
Muting sensor 1 with make contact function; e.g. reflection light barrier 1:
TRUE: reflection light barrier 1 energised
FALSE: reflection light barrier 1 not energised
IN3
S_Mut_S12
Muting sensor 2 with make contact function; e.g. reflection light barrier 2:
TRUE: reflection light barrier 2 energised
FALSE: reflection light barrier 2 not energised
IN4
S_MUT_LAM
Monitoring of muting lamp Reading back of muting lamp

(where OUT3=TRUE):
TRUE: muting lamp is illuminated
FALSE: muting lamp is not illuminated
IN5
Mut_Enab
Muting enable:
TRUE: muting possible
FALSE: muting not possible
IN6
S_Start_R
Power on reset:
TRUE: reset after power on (auto start after power on)
FALSE: no reset after power on (reset must be actuated
after power on)
IN7
Reset
Reset:
TRUE: where edge change low high
Otherwise FALSE
OUT1
Ready
FB initialised:
TRUE after switching on (power on) or after reset on
PSC-CPU-MON
OUT2
S_AOPD_O
Safety output:
TRUE: AOPD on IN1 free or muting active
FALSE: AOPD on IN1 not free and muting not active
OUT3
S_Mut_Ak
Muting active (actuation of muting lamp):

TRUE: parallel muting OK: see 3.7.2.2
FALSE: parallel muting not OK
OUT4
Error
Error indicator:
TRUE: IN1 or OUT3 is TRUE
FALSE: IN1 and OUT3 is FALSE
Tab. 3-9: Description of I/Os of Muting_2Sensors FB
38

Fig. 3-31: Connection of PSC-CPU-MON and PSC-S-IN-LC for example program 3.7.6
3.7.5 Connection example: Monitoring of

a parallel muting function
Performed with the help of a safety light
barrier, 2 reflection light barriers and a reset
button a parallel muting function is monitored. Muting and Error are displayed
with the help of 2 lamps. The feedback loop
of the connected actuator (2 contactors, not
illustrated in Figure 3-31) is monitored using
an additional function.
Description
A safety light barrier, two reflection light barriers, a feedback loop with two NC contacts
in series, a reset button for error acknowledgement and a muting and error lamp are
and PROTECT-PSC-S-IN-LC modules as
shown.
Desired function
Parallel muting as described under 3.7.3.
Additionally with muting and error lamp
indicator.
NB: The lamps represented in Figure 3-31
correspond to the output characteristics of
the PROTECT-PSC in terms of their current
and voltage characteristic curve.
39

3.7.6 Example program: Monitoring of parallel muting and feedback loop (see 3.7.5) through integration of the Muting_2Sensors
function block in the ladder diagram of the PROTECT PSCsw
Comment
Program start

Wiring of the Muting_2Sensors function block:

IN1: Connection AOPD safety outputs (OSSD 1+2); here: contact
with the address I010 and I011.
IN2: Connection PNP output (NO function) reflection light barrier
1; here: contact with the address I012.
IN3: Connection PNP output (NO function) reflection light barrier
2; here: contact with the address I013.
IN4: Connection monitoring of muting lamp, if desired. Here: no
monitoring desired, therefore wiring with safe 1 (here: M7F1).
IN5: Connection muting enable, if desired. Here: no extra enable
switch is desired, therefore wiring with safe 1 (here: M7F1).
IN6: If immediate activation of OUT2 is desired after Power on,
wire with safe 1; Here: activation only desired with reset switch
(IN7), therefore wiring with safe 0 (here M7F0).
IN7: Reset with rising edge to reset FM; here wiring with the address of the reset switch (I008) and as additional condition link to
feedback loop (I009).
OUT1: Output signal Ready (FB ready); output (here: M000) for
further use.
OUT2: Safety output AOPD or muting OK; output (here: M001) for
further use.
OUT3: Output signal for muting lamp indicator; here: output
Q002.
OUT4: Output signal for error lamp indicator; here: output Q003.
End of program
Fig. 3-32: Programming environment PROTECT-PSCsw example program: True_False and Muting_2Sensors FBs
40
3.8 FBs Flip-Flop (1)

(Name of FB in the Elan Library: RS_FlipFlop_prio; seal ID: 590E;

(Name of FB in the Elan Library: RS_FlipFlop_no_prio; seal ID: 4D5D;
(Name of FB in the Elan Library: D_FlipFlop_fallingEdge; seal ID: 515F;
(Name of FB in the Elan Library: D_FlipFlop_risingEdge; seal ID: 7EE6)
3.8.1 Application
A flip-flop, also known as a bistable trigger
circuit, is generally understood as circuitry
that can take two stable states and save
these.
R-S flip-flop with priority

The R input has priority where there is a
simultaneous high signal on inputs S and R,
i.e. the output (NOT-Q) is set and the output
Q is reset.
Flip-flops are used in caches of individual,

defined states or to evaluate clock frequencies, for example.
R-S flip-flop without priority

The simultaneous applying of a high signal
to inputs S and R here leads to an undefined
state. The R-S flip-flop without priority
takes on a (third) state here, however, in
which both outputs Q and (NOT-Q) lead to
the same level (high) which cannot be saved.
While there may be a wish for this function, it
is not completely clear.
3.8.2 Features
Of all the possible flip flop permutations,
only the following types will be considered
here:
R-S flip-flop with priority
R-S flip-flop without priority
D flip-flop with evaluation on falling edge
D flip-flop with evaluation on rising edge
An RS flip-flop is the simplest kind of state
actuated flip-flop. The output Q is set to high
with a high signal on the Set input (S) and
reset to low with a high signal on the Reset
input (R). Here the output (NOT-Q) is always
complementary to (runs counter to) output
Q.
D flip-flop with rising edge

The D flip-flop saves the logical state of the
input where there is a rising (positive) cycle
edge on the clock input and reads its value
out in sequence on Q. If there is no rising
cycle edge there is no assumption of the
input value.
D flip-flop with falling edge
The D flip-flop saves the logical state of the
input where there is a falling (negative) cycle
edge on the clock input and reads its value
out in sequence on Q. If there is no falling
cycle edge there is no assumption of the
input value.
D flip-flops have a data or signal input D, a

clock input C (often represented as >) and
an output Q. A signal applied to input D is
transmitted with the next clock signal to the
clock input C on output D and saved.
NB: The maximum clock frequency to input
C (> or Clock) may not lie below the maximum total cycle time to signal processing
of the PROTECT-PSC (22 ms reaction time).
This results in a maximum clock frequency
of 45 Hz.
Fig. 3-33: Representation of R-S flip-flop
Fig. 3-34: Representation of a D flip-flop
41


3.8.3 Description of inputs/outputs (1)

3.8.3 Description of FlipFlop FBs inputs/outputs
3.8.3.1 FB RS_FlipFlop_prio
Fig. 3-35: RS_FlipFlop_prio FB
Input/output
Name
Description
IN1
Set
Set input:
TRUE: high signal
FALSE: low signal
IN2
Reset
Reset input (priority with simultaneous high signal to IN1 and

IN2):
TRUE: high signal
FALSE: low signal
OUT1
Bistable state:
TRUE: after high signal to IN1
FALSE: after high signal to IN2
OUT2
Qnot
Bistable state:
TRUE: after high signal to IN2
Tab. 3-10: Description of I/Os of RS_FlipFlop_prio FB
3.8.3.2 FB RS_FlipFlop_no_prio
Fig. 3-36: RS_FlipFlop_no_prio FB
Input/output
Name
Description
IN1
Set
Set input:
TRUE: high signal
FALSE: low signal
IN2
Reset
Reset input:
TRUE: high signal
FALSE: low signal
OUT1
Bistable state:
TRUE: (after high signal to IN1) or (after high signal to IN1
and IN2 )
FALSE: after high signal to In2
OUT2
Qnot
Bistable state:
TRUE: (after high signal to In1) or (after high signal to IN1
and IN2)
Tab. 3-11: Description of I/Os of RS_FlipFlop_no_prio FB
42


3.8.3 Description of inputs/outputs (2)

3.8.3.3 FB D_FlipFlop_fallingEdge
Input/output
Name
Description
IN1
Data or signal input:

TRUE: high signal
FALSE: low signal
IN2
Clock
Clock input:
TRUE: falling edge
FALSE: no falling edge
OUT1
Bistable state:
TRUE: next falling edge to IN2 after high signal to IN1
FALSE: always after power on; then next falling edge to IN2
after low signal to IN1
Fig. 3-37: D_FlipFlop_fallingEdge FB
Tab. 3-12: Description of I/Os of D_FlipFlop_fallingEdge FB
3.8.3.4 FB D_FlipFlop_risingEdge
Fig. 3-38: D_FlipFlop_risingEdge FB
Input/output
Name
Description
IN1
Data or signal input:

TRUE: high signal
FALSE: low signal
IN2
Clock
Clock input:
TRUE: falling edge
FALSE: no falling edge
OUT1
Bistable state:
TRUE: next rising edge to IN2 after high signal to IN1
FALSE: always after power on; then next rising edge to IN2
after low signal to IN1
Tab. 3-13: Description of I/Os of D_FlipFlop_risingEdge FB
43



3.8.4 Connection example 1: Monitoring of the direction of movement of a conveyor
belt
A production process requires safe signalling of the direction of movement of a conveyor
belt using a corresponding lamp indicator. The direction of the conveyor belt is controlled by
actuating two buttons.
In this example only the safe lamp indicator is shown.
Description
Two buttons and two lamps are connected
to the PROTECT-PSC-CPU-MON module as
shown.
Desired function
The direction of the conveyor belt is set to
forwards by actuating button 1. This is
safely displayed by lamp 1. The direction of
the conveyor belt is set to backwards by
actuating button 2. This is safely indicated
by lamp 2. Simultaneous actuation of buttons 1 and 2 is not defined. The preferred
direction of forwards should be provided
for this event.
NB: The lamps shown in Figure 3-39 represent the output characteristics of the PROTECTPSC in terms of their current and voltage characteristic curve.
44



3.8.5 Example program 1: Reliable indicator of the last actuated button (see 3.8.4) through integration of the RS_FlipFlop_prio
function block in the ladder diagram of the PROTECT PSCsw
Comment
Program start
Wiring of the RS_FlipFlop_prio function block:

IN1: Connection button 1 to set OUT1; here: contact with the address I007.
IN2: Connection button 2 to set OUT1; here: contact with the address I001. This input has priority if there is simultaneous activation of IN1 and IN2.
OUT1: Output signal Q to connect lamp 2; here: output Q00B; is
set when IN1 is activated.
OUT2: Output signal Qnot to connect lamp 1; here: output
Q00B; is set when IN2 is activated, or when IN1 and IN2 are activated simultaneously.
End of program
Fig. 3-40: Programming environment PROTECT-PSC example program 1: RS_FlipFlop_prio FB
45



3.8.6 Connection example 2: Monitoring of the state change of a contactor:
A contactor in a process sequence is to be switched against an input signal of a reflection
light barrier. The state change of the contactor may only take place at a defined moment.
This moment is stipulated by the clock that emits a periodic signal every 30 s lasting for
500ms.
Description
A reflection light barrier, a clock and a contactor are connected to the PROTECT-PSCCPU-MON module as shown.
Desired function
When the reflection light barrier has been energised the connected contactor should be
activated at the moment when a rising edge is present on the clock. If the reflection light
barrier has not been energised the contactor should be turned off at this time if there is
similarly a rising edge on the clock.
46



3.8.7 Example program 2: Reliable indicator of the last actuated button (see 3.8.6) through integration of the
D_FlopFlop_risingEdge function block in the ladder diagram of the PROTECT PSCsw
Comment
Program start
Wiring of the D_FlipFlop_risingEdge function block:

IN1: Connection for NO contact (reflection light barrier, here:
contact with the address I007) to set OUT1 when there is a rising
edge at IN2.
IN2: Clock input; here: contact with the address I007.
OUT1: Output signal (for control of the contactor; here: output
Q00A is set when IN1 is active and rising edge is at IN2).
End of program
Fig. 3-42: Programming environment PROTECT-PSCsw example program 2: D_FlipFlop_risingEdge FB
47
3.9 Turn off delay R FB (drop off delayed, retriggerable) (1)

(Name of FB in the Elan Library: Turn_off_delay_R; seal ID: 14E7)
3.9.1 Application
The Turn_off_delay_R FB can be used in
all applications in which a retriggerable drop
off delayed time is desired (generally termed
a Stop1 function), depending on the input
condition. Retriggerable means, that the
drop off delayed time starts again, if during
the run of the delayed time the input condition is reset and set again.
Category 1 STOP in accordance with EN
60204-1 Section 9.2.2: Controlled stop
by interrupting the power supply to the
actuator level if, for example, the hazardous
movement has been brought to a standstill
(= time-delayed shut-down of the power
supply).
Example: the controller enable of an electronic drive is shut down immediately using
an enable with STOP category 0 and the
power contactor only after the operational
braking time of the motor (= STOP category1).
3.9.2 Features
The following syntax applies in order to
design drop off delay times flexibly for every
programmer:
The Turn_off_delay_R FB is always preceded by a time function (Tx) in which the
desired shut-down delay is defined. This
time function is wired with the output signal
Out2 (Sig_off_T) from the FB. Tx serves as
the input signal for IN1 from the FB (see
example program).
3.9.3 Description of Turn_off_delay_R FB inputs/outputs
Fig. 3-43: Turn_off_delay_R FB
Input/
output
Name
Description
IN1
Timer
Time function input:

TRUE: delay time expired
FALSE: delay time not expired
IN2
Signal
Monitoring contact:
TRUE FALSE: start delay time
FALSE: monitoring contact not active
OUT1
Sig_Stop1
Time delay output:

TRUE: monitoring contact to IN1 active or delay time not
expired
FALSE: monitoring contact to IN1 not active or delay
time expired
OUT2
Sig_off_T
Expire delay time:

TRUE = falling edge to IN2 and delay time not expired
False = no falling edge to IN2 or delay time expired
Tab. 3-14: Description of I/Os of Turn_off_delay_R FB

Which time function (TMRS, TMRHS) is
selected depends on the desired function
(time window, time tolerance; see PROTECTPSC manual).
48

3.9.4 Connection example: After the actuation of an emergency stop control device
two connected contactors are only to be drop off after 5 s delay.
Description
An emergency stop control device and two
contactors are connected to the PROTECTPSC-CPU-MON module as shown.
Desired function
After actuating the emergency stop control device both contactors should drop off after
expiry of 5 s, retriggerable. This means that the connected contactors do not drop off if the
emergency stop is reset before expiry of the 5 s. A new actuating of the emergency stop
control device starts the drop off delay time of 5 s for the connected contactors again.
49

3.9.5 Example program: Drop off delay, retriggerable (see 3.9.4) through integration of the Turn_off_delay_R function block in
Comment
Program start
Setting of the drop off delay time:

The delay time (here: 5.0 s) is set in the time function TMRS (here:
T010). The timer function contains the start signal from the FB
(OUT2).
An active signal to the reset input resets the time function. Here:
the time function only elapses if the emergency stop control
device is not reset within 5 s.
Wiring of the Turn_off_delay_R function block:

IN1: Connection timer function; here: timer with the address T010.
IN2: Connection emergency stop; here: contacts with the addresses I000 and I001.
OUT1: Safe output signal 1 FB (here: M000); remains high until
expiry of the time delay (here: 5 s) or if the emergency stop is not
actuated.
OUT2: Output signal 2 FB; changes to high after actuation of the
emergency stop until expiry of the delay time.
Wiring of output contacts:
Desired outputs (here: Q00A and Q00B) are wired with safe output signal 1 from the FB.
End of program
Fig. 3-45: Programming environment PROTECT-PSCsw example program: Turn_off_delay_R FB
50
3.10 Turn off delay NR FB (drop off delayed, not retriggerable) (1)

(Name of FB in the Elan Library: Turn_off_delay_NR; seal ID: 3BE7)
3.10.1 Application
The Turn_off_delay_R FB can be used in
all applications in which a not retriggerable
drop off delayed time is desired (generally
termed a Stop 1 function), depending on the
input condition. Not retriggerable means,
that the drop off delayed time has to be
finished, before to actuate it again.
3.10.3 Description of Turn_off_delay_NR FB inputs/outputs
Category 1 STOP in accordance with EN

60204-1 Section 9.2.2: Controlled stop by
interrupting the power supply to the actuator
level if, for example, the hazardous movement has been brought to a standstill (=
time-delayed drop off of the power supply).
Example: the controller enable of an electronic drive is drop off immediately using an
enable with STOP category 0 and the power
contactor only after the operational braking
time of the motor (= STOP category 1).
3.10.2 Features
The following syntax applies in order to
design drop off delay times flexibly for every
programmer:
The Turn_off_delay_NR FB is always
preceded by a time function (Tx) in which
the desired drop off delay is defined. This
time function is wired with the output signal
Out3 (I_Timer) from the FB. Tx serves as the
input signal for IN1 from the FB (see example
program).
Which time function (TMR, TMRH) is selected depends on the desired function (time
window, time tolerance; see PROTECT-PSC
manual).
Fig. 3-46: Turn_off_delay_NR FB

Input/
output
Name
Description
IN1
TimerNR
Timer function input:

TRUE: delay time expired
FALSE: Delay time not expired
IN2
Signal
Monitoring contact:
TRUE FALSE: start delay time
FALSE: monitoring contact not active
OUT1
OutStop1
Output Stop 1:
TRUE: monitoring contact to IN1 active or delay time not
expired
FALSE: monitoring contact to IN1 not active or delay
time expired
OUT2
OutStop0
Output Stop 0:
TRUE = IN2 active
False = IN2 not active
OUT3
I_Timer
Expire delay time:

TRUE = falling edge to IN2 and delay time not expired
False = no falling edge to IN2 or delay time expired
Tab. 3-15: Description of I/Os of Turn_off_delay_NR FB
51

3.10.4 Connection example with Time_delay FB: After the actuation of an emergency stop control device two connected contactors are only to be drop off after 5 s
delay.
Description
An emergency stop control device and two
contactors are connected to the PROTECTPSC-CPU-MON module as shown.
Desired function
After actuating the emergency stop control device both contactors should drop off after
expiry of 5s, not retriggerable. It means, that a new start of the drop off delay time can be
executed again after the expiry of the preset time (here: 5 s). So the set time elapses without
change.
52

3.10.5 Example program: drop off delay, not retriggerable (see 3.10.4), through integration of the Turn_off_delay_NR function
block in the ladder diagram of the PROTECT PSCsw
Comment
Program start
Setting of drop off delay time:

The delay time (here 5.0s) is set in the time function TMRH (here
T010). The timer function contains the start signal from the FB
(OUT3). An active signal to the reset input resets the time function. Here: the time function only elapses if the emergency stop
control device is not reset within 5 s.
Wiring of the Turn_off_delay_NR function block:
IN1: Connection timer, here: T010.
IN2: Connection emergency stop, here: contacts with the addresses I000 and I001.
OUT1: Safe output signal 1 FB (here: M000); remains high until
expiry of the time delay (here: 5 s) or if the emergency stop is not
actuated.
OUT2: Safe output signal 2 FB (here: M001); remains high until the
emergency stop is not actuated.
OUT3: Output signal 3 FB; changes to high after actuation of the
emergency stop until expiry of the delay time.
Wiring of output contacts:

Desired outputs (here: Q00A and Q00B) are wired with safe output signal 1 from the FB.
End of program
Fig. 3-48: Programming environment PROTECT-PSCsw example program: Turn_off_delay_NR FB
53
54
55
K.A. Schmersal GmbH

Industrielle Sicherheitsschaltsysteme
Mddinghofe 30, D-42279 Wuppertal
P.O. Box 240263, D-42232 Wuppertal
Phone
Fax
E-mail:
Internet:
+49 (0)202 6474-0

+49 (0)202 6474-100
info@schmersal.com
www.schmersal.com
Elan Schaltelemente GmbH & Co. KG

Im Ostpark 2, D-35435 Wettenberg
P.O. Box 1109, D-35429 Wettenberg
Phone
Fax
E-mail:
Internet:
+49 (0)641 9848-0

+49 (0)641 9848-420
info-elan@schmersal.com
www.elan.de
0000000 00/09 25.07.09

PSC-FB Library-Manual V1 1

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

PSC-FB Library-Manual V1 1

Transféré par

Droits d'auteur :

Formats disponibles

Programmable Small Safety PLC

Table of contents (1)

3Protected ELAN functional modules within

Features of the PROTECT-PSCsw

3.0.1 True_False FB (to generate a safe 1 and a safe 0)

3.0.2 Description of the True_False auxiliary function block

3.1.3 Description of inputs/outputs

3.1.4 Connection example

3.1.5 Example program

3.2.3 Description of inputs/outputs

3.2.4 Connection example

3.2.5 Example program

3.3.3 Description of inputs/outputs

3.3.4 Connection example

3.3.5 Example program

3.4.3 Description of inputs/outputs

3.4.4 Connection example 1

3.4.5 Example program 1

3.4.6 Connection example 2

3.4.7 Example program 2

Two Hand Control FB

3.5.3 Description of inputs/outputs

3.5.4 Connection example 1

3.5.5 Example program 1

3.5.6 Connection example 2

3.5.7 Example program 2

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Table of contents (2)

3.6.3 Process of sequential muting

3.6.4 Description of inputs/outputs

3.6.5 Connection example

3.6.6 Example program

3.7.3 Process of parallel muting

3.7.4 Description of inputs/outputs

3.7.5 Connection example

3.7.6 Example program

3.8.3 Description of inputs/outputs

3.8.4 Connection example 1

3.8.5 Example program 1

3.8.6 Connection example 2

3.8.7 Example program 2

Turn off delay R FB (drop off delayed, retriggerable)

3.9.3 Description of inputs/outputs

3.9.4 Connection example

3.9.5 Example program

Turn off delay NR FB (drop off delayed, not retriggerable)

3.10.3 Description of inputs/outputs

3.10.4 Connection example

3.10.5 Example program

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Use of the FBs does not release the user

Caution: If a safety-critical setting has

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Fig. 2-1: Screens to protect own created FBs

The significance of a safe or an unsafe

Protected Elan functional modules within the PROTECT-PSCsw library function

Protected ELAN functional modules

3.0.1 True_False FB (to generate a

3.02 Description of the True_False auxiliary function block

As described in Chapter 2.3, input or

Fig. 3-1: True_False FB

Safe input signal; e.g. A-contact (| |)

3Protected ELAN functional modules within

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1

Description of Safety Function Blocks PROTECT-PSC | Version 1.1