Académique Documents
Professionnel Documents
Culture Documents
Topic Page
Important User Information 2
General Safety Information 3
Introduction 3
Safety Function Realization: Risk Assessment 4
Emergency Stop Safety Function 4
Safety Function Requirements 4
Functional Safety Description 5
Bill of Material 5
Setup and Wiring 5
Configuration 7
Calculation of the Performance Level 7
Verification and Validation Plan 9
Additional Resources 12
Safety Function: Cable Pull Switch
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are
required to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may
be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from
the use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal
injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss.
Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash will
cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and for
Personal Protective Equipment (PPE).
IMPORTANT This application example is for advanced users and assumes that you are trained and experienced in safety system requirements.
ATTENTION: Perform a risk assessment to make sure that all task and hazard combinations have been identified and addressed. The risk assessment can require
additional circuitry to reduce the risk to a tolerable level. Safety circuits must consider safety distance calculations, which are not part of the scope of this
document.
ATTENTION: While safety distance or access time calculations are beyond the scope of this document, compliant safety circuits must often consider a safety
distance or access time calculation.
Non-separating safeguards provide no physical barrier to prevent access to a hazard. Publications that offer guidance for
calculating compliant safety distances for safety systems that use non-separating safeguards, such as light curtains,
scanners, two-hand controls, or safety mats, include the following:
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of
parts of the human body)
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
Separating safeguards monitor a moveable, physical barrier that guards access to a hazard. Publications that offer
guidance for calculating compliant access times for safety systems that use separating safeguards, such as gates with limit
switches or interlocks (including SensaGuard™ switches), include the following:
EN ISO 14119:2013 (Safety of Machinery – Interlocking devices associated with guards - Principles for design
and selection)
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of
parts of the human body)
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
Introduction
This safety function application technique explains how to wire and configure two cable pull switches to a Guardmaster™
single-input safety relay. When one of the two cable pull switches is pulled, the relay responds by opening its safety
contacts and removing 24V DC from the coils of the two 100S safety contactors. The 100S contactors open and remove
power from the hazardous motion. The hazardous motion coasts to a stop (stop category 0).
ISO 13849-1 directs that when devices are connected in series, such as the two cable pull switches in each segment in this
safety function application, the function of each device is evaluated as a separate safety function.
In this safety function application, the two cable pull switches are evaluated as two identical E-stop safety functions.
To confirm the proper state of the two 100S safety contactors before permitting a start or reset, 24V DC is run in series
through an N.C. auxiliary contact on each 100S contactor to the Reset button of the safety relay. If a safety contact of one
or both 100S contactors is welded closed, the corresponding auxiliary N.C. contact is held open, breaking the 24V DC
circuit to the Reset button.
The safety relay in this application is configured for Automatic/Manual Start. When the inputs of the cable pull switch
are in the proper state, and the two 100S contactors are properly de-energized, turning the Reset button of the cable pull
switch results in the safety relay energizing the two 100S safety contactors.
Bill of Material
This application technique uses these products.
Cat. No. Description Quantity
440E-L13137 440E emergency stop device – Lifeline™ 4 cable pull switch 2
440R-S12R2 Guardmaster single-input safety relay, one dual-channel universal input, one N.C. solid-state auxiliary output 1
100S-C09ZJ23C Modular control system 100S-C safety contactor, 9A, 24V DC 2
System Overview
The pulsed outputs of the Guardmaster single-input safety relay (terminals S11 and S21) are run separately through the
contact strings of the two cable pull switches (cable pull 1 to cable pull 2) to input terminals S12 and S22, respectively.
This configuration enables the safety relay to detect a loose wire, a short to 24V DC, a short to GND, and cross-channel
faults. There is the possibility that a contact in one of the cable pull switches could fail closed and that this failure could
be masked by the operation of the other cable pull switch. For this reason, the two cable pull switches in the string are
calculated as having a Category 3 structure.
The safety relay responds to the inputs of the cable pull switches and detected circuit faults of the cable pull switches by
opening its safety contacts (13…14 and 23…24), thus de-energizing the coils of K1 and K2. The safety relay cannot be
reset until the cable pull switch is released, or the fault is corrected. In some cases, the cable pull switch must be pulled
and released before the safety relay can be reset. After some faults, before it can be reset, the safety relay must be power-
cycled once the fault is cleared.
The safety relay monitors itself for any internal faults. When a fault is detected, the safety relay responds by opening its
safety contacts (13…14 and 23…24) and de-energizing the coils of K1 and K2. Some internal faults can be cleared by
power-cycling the safety relay. In other cases, the safety relay must be replaced.
The safety relay monitors the 100S contactors for welded contacts via two N.C. contacts in series, one from each 100S
contactor, in its reset circuit. If a contact of a 100S contactor is welded, the N.C. contact is held open, which breaks the
reset circuit.
Electrical Schematic
24V
24V 0V
0V
WIRING
Wiring
A1 A2
S11 SI
Status
Status
S21 Y32
to
toPLCPLC
Reset
Reset 0
AM
MM
33 34 Status
Status 33 34 Status
Status
to PLC
to PLC totoPLC
PLC
11 12 11 12
S12
21 22 21 22
S22
K1a K2a
S34
Status
Status
to
toPLC
PLC A1 A2
13 14 K1
A1 A2
23 24 K2
K1b Status
Status
totoPLCPLC
K2b Status
Status
totoPLCPLC External Switched
External Switched
Stop/Start Circuit
Stop/Start Circuit
K1
K2
M
6 Rockwell Automation Publication SAFETY-AT088B-EN-P - May 2016
Safety Function: Cable Pull Switch
Configuration
Follow these steps to configure the relay.
1. With power off, turn the rotary switch to position 0, and apply power.
The IN 1 status indicator blinks to acknowledge the new setting. The position is set when the PWR status
indicator is solid green.
3. Lock in the configuration by cycling power to the relay.
The configuration must be confirmed before operation. Use the white space on the front of the device to record
the unit setting.
The individual subsystem values for one of the E-stop functions are shown in the graphic.
Cable Pull
Cable Pull 1 1 100S-C
100S-C
S1 K1
K1
S1
Guardmaster
Fault
Fault GSR SI
Single-input
Exclusion
Exclusion Safety Relay
Cable Pull
Cable Pull 1 1 100S-C
100S-C
S2 K2
S1 K2
Subsystem
Subsystem 1 1 Subsystem
Subsystem 2 2 Subsystem
Subsystem 3 3 Subsystem
Subsystem 4 4
The SISTEMA values and the block diagram model are the same for the second E-stop function.
Because the cable pull switches are electromechanical devices, certain data must be provided for evaluation of expected
performance, which need not be provided for electronically based devices, such as a safety relay, when used in a safety
function.
The functional safety evaluations of the electromechanical devices include the following:
• How frequently they are operated
• Whether they are effectively monitored for faults
• Whether they are properly specified and installed
Because the cable pull switches are electromechanical devices, a fault exclusion must be considered when calculating a
safety rating. A fault exclusion subsystem is added to the SISTEMA calculation to reflect this. EN-ISO 13849-2:2012,
Annex D, allows a fault exclusion for mechanical aspects of emergency stop (complementary) devices in accordance with
IEC 60947-5-5, when the estimated maximum number of cable pull switch (E-stop) operations is not excessive. Such an
allowed fault exclusion has no effect on the Category or Performance Level achieved by the cable pull switch (E-stop)
safety functions. To reflect this configuration in the SISTEMA project calculations, the Category and Performance Level
of the fault exclusion subsystem were manually entered as Category 4 and Performance Level e.
SISTEMA calculates the MTTFd by using B10d data for the electromechanical devices provided in the Rockwell
Automation SISTEMA library, along with the estimated frequency of use, entered during the creation of the SISTEMA
project. In this application, the estimated frequency of use for each cable pull switch was 365 times a year.
The DCavg (60%) for the cable pull switch (E-stop) was entered manually to take into account that they are connected
in series. Masking, due to series connection, reduces the ability of the system to detect faults.
The DCavg (99%) for the contactors is selected from the Output Device table of ISO 13849-1:2006, Annex E, Direct
Monitoring.
The CCF value was generated by using the scoring process outlined in Annex F of ISO 13849-1. The complete CCF
scoring process must be performed when actually implementing an application. A minimum score of 65 must be
achieved. A CCF of 65 was entered for practical purposes in each case to satisfy SISTEMA requirements.
Verification is an analysis of the resulting safety control system. The Performance Level (PL) of the safety control system
is calculated to confirm that the system meets the required Performance Level (PLr) specified. The SISTEMA software
is typically used to perform the calculations and assist with satisfying the requirements of ISO 13849-1.
Validation is a functional test of the safety control system to demonstrate that the system meets the specified
requirements of the safety function. The safety control system is tested to confirm that all safety-related outputs respond
appropriately to their corresponding safety-related inputs. The functional test includes normal operating conditions and
potential fault injection of failure modes. A checklist is typically used to document the validation of the safety control
system.
Before validating the system, confirm that the Guardmaster safety relay has been wired and configured in accordance
with the installation instructions.
Additional Resources
These documents contain more information about related products from Rockwell Automation.
Resource Description
Guardmaster Safety Relay SI–Monitoring Safety Relay Installation Instructions, Provides guidance on how to install, commission, operate, and maintain a Guardmaster
publication 440R-IN042 440R-S12R2 single-input safety relay.
Lifeline 4 Installation Instructions, publication 440E-IN001 Provides instructions on how to install a Lifeline 4 cable pull switch.
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines on how to install a Rockwell Automation® industrial
system.
Safety Products Catalog, publication S117-CA001
Website http://www.rockwellautomation.com/rockwellautomation/catalogs/ Provides information about Rockwell Automation safety products.
overview.page
Product Certifications Website, http://www.rockwellautomation.com/global/ Provides declarations of conformity, certificates, and other certification details.
certification/overview.page
Notes:
Product Compatibility and Download Center Get help determining how products interact, check
features and capabilities, and find associated www.rockwellautomation.com/global/support/pcdc.page
(PCDC) firmware.
Documentation Feedback
Your comments will help us serve your documentation needs better. If you have any suggestions on how to improve this document, complete the
How Are We Doing? form at http://literature.rockwellautomation.com/idc/groups/literature/documents/du/ra-du002_-en-e.pdf.
Rockwell Automation maintains current product environmental information on its website at http://www.rockwellautomation.com/rockwellautomation/about-us/sustainability-ethics/product-environmental-compliance.page.
Allen-Bradley, Guardmaster, Lifeline, LISTEN. THINK. SOLVE, Rockwell Automation, Rockwell Software, and SensaGuard are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
Rockwell Otomasyon Ticaret A.Ş., Kar Plaza İş Merkezi E Blok Kat:6 34752 İçerenköy, İstanbul, Tel: +90 (216) 5698400