Beruflich Dokumente
Kultur Dokumente
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off
on EtherNet/IP Networks Safety Function
Products: GuardLogix 5570 or Compact GuardLogix 5370 Controller, Kinetix 5500 or Kinetix 5700 Servo Drive
Safety Rating: Capable of CAT. 4, PLe to ISO 13849-1: 2008
Topic
Page
Introduction
Bill of Material
Configuration
12
14
16
Additional Resources
19
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury
or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions
help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT
Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash will
cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and for Personal
Protective Equipment (PPE).
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
This application example is for advanced users and assumes that you are trained and experienced in safety system requirements.
Risk Assessment
ATTENTION: Perform a risk assessment to make sure that all task and hazard combinations have been identified and addressed. The risk assessment can require
additional circuitry to reduce the risk to a tolerable level. Safety circuits must consider safety distance calculations, which are not part of the scope of this
document.
Non-separating safeguards provide no physical barrier to prevent access to a hazard. Publications that offer guidance for
calculating compliant safety distances for safety systems that use non-separating safeguards, such as light curtains,
scanners, two-hand controls, or safety mats, include the following:
EN ISO 13855:2010 (Safety of Machinery Positioning of safeguards with respect to the approach speeds of
parts of the human body)
EN ISO 13857:2008 (Safety of Machinery Safety distances to prevent hazardous zones being reached by upper
and lower limbs
ANSI B11:19 2010 (Machines Performance Criteria for Safeguarding)
Separating safeguards monitor a movable, physical barrier that guards access to a hazard. Publications that offer guidance
for calculating compliant access times for safety systems that use separating safeguards, such as gates with limit switches
or interlocks (including SensaGuard switches), include the following:
EN ISO 14119:2013 (Safety of Machinery Interlocking devices associated with guards - Principles for design
and selection)
EN ISO 13855:2010 (Safety of Machinery Positioning of safeguards with respect to the approach speeds of
parts of the human body)
EN ISO 13857:2008 (Safety of Machinery Safety distances to prevent hazardous zones being reached by upper
and lower limbs
ANSI B11:19 2010 (Machines Performance Criteria for Safeguarding)
In addition, consult relevant national or local safety standards to assure compliance.
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Introduction
This application technique explains how to program the logic (GuardLogix controller) and configure the actuator
(Kinetix drive with integrated Safe Torque Off ) subsystems of a safety function. In this application technique, the
GuardLogix controller de-energizes the final control devices, in this case, the integrated Safe Torque Off (STO) inputs
on the Kinetix drive. The final control element is de-energized immediately for a category 0 stop, and a delay (or
monitoring that the hazard is stopped or in a safe state) is introduced before de-energizing for a stop category 1.
Use this application technique with the sensor subsystems from any other GuardLogix safety function application
technique. For example, you can use sensor subsystems 1 and 2 from Door-monitoring Interlock Switch with an
Integrated Safety Controller Safety Function, publication SAFETY-AT034, along with the actuator subsystems from
this application technique, to create the following overall safety function.
Sensor
IMPORTANT
Input
Logic
Actuator
SensaGuard
switch
1734-IB8S
GuardLogix
Controller
Kinetix Drive
Safe Torque Off
Subsystem 1
Subsystem 2
Subsystem 3
Subsystem 4
You must add the PFH values for each subsystem together to create a PFH for the overall safety function. Depending on the sensor subsystems and devices
you choose, the overall safety rating of your system could be reduced. The results of an example calculation for a complete safety function are shown in the
section titled Calculation of the Performance Level on page 14.
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Bill of Material
The subsystems within this application use these products.
Cat. No.
Description
Quantity
800FM-G611MX10
800F reset push button - metal, guarded, blue, R, metal latch mount, 1 N.O. contact, standard
1(1)
Choose either the GuardLogix 5570 hardware list or the Compact GuardLogix 5370 hardware list.
Controller
GuardLogix 5570
Controller
Compact
GuardLogix 5370
Controller
Cat. No.
Description
Quantity
1756-L71S
1756-L72S
1756-L73S
1756-L7SP
1756-EN2TR
1756-PA72
1756-A7
1769-L30ERMS
1769-L33ERMS
1769-L36ERMS
1769-PA4
Description
Quantity
2198-H008-ERS2(1)
Kinetix 5500 195-528 Vrms, 1.6 kW, 2.5 A, Safe Torque Off
2198-D006-ERS3
Kinetix 5700 Dual Axis, 2.5 A, 458747 Volt DC Network Safety Safe Torque Off
(1) Kinetix 5500 catalog numbers ending in -ERS2 provide the integrated Safe Torque Off feature.
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
System Overview
The final control device is the Kinetix drive with integrated Safe Torque Off (STO). Because this drive features
integrated STO inputs rather than hard-wired inputs, there is no need for a safety output module in this safety function.
The GuardLogix controller and the Kinetix drive are both connected on an EtherNet/IP network. CIP Safety protocol
requires a direct connection between the Kinetix drive and the GuardLogix controller. This direct connection makes the
EtherNet/IP hardware between these two end devices a black channel. Any EtherNet/IP hardware can be used with no
effect on the PL calculation.
The overall safety function must have individual reset buttons for resetting faults and for resetting safety outputs. These
reset buttons can be wired to any input module (safety or standard) in your system. The safety rating of the reset button
must not diminish the rating of the relevant safety function. This is accomplished by the trailing edge or falling edge of
the button generating the reset command, thus tolerating faults in the reset circuit.
Network Architecture
A schematic for this actuator subsystem is not needed, because the Kinetix drive and the GuardLogix controller are
connected on an EtherNet/IP network. The I/O configurations below show the differences between the GuardLogix
5570 and Compact GuardLogix 5370 connections to the Kinetix drive over the EtherNet/IP network.
Configuration
The GuardLogix controller is configured by using the Studio 5000 Logix Designer application. You must create a
project and add the Kinetix drive. A detailed description of each step is beyond the scope of this document. Knowledge
of the Logix Designer application is assumed.
Minimum Logix Designer Version
Product
20
24
26
28
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
3. If you are using a Compact GuardLogix 5370 controller, skip to step 5. Otherwise, in the Controller Organizer, add the 1756-EN2TR
module to the 1756 Backplane.
This example uses 192.168.1.1 as the IP address. Your IP address can differ.
10
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
5. If you are using a Compact GuardLogix 5370 controller, set the IP address. Otherwise, skip this step.
This example uses 192.168.1.36 as the IP address. Your IP address can differ.
6. To add the Kinetix drive, right-click the Ethernet network and choose New Module.
11
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
12
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
The Kinetix Safe Torque Off feature requires a reset after the STO feature is initially energized. Rung 2 accomplishes this
reset. For details on the reset function, see the STO Reset topic in the appropriate Kinetix drive manual, which is listed in
the Additional Resources on page 19
The STO output is energized if the safety interlocks are satisfied, there are no faults, there is a valid connection, and there
is a falling edge on the reset button.
The following code is an example for a category 0 stop. When a demand is placed on safety interlocks, and
'Safety_Interlocks_OK' goes to low (0), then the Kinetix STO output immediately goes to low (0) as well.
The following code is an example for a category 1 stop. When a demand is placed on the safety interlocks, then the
Kinetix STO output goes to low (0) after a three-second delay. The length of the delay is determined in the risk
assessment. During the three-second delay, the 'Motion_Axis_Stop' tag can be used to stop the axis. For example, this tag
could control the Motion Axis Stop command.
13
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
To calculate the PL of your entire safety function, you must include the sensor subsystems along with the logic and actuator subsystems shown here.
Depending on the sensor subsystems and devices you choose, the overall safety rating of your system could be reduced. An example that describes how to
calculate the safety rating for a complete safety function appears in the section titled Complete Safety Function PL Calculation Example on page 14.
Sensor
Determined by the
safety function
sensor subsystems
you choose.
Subsystem 1
Actuator
GuardLogix
Controller
Subsystem 2
Subsystem 3
14
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Here are the subsystems from Door-monitoring Interlock Switch with an Integrated Safety Controller Safety Function,
publication SAFETY-AT034,: sensor, logic, and actuator.
The sensor subsystems from Door-monitoring Interlock Switch with an Integrated Safety Controller Safety Function,
publication SAFETY-AT034, are the SensaGuard Interlock Switch and the 1734-IB8S POINT Guard I/O input
module. The overall safety function is shown here, combining those sensor subsystems from publication SAFETYAT034, and the logic and actuator subsystems from this document.
Sensor
Input
Logic
SensaGuard
switch
1734-IB8S
GuardLogix
Controller
1756-L71S
Subsystem 1
Subsystem 2
Subsystem 3
Actuator
Subsystem 4
The PFH values for each subsystem in the safety function that is modeled on page 15 are taken from their respective
publications and combined.
IMPORTANT
The PFH for this complete safety function, with the sensor, logic, and actuator subsystems, is 4.37E-09, which consumes 4.37 % of the PLe bandwidth. The
PL for the complete safety function is PLe.
15
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
16
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Before validating the GuardLogix Safety System, it is necessary to confirm that the safety system and safety application
program have been designed in accordance with the GuardLogix 5570 and Compact GuardLogix 5370 Controller
Systems Safety Reference Manual, publication 1756- RM099, and the GuardLogix Application Instruction Safety
Reference Manual, publication 1756-RM095.
Catalog Numbers(1)
1756-L71S
1756-EN2TR
Kinetix Drive
Sensor subsystem
SensaGuard Switch
1734-IB8S
Firmware Version
Verification
Pass/Fail
Verify that the safety system has been designed in accordance with the GuardLogix 5570
and Compact GuardLogix 5370 Controller Systems Safety Reference Manual, publication
1756-RM099.
Verify that the safety application program has been designed in accordance with the
GuardLogix Application Instruction Safety Reference Manual, publication 1756-RM095.
Visually inspect the safety system network and verify that the I/O is wired as documented
in the schematics.
Visually inspect the Logix Designer application program to verify that the safety system
network and I/O module configuration is configured as documented.
Visually inspect the Logix Designer application program to verify that suitable safetycertified instructions are used. The logic must be readable, understandable, and testable
with the aid of clear comments.
All input devices are qualified by cycling their respective actuators. Monitor the status in
the Controller Tags window of the Logix Designer application.
All output devices are qualified by cycling their respective actuators. Monitor the status in
the Controller Tags window of the Logix Designer application.
Changes/Modifications
17
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Normal Operation Verification - The GuardLogix safety system properly responds to all normal Start, Stop, E-Stop, and Reset commands.
Test Step
Verification
Pass/Fail
Initiate a Start command. The Kinetix Safe Torque Off (STO) feature should energize for a
normal machine run condition. Verify proper machine status indication and safety
application program indication.
Initiate a Stop command. The Kinetix STO feature should de-energize for a normal
machine Stop condition. Verify proper machine status indication and safety application
program indication.
While the system is running, place a demand on the sensor subsystem. The Kinetix STO
feature should de-energize for a normal safe condition. Verify proper machine status
indication and safety application program indication. Repeat for all sensor subsystems.
While the system is stopped with the sensor subsystems in a safe state, initiate a Start
command. The Kinetix STO feature should remain de-energized for a normal safe
condition. Verify proper machine status indication and safety application program
indication.
While the system is stopped with the sensor subsystems in a safe state, initiate a Reset
command. The Kinetix STO feature should remain de-energized. Verify proper machine
status indication and safety application program indication
Changes/Modifications
Validation of Safe Response to Abnormal Operation - The safety system responds properly to all foreseeable faults with corresponding diagnostics.
GuardLogix Controller and Network Tests
Test Step
Validation
While the system is running, remove the EtherNet/IP network connection between the
Kinetix drive and the controller. The Kinetix STO feature should de-energize. Verify proper
machine status indication and I /O connection status in the safety application program.
Restore the EtherNet/IP connection and allow time to re-establish communication. Verify
that the Kinetix STO feature does not automatically energize.
While the system is running, switch the controller out of Run mode. The Kinetix drive
should de-energize. Return the controller to Run mode. The Kinetix STO feature should
remain de-energized. Verify proper machine status indication and safety application
program indication.
Pass/Fail
Changes/Modifications
Pass/Fail
Changes/Modifications
Pass/Fail
Changes/Modifications
Safety InputTests
Test Step
Validation
To find a safety function application technique that uses the type of input device you plan
to use, refer to: http://marketing.rockwellautomation.com/safety/en/safety_functions
Use the input section of that validation procedure as a guide to test your input device.
Validation
Initiate a Safety Reset command. The Kinetix STO feature should energize for a normal
machine run condition. Verify proper machine status indication and safety application
program indication.
(1) These catalog numbers may be different, depending on which products you chose for your system.
IMPORTANT
18
In addition to the verification and validation steps provided here, consult the application technique for your input subsystem for the steps that are required
to validate the input device. For the input subsystem example used in this safety function application technique, we reference Door-monitoring Interlock
Switch with an Integrated Safety Controller Safety Function, publication SAFETY-AT034.
Stop Cat. 0 or 1 via a Kinetix Drive with Integrated Safe Torque Off on EtherNet/IP Networks Safety Function
Additional Resources
These documents contain additional information concerning related products from Rockwell Automation.
Resource
Description
GuardLogix 5570 and Compact GuardLogix 5370 Controller Systems Safety Reference
Manual, publication 1756-RM099
Provides information on how to install, configure, and program the GuardLogix 5570
controllers in the Logix Designer application.
Information on how to install, configure, start, and troubleshoot your Kinetix 5500
servo drive system.
Information on how to install, configure, start, and troubleshoot your Kinetix 5700
servo drive system.
19
www.rockwellautomation.com/knowledgebase
www.rockwellautomation.com/global/support/get-supportnow.page
Find the Direct Dial Code for your product. Use the
code to route your call directly to a technical support
engineer.
www.rockwellautomation.com/global/support/directdial.page
Literature Library
www.rockwellautomation.com/literature
www.rockwellautomation.com/global/support/pcdc.page
Documentation Feedback
Your comments will help us serve your documentation needs better. If you have any suggestions on how to improve this document, complete the
How Are We Doing? form at http://literature.rockwellautomation.com/idc/groups/literature/documents/du/ra-du002_-en-e.pdf.
Rockwell Automation maintains current product environmental information on its website at http://www.rockwellautomation.com/rockwellautomation/about-us/sustainability-ethics/product-environmental-compliance.page.
Allen-Bradley, ControlLogix, POINT Guard I/O, GuardLogix, Kinetix, LISTEN. THINK. SOLVE, Rockwell Software, Rockwell Automation, SensaGuard, and Studio 5000 Logix Designer are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
CIP Safety and EtherNet/IP are trademarks of ODVA, Inc.
Rockwell Otomasyon Ticaret A.., Kar Plaza Merkezi E Blok Kat:6 34752 erenky, stanbul, Tel: +90 (216) 5698400
Copyright 2016 Rockwell Automation, Inc. All rights reserved. Printed in the U.S.A.