Monitoring and Locking A Protective Door With The 3Rk3 MSS: SIRIUS Safety

Monitoring and locking a
protective door with the

3RK3 MSS
Siemens
SIRIUS Safety Industry
Online
https://support.industry.siemens.com/cs/ww/en/view/62837891 Support
Legal information
Legal information
Use of application examples
Application examples illustrate the solution of automation tasks through an interaction of several
components in the form of text, graphics and/or software modules. The application examples are
a free service by Siemens AG and/or a subsidiary of Siemens AG (“Siemens”). They are non-
binding and make no claim to completeness or functionality regarding configuration and
equipment. The application examples merely offer help with typical tasks; they do not constitute
customer-specific solutions. You yourself are responsible for the proper and safe operation of the
products in accordance with applicable regulations and must also check the function of the
respective application example and customize it for your system.
Siemens grants you the non-exclusive, non-sublicensable and non-transferable right to have the
application examples used by technically trained personnel. Any change to the application
examples is your responsibility. Sharing the application examples with third parties or copying the
application examples or excerpts thereof is permitted only in combination with your own products.
The application examples are not required to undergo the customary tests and quality inspections
of a chargeable product; they may have functional and performance defects as well as errors. It is
your responsibility to use them in such a manner that any malfunctions that may occur do not
result in property damage or injury to persons.
Disclaimer of liability
Siemens shall not assume any liability, for any legal reason whatsoever, including, without
limitation, liability for the usability, availability, completeness and freedom from defects of the
application examples as well as for related information, configuration and performance data and
any damage caused thereby. This shall not apply in cases of mandatory liability, for example
under the German Product Liability Act, or in cases of intent, gross negligence, or culpable loss of
life, bodily injury or damage to health, non-compliance with a guarantee, fraudulent
non-disclosure of a defect, or culpable breach of material contractual obligations. Claims for
damages arising from a breach of material contractual obligations shall however be limited to the
 Siemens AG 2018 All rights reserved
foreseeable damage typical of the type of agreement, unless liability arises from intent or gross
negligence or is based on loss of life, bodily injury or damage to health. The foregoing provisions
do not imply any change in the burden of proof to your detriment. You shall indemnify Siemens
against existing or future claims of third parties in this connection except where Siemens is
mandatorily liable.
By using the application examples you acknowledge that Siemens cannot be held liable for any
damage beyond the liability provisions described.
Other information
Siemens reserves the right to make changes to the application examples at any time without
notice. In case of discrepancies between the suggestions in the application examples and other
Siemens publications such as catalogs, the content of the other documentation shall have
precedence.
The Siemens terms of use (https://support.industry.siemens.com) shall also apply.
Security information
Siemens provides products and solutions with industrial security functions that support the secure
operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is necessary
to implement – and continuously maintain – a holistic, state-of-the-art industrial security concept.
Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems, machines
and networks. Such systems, machines and components should only be connected to an
enterprise network or the internet if and to the extent such a connection is necessary and only
when appropriate security measures (e.g. firewalls and/or network segmentation) are in place.
For additional information on industrial security measures that may be implemented, please visit
https://www.siemens.com/industrialsecurity.
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends that product updates are applied as soon as they are available
and that the latest product versions are used. Use of product versions that are no longer
supported, and failure to apply the latest updates may increase customer’s exposure to cyber
threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS Feed
at: http://www.siemens.com/industrialsecurity.
Monitoring and locking a protective door with the 3RK3 MSS

Entry-ID: 62837891, V1.1, 01/2018 2
Table of contents
Table of contents
Legal information ......................................................................................................... 2
1 Question .............................................................................................................. 4
1.1 Answer.................................................................................................. 4
2 General ................................................................................................................ 5
2.1 Introduction .......................................................................................... 5
2.2 Terms .................................................................................................... 6
2.3 Difference between the two safety functions: position
monitoring and locking....................................................................... 11
3 Variations of the position switch with tumbler .............................................. 13
3.1 Enclosure versions and types of connection ....................................... 13
3.2 Installation and use of tumblers ......................................................... 18
4 "Protective door monitoring with tumbler" block .......................................... 19
5 Design and parameter assignment ................................................................. 23
5.1 SIL1/PLc for position monitoring and tumbler .................................... 23
5.2 SIL2/PLd for actuator monitoring and tumbler .................................... 27
5.3 SIL2/PLd for position monitoring via AS-i bus ..................................... 32
5.4 SIL3/PLe for position monitoring and SIL2/PLd for the tumbler........... 38
5.5 SIL3/PLe for actuator monitoring and tumbler .................................... 44
6 Appendix .......................................................................................................... 49
6.1 Service and Support ........................................................................... 49
6.2 Application Support ............................................................................ 50
6.3 Links and Literature ............................................................................ 50
6.4 Change documentation ...................................................................... 50

Entry-ID: 62837891, V1.1, 01/2018 3
1 Question
1 Question
How can position switches with tumbler be connected to the 3RK3 MSS?
1.1 Answer
Position switches with tumbler can be connected to the MSS via conventional
wiring or via AS-i.
When a position switch with tumbler is connected via conventional wiring, a safety
level up to SIL2/PLd can be achieved for both safety functions (position monitoring
and locking). When two position switches with tumbler are used, a safety level up
to SIL3/PLe can be achieved for both safety functions.
When a position switch with tumbler is connected via AS-i, a safety level up to
SIL2/PLd can be achieved for the position monitoring safety function.
The FAQ below shows how position switches with tumbler are connected to the
MSS and parameterized.

Entry-ID: 62837891, V1.1, 01/2018 4
2 General
2 General
2.1 Introduction
Interlocking devices with tumbler are used to protect danger zones against
inadvertent entry. There are usually two reasons for this:
Firstly, the protection of persons who
should be protected, for example,
against subsequent hazardous
machine movements, high
temperatures, etc. EN 1088 describes
principles for the design and selection
of interlocking devices. This standard
states that the danger zone must not
be accessible until after the hazardous
machine movement has been stopped.
Secondly, locking may be useful for
reasons of process reliability. This
situation occurs when the danger is
stopped after opening the guard, but
damage can occur to the machine or
workpiece as a result. In this case, the
machine is first moved to a controlled
stop position before access is enabled.

Both applications can be implemented quickly and easily using the position
switches with tumbler from the 3SE53… or 3SF13… series and the MSS
Advanced/ASIsafe.
This FAQ should provide support in selecting the right position switch with tumbler
for the required application and the
necessary safety level.
The connection and configuration of a
SIRIUS 3RK3 Modular Safety System (MSS)
Advanced/ASIsafe is described for various
safety levels with the aid of specially
chosen application examples.
In this FAQ, this is implemented using the
"Protective door with tumbler" system block
provided in the MSS Advanced/ASIsafe. This
block can be easily adapted to the relevant
application and the required safety level
using a few parameters.
Note The MSS Advanced/ASIsafe central module and the Modular Safety System
ES 2008 software + SP2 or later or SIRIUS Safety ES are required in order to
use the "Protective door with tumbler" system block.

Entry-ID: 62837891, V1.1, 01/2018 5
2 General
2.2 Terms
Start/restart function
The start and restart function is used to start the machine once functional safety
has been restored. For example, after a protective door is opened and then closed.
Three different start types are available in the MSS.
Automatic start:
In the case of an automatic start, the device is started without manual
acknowledgment once functional safety has been restored. This function is also
known as dynamic operation and is not permissible for emergency stop devices.
Non-access guards can be operated with automatic start, however, it must be
demonstrated that a hazardous situation cannot occur when the guard is closed (EN
ISO 13849-1, start/restart function).
A hazardous situation may occur, for example, if the protective door slams shut
behind a person entering the danger zone.
Using the example of a protection cover, closure triggers an immediate machine

start.
Manual start:
In the case of a manual start, the machine is started by pressing the "ON" button
once functional safety has been restored. This function is also known as steady-
state operation and is a minimum requirement for emergency stop devices (EN
60204-1, conscious action).
Using the example of a protective door, the "ON" button must be pressed after
closing the protective door in order to start the machine.

Entry-ID: 62837891, V1.1, 01/2018 6
2 General
Monitored start:
In the case of a monitored start, the device is started by pressing the "ON" button
once functional safety has been restored. Contrary to the manual start, the
monitored start evaluates a signal change of the "ON" button. The "ON" button must
be held down for at least 0.15 seconds but no longer than 2 seconds in order to
start the machine. This means that the "ON" button cannot be tampered with.
In general, a monitored start is always recommended as this provides the best

protection against manipulation or bus errors (transmission errors due to bit errors).
Null sequence
When both switch contacts of a connected safety element are open, this is referred
to as a null sequence.
Positively-driven contacts /mirror contacts

Positively-driven contacts or mirror contacts are used to diagnose the functional
capability of the contactor relay or power contactor.
According to EN 60947-5-1, Annex L, positively-driven contact elements are a
combination of "n" NO contacts and "m" NC contacts, which are designed such that
they cannot be closed simultaneously.
When positively-driven contacts or mirror contacts are used, a feedback circuit must
be implemented. The states of the contactor auxiliary NC contact are evaluated
using this feedback circuit. The load can only be switched on when the feedback
circuit is closed.

Entry-ID: 62837891, V1.1, 01/2018 7
2 General
The illustration on the left shows

an example of how the welding
of a contact can be detected
using positively-driven contacts:
In the first two steps, no faults

are detected when switching
from "0" to "1".
A contact is then welded. On the

subsequent control signal
change from "1" to "0", the
feedback signal remains
unchanged and is still set to "0".
The fault is detected by

evaluating the control signal and
the feedback signal.
According to EN 60947-4-1, Annex F, a mirror contact is an auxiliary NC contact

that cannot be closed simultaneously with a main NO contact.
Both contact characteristics, the positively-driven contact element in the contactor

relay as well as the mirror contacts in the power contactor, are absolutely equal.
Positive opening operation

For positive opening contacts, the contacts
separate as a direct result of a defined motion
of the switch actuator using non-sprung
mechanical linkage (e.g. pressing an
emergency stop). For the electrical equipment
of machines, the assured opening of NC
contacts in all safety circuits is recommended.
In the case of position switches with tumbler (from the 3SE53… or 3SF13… series),
the NC contacts are designed as positive opening contacts.
Fail-locking system
Design feature of a tumbler which ensures that the locking mechanism (e.g. a
locking bolt) cannot enter the locked position (locking position) while the guard is
open.

Entry-ID: 62837891, V1.1, 01/2018 8
2 General
The mechanical design of Siemens position switches with tumbler (3SE53... and
3SF13…) complies with the requirements for fail-locking systems in accordance
with EN 1088.
Spring-locked (closed-circuit principle)

As illustrated below, in the case of a spring-locked tumbler the interlock bolt is
positioned in the actuator by a spring. The advantage of this is that the locking
function is maintained in the event of a power failure or wire break; for this reason
a spring-locked tumbler is recommended in the case of safety-related locking.
The tumbler can be unlocked manually using an auxiliary release mechanism if, for
example, access is required due to voltage failure or during installation (see Chapter
2.1).
Magnetic field lock (open-circuit principle)

In the case of a solenoid-locked position switch with tumbler, the interlock is
controlled by the magnet. If the magnet is energized the actuator is held in place by
the bolt.
Note Protective door unlocking in the event of voltage failure:

Risk of death, serious injury or material damage
Please note that in the event of voltage failure this tumbler version
does not take into account any system delay times. Should this result in

Entry-ID: 62837891, V1.1, 01/2018 9
2 General
a potential hazard for persons, this tumbler version must not be used.
Solenoid-locked position switches with tumbler can be identified by the 10th

character in the MLFB. Here the letter B represents a solenoid-locked position
switch with tumbler. For example 3SE5312-0SB11-****.
MLFB Interlock
3S**3**-*SB**-**** Solenoid-locked
3S**3**-*S(D-J)**-**** Spring-locked
Note Only spring-locked position switches with tumbler are used in this FAQ.
Exclusion of faults
Example: Breakage of the actuator
Thanks to the application of proven safety principles, the exclusion of faults is also
permissible for mechanical systems: for example, the appropriate installation
(design measure) of the position switch and the separate actuator can rule out
breakage of the separate actuator.
Thanks to an additional two-channel electrical version of the position switch (with
positive opening contacts), safety level PLd or SIL2 can be achieved.

Entry-ID: 62837891, V1.1, 01/2018 10
2 General
Note The device may only be used and installed in accordance with the
information provided by the manufacturer and under the conditions
specified, which must be maintained during operation.
Since the machine manufacturer must provide proof of fault exclusion,
the component manufacturer is unable to carry out a definitive
assessment of the measures taken.
Possible design measures (greater protection against failure) may include:

• Prevention of self-loosening (e.g. contact welding, riveting)
• Tight fit following installation (e.g. bolts or pins)
• Do not use position switches as a mechanical end stop
• Compliance with the approach velocity, direction of approach, and angle of
approach in accordance with information provided by the manufacturer
• Take into consideration any damage caused by foreseeable external influences:
keep away from any materials (e.g. dirt, dust, metal shavings, paint, etc.) which
could lead to the failure or indeed destruction of the position switch by selecting
the correct type of installation
2.3 Difference between the two safety functions: position

monitoring and locking

Two safety functions are integrated within the safety position switch with tumbler,
whose only common interface is the actuator. This chapter explains the two
functions individually.
Position monitoring:
Position monitoring determines whether the guard is closed. In the case of position
switches with tumbler from the 3SE53… or 3SF13… series, this can be queried
electromechanically via one NO contact and two NC contacts.
Locking:
The locking function holds the guard securely in the closed position, a
counteracting force of up to 2600 N is possible here depending on the version.
Locking can be activated and deactivated via magnet control. The position of the
magnet can be queried via the magnet monitoring function.
Operational locking:
Operational locking is the most common application.
In the event that the guard is opened inadvertently, the workpiece or machine may
be damaged due to the immediate machine stop.
In this case, the machine is first moved to a controlled stop position before access is
enabled.
Safety-related locking:

Entry-ID: 62837891, V1.1, 01/2018 11
2 General
The safety-related locking function is used in order to protect persons. This is

necessary, for example, in the event of large rotating masses, sources of intense
heat or hazardous gases. These dangers cannot be shut down immediately.
In this case, the locking function should ensure that access remains closed until the
source of danger has been completely shut down and there is consequently no
danger to persons. A safety-related inspection and assessment are required here.
Joint use of magnet monitoring and actuator monitoring for two-channel position
monitoring
Thanks to the fail-locking system, it is also possible to determine whether the
actuator is inserted using the magnet monitoring function. The tumbler only
interlocks if the actuator is inserted.
This means that magnet monitoring and actuator monitoring can be combined in
order to implement two-channel position monitoring and simultaneously provide
the magnet monitoring information in the MSS.
This is of particular interest for the AS-i version of the position switch with tumbler
(MLFB 3SF13**-…-1BA1) as it only has two channels available for fail-safe read-in.
Note When implementing this type of actuator monitoring, please note that
there is a discrepancy in the actuator monitoring when locking is
deactivated. In order to enable the machine again, the actuator must
also be withdrawn (null sequence). This means that the door must be
opened again each time locking is deactivated.

If this behavior is undesirable, select the version (3SF1314-…-1BA4) of
the position switch with tumbler where a discrepancy evaluation is
carried out on both NC contacts for actuator monitoring in the position
switch itself and the result is supplied to one channel. Here discrepancy
evaluation can be deactivated in the MSS.

Entry-ID: 62837891, V1.1, 01/2018 12
3 Variations of the position switch with tumbler
3 Variations of the position switch with

tumbler
The safety position switch is available in various configurations and versions. This
chapter should provide an overview of the configuration options and versions.
3.1 Enclosure versions and types of connection

1. Two different enclosure versions are available. One is a plastic version with a
locking force of 1300 N and the other is a metal version (plastic cover) with a
locking force of 2600 N. The 6th character of the MLFB indicates the form of
enclosure.
MLFB Form of enclosure

3S**31-… Metal enclosure
3S**32-… Plastic enclosure
2. The fixing holes and actuator level are congruent with the slim size of the
3SE37/8 and are therefore easily exchangeable.
3. Auxiliary release is possible at the front or back. Release is always possible at
the front. If rear installation is desired, this should be taken into consideration
when ordering. If an attachment is not used (for example a key-operated
release), release is possible via the crosshead screw.
There are three different auxiliary releases:
Key-operated release
In this case the tumbler can be released manually using a key.
Escape release
Allows the tumbler to be unlocked manually so that the danger zone can be
exited without additional aids.

Entry-ID: 62837891, V1.1, 01/2018 13
Emergency release
Allows the tumbler to be unlocked manually in a dangerous situation without
additional aids. To re-enable interlock blocking, the position switch with
tumbler must be screwed on as it is when a repair is carried out.
MLFB Interlock combination

3S**3**-**D**-… Spring-actuated lock/front auxiliary release
3S**3**-**E**-… Spring-actuated lock/front key-operated release
3S**3**-**F**-… Spring-actuated lock/front escape release
3S**3**-**G**-... Spring-actuated lock/front auxiliary release/rear
escape release
3S**3**-**H**-… Spring-actuated lock/front key-operated
release/rear escape release
3S**3**-**J**-… Spring-actuated lock/front auxiliary release/rear
emergency release
3S**3**-**K**-… Spring-actuated lock/front key-operated
release/rear escape release

Entry-ID: 62837891, V1.1, 01/2018 14
4. An optical signaling device can be selected as an option. The signaling device

uses 2 LEDs on the front surface to indicate the switch position of the interlock
and the guard.
Guard Tumbler Display Meaning

Closed Unlocked Yellow and Actuator free for
green withdrawal
Closed Locked Green Actuator locked
Open Unlocked Yellow Actuator withdrawn
In the case of the AS-i version of the position switch with tumbler, the state of
the F outputs and the AS-i bus is displayed on the device. The selected position
switch with tumbler determines which of the channels is assigned to the
actuator and the tumbler. This is described in more detail in the "Connection via
AS-i" section below.
LED 1 (green) AS-i AS-i active

LED 2 (red) FAULT Bus fault
LED 3 (yellow) F-IN1 The output state is "1"
LED 4 (yellow) F-IN2 The output state is "1"
5. The device can be connected via 3x (M20x1.5) or 3x M12 plug connector as

standard. The connection to the AS-Interface is made using a 4-pole M12 plug
connector (plastic version) to the yellow AS-Interface bus cable (the low power
consumption of the magnet, i.e. max. 170 mA, means that an additional
auxiliary power supply is not necessary). The 7th character of the MLFB
indicates the type of device connection.
MLFB Device connection
3S**3*2… M20x1.5
3S**3*4… M12 plug connector
3SE53*8… Special (without AS-Interface)

Entry-ID: 62837891, V1.1, 01/2018 15
Conventional connection
The safety position switch with tumbler is available for conventional wiring or with
AS-Interface.
In the case of conventional
wiring (3SE53**-…), the position
switch with tumbler can be wired
as per the requirements of the
safety level and application.
Contact versions with two NC
contacts and one NO contact can
be selected for position
monitoring and magnet
monitoring.
The magnet is controlled via E1
and E2. Here the magnet can be
controlled with 24 V DC, 24 V AC,
115 V AC or 230 V AC depending
on the version.
MLFB Magnet control

3SE53**-****1-… 24 V AC/DC
3SE53**-****2-… 115 V AC
3SE53**-****3-… 230 V AC
Connection via AS-i

Position switches with tumbler from the 3SF13**-… series are connected via AS-i.
With the infrastructure in place (AS-i master, power supply), an AS-i-capable MSS
can read the fail-safe inputs of the position switch with tumbler. The magnet is
controlled via the standard AS-i output and can be implemented via a CPU, for
example.
The "Failsafe and standard cross communication of the MSS 3RK3 via AS-Interface"
FAQ describes how to design an AS-i infrastructure in connection with the MSS:
http://support.automation.siemens.com/WW/view/en/58512565
If the position switch with tumbler and the MSS are connected to the AS-i
infrastructure, two fail-safe inputs can be evaluated. The internal wiring determines
which signals are transmitted. They are already pre-wired in 3 versions:
In the first version (MLFB … -1BA1), there is one channel at the NC contact of the
actuator and one at the NC contact of the magnet.

Entry-ID: 62837891, V1.1, 01/2018 16
In the second version (MLFB … -1BA3), one NC contact of the actuator is connected
to one channel.
In the third version (MLFB … -1BA4), the discrepancy between the two NC contacts
of the actuator is evaluated in the switch itself. The result is supplied to channel 1.
Channel 2 is wired to the NC contact of the magnet.

Entry-ID: 62837891, V1.1, 01/2018 17
3.2 Installation and use of tumblers

Tumblers adjacent to the door handle
In order to ensure problem-free use, it is essential that the actuator is always
inserted cleanly into the tumbler. If, in spite of the interlock being active, the door is
pulled, the door may become deformed or warped. This deformation can be
minimized if the tumbler is fitted directly adjacent to the door handle. In this way it
can be ensured that the actuator can still be cleanly inserted into the tumbler and
withdrawn even after a long period of use.
Heavy protective doors: provide door damper as end stop

If the tumbler is used as a mechanical stop, it may be damaged as a result of the
high impact force. One solution is to use an additional damper on the door. The
damper can prevent the tumbler being damaged as a result of the impact and
rebound action of the actuator.
Protect the tumbler against manipulation

The easy bypassing and the disabling of interlocking devices by hand or by means
of simple aids must be rendered impossible during the installation of the tumbler.
Such aids include, for example, tools, pencils, ballpoint pens, pins, screws, nails,
straight or easily bent pieces of wire, bottle openers, door keys, adhesive strips,
scissors, knives, etc. (BGI 575)

Entry-ID: 62837891, V1.1, 01/2018 18
4 "Protective door monitoring with tumbler" block
4 "Protective door monitoring with tumbler"

block
Block
Note The function element is only available in MSS ES if a 3RK3 MSS

Advanced/ASIsafe is used. If a 3RK3 MSS Basic is configured in the
configuration, the function element will be hidden in the catalog
window.
Description
The "Protective door with tumbler" function element can be used to evaluate signals
from protective doors. You can control the door interlocking and monitor its status.
For this purpose, the element has the following inputs:
 Two function inputs IN1 and IN2 for position detection of the protective
door.
 A "FEEDBACK_LOCK" function input for acquiring the interlocking state of
the tumbler.
 An "IN_LOCK" function input for controlling the tumbler.
The element provides the following signals as the result:
 The switch-off signal for the system is output via function output "Q."
 The control signal for the tumbler is output via function output "LOCK."
 Error messages are output via function output "FAULT."

Entry-ID: 62837891, V1.1, 01/2018 19
Functional principle
Function output "Q" of this element is only set to the value "1" if the protective door
is closed and locked.
When an unlocking command (= value "1") is applied to function input "IN_LOCK",
function output "Q" is immediately set to "0" and the tumbler is unlocked after an
adjustable unlocking time via function output "LOCK".
If the locking command is applied to function input "IN_LOCK" before the unlocking
time has elapsed, the tumbler will remain locked and the system can restart.
To lock an unlocked tumbler again, it is not necessary for the protective door to
have been opened in the meantime. It can remain closed and be immediately
locked again.
Discrepancy time
The maximum time that may elapse between the operation of both switching
contacts of a connected safety element before the MSS enters the fault state.
If an infinite discrepancy time is set, the MSS will not enter the fault state in the
event of a discrepancy. Nevertheless, a null sequence is required in order to restart
the machine. This is necessary in order to ensure that the second contact is still
functional.
Interlock types
The "Protective door with tumbler" function element can be used for spring-locked
or solenoid-locked position switches.
 Spring-locked in accordance with the closed-circuit principle
The tumbler is locked passively and unlocked actively, i.e. spring force
keeps the tumbler locked. In the event of voltage failure, the tumbler
remains locked.

Entry-ID: 62837891, V1.1, 01/2018 20
 Solenoid-locked in accordance with the open-circuit principle
The tumbler has to be locked actively, i.e. magnetic force (solenoid

energized) keeps the tumbler locked. In the event of voltage failure, the
tumbler is automatically unlocked, thus allowing service engineers to enter
the system while it is de-energized.
Warning Protective door unlocking in the event of voltage failure
Please note that in the event of voltage failure this tumbler version
does not take into account any system delay times. Should this result
in a potential hazard for persons, this tumbler version must not be
used.
Start override
The start override enables function output "Q" to be set to the value "1" although an
unlocking command is pending. This function can be used if the locking or
unlocking command comes from a standstill monitor (e.g. 3TK2810-1). (The
standstill monitor only sends the locking command when a standstill is no longer
detected).
You can specify the length of the startup time in the "Startup time" parameter.
This setting has the following properties:
 When the START command is applied to function input "START", the
tumbler of the element is automatically locked if the unlocking command is
pending at function input "IN_LOCK" and the protective door is closed.
Function output "Q" is set to "1." Parallel to this, the startup time is started
and the "Start override active" message is set.
If the protective door is open, locking is only performed if this is permitted in the
"Tumbler with protective door open" parameter.
 You can adjust the length of the startup time according to the application
using the "Startup time" parameter. At the latest, the "Start override active"
message will be reset once the startup time has elapsed. The locking
command must then be pending at function input "IN_LOCK". If no locking
command is pending, function output "Q" will be reset to "0" and the
tumbler will be unlocked after the unlocking time has elapsed. If the
locking command is detected before the startup time has elapsed, the
startup time will be interrupted. The tumbler remains locked and the
function output retains the value "1."
 If another starting command is detected at function input "START" while the
startup time is running, the startup time is "retriggered", i.e. started from
the beginning without the signal state of function outputs "Q" and "LOCK"
being changed.
 This function is deactivated if the "Startup time" parameter is parameterized
as "0." A value not equal to "0" activates the function.
Warning Erroneous start in the event of transmission errors at fieldbus

inputs

Entry-ID: 62837891, V1.1, 01/2018 21
Transmission errors at the fieldbus inputs can result in an erroneous

start in which the system is inadvertently started. To prevent this, the
start type must be parameterized as "monitored." This is necessary in
order to achieve SIL 3 according to IEC 61508/PL e according to
DIN EN ISO 13849-1.
Notice The configured discrepancy time of the "Protective door with tumbler"
monitoring function must be greater than the configured input delay
because otherwise a discrepancy time violation may occur with
bouncing contacts, e.g. when the protective door is closed.
Note On a signal change at function input "FEEDBACK_LOCK", a fault is

generated immediately if the signal at function output "LOCK" has not
changed.

Entry-ID: 62837891, V1.1, 01/2018 22
5 Design and parameter assignment

Note Only spring-locked position switches with tumbler are used in the
following application examples.
5.1 SIL1/PLc for position monitoring and tumbler

Principle requirements for safety functions
Requirements for implementing actuator monitoring according to SIL1/PLc:
 Single-channel fail-safe querying of the sensor
 The response can have a single-channel design and must be monitored
dynamically. Contactor read back may be carried out via a standard input,
however because the MSS Advanced central unit only has fail-safe inputs,
these are used in the following representations.
The following figure shows the theoretical signal sequence:
Requirements for implementing the tumbler according to SIL1/PLc:

 A safety-related signal must be used for acquisition. (In this example, the
relay outputs of a 3TK2810-1 safety-related speed monitor)
 The response (locking the guard) must be controlled in a fail-safe way and
may be read back via a standard input. Because the MSS Advanced central
unit only has fail-safe inputs, these are used in the following
representations.

Entry-ID: 62837891, V1.1, 01/2018 23
Hardware design

Entry-ID: 62837891, V1.1, 01/2018 24
Parameter assignment of the MSS

1. Step: Adding the hardware used
2. Step: Adding the required blocks and parameter assignment

1. Add blocks
2. Assign block parameters
Note If the block is selected in the block library, a detailed description of the
parameters can be viewed via the "F1" key.

Entry-ID: 62837891, V1.1, 01/2018 25
3. Step: Linking blocks to the corresponding signals


Entry-ID: 62837891, V1.1, 01/2018 26
5.2 SIL2/PLd for actuator monitoring and tumbler

Requirements for implementing actuator monitoring according to SIL2/PLd:
 Must be possible to rule out breakage of the actuator (Chapter 2.2 terms)
 The sensor must be queried redundantly
 The response must have a single-channel design and must be monitored
dynamically. Contactor read back may be carried out via standard inputs,
Requirements for implementing the tumbler according to SIL2/PLd:

relay outputs of a safety-related speed monitor)
 The response (locking the guard) must be both controlled and read back in
a fail-safe way. This is because the feedback circuit must have the same
safety level as the safety function.

Entry-ID: 62837891, V1.1, 01/2018 27

Entry-ID: 62837891, V1.1, 01/2018 28
Hardware design
Two options are presented here for the wiring. The difference is in the magnet
control. Because the cross circuit inhibits a tumbler, either the cross circuit must be
excluded here or a response must be possible via p/m-switching.
Option 1 (cross-circuit proof installation of control):

Entry-ID: 62837891, V1.1, 01/2018 29


1. Add blocks

Entry-ID: 62837891, V1.1, 01/2018 30


Entry-ID: 62837891, V1.1, 01/2018 31
5.3 SIL2/PLd for position monitoring via AS-i bus

Properties of the AS-i version
In the case of the AS-i version of the position switch with tumbler, the minimized
wiring effort is a key advantage. The MSS can monitor up to 31 position switches
via AS-i up to SIL2/PLd.
Because the magnet controls the locking function via a standard AS-i slave, only
operational locking is supported. The slave is controlled via the AS-i master.
The "Failsafe and standard cross communication of the MSS 3RK3 via AS-Interface"
FAQ describes how to design an AS-i infrastructure in connection with the MSS:
Note Position switches with tumbler from the 3SF13*… series are not
approved for a 24 V power supply (AS-i Power 24V). An AS-i power
supply (30 V) is required.
The list of approved AS-i slaves can be found under the following link:
Behavior of the safety function (position monitoring) for the various switch versions
MLFB Discrepancy Triggering of Restart possible after

evaluation safety
in the MSS function
…-1BA1 Yes On unlocking Opening, closing, and locking the

guard
…-1BA3 Yes On opening Closing the guard
…-1BA4 No On unlocking Locking the guard (must not be

opened)

Entry-ID: 62837891, V1.1, 01/2018 32

Requirements for implementing actuator monitoring according to SIL2/PLd:
 The sensor must be queried redundantly
dynamically. Read back may be carried out via standard inputs, however
because the MSS Advanced central unit only has fail-safe inputs, these are
used in the following representations.

Entry-ID: 62837891, V1.1, 01/2018 33
Hardware design

Entry-ID: 62837891, V1.1, 01/2018 34

1. Adding the MSS Advanced central unit
2. Clicking on the new "Subsystem" menu command
2. Step: Adding the AS-i slave


Entry-ID: 62837891, V1.1, 01/2018 35
3. Step: Adding and assigning the parameters of the blocks

1. Add blocks

Entry-ID: 62837891, V1.1, 01/2018 36


Entry-ID: 62837891, V1.1, 01/2018 37
5.4 SIL3/PLe for position monitoring and SIL2/PLd for the

tumbler
Requirements for implementing actuator monitoring according to SIL3/PLe:
 Redundant mechanical position monitoring
dynamically. Contactor read back may be carried out via standard inputs,
Requirements for implementing the tumbler according to SIL2/PLd:

 Breakage of the actuator must be ruled out (Chapter 2.2 terms)
relay outputs of a 3TK2810-1 safety-related speed monitor)
 The response (locking the guard) must be controlled and read back in a fail-
safe way.

Entry-ID: 62837891, V1.1, 01/2018 38

Entry-ID: 62837891, V1.1, 01/2018 39
Hardware design
Two options are presented here for the wiring. The difference is in the magnet
control. Because the cross circuit inhibits a tumbler, either the cross circuit must be
excluded here or a response must be possible via p/m-switching.
Option 1 (cross-circuit proof installation of control):

Entry-ID: 62837891, V1.1, 01/2018 40
Option 2 (p/m-switching of control):


Entry-ID: 62837891, V1.1, 01/2018 41


1. Add blocks

Entry-ID: 62837891, V1.1, 01/2018 42


Entry-ID: 62837891, V1.1, 01/2018 43
5.5 SIL3/PLe for actuator monitoring and tumbler

Requirements for implementing actuator monitoring according to SIL3/PLe:
 Redundant mechanical position monitoring
 It must be possible to rule out the breakage of both actuators by a common
cause
because the MSS Advanced central unit only has fail-safe inputs, these are
used in the following representations.
Requirements for implementing the tumbler according to SIL3/PLe:

 Redundant mechanical version of the tumbler
 It must be possible to rule out the breakage of both actuators by a common
cause
because the MSS central unit has fail-safe inputs, these are used.

Entry-ID: 62837891, V1.1, 01/2018 44

Entry-ID: 62837891, V1.1, 01/2018 45
Hardware design


Entry-ID: 62837891, V1.1, 01/2018 46

1. Add blocks

Entry-ID: 62837891, V1.1, 01/2018 47


Entry-ID: 62837891, V1.1, 01/2018 48
6 Appendix
6 Appendix
6.1 Service and Support
Industry Online Support
Do you have any questions or need assistance?
Siemens Industry Online Support offers round the clock access to our entire
service and support know-how and portfolio.
The Industry Online Support is the central address for information about our
products, solutions and services.
Product information, manuals, downloads, FAQs, application examples and videos
– all information is accessible with just a few mouse clicks at:
https://support.industry.siemens.com
Technical Support
The Technical Support of Siemens Industry provides you fast and competent
support regarding all technical queries with numerous tailor-made offers
– ranging from basic support to individual support contracts. You send queries to
Technical Support via Web form:
www.siemens.com/industry/supportrequest
SITRAIN – Training for Industry

With our globally available training courses for our products and solutions, we help
you achieve with practical experience, innovative learning methods and a concept
that’s tailored to the customer’s specific needs.
For more information on our offered trainings and courses, as well as their
locations and dates, refer to:
www.siemens.com/sitrain
Service offer
Our range of services includes the following:
 Plant data services
 Spare parts services
 Repair services
 On-site and maintenance services
 Retrofitting and modernization services
 Service programs and contracts
You can find detailed information on our range of services in the service catalog:
https://support.industry.siemens.com/cs/sc
Industry Online Support app

You will receive optimum support wherever you are with the "Siemens Industry
Online Support" app. The app is available for Apple iOS, Android and Windows
Phone:
https://support.industry.siemens.com/cs/ww/en/sc/2067

Entry-ID: 62837891, V1.1, 01/2018 49
6 Appendix
6.2 Application Support

Siemens AG
Technical Assistance
Phone: +49 (911) 895-5900
Fax: +49 (911) 895-5907
E-mail: technical-assistance@siemens.com
6.3 Links and Literature

Table 6-1
No. Topic
\1\ Siemens Industry Online Support
https://support.industry.siemens.com
\2\ Link to this entry page of this application example
https://support.industry.siemens.com/cs/ww/en/view/62837891
\3\
6.4 Change documentation

Table 6-2
Version Date Modifications
V1.0 08/2012 First version
V1.1 01/2018 Minor layout changes

Entry-ID: 62837891, V1.1, 01/2018 50

Monitoring and Locking A Protective Door With The 3Rk3 MSS: SIRIUS Safety

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Monitoring and Locking A Protective Door With The 3Rk3 MSS: SIRIUS Safety

Hochgeladen von

Copyright:

Verfügbare Formate

Monitoring and locking a

protective door with the

Monitoring and locking a protective door with the 3RK3 MSS

Monitoring and locking a protective door with the 3RK3 MSS

Monitoring and locking a protective door with the 3RK3 MSS

stop position before access is enabled.

Monitoring and locking a protective door with the 3RK3 MSS

Using the example of a protection cover, closure triggers an immediate machine

Monitoring and locking a protective door with the 3RK3 MSS

In general, a monitored start is always recommended as this provides the best

Positively-driven contacts /mirror contacts

Monitoring and locking a protective door with the 3RK3 MSS

The illustration on the left shows

In the first two steps, no faults

A contact is then welded. On the

The fault is detected by

According to EN 60947-4-1, Annex F, a mirror contact is an auxiliary NC contact

Both contact characteristics, the positively-driven contact element in the contactor

Positive opening operation

Monitoring and locking a protective door with the 3RK3 MSS

Spring-locked (closed-circuit principle)

Magnetic field lock (open-circuit principle)

Note Protective door unlocking in the event of voltage failure:

Monitoring and locking a protective door with the 3RK3 MSS

Solenoid-locked position switches with tumbler can be identified by the 10th

Monitoring and locking a protective door with the 3RK3 MSS

Possible design measures (greater protection against failure) may include:

2.3 Difference between the two safety functions: position

monitoring and locking

Monitoring and locking a protective door with the 3RK3 MSS

The safety-related locking function is used in order to protect persons. This is

opened again each time locking is deactivated.

Monitoring and locking a protective door with the 3RK3 MSS

3 Variations of the position switch with

3.1 Enclosure versions and types of connection

MLFB Form of enclosure

Monitoring and locking a protective door with the 3RK3 MSS

MLFB Interlock combination

Monitoring and locking a protective door with the 3RK3 MSS

4. An optical signaling device can be selected as an option. The signaling device

Guard Tumbler Display Meaning

LED 1 (green) AS-i AS-i active

LED 4 (yellow) F-IN2 The output state is "1"

5. The device can be connected via 3x (M20x1.5) or 3x M12 plug connector as

MLFB Device connection

3S**3*4… M12 plug connector

3SE53*8… Special (without AS-Interface)

Monitoring and locking a protective door with the 3RK3 MSS

MLFB Magnet control

Connection via AS-i

Monitoring and locking a protective door with the 3RK3 MSS

Monitoring and locking a protective door with the 3RK3 MSS

3.2 Installation and use of tumblers

Heavy protective doors: provide door damper as end stop

Protect the tumbler against manipulation

Monitoring and locking a protective door with the 3RK3 MSS

4 "Protective door monitoring with tumbler"

Note The function element is only available in MSS ES if a 3RK3 MSS

For this purpose, the element has the following inputs:

The element provides the following signals as the result:

Monitoring and locking a protective door with the 3RK3 MSS

Monitoring and locking a protective door with the 3RK3 MSS

 Solenoid-locked in accordance with the open-circuit principle