Safety PLCs

GuardPLC System Overview . . . . . . . . . . . . . . . . . . . 8-2

GuardPLC 1200 Packaged Safety Controller . . . . . . . 8-6

GuardPLC 2000 Safety System. . . . . . . . . . . . . . . . . . . 8-7

Safety PLCs
GuardPLC Safety Control Systems
System Overview

CPU processes input values to control outputs.

GuardPLC 2000
1755 Chassis Safety System

Slot Filler

Power Supply

I/O Module converts input-circuit signals to back plane

levels and converts back plane signals to output circuit
levels. The total number of safety I/O modules must not
exceed six (any combination of digital, analog and counter).

8-2

GuardPLC 1200 Packaged
Safety Controller is a fully-
equipped and compact unit
with built-in CPU, power
supply, and I/O (digital I/O
and counter/encoder
module).
During the 1960s and throughout the 1970s, the machine control
industry made the transformation from relay-based logic to
programmable logic controllers, commonly referred to as PLC
controllers. This transformation let the control engineer create
systems with extremely high productivity, flexibility and reliability,
and revolutionized the machine control market. The continual
evolution and consolidation of safety standards among Europe,
North America and Asia has brought about new practices in the
application of safety on the factory floor. New classes of products
such as safety relays and safety switches have become familiar
fixtures in the automation industry. Now, just as the PLC controller
changed the way standard machine control logic was accomplished,
the Safety PLC System is changing the face of functional safety for
machine control.
Rockwell Automation is no stranger to meeting manufacturers’
safety needs. Some of the company’s earliest safety products
included emergency stop buttons in the early 1900s and the Allen-
Bradley 700P control relay with interlocked contacts in the 1940s. In
the 1960s, the Bulletin 1040 was created for clutch/brake control for
mechanical stamping presses. Throughout the 1970s and 1980s,
Allen-Bradley, now part of Rockwell Automation, manufactured
programmable controllers that featured unalterable core memory for
unprecedented safety. Today, safe start-up and shutdown of igniters
is provided by the Rockwell Automation advanced burner
management control systems. GuardPLC 1200 and 2000 Safety
controllers take Rockwell Automation into their next generation of
safety systems.
As industrial automation broadens to accommodate a more global
marketplace, equipment manufacturers and users are applying
international standards to their installations—in no area is this more
true than in machine safety. Historically, safety and productivity have
worked against each other on the plant floor. With the latest
developments in machine safety products, this is no longer the case.
In the past, machine safety was thought of as merely an expense; that
notion has evolved into the acceptance of safety as an investment
that may actually increase productivity. With Rockwell Automation
Safety Systems, all maintenance programs are run in the same
controller so that specific portions of a manufacturing cell can
operate while other portions are stopped for safety reasons.
Safety PLCs
GuardPLC Safety Control Systems
System Overview
Advantages
Depending on your application needs, Rockwell Automation offers
two state-of-the-art GuardPLC Safety Control Systems. The
GuardPLC 1200 Packaged Safety Controller is designed for small
control applications that require functional safety and that can be
serviced with a fixed number of I/O points.
In contrast, the GuardPLC 2000 Safety System is designed to
control large applications. This system can have a maximum of 144
digital inputs, 96 digital outputs, or 48 analog inputs, or 48 analog
outputs. You can have any combination of six safety-related I/O
modules as long as you don’t exceed the maximum current of 30A
for the 24V DC power supply.
• Programming is simple. RSLogix Guard Software, designed to
operate with Microsoft Windows NT v4.0 or Windows 2000,
provides a drag-and-drop palette of function blocks to create
safety logic; while, other screens help developers enter tag names,
populate chassis, set up communication, and associate tags with
specific I/O.
• Affordable solution. The GuardPLC Safety Control System is
built with redundant CPUs in one controller, has outputs with
built-in monitoring, is designed to comply with the latest global
safety standards, and uses graphical programming software.
Therefore, the cost of a GuardPLC safety control system is
affordable compared to the cost of using standard redundant
PLC processors, excessive I/O hardware, custom software, and
additional engineering time to create a safety system wherein all
the components meet global safety standards.
• Reliability. GuardPLC Safety Controllers and modules are
designed specifically for very high MTBF (Mean Time Between
Failure) and very low PFD (Probability of Failure on Demand).
• Modularity. The GuardPLC 2000 system provides a
configurable and expandable system including digital I/O, analog
I/O, timers, and high-speed counters.
• Compact size. The GuardPLC 1200 Packaged Safety Controller
mounts on a DIN rail and fits into limited panel space.
• Flexibility. The programmable nature of the GuardPLC
controllers make them ideal as solutions for several types of
safety applications and provides for functionality that may be
difficult or impossible to implement with a hard-wired safety
solution.
• High productivity. The flexible programming of the GuardPLC
controllers helps the control engineer create maintenance modes
of operation with “limited shutdown” capability, which allows for
quick restarting of the process and reduced downtime. The
extensive diagnostics aid in the troubleshooting and repair of the
safety system as well as reduce downtime and increase
productivity of the manufacturing process.
Safety System Features
• Designed for application in systems up to Safety Integrity Level 3
(SIL 3) according to IEC 61508 without restrictions; certified by
TÜV Product Services; and meets Machinery Directive EN 954–
1, Category 4.
8-3
Safety PLCs
GuardPLC Safety Control Systems
System Overview (continued)
• Eliminates the need for dual standard PLC processors and
excessive I/O in safety-related applications
• Eliminates writing, testing, and certifying software whose only
purpose is to monitor the safety control system
• Creates run time and maintenance programs using easy-to-
program function blocks
A GuardPLC product is the intelligent combination of safety-related
programmable controllers and easy-to-learn programming. As
shown below, there are two types of controllers available to fit
customer needs—one that’s compact and one that’s modular.
Communication
A proprietary Ethernet safety link is used for programming and
configuration between the safety controller and the Programming
and Debugging Tool with RSLogix Guard software installed.
GuardPLC 1200 Packaged
Safety Controller is a fully-
equipped and compact unit.
8-4
Safety Concept
The GuardPLC 1200 and GuardPLC 2000 systems each have a fail-
safe CPU. Faults that individually have a direct impact on the safety
system are detected within a Safety Time specified by the user. Faults
that do not directly affect the safety function of the system unless
they occur in combination with another fault are detected within the
Multiple Error Occurrence Time, which is preset in the operating
system to 24 hours. This results in the following behaviours:
• The user specifies the Safety Time and the Watchdog Time for
the safety system. The Multiple Error Occurrence Time is preset
in the operating system (24 hours).
• The controller continues to provide safety-related functions even
upon the detection of an error.
• Faulty input signals (e.g. incorrectly transmitted input values) do
not affect the safety function of the CPU. Faulted input signals
have a “0” value.
• The failure of the CPU does not affect the safety function of the
other safety-related modules (digital inputs, digital outputs, etc.).
GuardPLC 2000
Safety System is a
modular system.

Functional Design
Each of the logic circuits within the Safety PLC that supports digital
and analog inputs, outputs, and counters contains several test points
as shown in the following figure. A typical digital output logic circuit
contains a test point near each of the two safety switches located
behind the output driver as well as a third test point near the second
output driver. Each of the two safety switches is controlled by a
different microprocessor. If a failure is monitored at either of the
two safety switches due to switch or microprocessor failure or at the
test point near the output driver, the operating system of the Safety
PLC automatically acknowledges system failure. Then, on its own,
the Safety PLC defaults to a known state facilitating an orderly
equipment shutdown.
Safety PLCs
GuardPLC Safety Control Systems
System Overview (continued)
A simple system for small control applications can consist of a single
compact GuardPLC 1200 unit and a Programming and Debugging
Tool, which is a personal computer running Windows NT v4.0 or
Windows 2000 operating system and has RSLogix Guard 1200 or
RSLogix Guard 2000 installed. On-board I/O includes a maximum
of 20 digital inputs, 8 digital outputs, and 2 counters.
Programming and
Debugging Tool
Proprietary Ethernet Safety Link

Safety Safety Output

Switch 1 Switch 2 Driver
To Actuator

GuardPLC 1200 OUTPUTS

Local I/O on-board the
Test Test Test Packaged PLC
1200 GuardPLC 1200
Points Points Points Controller GuardPLC 1200 Back Plane Packaged
Output Microprocessor Controller, 8 digital
INPUTS

Driver outputs, 20 digital inputs,

and 2 counters.

Test For large applications, a module safety controller system

Points communicates over a proprietary Ethernet safety link to a
To Secondary Programming and Debugging Tool with RSLogix Guard 2000
(Redundant) Actuator
installed. You can have a maximum of 144 digital inputs, 96 digital
outputs, or 48 analog inputs or 48 analog outputs.
Mechanical Design
The GuardPLC 1200 Packaged Safety Controller contains the safety Programming and
controller, power supply, and associated safety-related I/O packaged Debugging Tool
in a rugged plastic housing. It’s a compact system that’s ideal for
small spaces.

The GuardPLC 2000 Safety System chassis, which is a modular Proprietary Ethernet Safety Link
system, can house one safety controller, one power supply, and up to
six safety-related I/O modules.

GuardPLC 2000 Local I/O on-board the

Safety GuardPLC 2000
GuardPLC 2000 Back Plane Controller:
Microprocessor
You can have any combination
of 6 I/O modules including:
a digital combination module
with 24 inputs and 16 outputs,
an 8-point analog input module, an 8-point
analog output module and a high-speed
counter module that provides 2 counters.

8-5
Safety PLCs
GuardPLC 1200 Packaged Safety Controller
1754–L28BBB
Specifications
Number of safety-related 20 (not electrically isolated)
digital inputs
Nominal Input Voltage 24V DC
On-State Voltage 10-30V DC
On-State Current 2mA @ 10V DC, 13mA @ 30V DC
Off-State Voltage 5V DC (maximum)
Off-State Current 1.5mA per channel (maximum)
4mA per channel (minimum)
Number of safety-related 8 (not electrically isolated)
digital outputs
Output Voltage Range 18.4 to 26.8 V DC
Output Current Channels 1 through 6: 0.5A per channel
Channels 7 & 8: 2A per channel
The GuardPLC 1200 is a safety-related compact Programmable Number of safety-related 2
counters
Electronic System (PES), which is designed in accordance with IEC
Inputs per counter 3 (Input A, Direction, Gate/Reset)
61131. Despite its small size, it complies with the requirements for a
Counter Resolution 24 Bit
control system with the safety integrity level (SIL 3) according
Input Frequency 100 kHz (maximum) in counter modes
IEC 61508.
Power Supply Voltage 24V DC(20 / -15%), ≤ 15% ripple
The GuardPLC 1200 is designed for smaller applications that Power Rating 8A (maximum)
require functional safety and that can be serviced with a fixed Ambient Temperature 0°C to 60°C (32°F to 140°F)
number of I/O points. The compact size of the GuardPLC 1200 (Operating)
combined with DIN rail mounting allows deployment even under Storage Temperature -40°C to 85°C (-40°F to 185°F)
cramped space conditions. Operating Humidity 5 to 95% (without condensation)
Shock Operating: 30g non operating: 50g
The GuardPLC 1200 includes a power supply, CPU, Watchdog, 20 Vibration Operating: 2g @ 10 to 500Hz
digital inputs, 8 digital outputs plus 2 counters and communication Dimensions (WxHxD) 90 x 160 x 87mm
(3.54 x 6.29 x 3.42in)
ports, all incorporated in a rugged plastic housing.
Weight 0.68 kg

Typical Applications
• Perimeter guarding for Robot/weld cells
• Perimeter guarding for Packaging Machines
• Entertainment industry (ride control and ski lift control)
• Burner Management
• Press Controls

Features
• Rugged plastic housing
• DIN rail mounting
• I/O self test
• 30 I/O points
• 24V digital I/O
• Multiple I/O test points
• Certified by TÜV for use in applications to SIL 3 according to
IEC 61508; EN 954–1, Category 4
• Programmed with RSLogix Guard Software
• RS–232 port for ASCII communication (read only)
• Ethernet port for programming, configuration and Peer-to-Peer

8-6
 Safety PLCs
GuardPLC 2000 Safety System
1755–L1
Specifications
User Memory 500 KB application code memory
500 KB application data memory
Operating Voltages 3.3V DC
5V DC
Current Consumption 3.3V @ 1.5A5V @ 0.1A
Operating Temperature 0°C to 60°C (32°F to 140°F)
Storage Temperature -40°C to 85°C (-40°F to 185°F)
Operating Humidity 5 to 95% (without condensation)
Shock Operating: 30g non operating: 50g
Vibration Operating: 2g @ 10 to 500Hz
Weight 6.3 kg (fully equipped)
Dimensions (WxHxD) 255 x 285 x 210mm
(10 x 11.22 x 8.26in)
The GuardPLC2000 CPU has one 10/100BaseT Ethernet port for
programming and configuration and two interface ports (9-pin
D-shell) for serial connections. The CPU controls all functions of
the GuardPLC 2000 system as well as communication to other
systems. LEDs display the operating modes: Run and Error for the
I/O modules; Run, Error, Stop, Programming and Forcing for the
CPU.

Typical Applications
• Perimeter guarding for Robot/weld cells
• Perimeter guarding for Packaging Machines
• Entertainment industry (ride control and ski lift control)
• Semi-conductor industry
• Press Control
• Burner Management
• Shipping (rudder controls)

Features
• Metal chassis
• I/O self test
• 24V DC digital I/O
• Expandable number of I/O
• Multiple I/O test points
• Certified by TÜV for use in applications up to SIL 3 according to
IEC 61508; EN 954–1, Category 4
• Programmed with RSLogix Guard Software
• RS–232 port for ASCII communication (read only)
• Ethernet port for programming, configuration and Peer-to-Peer

8-7
Safety PLCs
GuardPLC 2000 Safety System
Chassis 1755–A6 Power Supply 1755–PB720

The GuardPLC chassis houses the GuardPLC 2000 controller, The power supply module transforms the system supply voltage
power supply, and up to six safety I/O modules. A filler module is from 24V to 3.3V DC/5V DC (used for internal I/O bus). It
also available for unused slots (catalogue number 1755–N2). occupies the left-most slot of the GuardPLC 2000 chassis. The
power supply comes with a lithium battery, which has a four-year life
Specifications span, that is used for back-up. Four LEDs indicate the power supply,
battery voltage, and faults.
Description Expansion chassis for adding safety I/O
modules
Number of Slots 6
Dimensions (WxHxD) 255 x 285 x 210mm (10 x 11.2 x 8.3in)
Weight 3.3kg (7.2lbs)
Mounting Back-panel mounting
Catalogue Number 1755-A6

8-8
 Safety PLCs
GuardPLC Safety Control Systems

Overview • The analog output module, which is available in the GuardPLC

Safety-related input modules are automatically subjected to a high-
grade, cyclical self-test in both the GuardPLC 1200 and GuardPLC
2000 systems during operation. These test routines are TÜV
approved and help ensure the safe function of the respective
module. When an error is detected, the application is provided with
an “0” signal, and a detailed error message is generated optionally. If
there are minor failures in the module (no effect on the safety
function), no user diagnostic information is generated.
• The counter module has two operating modes: counter mode and
• The GuardPLC 2000 digital I/O module has 24 inputs and 16
outputs for signals, and the inputs and outputs are electrically
isolated in groups of eight. The GuardPLC 1200 digital I/O
module has 20 inputs and 8 outputs. In case of module error, the
outputs are switched to the de-energized state.
• The analog output module, which is available in the GuardPLC
2000 system only, the eight channels on the analog input module
can be used as eight single-ended or four differential analog
inputs for 0 to 20 mA. No mixing is allowed. The incoming
signals are converted into an integer value with a 12-bit
resolution. This value then can be used in the user program. In
case of module error, the logic outputs of the modules are
switched to the de-energized state.
2000 system only, has eight analog outputs with a 12-bit
resolution. They are electrically isolated in groups of two outputs
with a common ground. The output ranges of the module can be
switched to 0 to 21 mA, 0 to 10.25V DC or -10.25 to +10.25V
DC. For each channel, the module has a switch placed on the
printed circuit board to switch the different output ranges. In
case of module error, the outputs are switched to the de-
energized state.
decoder mode. The module has 24-bit counters with two outputs
each. The counters can operate in both directions (up and down)
and have a separate reset input. The input signals of 5V can be in
a frequency range of 0 to 1 MHz in a GuardPLC 2000 system.
Use a PC to configure the input voltage, which can be 5V or in a
range of 10 to 26.4V. In case of module error, the outputs are
switched to the de-energized state. The counter can count pulses
with direction and reset inputs up to 1 MHz in the GuardPLC
2000 system and up to 100 KHz in the GuardPLC 1200 system.
The counter module can also be used as an 8-bit gray code
encoder in the GuardPLC 2000 system or a 6-bit gray code
encoder in the GuardPLC 1200 system.

I/O Hardware
Safety Digital I/O Combination Module
Max
Maximum Operating Continuous Number Catalogue
Operating Signal Delay Off-State On-State Number Voltage/ Signal Delay Current of Number
Voltage (max) Current Current of Inputs Type (max) per Output Outputs Applications 1755–
GuardPLC GuardPLC
2000 2000
on = 70µs on = 70 µs Safety
off = 70 µs 2mA @ 10V off = 15 µs 2A (8A applications
10-30V 1.5mA @
13mA @ 24 18.4-
total per 16 requiring 24V
DC 5V DC 26.8V DC DC inputs and –IB24XOB16
GuardPLC 30V GuardPLC module) 24V DC
1200 1200 outputs
on = 120 µs on = 15 µs
off = 200 µs off = 90 µs

Safety Analog I/O Modules

Catalogue
Number of Inputs/ Back Plane Channel Update/ Number
Outputs Data Format Voltage Range Current Range Current Load Resolution 1755–
4 differential or 8 12-bit signed
single–ended inputs Integer (natural ±10V 0-20.5mA 150 mA/3.3V DC 12 bits (0-1000) IF8
0-10V DC (with shunt) 400 mA/24V DC
— selectable binary)
12-bit signed
±10V 150 mA/3.3V DC
8 outputs Integer (natural 0-20mA 12 bits (0-1000) OF8
0-10V DC 400 mA / 24V DC
binary)

Safety Counter Module

Maximum Input
Inputs Frequency Outputs Location Back Plane Current Load Catalogue Number
0.1A / 24V DC without load
2 1 MHz 4 Any unused slot 0.8A (3.3V DC), 0.1A (5V 1755-HSC
DC)

8-9
Safety PLCs
GuardPLC Safety Control Systems

Weights Features
• Save programming and configuration time using software that’s
Catalogue Number and Weight in kg (lb)
already certified for use in applications up to SIL 3
• 1754–L28BBB 0.68 (1.5) • Program your safety control system using pre-defined graphical
• 1755–A6 3.3 (7.3) elements and a “drag and drop” palette
• 1755–HSC 0.26 (0.57) • Tag-based system
• 1755–IB24XOB16 0.26 (0.57)
• 1755–IF8 0.24 (0.53)
System Requirements
• 1755–L1 0.28 (0.62)
• 1755–OF8 0.28 (0.62) To install RSLogix Guard Programming Software on a personal
• 1755–PB720 0.82 (1.8) computer, you need to meet the following minimum requirements.

Programming Software CPU Processor Pentium II, 400 MHz

RAM 128M bytes
RSLogix Guard Software
Graphic Adaptor Resolution: 1024 x 768 pixels (XGA)
The safety aspects of the GuardPLC Safety Control System extend
beyond the physical control platforms. Like the controllers, Hard Disk Space 30M bytes (minimum) for RSLogix
Guard plus space for user defined
programming software must also be certified to support Safety programs
Integrity Level 3 (SIL 3) applications and is a critical component of Operating System Windows NT v4.0 or Windows 2000
the total safety system. The programming and configuration tool for
GuardPLC 2000 and GuardPLC 1200 safety controls is RSLogix Ordering Information
Guard software, designed to operate with Microsoft Windows NT You can install RSLogix Guard Programming Software on a local
v4.0 or Windows 2000 operating system. drive only (not a network).

Since the RSLogix Guard software is a function block-based

Description Catalogue Number
programming tool, there is no need for programmers to learn a
RSLogix Guard 1200 for GuardPLC 1200
cryptic programming language. Using such pre-defined elements as Packaged Safety Controller
AND and OR gates, numerical functions, counters, and timers, • 200 variables per POU (Program Organization 1754–PCS
programmers select and “drag” the appropriate functions onto their Unit)
workstation screen. These functions, like the controllers, have been RSLogix Guard 2000 for GuardPLC 1200 and
GuardPLC 2000 Safety Controllers
certified for use in applications up to SIL 3. Subsequent • 650 variables per POU (Program Organization 1755–PCS
programming is as easy as drawing lines to “wire” inputs and Unit)
outputs to the logical elements and making connections to hardware • User-defined function blocks
by way of user-defined variables or tags.

The RSLogix Guard software is also used for system diagnosis and
debugging. It can provide the status of controller CPU and I/O and
can be used to obtain information about the application program.

8-10