3.2.5 Type label ................................................................................................................................... 16
10.3.1 Direct link .................................................................................................................................. 158
10.3.2 Connection via Ethernet network .............................................................................................. 158
10.6.3 Cyclic data ................................................................................................................................ 178
10.6.4 Acyclic data .............................................................................................................................. 202
10.6.5 I&M data ................................................................................................................................... 209
10.7.4 OSC messages: Safety PLCopen function blocks .................................................................... 238
11 Index 239
SmartPLC SafeLine with PROFIBUS slave interface
5
SmartPLC SafeLine with PROFIBUS slave interface
6
1Preliminary note
Content
Legal and copyright information ............................................................................................................ 6
Purpose of the document ...................................................................................................................... 6
Explanation of Symbols ......................................................................................................................... 7
Overview: User documentation for AC4S ............................................................................................. 8
Modification history ................................................................................................................................ 8
All product names, pictures, companies or other brands used on our pages are the property of the
respective rights owners:
AS-i is the property of the AS-International Association, (→www.as-interface.net)
CAN is the property of the CiA (CAN in Automation e.V.), Germany (→www.can-cia.org)
CODESYS™ is the property of the 3S – Smart Software Solutions GmbH, Germany
(→www.codesys.com)
DeviceNet™ is the property of the ODVA™ (Open DeviceNet Vendor Association), USA
(→www.odva.org)
EtherNet/IP® is the property of the →ODVA™
EtherCAT® is a registered trade mark and patented technology, licensed by Beckhoff Automation
GmbH, Germany
IO-Link® (→www.io-link.com) is the property of the → PROFIBUS Nutzerorganisation e.V.,
Germany
ISOBUS is the property of the AEF – Agricultural Industry Electronics Foundation e.V.,
Deutschland (→www.aef-online.org)
Microsoft® is the property of the Microsoft Corporation, USA (→www.microsoft.com)
PROFIBUS® is the property of the PROFIBUS Nutzerorganisation e.V., Germany
(→www.profibus.com)
PROFINET® is the property of the → PROFIBUS Nutzerorganisation e.V., Germany
Windows® is the property of the → Microsoft Corporation, USA
>
1.2 Purpose of the document
This document applies to devices of the type "SmartPLC AC4S with PROFIBUS" interface" (art. no.:
AC412S) with the firmware version 4.3.2.
These instructions describe the following topics:
Mounting and electrical connection of AC412S
Installation of additional devices (sensors, actuators) to the local I/O interface
Operation and configuration of the device via the menu (GUI and web interface)
Command channels, cyclic and acyclic data records
Error diagnostics and troubleshooting
42287
SmartPLC SafeLine with PROFIBUS slave interface
7
1.3Explanation of Symbols
WARNING!
Death or serious irreversible injuries may result.
CAUTION!
Slight reversible injuries may result.
NOTICE!
Property damage is to be expected or may result.
Important note
Non-compliance can result in malfunction or interference
Information
Supplementary note
► ...
Request for action
>...
Reaction, result
→ ...
"see"
abc
Cross-reference
123
0x123
0b010
Decimal number
Hexadecimal number
Binary number
[...]
Designation of pushbuttons, buttons or indications
34171
SmartPLC SafeLine with PROFIBUS slave interface
8
1.4Overview: User documentation for AC4S
Document
Content / Description
Data sheet
Technical data of AC412S as a table
Operating instructions *
Notes on mounting and electrical installation of the AC412S
Set-up, description of the operating and display elements, maintenance information, scale
drawing
Device manual
Notes on operation of AC412S via GUI and web interface
Description of the cyclic and acyclic data records, fieldbus parameters and command
interface
Error description
Supplement device manual
Description of the acyclic data sets and the command interface
Programming manual
Creation of a project with the device using CODESYS
Configuration of the device using CODESYS
Programming of the Standard-SPS of the device
Programming of the fail-safe PLC of the device
Description of the device-specific CODESYS function libraries
All documents can be downloaded from ifm's website.
Version
Topic
Date
00
New creation of document
12 / 2017
01
Update to firmware 4.3.1
Changed: Restore device configuration
09 / 2018
02
Deleted: chapter 5.2.2 „Device supply via a joint power supply”
01 / 2019
03
Update to firmware 4.3.2
42309
ifm electronic provides the following user documentation for the models of the device class "Fail-safe
SmartPLC AC4S":
Legend:
*... The operating instructions are supplied with the device.
>
1.5 Modification history
34492
04 / 2019
SmartPLC SafeLine with PROFIBUS slave interface
9
2Safety instructions
Content
General safety instructions .................................................................................................................... 9
Tampering with the unit ......................................................................................................................... 9
WARNING!
Tampering with the unit.
>In case of non-compliance:
Possible affects on safety of operators and machinery
Expiration of liability and warranty
► Do not open the devices!
► Do not insert any objects into the devices!
► Prevent metal foreign bodies from penetrating!
>
28333
2.1 General safety instructions
41415
Read this document before setting up the product and keep it during the entire service life.
Only use the product for its intended purpose.
If the operating instructions or the technical data are not adhered to, personal injury and/or damage to
property may occur.
Improper or non-intended use may lead to malfunctions of the device, to unwanted effects in the
application or to a loss of the warranty claims.
The manufacturer assumes no liability for any consequences caused by tampering with the device or
incorrect use by the operator.
► Observe these operating instructions.
► Adhere to the warning notes on the product.
>
2.2 Required background knowledge
41648
This document is intended for specialists. Specialists are people who, based on their relevant training
and experience, are capable of identifying risks and avoiding potential hazards that may be caused
during operation or maintenance of the product.
For programming these people should also have knowledge of control technology experience in PLC
programming to IEC 61131-3.
The document contains information about the correct handling of the product.
>
2.3 Tampering with the unit
33190
SmartPLC SafeLine with PROFIBUS slave interface
10
3System description
Content
Intended use ........................................................................................................................................ 11
Information concerning the device ...................................................................................................... 12
This chapter describes the structure and the components of the system.
42275
SmartPLC SafeLine with PROFIBUS slave interface
11
3.1Intended use
Content
Permitted use ...................................................................................................................................... 11
Prohibited use ...................................................................................................................................... 11
>
3.1.1 Permitted use
AC412S can assume the following functions:
AS-i master in 2 separate AS-i networks
Fail-safe programmable logic controller (PLC) and standard PLC for acquiring, processing and
providing safe and non-safe data of the connected AS-i slaves and the channels of the local I/O
interface
Gateway for the transmission of standard control and user data between a higher-level
PROFIBUS controller and the slaves in the AS-i networks
>
3.1.2 Prohibited use
The device may not be used beyond the limits of the technical data (→Technical data (→ S. 153))!
Type label ............................................................................................................................................ 16
Anschlussstecker (X1) für
AS-i 1, AS-i 2, Funktionserde
Anschlussstecker (X2) für AUX
Lokale Ein- und Ausgänge (X4)
(hinter der Frontklappe)
Frontklappe
Steckplatz für SD-Karte (X5)
(hinter der Frontklappe)
Ethernet-Konfigurationsschnittstelle (X3)
(hinter der Frontklappe)
PROFIBUS-Schnittstelle (X6)
>
3.2.1 Overview
36905
42308
SmartPLC SafeLine with PROFIBUS slave interface
13
3.2.2 Operating elements
36790
The device provides the following operating elements.
>
Arrow and function keys
36959
Below the display is the key panel with two function keys and four arrow keys. The operator controls
the Graphical User Interface (GUI) of the device with the keys.
Operating notes: →Operation (→ S. 44)
>
3.2.3 Display elements
36917
The device provides the following display elements:
>
Display
36894
The display is used to display the Graphical User Interface (GUI) of the device.
Operating notes: →Operation (→ S. 44)
Technical data: →Technical data (→ S. 153)
>
Status LEDs
36784
The device features the following status LEDs which display the current status of system components.
Meaning of the LED colours and flashing frequencies: →Status LED (→ S. 145)
2x voltage ground GND
→Voltage source / voltage ground
(→ S. 14)
2x voltage source +24V
→Voltage source / voltage ground
(→ S. 14)
8x input channels (IN1 ... IN8)
→ Local inputs (→ S. 14)
AC412S has the following interfaces.
>
Ethernet configuration interface
The configuration interface (X3) is located behind the front flap of the device. It allows the user to
access the following device functions:
web interface for device configuration and diagnosis
programming of the device-internal Standard-SPS and the fail-safe PLC using CODESYS
Configuration as fieldbus interface
Possible network topologies: →Configuration interface: connection concepts (→ S. 158)
Technical data: →Technical data (→ S. 153)
>
Local input/output interface
The local input/output interface (X4) is behind the front flap of the device. Safe and non-safe
peripherals without AS-i interface can be connected to the local inputs and outputs.
Connections of the local I/O interface:
42306
42193
42303
>
Voltage source / voltage ground
+24V and GND are used as voltage supply for the safety IO PCB of the safety module of AC412S.
Notes on the electrical connection: →Electrical connection (→ S. 29)
>
Local inputs
The local I/O interface provides 8 input channels for the connection of devices (e.g. sensors, switches,
light curtains). Each input channel can be used as safe or standard input. Configuration is effected via
the programming system CODESYS.
Connection of peripherals: →Connect devices to local I/O interface (→ S. 31)
Technical data: →Technical data (→ S. 153)
The local I/O interface provides 4 output channels for the connection of devices (e.g. actuators,
relays). Each output channel can be used as safe or standard output. Configuration is effected via the
programming system CODESYS.
Notes on the connection of peripherals: →Connect devices to local I/O interface (→ S. 31)
Technical data: →Technical data (→ S. 153)
>
Possible combinations of input and output channels
42315
The inputs IN1...IN8 can be configured both as safe and non-safe inputs.
The outputs OUT1...OUT4 can be configured both as safe and non-safe outputs.
This permits the following minimum or maximum input and output combinations:
>
SD card slot
42194
The SD card slot (X5) is located behind the front flap of the device. The following actions can be
performed with an SD card:
Save and restore the device configuration
Storage medium for access to Standard-SPS
Technical data: →Technical data (→ S. 153)
>
PROFIBUS fieldbus interface
The device communicates with the higher-level control instance of the PROFIBUS network via the
PROFIBUS interface (X6).
Notes regarding connetion concepts: →Configuration interface: connection concepts (→ S. 158)
Technical data: →Technical data (→ S. 153)
41428
SmartPLC SafeLine with PROFIBUS slave interface
16
3.2.5 Type label
QR code for product website
CE/cULus marking
Protection class
AS-i certification
TÜV certification
Hardware version
Operating voltage for
– Aux / local IO PCB
– AS-i
max. current consumption of the
device
max. load per output channel of the
local I/O interface
Type designation incl. device
functionality
– number of AS-i fieldbus gateways
– classification of the AS-i masters
– fail-safe PLC
– fieldbus
Manufacturer identification
The type label is on the right housing side of the device. It provides the following information:
42274
>
3.2.6 Required accessories
To be able to operate the device in a sensible way you need the following accessories (not supplied
with the device):
Depending on the selected voltage supply ( Operating instructions) you need:
a power supply for the 24 V power supply (e.g. art. no. DN3011)
for each AS-i master one AS-i power supply each (e.g. art. no. AC1236)
a data decoupling module AC1250 (accessory, optional)
Fail-safe and standard AS-i slaves
Fail-safe and standard devices for connecting with the local I/O interface
Operating states of AC412S .............................................................................................................. 22
Monitoring and securing mechanisms ................................................................................................. 23
Error detection and processing ........................................................................................................... 23
42223
SmartPLC SafeLine with PROFIBUS slave interface
18
3.3.1Safety architecture
Content
System architecture ............................................................................................................................. 18
Process safety time ............................................................................................................................. 21
The reachable characteristic safety values of the automation system implemented with
AC412S depend on the following components:
Safety classification of the peripherals installed at the local I/O interface (→Supported device
types (→ S. 32))
Safety classification of the installed safe AS-i slaves
>
42266
System architecture
42268
The hardware structure of the safety module of AC412S corresponds to the implementation to DIN EN
ISO 13849-1:2008, IEC 62061:2010 and IEC61508:2010 with a two-channel architecture with
hardware fault tolerance (HFT = 1).
The device achieves the following characteristic safety values:
SIL 3 / SIL CL 3 referred to IEC 61508:2010 and IEC 62061:2010
Performance Level e EN ISO 13849-1:2008)
Category 4 (EN ISO 13849-1:2008)
SmartPLC SafeLine with PROFIBUS slave interface
19
AC412S has the following system architecture:
>
Main module
42292
The main module is the central component of AC412S. It contains the recovery system and the
firmware of the device and controls the communication between the individual system components via
the backplane. The main module has interfaces to the following components:
Display (→Display (→ S. 19))
COM module (→COM module (→ S. 20))
Ethernet configuration interface
AS-i module (→AS-i module (→ S. 20))
Safety module (→Safety module (→ S. 20))
>
Display
42230
The display is the graphic user interface of AC412S via which the user can configure and diagnose the
device. The display exchanges the resulting data with the main module.
SmartPLC SafeLine with PROFIBUS slave interface
20
COM module
42210
The COM module provides the PROFIBUS functionality of AC412S. This comprises the PROFIBUS
connection and the necessary firmware. The COM module receives the fieldbus data from the main
module via an interface and transfers it to the fieldbus. Simultaneously it receives data from the
fieldbus and transfers it to the main module for further processing.
>
AS-i module
42242
The AS-i module provides the AS-i functionality of AC412S such as receiving, evaluating and
transmitting AS-i telegrams without any logical preprocessing. It contains 2 AS-i masters controlling 2
separate AS-i circuits.
The following number of AS-i slaves can be connected to each AS-i master:
up to 62 non safe AS-i slaves or
up to 31 safe AS-i input slaves or
up to 15 AS-i control slaves to control safe AS-i output slaves
The AS-i module exchanges the data of the safe AS-i slaves with the safety module via the backplane.
All AS-i data is provided to the main module for representation on the display.
>
Safety module
42251
The safety module contains the safety-related hardware of AC412S. The architecture of the safety
module provides the following structural features:
1oo2 hardware architecture (1 out of 2 architecture)
2-channel structure with separate diagnostics in both channels
2-channel safe inputs selectable
1-channel and 2-channel safe outputs selectable
Built-in tests on both safe processing units (safety CPU 1/2)
Hardware failure tolerance (HFT) = 1
The safety module consists of the following components:
Safety CPU PCB with 2 processors for the control technology signal processing (safety CPU1/2)
Safety I/O PCB with a separate voltage supply for the local I/O interface
Both PCBs are separated from each other galvanically. They are supplied from separate voltage
sources.
Both safety CPUs have separate watchdogs and reset circuits. They are interconnected via cross
communication.
Both PCBs are interconnected via a serial interface for bidirectional data exchange.
The safety module has interfaces to the main module and the AS-i module.
SmartPLC SafeLine with PROFIBUS slave interface
21
Process safety time
► When setting up the safety function, also take into account the process safety time of the
application!
► Take into account other potential delays caused by upstream and downstream
components (sensors, actuators) for time-related considerations. These times extend the
response time for safety-related faults.
► Process safety time of the other components of the safety function: the manufacturers’
data sheets
In the following cases a single fault cannot lead to a hazardous situation:
if the safe state is assumed
if the fault detection and the reaction to the fault happen within the process safety time
42313
The process safety time depends on the source and the objective of the request, the signal processing
and the transmission length.
If the safety time is shorter than the process safety time required by the safety function of the plant, a
single fault can in the worst case lead to a faulty output signal for a short time but not to a loss of the
safety function.
A loss of the safety function can only occur if the faulty signal cannot be corrected within the process
safety time.
SmartPLC SafeLine with PROFIBUS slave interface
22
3.3.2 Operating states of AC412S
AC412S has the following operating states:
INIT
NORMAL OPERATION
SYSTEM STOP
Below the state chart:
42321
INIT
After the start the device automatically goes into the INIT state (). In the INIT state the device
undergoes the different hardware and integration tests (PBIT = Power-up Built-In Test). If the PBIT
test is successfully passed, the device takes the state NORMAL OPERATION (). If the PBIT
test is not passed, the device passes into the SYSTEM STOP ().
NORMAL OPERATION
In NORMAL OPERATION the device of Standard-SPS and the fail-safe PLC provides a working
environment. The states and the operation modes of the PLC applications are valid (see
programming manual). Simultaneously and irrespective of the processing of the PLC applications
the device continuously undergoes different hardware tests (CBIT = continuous built-in test). If this
CBIT test is not passed, the device goes into the SYSTEM STOP state ().
SYSTEM STOP
In SYSTEM STOP the device is in the safe state. To leave the SYSTEM STOP state the operator
has to carry out a power-on reset. The device changes to the INIT state ().
SmartPLC SafeLine with PROFIBUS slave interface
23
3.3.3 Monitoring and securing mechanisms
>
System start / power on reset
When the voltage supply has been applied, the safety module of AC412S automatically undergoes a
power-on built-in test (PBIT). The PBIT consists of the following routines:
Test and installation of the safety-relevant hardware modules
Test of the program, configuration and user data in SDRAM (CRC test)
If at least one of these partial tests is failed, the system reacts as follows:
The safety module goes into the safe state
The transition from the fail-safe PLC to the safe operation is prevented
An error message is provided in the online support centre (OSC) of the device
>
Normal operation
During normal operation the safety module of AC412S continuously undergoes a continuous built-in
test (CBIT). The CBIT detects accidental hardware errors. It monitors all safety-relevant hardware
modules. The CBIT consists of the following routines:
Monitor the safety-relevant hardware modules with the required DC
Monitor all diagnostic data that is relevant for the safe functions
Monitor the program process
Depending on the error class the device triggers certain measures (→Error classes (→ S. 23)).
>
42296
42276
42297
3.3.4 Error detection and processing
>
Error classes
AC412S recognises the following error classes:
>
Fatal error
The following errors are classified as fatal errors:
error in the device (temperature exceeded, soiling)
error in the channels
Response to fatal errors:
The safety module goes into the safe state (→Safe state (→ S. 25))
42221
42218
42222
SmartPLC SafeLine with PROFIBUS slave interface
24
Serious error
42252
Following errors are classified as serious errors:
Errors occurring in the periphery which do not affect the processing logic of the device
Response to serious errors:
The safety module goes into the safe state (→Safe state (→ S. 25))
>
Exception errors
42225
An exception error occurs when the device software is in a non foreseen state.
Response to exception errors:
The safety module goes into the safe state (→Safe state (→ S. 25))
>
Scheduling errors
42254
The following errors are classified as scheduling errors:
Errors in the correct processing of the different tasks in the course of which the operating system
cannot make a task change any more so that the watchdog is triggered.
Response to scheduling errors:
All output channels of the local I/O interface go into the default state (= switched off)
All safe output slaves stop sending code sequences
Restart disable of the fail-safe PLC
>
Error message
AC412S signals occurring errors via the following mechanisms:
status LED (→Status LED (→ S. 145))
online support Centre (→Online Support Centre (OSC) (→ S. 148))
42224
SmartPLC SafeLine with PROFIBUS slave interface
25
Safe state
All non safety-relevant functions of the basic device continue to be available in the safe state.
42258
The safety module of AC412S is always in the safe state. Exceptions are the following operating
states of the fail-safe PLC:
If a fatal, serious or exception error occurs during these operating states, the safety module of
AC412S goes into the safe state.
The safe state is characterised by the following features:
All safe output channels of the local I/O interface are already power-free
All safe AS-i control slaves have stopped sending code sequences
the fail-safe PLC is in the STOP mode
the cyclic data transfer between safety module and basic device is interrupted
the data packages of the safe cross communication between the two safety CPUs are filled with
zero sequences and marked as "invalid"
the basic device detects that the safety module is in the safe state and provides this information in
the OSC and on the PROFIBUS and configuration interface
>
Reset error
All error states (→Error classes (→ S. 23)) can only be exited using one of the following measures.
► Reboot the device (power-on reset)
42257
SmartPLC SafeLine with PROFIBUS slave interface
26
3.4Software
Content
Software modules of the device .......................................................................................................... 26
Certified software components for safe applications ........................................................................... 27
Software modules
Description
Recovery system
Environment for the firmware installation
Firmware
Firmware of AC412S
CODESYS standard runtime system
(Standard-SPS)
Runtime environment for the execution of CODESYS applications to IEC 61131
CODESYS safety runtime system (failsafe PLC)
Certified runtime environment for the execution of safe CODESYS applications
Standard application
CODESYS application for Standard-SPS
Safe application
CODESYS application for fail-safe PLC (= safety function)
The user is responsible for setting the safe function of the application (= safe application). If
necessary, he must also obtain an approval from the supervisory and test organisations
according to the national regulations.
AC412S provides the programmer with a safe environment which is suited for the execution
of a safe application to SIL3. The user is responsible for programming the safe application.
>
3.4.1 Software modules of the device
AC412S has the following software modules:
>
3.4.2 Safety functions
AC412S provides the following safety functions:
Freely programmable fail-safe PLC
Safe reading of local digital inputs and linking via the fail-safe PLC
Safe control of local digital outputs via the fail-safe PLC
Safe reading of safe AS-i input slaves and linking via the fail-safe PLC
Control of safe AS-i output slaves via the fail-safe PLC
Safe data transfer between min. 2 AC412S
Safe data transfer from and to EtherCAT slaves (FSoE)
42280
42281
42262
SmartPLC SafeLine with PROFIBUS slave interface
27
3.4.3 Certified software components for safe applications
Information about device-specific software components and about how to program StandardSPS and the fail-safe PLC: → Programming manual fail-safe SmartPLC AC4S"
42207
To program safe applications for AC412S ifm electronic provides certified software components for the
programming environment CODESYS safety 3.5. In addition, the user can use the function libraries
supplied with CODESYS safety.
Ensure a condensation-free environment. Avoid excessive dust, vibration and shock. The air
circulation through the vents must not be impeded. Installation in environments with ionising
radiation is not permitted.
Avoid installation in direct vicinity of frequency inverters or other interfering sources.
>
34058
4.1 Install device
42302
The device must only be installed, connected and put into operation by a qualified electrician as the
safe function of the device and machinery is only guaranteed when installation is correctly carried out.
The installation and connection must comply with the applicable national and international standards.
Responsibility lies with the person installing the device.
► Fix the device onto a 35 mm raised rail.
► Vertical installation (upright).
► Adhere to a minimum distance of 30 mm between the ventilation holes (perforated sheet) and
other parts.
► Maximum operating distance: 2000 m above sea level
► The protection rating of the device is IP 20. The installation must take place in a control cabinet
with at least IP 54 protection.
► Lay the cables in a cable duct.
► Keep the installation space of the device free from electrically-conductive particles.