(Always read these instructions before using this equipment.)
Before using the product, please read this manual, the relevant manuals introduced in this manual,
standard PLC manuals, and the safety standards carefully and pay full attention to safety to handle the
product correctly.
In this manual, the safety instructions are ranked as "DANGER" and "CAUTION".
DANGER
CAUTION
Note that the CAUTION level may lead to a serious consequence according to the circumstances.
Always follow the instructions of both levels because they are important to personal safety.
Please save this manual to make it accessible when required and always forward it to the end user.
Indicates that incorrect handling may cause hazardous conditions,
resulting in death or severe injury.
Indicates that incorrect handling may cause hazardous conditions,
resulting in medium or slight personal injury or physical damage.
A - 1
[Design Precautions]
DANGER
When a safety PLC detects an error in an external power supply or a failure in PLC main module, it
turns off all the outputs.
Create an external circuit to securely stop the power of hazard by turning off the outputs.
Incorrect configuration may result in an accident.
Create short current protection for a safety relay, and a protection circuit such as a fuse, and
breaker, outside a safety PLC.
If load current more than the rating or overcurrent due to a short circuit in the load has flowed in the
CC-Link Safety remote I/O module, the module defines it as a fault and turns off all the outputs.
However, if overcurrent flows in the CC-Link Safety remote I/O module for a long time, it may cause
smoke or a fire. To prevent it, create a safety circuit such as a fuse outside the module.
When data/program change, or status control is performed from a PC to a running safety PLC,
create an interlock circuit outside the sequence program and safety PLC to ensure that the whole
system always operates safely.
For the operations to a safety PLC, pay full attention to safety by reading the relevant manuals
carefully, and establishing the operating procedure.
Furthermore, for the online operations performed from a PC to a safety CPU module, the corrective
actions against a communication error due to a cable connection fault, etc. should be predetermined
as a system.
All output signals from a safety CPU module to the CC-Link Safety system master module are
prohibited to use.
These signals can be found in the CC-Link Safety System Master Module User's Manual.
Do not turn ON or OFF these signals by sequence program, since turning ON/OFF these output
signals of the PLC system may cause malfunctions and safety operation cannot be guaranteed.
When a safety remote I/O module has detected CC-Link Safety error, it turns off all the outputs. Note
that the outputs in a sequence program are not automatically turned off.
If CC-Link Safety error has been detected, create a sequence program that turns off the outputs in
the program.
If the CC-Link Safety is restored with the outputs on, it may suddenly operate and result in an
accident.
To inhibit restart without manual operation after safety functions was performed and outputs were
turned OFF, create an interlock program which uses a reset button for restart.
A - 2
[Design Precautions]
CAUTION
Do not bunch the wires of external devices or communication cables together with the main circuit or
power lines, or install them close to each other.
They should be installed 100 mm (3.94 inch) or more from each other.
Not doing so could result in noise that would cause malfunctions.
Select the external devices to be connected to the CC-Link Safety remote I/O module, considering
the maximum inrush current with reference to the CC-Link Safety System Remote I/O Module User's
Manual.
[Installation Precautions]
CAUTION
Use a safety PLC in the environment that meets the general specifications described in the QSCPU
User's Manual (Hardware Design, Maintenance and Inspection).
Using this PLC in an environment outside the range of the general specifications could result in
electric shock, fire, erroneous operation, and damage to or deterioration of the product.
While pressing the installation lever located at the bottom of module, insert the module fixing tab into
the fixing hole in the base unit until it stops. Then, securely mount the module with the fixing hole as
a supporting point.
Incorrect loading of the module can cause a failure or drop.
Secure the module to the base unit with screws.
Tighten the screw in the specified torque range.
If the screws are too loose, it may cause a drop of the screw or module.
Over tightening may cause a drop due to the damage of the screw or module.
Make sure to fix the CC-Link Safety remote I/O module with a DIN rail or mounting screws and
tighten the screws with the specified torque.
If the screws are too loose, it may cause a drop of the screw or module.
Over tightening may cause a drop due to the damage of the screw or module.
Completely turn off the external supply power used in the system before mounting or removing the
module.
Not doing so could result in damage to the product.
Do not directly touch the module's conductive parts or electronic components.
Doing so may cause malfunctions or a failure.
A - 3
[Wiring Precautions]
DANGER
Be sure to shut off all phases of the external supply power used by the system before wiring.
Not completely turning off all power could result in electric shock or damage to the product.
When energizing or operating the module after installation or wiring, be sure to close the attached
terminal cover.
Not doing so may result in electric shock.
CAUTION
Ground the FG and LG terminals correctly.
Not doing so could result in electric shock or malfunctions.
Use a solderless terminal with insulation sleeve for wiring of a terminal block.
Use up to two solderless terminals for a single terminal.
Use applicable solderless terminals and tighten them with the specified torque. If any solderless
spade terminal is used, it may be disconnected when the terminal screw comes loose, resulting in a
failure.
Wire the module correctly after confirming the rated voltage and terminal layout.
Connecting a power supply of a different rated voltage or incorrect wiring may cause a fire or failure.
Tighten a terminal block mounting screw, terminal screw, and module mounting screw within the
specified torque range.
If the terminal block mounting screw or terminal screw is too loose, it may cause a short circuit, fire,
or malfunctions.
If too tight, it may damage the screw and/or the module, resulting in a drop of the screw or module, a
short circuit or malfunctions.
If the module mounting screw is too loose, it may cause a drop of the screw or module.
Over tightening the screw may cause a drop due to the damage of the screw or module.
Be sure there are no foreign substances such as sawdust or wiring debris inside the module.
Such debris could cause a fire, failure, or malfunctions.
The module has an ingress prevention label on its top to prevent foreign matter, such as wire offcuts,
from entering the module during wiring.
Do not peel this label during wiring.
Before starting system operation, be sure to peel this label because of heat dissipation.
A - 4
[Wiring Precautions]
CAUTION
Be sure to fix the communication cables or power cables by ducts or clamps when connecting them
to the module.
Failure to do so may cause damage of the module or cables due to a wobble, unintentional shifting,
or accidental pull of the cables, or malfunctions due to poor contact of the cable.
When removing the connected communication cables or power cables, do not pull the cable with
grasping the cable part.
Remove the cable connected to the terminal block after loosening the terminal block screws.
Pulling the cable connected to a module may result in malfunctions or damage of the module or
cable.
For the cables to be used in the CC-Link Safety system, use the ones specified by the manufacturer.
Otherwise, the performance of the CC-Link Safety system is not guaranteed.
As to the maximum overall cable length and station - to station cable length, follow the specifications
described in the CC-Link Safety System Master Module User's Manual.
If not following the specification, the normal data transmission is not guaranteed.
Install our PLC in a control panel for use.
Wire the main power supply to the power supply module installed in a control panel through a
distribution terminal block.
Furthermore, the wiring and replacement of a power supply module have to be performed by a
maintenance worker who acquainted with shock protection.
(For the wiring methods, refer to the QSCPU User's Manual (Hardware Design, Maintenance and
Inspection).
A - 5
[Stratup and Maintenance precautions]
DANGER
Do not touch the terminals while power is on.
Doing so could could result in electric shock.
Correctly connect the battery.
Also, do not charge, disassemble, heat, place in fire, short circuit, or solder the battery.
Mishandling of battery can cause overheating, cracks, or ignition which could result in injury and
fires.
Turn off all phases of the external supply power used in the system when cleaning the module or
retightening the terminal block mounting screws, terminal screws, or module mounting screws.
Not doing so could result in electric shock.
Tighten a terminal block mounting screw, terminal screw, and module mounting screw within the
specified torque range.
If the terminal block mounting screw or terminal screw is too loose, it may cause a short circuit, fire,
or malfunctions.
If too tight, it may damage the screw and/or the module, resulting in a drop of the screw or module, a
short circuit or malfunctions.
If the module mounting screw is too loose, it may cause a drop of the screw or module.
Over tightening the screw may cause a drop due to the damage of the screw or module.
CAUTION
The online operations performed from a PC to a running safety PLC (Program change when a safety
CPU is RUN, device test, and operating status change such as RUN-STOP switching) have to be
executed after the manual has been carefully read and the safety has been ensured.
Following the operating procedure predetermined at designing, the operation has to be performed by
an instructed person.
When changing a program while a safety CPU is RUN (Write during RUN), it may cause a program
breakdown in some operating conditions.
Fully understand the precautions described in the GX Developer's manual before use.
Do not disassemble or modify the modules.
Doing so could cause a failure, malfunctions, injury, or fire.
If the product is repaired or remodeled by other than the specified FA centers or us, the warranty is
not covered.
Use any radio communication device such as a cellular phone or a PHS phone more than 25cm
(9.85 inch) away in all directions of safety PLC.
Not doing so can cause malfunctions.
A - 6
[Stratup and Maintenance precautions]
CAUTION
Completely turn off the external supply power used in the system before mounting or removing the
module.
Not doing so may result in a failure or malfunctions of the module.
Restrict the mounting/removal of a module, base unit, and terminal block up to 50 times
(IEC61131-2-compliant), after the first use of the product.
Failure to do so may cause the module to malfunction due to poor contact of connector.
Do not drop or give an impact to the battery mounted to the module.
Doing so may damage the battery, causing the battery fluid to leak inside the battery.
If the battery is dropped or given an impact, dispose of it without using.
Before touching the module, always touch grounded metal, etc. to discharge static electricity from
human body, etc.
Not doing so may result in a failure or malfunctions of the module.
Since the module case is made of resin, do not drop or apply any strong impact to the module.
Doing so may damage the module.
Completely turn off the external supply power used in the system before mounting or removing the
module to/from the panel.
Not doing so may result in a failure or malfunctions of the module.
[Disposal Precautions]
CAUTION
When disposing of this product, treat it as industrial waste.
[Transportation Precautions]
CAUTION
When transporting lithium batteries, make sure to treat them based on the transport regulations.
(For details of the controlled models, refer to the QSCPU User's Manual (Hardware).
A - 7
REVISIONS
The manual number is given on the bottom left of the back cover.
Print dateManual numberRevision
Sep., 2006SH(NA)-080613ENG-A First edition
Mar., 2007SH(NA)-080613ENG-B
Apr., 2008SH(NA)-080613ENG-C
Partial correction
CHAPTER1, Section 4.2, 5.5, 5.6.3, 5.6.4
Partial correction
Section 4.1, Appendix 1
Japanese Manual Version SH-080611-C
This manual confers no industrial property rights or any rights of any other kind, nor does it confer any patent licenses.
Mitsubishi Electric Corporation cannot be held responsible for any problems involving industrial property rights which may
occur as a result of using the contents noted in this manual.
2006 MITSUBISHI ELECTRIC CORPORATION
A - 8
INTRODUCTION
Thank you for purchasing the Mitsubishi safety programmable controller MELSEC-QS series.
Before using the equipment, please read this manual carefully to develop full familiarity with the functions
and performance of the QS series PLC you have purchased, so as to ensure correct use.
CONTENTS
SAFETY PRECAUTIONS ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 1
INTRODUCTION •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 9
CONTENTS••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 9
ABOUT MANUALS ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 11
HOW THIS MANUAL IS ORGANIZED ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 13
HOW TO USE THIS MANUAL ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 14
GENERIC TERMS AND ABBREVIATIONS ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 15
TERMINOLOGY •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 16
Chapter1 OVERVIEW1 - 1 to 1 - 2
Chapter2 APPLICATION EXAMPLE2 - 1 to 2 - 2
Chapter3 RISK ASSESSMENT AND SAFTY LEVEL3 - 1 to 3 - 5
5.2Network-Related Switch Settings of Module••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 2
5.2.1Safety Power supply module••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••5 - 2
5.2.2Safety CPU module•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••5 - 2
5.3.1CC-Link station information settings••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 4
A - 9
5.3.2Safety remote station parameter settings ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••5 - 5
5.4Relationship between the Safety CPU Module Devices and Remote I/O •••••••••••••••••••••••••••••••• 5 - 6
5.5Wiring Diagram and Parameter Setting of Standard Input •••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 7
The following manuals are related to this product.
If necessary, order them by quoting the details in the tables below.
Manual name
QSCPU User's Manual (Hardware)
Explains the specifications of the QSCPU, safety power supply module and safety base unit, etc.
(Supplied with the product)
QSCPU User's Manual (Hardware Design, Maintenance and Inspection)
Explains the specifications of the QSCPU, safety power supply module, safety base unit, etc.
(Sold separately)
QSCPU User's Manual (Function Explanation, Program Fundamentals)
Explains the functions, programming methods, devices, etc. that are necessary to create programs
with the QSCPU.
(Sold separately)
QSCPU Programming Manual (Common Instructions)
Explains how to use the sequence instructions, basic instructions, application instructions, and
QSCPU dedicated instructions.
(Sold separately)
CC-Link Safety System Master Module User's Manual (Hardware)
QS0J61BT12
Explains the specifications of the QS0J61BT12 type CC-Link Safety system master module.
(Supplied with the product)
CC-Link Safety System Master Module User's Manual QS0J61BT12
Explains the specifications, procedures and settings up to operation, parameter settings and trouble
shootings of the QS0J61BT12 type CC-Link Safety system master module.
(Sold separately)
CC-Link Safety System Remote I/O Module User's Manual (Hardware)
QS0J65BTB2-12DT
Explains the specifications of the QS0J65BTB2-12DT type CC-Link Safety system remote I/O module.
(Supplied with the product)
CC-Link Safety System Remote I/O Module User's Manual QS0J65BTB2-12DT
Explains the specifications, procedures and settings up to operation, parameter settings and
trouble shootings of the QS0J65BTB2-12DT type CC-Link Safety system remote I/O module.
(Sold separately)
Q Corresponding MELSECNET/H Network System Reference Manual (PLC to PLC network)
Explains the specifications for a MELSECNET/H network system for PLC to PLC network, the
procedures and settings up to operation, parameter settings, programming and troubleshooting.
(Sold separately)
GX Developer Version 8 Operating Manual (Startup)
Explains the system configration, installation and starting methods of GX Developer.
(Sold separately)
GX Developer Version 8 Operating Manual
Explains the online functions of the GX Developer, such as the programming, printout, monitoring, and
debugging methods.
(Sold separately)
GX Developer Version 8 Operating Manual (Safety PLC)
Explains the functions of GX Developer that are added or changed to support the safety PLC.
(Sold separately)
Manual number
(Model code)
IB-0800340ENG
(13JR91)
SH-080626ENG
(13JR92)
SH-080627ENG
(13JR93)
SH-080628ENG
(13JW01)
IB-0800344ENG
(13JP95)
SH-080600ENG
(13JP88)
IB-0800345ENG
(13JP96)
SH-080612ENG
(13JR89)
SH-080026ENG
(13JD04)
SH-080372ENG
(13JU40)
SH-080373ENG
(13JU41)
SH-080576ENG
(13JU53)
A - 11
Remark
If you would like to obtain a manual individually, printed materials are available
separately. Order the manual by quoting the manual number on the table above
(model code).
A - 12
HOW THIS MANUAL IS ORGANIZED
In this manual,
(Section 3.5)A reference destination is indicated as (Section 3.5).
In addition, this manual provides the following explanations.
POINT
Remark
Explains the matters to be especially noted, the functions and others
related to the description on that page.
Provides the reference destination related to the description on that
page and the useful information.
A - 13
HOW TO USE THIS MANUAL
This manual describes the points to be concerned when configuring safety application that
meets the safety standards using the safety PLC.
Although the safety application configuration example is shown in CHAPTER 5 of this
manual, authentication is not obtained.
The safety standards conformance approval must be obtained for the user with the entire
safety-related system.
This manual is classified roughly into five chapters as shown below.
Chapter 1Describes the outline of the safety PLC.
Chapter 2Describes the safety application that is configured using the safety PLC.
Chapter 3Describes the risk assessment, Category, and SIL.
Chapter 4Describes the cautions for use of the safety PLC.
Chapter 5Describes the safety application examples.
For the detailed specifications and functions of each module, refer to the related manuals.
A - 14
GENERIC TERMS AND ABBREVIATIONS
Unless otherwise specified, this manual uses the following generic terms and abbreviaÂtions. When a clear indication of target model name is required, the module name is indiÂcated.
Generic term/
abbreviation
GX Developer
RWr
RWw
RX
RY
SB
SW
Safety remote I/O station
Standard remote I/O
station
Remote I/O stationGeneric term for safety remote I/O station and standard remote I/O station
Remote device station
Safety master moduleOther name for the QS0J61BT12 type CC-link Safety system master module.
Safety remote I/O module
Safety main base unitAbbreviation for the QS034B(-E) type safety main base unit.
Safety CPU moduleAbbreviation for the QS001CPU type safety CPU module.
Safety power supply
module
Safety PLC
Standard PLC
Safety inputGeneric term for the signals that are input to the safety PLC for realizing the safety functions.
Safety output
Safety application
Generic product name for models SWnD5C-GPPW, SWnD5C-GPPW-A, SWnD5C-GPPW-V,
and SWnD5C-GPPW-VA.
Remote register (Read area for CC-Link Safety system)
Information entered in 16-bit units from the remote device station to the master station.
(Expressed as RWr for convenience.)
Remote register (Write area for CC-Link Safety system)
Information output in 16-bit units from the master station to the remote device station.
(Expressed as RWw for convenience.)
Remote input (for CC-Link Safety system)
Information entered in bit units from the remote station to the master station. (Expressed as RX
for convenience.)
Remote output (for CC-Link Safety system)
Information output in bit units from the master station to the remote station. (Expressed as RY
for convenience.)
Link special relay (for CC-Link Safety system)
Bit information that indicates the module operating status and data link status of the master
station. (Expressed as SB for convenience.)
Link special register (for CC-Link Safety system)
16-bit information that indicates the module operating status and data link status of the master
station. (Expressed as SW for convenience.)
Remote station which handles only the informaion in bit units.
Compatible with the safety-related system.
Remote station which handles only the information in bit units.
Not compatible with the safety
Remote station which handles information in both bit and word units.
Not compatible with the safety-related system.
Other name for the QS0J65BTS2-8D, QS0J65BTS2-4T and QS0J65BTB2-12DT type CC-Link
Safety system remote I/O module.
Abbreviation for the QS061P-A1 and QS061P-A2 type safety power supply modules.
Generic term for safety CPU module, safety power supply module, safety main base unit,
CC-Link safety master module and CC-Link safety remote I/O module.
General name of each module for MELSEC-Q series, MELSEC-QnA series, MELSEC-A series
and MELSEC-FX series. (Used for distinction from safety PLC.)
Generic term for the signals that are output from the safety PLC for realizing the safety
functions.
Generic term for the applications that are operated using the safety PLC for realizing the safety
functions.
-related system.
Description
A - 15
TERMINOLOGY
TermDescription
Safety componentEquipment such as the safety compatible sensor and actuator.
Safety-related system
Safety functionsFunctions to be realized for protecting a human from machinery hazards.
Safety measureMeasure for reducing the risk.
CategorySafety level standardized in EN954-1. The safety level is classified into 5 levels of B and 1 to 4.
SIL
Risk
Risk assessmentTo clarify hazards in machinery and assess the degree of the hazards.
Link IDUnique network identifier which is given to each network of the CC-Link Safety system.
Target failure measure
NC
NO
Close contactSame as NC.
Open contactSame as NO.
Dark test
System executing a safety functions to be required.
Safety level which is standardized in IEC61508. The safety level is classified into 4 levels of SIL1
to SIL4.
Degree of hazards, which is the combination of the occurrence probability and degree of an injury
and a health problem.
Target value of reliability for each SIL level standardized in IEC61508. There are PFD and PFH
depending on the operation frequency of the safety functions.
Abbreviation for normal close contact which is normally closed, but opened when a switch or other
function is operated.
Abbreviation for normal open contact which is normally opened, but closed when a switch or other
function is operated.
Outputs a pulse to turn OFF the input/output when it is ON, and performs the failure diagnostics to
contacts including external equipment.
A - 16
1
OVERVIEW
CHAPTER1 OVERVIEW
This chapter describes the overview of the safety PLC.
The safety PLC is a PLC that acquired the safety approval of EN954-1/ISO13849-1
Category 4 and IEC61508 SIL3.
The safety PLC can be used in safety-related system configuration up to Category 4 of
EN954-1 and SIL3 of IEC61508.
The system configuration diagram of the safety PLC is shown in Figure1.1.
• Install the safety power supply module, safety CPU module, and safety master module
to the safety main base unit.
• Connect the safety master module and the safety remote I/O module to a network.
• Connect a personal computer with GX Developer installed to the safety CPU module via
USB when setting programs and parameters.
Power supply/CPU/CC-Link Safety master module
CC-Link Safety remote I/O station
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
GX Developer
(Version 8.40S or later)*1
Standard remote I/O station
*1 : The available functions vary depending on the version. For details, refer to the following manual.
The application image for the car welding line is shown as an application example of the
safety PLC in Figure2.1.
The safety application operated by the safety PLC is configured for the following purposes.
When the safe state signal can be confirmed, supply the power to a robot.
When the safe state signal cannot be confirmed, turn off the power to a robot .
Confirm the safe state signal using an emergency stop switch or a light curtain.
The safety PLC is operated as follows.
The safe state signal is connected to a safety remote I/O module.
The safe state signal is sent from the safety remote I/O module to the safety CPU module.
The safety CPU module processes the received safe state signal with the sequence
program and sends the safety output to the safety remote I/O module.
The safety output stops the power of a robot.
Integrated control panelFirst processSecond processn-th process
MELSECNET/H(10),
Ethernet, etc.
(Communication between
standard CPUs)
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
Safety PLC
(Safety control)
Line integrated controlLine control network
MELSECNET/H
Safety remote
I/O module
Standard input
Restart
switch
Safety inputSafety input
Standard output
Emergency
stop switch
Safety remote
I/O module
Warning
light
Process control CPU
Light curtain
Line control networkLine control network
Safety remote
I/O module
Safety output
RobotRobot
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Body welding line
Figure2.1 Application image for car welding line
2 - 1
2
Memo
APPLICATION EXAMPLE
2 - 2
3
t
RISK ASSESSMENT AND SAFTY LEVEL
CHAPTER3 RISK ASSESSMENT AND SAFTY LEVEL
Conforming to EN954-1 and IEC61508, select the risk assessment, safety category, and
SIL to reduce the risk.
This chapter briefly describes the risk assessment, risk reduction and safety category, and
SIL.
For details, refer to each standard.
3.1 Risk Assessment
The risk assessment is to clarify hazards in a machine and assess the degree of the
hazards.
The risk assessment procedure is shown in Figure3.1. This procedure is standardized in
ISO12100 and 14121.
1
2
APPLICATION
3
OVERVIEW
EXAMPLE
Risk reduction
( Section 3.1.1)
Section 3.1.1
1) Machine analysis,
target equipment
confirmation, and
operation status check
2) Hazard identidication
3) Risk estimation
4) Risk evalution
Safety category
Section 3.2
( Section 3.2)
SIL ( Section 3.3)
No
machinery safe?
Yes
Start
Section 3.3
Is the
END
Risk assesmen
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Figure3.1 Risk assessment procedure
(Referred to ISO12100.)
3.1 Risk Assessment
3 - 1
3
RISK ASSESSMENT AND SAFTY LEVEL
3.1.1 Risk reduction
As a result of the risk assessment, when the machinery is judged as unsafe, the risk
reduction must be performed.
The measures for the risk reduction are standardized in ISO12100 and ISO14121 as
shown in Figure3.2.
1) Inherently safety design
2) Safeguarding
Risk reduction
3) Additional precautions
4) Risk reduction with cautions for use
According to the procedure of Figure3.1, combine and execute the several risk reduction
measures until the machine is safe.
Protection by isolation
Protection by stop
Emergency stop device
Ensuring of the energy
zero status
Risk condition indication
and warning
Attached document and
instruction manual
Figure3.2 Risk reduction
Safety barrier
Protective
device
(Referred to ISO12100 and 14121.)
3 - 2
3.1 Risk Assessment
3.1.1 Risk reduction
3
RISK ASSESSMENT AND SAFTY LEVEL
3.2 Safety Category
The safety category is standardized in EN954-1.
The risk graph to be used for the safety category selection is shown in Figure3.3.
Risk analysis result
Safety category selection
1
OVERVIEW
2
Safety category
selection starting point
Severity of the injury
(S)
S1
Minor (normally
recoverable) trouble
S2
Major (normally
unrecoverable) trouble
Frequency and time of
exposure to hazard
(F)
F1
Rare, considerable,
often, or short
time exposures
F2
Frequent to
continuous, or long
time exposures
Definition of symbols:
SymbolDefinition
Safety category which is desirable as a reference
point
Safety category which may be over-specification
—Insufficient safety category
Possibility of
avoidance
P1
Available under a
specific condition
P2
Almost impossible
P1
Available under a
specific condition
P2
Almost impossible
hazard
(P)
Safety category
B 1 2
3 4
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
Figure3.3 Safety category selection relevant to safety related sections of control system
(Referred to EN954-1.)
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
3.2 Safety Category
3 - 3
3
Category
RISK ASSESSMENT AND SAFTY LEVEL
The requirements of standards for the safety category are shown in Table3.1.
Table3.1 Summary of safety category requirements
*1
Safety-related parts of control systems and/or
their protective equipment, as well as their
B
1
2
3
4
components, shall be designed, constructed,
selected, assembled and combined in
accordance with relevant standards so that
they can withstand the expected influence.
Requirements of B shall apply.
Well-tried components and well-tried safety
principles shall be used.
Requirements of B and the use of well-tried
safety principles shall apply.
Safety function shall be checked at suitable
intervals by the machine control system.
Requirements of B and the use of well-tried
safety principles shall apply.
-- a single fault in any of these parts does not
lead to loss of the safety function, and
-- whenever reasonably practicable the single
fault is detected.
Requirements of B and the use of well-tried
safety principles shall apply.
-- a single fault in any of these parts does not
lead to loss of the safety function, and
-- the single fault is detected at or before the
next demand upon the safety function. If
this is not possible, then an accumulation
of faults shall not lead to loss of the safety
function.
Summary of requirements
*1:The categories are not intended to be used in any given order or in any given hierarchy in respect of
safety requirements.
*2:The risk assessment will indicate whether the total or partial loss of the safety function(s) arising from
faults is acceptable.
System behaviour
The occurrence of a fault
can lead to loss of the
safety function.
The occurrence of a fault
can lead to loss of the
safety function, but the
probability of occurrence is
lower than for category B.
-- The occurrence of a
fault can lead to loss of
the safety function
between the checks.
-- The loss of safety
function is detected by
the check.
-- When a single fault
occurs, the safety
function is always
performed.
-- Some but not all faults
will be detected.
-- Accumulation of
undetected faults can
lead to loss of the safety
function.
-- When te faults occur the
safety function is always
performed.
-- The faults will be
detected in time to
prevent loss of the
safety function.
Principles to achieve
*2
Mainly characterized by
selection of components
Mainly characterized by
structure
safety
(Referred to EN954-1.)
3 - 4
3.2 Safety Category
3
3.3 SIL
RISK ASSESSMENT AND SAFTY LEVEL
SIL is standardized in IEC61508.
The risk graph to be used for the SIL selection is shown in Figure3.4.
Degree of
influence
Minor
Moderate
SIL selection starting point
Major
Enormous
Exposure
frequency
Low
High
Low
High
Low
High
Possibility of
risk event
avoidance
Avoidable
Hard to avoid
Avoidable
Hard to avoid
Avoidable
Hard to avoid
Avoidable
Hard to avoid
Probability of risk
event occurrence
Frequent
Moderate
a
1
2
3
4
b
a
1
2
3
4
Infrequent
a
1
2
3
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
Definition of symbols:
SymbolDefinition
-,aNo safety requirements.
bNot sufficient with a single safety-related system.
1,2,3,4
Figure3.4 SIL risk graph
Safety integrity level
Stands for SIL1, SIL2, SIL3 and SIL4 respectively.
(Referred to IEC61508-5.)
In SIL, the following target failure measure is defined according to the level.
Table3.5 Target failure measure (PFD,PFH)
SIL
4
3
2
1
Low demand mode of operation*1High demand mode of operation
-5
10
PFD 10
-4
PFD 10
10
-3
PFD 10
10
-2
10
PFD 10
*1: For the low and high demand modes of operation, refer to IEC61508.
-4
-3
-2
-1
10
10
10
10
-9
PFH 10
-8
PFH 10
-7
PFH 10
-6
PFH 10
-8
-7
-6
-5
(Referred to IEC61508-1.)
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
*1
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
3.3 SIL
3 - 5
4
POINT
PRECAUTIONS FOR USE OF SAFETY PLC
CHAPTER4 PRECAUTIONS FOR USE OF SAFETY PLC
The safety standards conformance approval must be made by the user for the entire
safety-related system.
The safety system inspection is made for the entire safety-related system including safety
components and a sequence program.
The sample program is shown in Chapter 5. However, the safety standards approval is not
obtained.
And all work for safety-related system construction (e.g. design, installation, operation,
maintenance) has to be handled by the person who has an enough education concerning
safety standards, safety devices, and safety PLC.
4.1 Precautions for Designing Safety Application
(1) Response time
The response time is a time from the safety input OFF to the safety output OFF using
the safety PLC.
The response time is needed for determining the safety distance for a safety-related
system.
Calculate the response time of a system to be configured with referring to Appendix.1.
POINT
For the safety PLC, connecting GX Developer makes the response time longer.Do
not constantly connect GX Developer during the safety-related system operation.
(2) Target failure measure (PFD/PFH) calculation
Target failure measure (PFD/PFH) is the target value of reliability for each SIL level
standardized in IEC61508.(Section 3.3)
Calculate the target failure measure (PFD/PFH) with the following formula for each
safety function.
PFD/PFH = A + B + C + D Calculation formula of PFD/PFH
Table4.1 Definition of each variable
Var iabl eDefinition
PFD/PFH of safety CPU module, safety power supply module, safety main base unit, and
CC-Link Safety master module
A
B1PFD/PFH of the safety remote I/O module to which the safety input device is connected
B2PFD/PFH of the safety remote I/O module to which the safety output device is connected
*1
C
*1
D
(1) The safety input device and safety output device are connected to the same safety
remote I/O module.
(2) The safety input device and safety output device are connected to the different safety
remote I/O modules.
PFD/PFH of safety input equipment
PFD/PFH of safety output equipment
*1: For PFD/PFH of C and D, refer to the manuals, etc. of the used safety components.
4 - 1
4.1 Precautions for Designing Safety Application
4
PRECAUTIONS FOR USE OF SAFETY PLC
PFD/PFH of the safety PLC is listed in Table4.2.
Table4.2 PFD/PFH of safety PLC
Module/unitPFDPFH (/h)
PFD/PFH of safety CPU module, safety power supply module, safety main base
unit, and CC-Link Safety master module
*2
QS0J65BTB2-12DT (DC input
transistor output combined module)
PFD/PFH of safety remote I/O module
QS0J65BTS2-8D (DC input module)
QS0J65BTS2-4T (transistor output
module)
*2: The number of the safety master modules is not relevant to the values of PFD or PFH.
(a) When using one QS0J65BTB2-12D
PFD= (PFD of A) + (PFD of B) + (PFD of C) + (PFD of D)
= (1.39 10 -4) + (2.57 10 -5) + (PFD of C) + (PFD of D)
= 1.65 10
PFH= (PFD of A) + (PFD of B) + (PFD of C) + (PFD of D)
= (4.95 10
= 6.10 10
-4
+ (PFD of C) + (PFD of D)
-9
) + (1.15 10
-9
+ (PFH of C) + (PFH of D)
-9
) + (PFH of C) + (PFH of D)
1.39 10
2.57 10
1.68 10
1.68 10
1
-4
-5
-5
-5
4.95 10
1.15 10
7.46 10
7.46 10
-9
-9
-9
-9
2
APPLICATION
OVERVIEW
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
InputOutput
Emergency stop switchSafety relay
Figure4.1 Example when using one QS0J65BTB2-12DT
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
4.1 Precautions for Designing Safety Application
4 - 2
4
PRECAUTIONS FOR USE OF SAFETY PLC
(b) When using one QS0J65BTS2-8D and one QS0J65BTS2-4T
PFD= (PFD of A) + (PFD of B) + (PFD of C) + (PFD of D)
=(1.39 10
= 1.73 10
PFH= (PFH of A) + (PFH of B) + (PFH of C) + (PFH of D)
=(4.95 10 -9) + ((7.46 10
= 6.44 10
-4
) + ((1.68 10 -5) + (1.68 10 -5)) + (PFD of C) + (PFD of D)
-4
+ (PFD of C) + (PFD of D)
-10
) + (7.46 10
-9
+ (PFH of C) + (PFH of D)
-10
)) + (PFH of C) + (PFH of D)
InputOutput
Emergency stop switchSafety relay
Figure4.2 Example when using one QS0J65BTS2-8D and one QS0J65BTS2-4T
4 - 3
4.1 Precautions for Designing Safety Application
4
POINT
POINT
PRECAUTIONS FOR USE OF SAFETY PLC
1
(3) Connecting safety components
Make a doubling wiring for safety components as shown in Figure4.3.
Dual input
Dual output
OVERVIEW
2
L
Safety relay
Safety relay
L
APPLICATION
EXAMPLE
Safety PLC
Figure4.3 Wiring of safety components
3
POINT
Use the doubling input signal to the safety remote I/O module with the following
combinations of input terminals.
For combinations other than the followings, an error is detected by doubling input
discrepancy detection.
{X00, X01}, {X02, X03}, {X04, X05}, {X06, X07}
{X08, X09}, {X0A, X0B}, {X0C, X0D}, {X0E, X0F}
RISK ASSESSMENT
AND SAFTY LEVEL
4
To execute the Input dark test function, connect the safety components using a test
pulse terminal.
POINT
To execute the Input dark test function, use the test pulse terminals and input
terminals of the safety remote I/O module with the following combinations.
Connecting to the incorrect test pulse terminal is identified as a wire break and
causes an error.
Correct combination
{X00, X02, X04, X06, X08, X0A, X0C, X0E} and T0
{X01, X03, X05, X07, X09, X0B, X0D, X0F} and T1
For wiring and setting methods, refer to Chapter 5.
For details of doubling wiring and Input dark test function, refer to the following
manual.
CC-Link Safety System Remote I/O Module User's Manual
(4) Using the monitor data of GX Developer
The monitor data of GX Developer should not be used for the operation related to the
safety.
(For example, the operations for the safety such as starting a machine or resetting the
stop status should not be performed with checking the monitor data of GX Developer.)
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
4.1 Precautions for Designing Safety Application
4 - 4
4
PRECAUTIONS FOR USE OF SAFETY PLC
4.2 Precautions for Programming
(1) Basic programming
Configure a program for realizing safety functions with attention to the following
points.
• Program so that a machine is started only when safe state can be confirmed at
the time the start switch is pressed.
• Program so that a machine is stopped if the safe state is not confirmed.
• Program so that a machine is started at the fall (ONOFF) of the signal of the
start switch.
The programming can prevent a machine from accidentally starting at the switch
failure (such as contact welding, spring damage).
• To inhibit restart without manual operation after safety functions were performed
and outputs were turned OFF, create an interlock program which uses a reset
button for restart.
Operation function
(Non-safety related parts)
Operation command
Start switch
Reset switch
Start
request
Safety PLC
(Start command signal)
Safety
output data
Machine operation
(startup)
Safety
input data
No entering detection to hazardous area
No emergency stop request
The Safety PLC and components are not
faulty status.
Figure4.4 Configuration example of safety-related system
For the program example, refer to Chapter 5.
Safety status
Interlock
4 - 5
4.2 Precautions for Programming
4
Station No.1
Station No.2
Station No.3
Station No.1
Station No.2
Station No.3
PRECAUTIONS FOR USE OF SAFETY PLC
(2) Devices used in a program for realizing the safety functions
Data can be used as safety I/O data are the following safety refresh devices. Use the
safety refresh devices to create a program for realizing the safety functions.
(a) Safety refresh device
The data of internal device refreshed by communicating to the safety remote I/O
station is the safety I/O data.
Safety CPU module
X10F - X100
X11F - X110
X12F - X120
X13F - X130
X14F - X140
X15F - X150
X16F - X160
X17F - X170
Y10F - Y100
Y11F - Y110
Y12F - Y120
Y13F - Y130
Y14F - Y140
Y15F - Y150
Y16F - Y160
Y17F - Y170
Safety master station
RX0F - RX00
RX1F - RX10
RX2F - RX20
RX3F - RX30
RX4F - RX40
RX5F - RX50
RX6F - RX60
RX7F - RX70
RY0F - RY00
RY1F - RY10
RY2F - RY20
RY3F - RY30
RY4F - RY40
RY5F - RY50
RY6F - RY60
RY7F - RY70
Figure4.5 I/O data of safety remote station
*1: Figure4.5 shows a case where X100 and Y100 are set with the auto refresh parameter.
The following device ranges actually not input/output to the safety remote I/O station are
included.
Station No. 1: X110 to X11F, Y110 to Y11F, Station No. 3: X150 to X15F, Y150 to Y15F
Station No.1 Safety remote I/O station
Station No.2 Standard remote I/O station
Station No.3 Safety remote I/O station
Station No.3 Safety remote I/O station
(input)
RX0F - RX00
(input)
RX0F - RX00
(input)
RX0F - RX00
(output)
RY0F - RY00
1
OVERVIEW
2
APPLICATION
EXAMPLE
Turn on/off the
emergency stop
switch, safety switch,
light curtain, etc.
Turn on/off the
power source of a
robot.
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
:Indicates the safety device range.
*1
SAFETY
APPLICATION
CONFIGURATION
(b) Special relay (SM), special register (SD)
Only SM1000 to SM1299 and SD1000 to SD1299, which are CC-Link SafetyÂrelated devices, can be used in a program for realizing the safety functions.
4.2 Precautions for Programming
APPENDIXINDEX
4 - 6
4
PRECAUTIONS FOR USE OF SAFETY PLC
(3) Error detection of CC-Link Safety
Errors concerning CC-Link Safety can be detected by safety station refresh
communication status which is described in Table4.3.
Create a proper sequence program using the information for error detection (SD)
which turns safety outputs OFF.
(a) Safety station refresh communication status
Names and numbers of the special registers for confirming the safety station
refresh communication status are shown in Table4.3.
Table4.3 Register names and compatible numbers
Definition for bits of special register (safety station refresh
communication status)
NameNo.
0: Normal, reserved station select, not connected, or standard remote
1: Safety station communication error
Definition of each bit indicated as station No. in the table
station
Safety station refresh
communication status
(1st safety master module)
Safety station refresh
communication status
(2nd safety master module)
SD1004 to
SD1007
SD1204 to
SD1207
b15b14
SD10041615to21
SD10053231to1817
SD10064847to3433
SD10076463to5049
1 to 64 in the table indicate the station numbers.
b15b14
SD12041615to21
SD12053231to1817
SD12064847to3433
SD12076463to5049
1 to 64 in the table indicate the station numbers.
–
–
b1b0
b1b0
For details, refer to the following manual.
QSCPU User's Manual (Function Explanation, Program Fundamentals)
(b) Program example
The program for handling the error detection of CC-Link Safety is shown in
Figure4.6.
Figure4.6 shows the program used when outputting from the safety remote I/O
station of station No.1 connected to the first module of the safety master module
using SD1004.0.
4 - 7
SD1004.0
Safety station refresh
communication status
Figure4.6 Program for handling error detection of CC-Link Safety
4.2 Precautions for Programming
Other safety
status
Output
4
PRECAUTIONS FOR USE OF SAFETY PLC
(4) Reset of CC-Link Safety error
NameNo.Definition for bits special register (Safety station interlock status)
Safety station interlock status
(1st safety master module)
Safety station
interlock clear request
(1st safety master module)
Safety station interlock status
(2nd safety master module)
Safety station
interlock clear request
(2nd safety master module)
When an CC-Link Safety error is detected, the safety station interlock status shown in
Table4.4 turns on.
To resume communications of the CC-Link Safety, turn on the safety station interlock
clear request.
Create the program which requests the safety station interlock clear by manual
operation using a reset button.
Table4.4 Register names and compatible numbers
0: Does not interlocked.
1: During interlock (head station number only)
b15b14–b1b0
SD1072 to
SD1075
SD1076 to
SD1079
SD1272 to
SD1275
SD1276 to
SD1279
SD10721615to21
SD10733231to1817
SD10744847to3433
SD10756463to5049
1 to 64 in the table indicate the station numbers.
0: Does not clear I/O interlock in safety station.
1: Clears I/O interlock in safety station.
(head station number only)
b15b14–b1b0
SD10761615to21
SD10773231to1817
SD10784847to3433
SD10796463to5049
1 to 64 in the table indicate the station numbers.
0: Does not interlocked.
1: During interlock (head station number only)
b15b14–b1b0
SD12721615to21
SD12733231to1817
SD12744847to3433
SD12756463to5049
1 to 64 in the table indicate the station numbers.
0: Does not clear I/O interlock in safety station.
1: Clears I/O interlock in safety station.
(head station number only)
b15b14–b1b0
SD12761615to21
SD12773231to1817
SD12784847to3433
SD12796463to5049
1 to 64 in the table indicate the station numbers.
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
For details, refer to the following manual.
QSCPU User's Manual (Function Explanation, Program Fundamentals)
4.2 Precautions for Programming
4 - 8
4
PRECAUTIONS FOR USE OF SAFETY PLC
(a) Program example
Figure4.7 shows the program when the interlock for the safety remote I/O station
of station 1, connected to the first safety master module is cleared.
SD1072.0
SET SD1076.0
Reset switch
Safety station
interlock status
Figure4.7 Program example when interlock for the CC-Link Safety is cleared
Safety station
interlock status
SD1076.0SD1072.0
Safety station interlock
clear request
(5) Version management of GX Developer project file
Fill in the created date and author at the top of sequence program using the statement
function of GX Developer.
When the program will be modified, fill in the modified date, modified person, and
modified description at the modified place using the statement function of GX
Developer for change history management.
And manage the data which was downloaded to the PLC by storing the hard disk of
personal computer or CD.
Safety station interlock
clear request
RST SD1076.0
Safety station interlock
clear request
Figure4.8 Version management of GX Developer project file
(6) User registration
Define the user who handles the corresponding project, then register the user
information and authorization required for the login authentication in the project.
For the user registration, refer to the following manual.
GX Developer Version 8 Operating Manual (Safety PLC)
4 - 9
4.2 Precautions for Programming
4
PRECAUTIONS FOR USE OF SAFETY PLC
4.3 Precautions for Startup
When new safety-related system will be started up or existing safety-related system will be
changed, confirm the below points.
1
OVERVIEW
(1) Confirmation of network connection configuration
Confirm that the safety remote I/O module used is set as designed.
The confirmation items are shown below.
1) Link ID
2) Station No.
3) Transmission speed
For the switch settings of the safety remote station, refer to the following manual.
CC-Link Safety System Remote I/O Module User's Manual
(2) Confirmation before writing parameters and program
Confirm the parameters and program to be written are as designed before writing
them to a PLC.
For the parameter settings by using GX Developer, refer to the following manual.
GX Developer Version 8 Operating Manual (Safety PLC)
For parameter definition and setting range for parameter settings of GX Developer,
refer to the following manual.
CC-Link Safety System Master Module User's Manual
(3) Usage of a checklist
Before operation, check if the safety-related system is correctly configured with the
checklist in Appendix.2.
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
4.4 Precautions for Safety Functions Maintenance
(1) Periodic inspection
To confirm whether the emergency stop switch, safety sensor, etc. are not faulty,
execute a periodic inspection every one year for meeting Category 3, every six month
for meeting Category 4.
As well as diagnostics of the safety PLC, perform a test from the emergency stop
request to machine stop as safety functions.
(2) Module/unit replacement
For the safety PLC, execute the module/unit replacement according to the
replacement cycle in Table4.5.
Table4.5 Module/unit replacement period
Module/unitModule/unit replacement cycle
Safety power supply module5 years
Safety CPU module10 years
Safety master module10 years
Safety remote I/O module5 years
Safety main base unit10 years
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
4.3 Precautions for Startup
4 - 10
4
PRECAUTIONS FOR USE OF SAFETY PLC
(3) Operation mode while a safety PLC is in operation
Set the operation mode of the safety PLC to SAFETY MODE when the PLC is in
operation.
(4) ROM information management of a safety CPU
Confirm the ROM information at regular intervals whether the programs and
parameters in the safety CPU module are illegally rewritten.
1) When writing a project file to ROM, check the ROM information using GX
Developer, and separately save the information.
2) With reference to the ROM information of GX Developer at regular intervals,
confirm whether the information is illegally rewritten.
3) When the information is illegally rewritten, stop the operation.
Then, recover the project using the backup project file.
For confirming the ROM information, refer to the following manual.
GX Developer Version 8 Operating Manual (Safety PLC)
(5) Password management
The project files for GX Developer and safety CPU module are protected by
password.
Manage the registered password properly and do not leak the password except
authorized person in order to prevent the unauthorized access.
4 - 11
4.4 Precautions for Safety Functions Maintenance
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
CHAPTER5 SAFETY APPLICATION CONFIGURATION
EXAMPLE
This chapter describes the configuration example of the safety application using the safety
PLC.
5.1 System Configuration
1
OVERVIEW
2
Parameters
Programs
GX Developer
This section describes the safety application using the system configuration of Figure5.1
as an example.
Master (1)
Safety master station (Link ID: 0, Station number: 0)
Master (2)
Safety master station (Link ID: 1, Station number: 0)
CC-Link Safety
Remote (1)
Safety remote I/O station
(Link ID: 0, Station number: 1)
Code name SR_IO1
Remote (4) Code name SR_IO4
Safety remote I/O station (Link ID: 1, Station number: 1)
Safety input
Emergency stop switch
Safety output
Safety relay
MC
L
Safety relay
Remote (2)
Safety remote I/O station
(Link ID: 0, Station number: 2)
Code name SR_IO2
Remote (3)
Safety remote I/O station
(Link ID: 0, Station number: 3)
Code name SR_IO3
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
Safety input
Safety switch
Light curtain
Laser scanner
Mat switch
CC-Link Safety
Figure5.1 System configuration
Standard input
Reset switch
Start switch
Stop switch
5.1 System Configuration
APPENDIXINDEX
5 - 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
5.2 Network-Related Switch Settings of Module
Set the switch settings of each main module as follows
5.2.1 Safety Power supply module
No switch on the safety power supply module
5.2.2 Safety CPU module
No network-related switch on the safety CPU module
5.2.3 Safety master module
No switch on the safety master module
5 - 2
5.2 Network-Related Switch Settings of Module
5.2.1 Safety Power supply module
5
POINT
SAFETY APPLICATION CONFIGURATION EXAMPLE
5.2.4 Safety remote I/O module
Set the link ID, station No. setting switch, and transmission speed setting switch.
123456789ABCDEF
X0
L RUN
POWER
L ERR.
RUN
SD
SAFETY
RD
ERR.
QS0J65BTB2-12DT
RESETSET
STATION NO. B RATE
LINK ID
LBT
EL
0
0
0
0
1
1
1
1
2
2
2
2
3
3
3
37
456
4
456
456
X10 X1
1)2)3)
Figure5.2 Switch position of safety remote I/O module
*1: Fixed to "Clears compulsorily" when the safety CPU operation mode is set to SAFETY MODE.
*1
Clears compulsorilyClears compulsorily
Section 5.3.1
Section 5.3.2
POINT
Make the same settings between the link ID and transmission speed in the CCÂLink parameter of GX Developer and those of the switches on remote I/O main
module to be connected.
5.3.1 CC-Link station information settings
Set the CC-Link station information settings as follows.
Table5.3 Setting example of master (1) station information /
ModuleStation No.Station typeExclusive station countReserve station count
1/1Safety remote I/O stationExclusive station 1No setting
Master (1)
ModuleStation No.Station typeExclusive station countReserve station count
Master (2)1/1Safety remote I/O stationExclusive station 1No setting
5 - 4
2/2Safety remote I/O stationExclusive station 1No setting
3/3Safety remote I/O stationExclusive station 1No setting
Table5.4 Setting example of master (2) station information
5.3 CC-Link Parameter Settings
5.3.1 CC-Link station information settings
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
5.3.2 Safety remote station parameter settings
Set the safety remote station parameter settings as follows.
Table5.5 Safety remote station parameter settings
Module
Model nameQS0J65BTB2-12DTQS0J65BTB2-12DTQS0J65BTB2-12DTQS0J65BTB2-12DT
Module technical
*1
version
Specify production
information to find
module
Production
information
ParameterIndicated in each case example of Section 5.6 or later.
*2
1100000000000010––1100000000000020
(1)(2)(3)(4)
SR_IO1SR_IO2SR_IO3SR_IO4
AAAA
Yes (check)No (no check)No (no check)Yes (check)
*1: For Module technical version, check the rated plate on the module side in the corresponding safety
remote station.
CC-Link Safety System Remote I/O Module User's Manual QS0J65BTB2-12DT
*2: Enter Production information field referring to the rated plate on the module side in the
corresponding safety remote station.
CC-Link Safety System Remote I/O Module User's Manual QS0J65BTB2-12DT
The use of production information is needed to maintain a proper function after module exchange or
to detect any incorrect station number settings such as station number duplication. Use the
production information to use safety PLC properly and safely.
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
5.3 CC-Link Parameter Settings
5.3.2 Safety remote station parameter settings
5 - 5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
5.4 Relationship between the Safety CPU Module Devices and
Remote I/O
The following shows the relationship between the safety CPU module devices and the
remote I/O stations in the settings of Table5.2.
The shaded device numbers are used to create sequence programs.
Station number 1
Station number 2
Station number 3
Station number 1
Station number 2
Station number 3
Safety CPU
X010F - X0100
X011F - X0110
X012F - X0120
X013F - X0130
X014F - X0140
X015F - X0150
Y010F - Y0104
Y011F - Y0110
Y012F - Y0124
Y013F - Y0130
Y014F - Y0144
Y015F - Y0150
Y0103 - Y0100
Y0123 - Y0120
Y0143 - Y0140
Link ID: 0
Remote (1)
SR_IO1
Remote (2)
SR_IO2
Remote (3)
SR_IO3
Safety remote I/O station
(Link ID: 0, Station number: 1)
QS0J65BTB2-12DT
X0F - X00
Safety remote I/O station
(Link ID: 0, Station number: 2)
QS0J65BTB2-12DT
X0F - X00
Safety remote I/O station
(Link ID: 0, Station number: 3)
QS0J65BTB2-12DT
X0F - X00
Y03 - Y00
Y03 - Y00
Y03 - Y00
Station number 1
Station number 1
Link ID: 1
Remote (4)
SR_IO4
X020F - X0200
X021F - X0210
Y020F - Y0204
Y021F - Y0210
Figure5.3 Relationship between safety CPU devices and remote I/O
Y0203 - Y0200
Safety remote I/O station
(Link ID: 1, Station number: 1)
QS0J65BTB2-12DT
X0F - X00
Y03 - Y00
5 - 6
5.4 Relationship between the Safety CPU Module Devices and Remote
I/O
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
5.5 Wiring Diagram and Parameter Setting of Standard Input
Wire the reset switch, start switch, and stop switch as follows.
1
Remote (3):SR_IO3
QS0J65BTB2-12DT(3)
(LinkID: 1, Station number: 3)
COM-
1
X0
Reset switch (NO)
Start switch (NO)
Stop switch (NC)
2
T0
3
X1
4
COM-
5
X2
6
T1
7
X3
8
COM-
9
X4
10
T0
11
X5
12
COM-
13
X6
14
T1
15
X7
16
COM+
17
COM+
18
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
Figure5.4 Remote (3) SR_IO3 standard input wiring
OVERVIEW
2
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
APPLICATION
EXAMPLE
3
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
24VDC
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
For the reset switch, start switch, and stop switch, set the parameters as follows.
Table5.6 Remote (3) SR_IO3 parameter settings
ItemSetting
Time of noise removal filter X0, 1
Time of noise removal filter X2, 3
Time of noise removal filter X4, 5
Doubling input discrepancy detection time X0, 1
Doubling input discrepancy detection time X2, 3
Doubling input discrepancy detection time X4, 5
Input dark test selection X0, 1
Input dark test selection X2, 3
Input dark test selection X4, 5
Input dark test pulse OFF time
*1
*1
*1
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
time according to the installation environment and wiring length. Set Doubling input discrepancy
detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
SAFETY
APPLICATION
CONFIGURATION
0: 1ms
0: 1ms
0: 1ms
*1
*1
*1
100ms (setting range: 20 to 500ms)
100ms (setting range: 20 to 500ms)
100ms (setting range: 20 to 500ms)
0: Execute,
0: Execute,
0: Execute,
0: 400 s
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
APPENDIXINDEX
1: Not execute
1: Not execute
1: Not execute
, 1: 1ms, 2: 2ms
5.5 Wiring Diagram and Parameter Setting of Standard Input
5 - 7
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
5.6 Case Examples
5.6.1 Emergency stop circuit
(1) Application overview
The emergency stop circuit is the safety application that turns off the power source of
a robot with the emergency stop switch.
The application controls the start and stop of a robot by turning on or off the main
contact of the contactor which opens and closes the power source of a robot at the
safety relay contact.
The emergency stop switch and safety relays are connected to the safety PLC.
The safety PLC controls the ON/OFF status of the safety relays with a sequence
program.
When the safety PLC detects an error using the self-diagnostics, the outputs to the
safety relays are turned off independent of the sequence program.
When the outputs are turned off with the self-diagnostics, the OFF status is
maintained regardless of the sequence program until the safety CPU module or safety
remote I/O module is reset.
The following functions are realized with the sequence program.
1) After safety is ensured (Emergency stop signal is on), pushing the reset
switch, then the start switch turning the safety relays on.
2) When the safety relays are welding, input the close contacts of the safety
relays to the safety PLC for avoiding the start, and check for welding.
3) The reset switch and start switch are set to start only when changed from
ON to OFF for avoiding an accidental start of the switches at welding or
short-circuit.
4) The safety relay outputs are turned off when the emergency stop switch
input is turned off or an error is detected in the safety remote I/O station
after the operation is started.
5 - 8
Figure5.5 Emergency stop switch
(Partially quoted from "Safety Guide Book - the safety measures of machinery in the workplace"
: Nippon Electric Control Equipment Industries Association.)
5.6 Case Examples
5.6.1 Emergency stop circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(2) Connection of safety devices
Remote (4):SR_IO4
X200-20F
Y200-203
CC-Link Safety
Remote (1):SR_IO1Remote (2):SR_IO2
X100-10F
Y100-103
CC-Link Safety
X120-12F
Y120-123
Figure5.6 Safety device connection diagram
Wiring: Indicated in Figure
.
Figure5.7
5.7.
Parameters: Indicated in
Table5.7
Table 5.7.
Remote (3):SR_IO3
X140-14F
Y140-143
: Safety remote I/O module
used in this case example
Wiring: Indicated in Figure
Figure5.4.
5.4.
Parameters: Indicated in
Table5.6
Table 5.6.
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
5.6 Case Examples
5.6.1 Emergency stop circuit
5 - 9
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(3) Wiring diagram and parameter settings
Wire the emergency stop switch and safety relays to the safety remote I/O module as
follows.
Connect the close contact
of the safety relay
between the input
terminal and the test
pulse terminal.
Connect the emergency
stop switch with two NC
contacts of direct
opening action between
the input terminal and
the test pulse terminal.
Emergency stop
switch3
Remote(4)
QS0J65BTB2-12DT(4)
(LinkID: 1, Station number: 1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
24VDC
Connect two relays
with forcibly guided
(mechanically linked)
contacts.
Safety relay4
Safety relay5
24VDC
Figure5.7 Remote (4) SR_IO4 wiring
5 - 10
5.6 Case Examples
5.6.1 Emergency stop circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the emergency stop switch and the safety relay, set the parameters as follows.
Table5.7 Remote (4) SR_IO4 parameter settings
ItemSetting
Time of noise removal filter X2, 3
Time of noise removal filter X4, 5
Doubling input discrepancy detection time X2, 3
Doubling input discrepancy detection time X4, 5
Input dark test selection X2, 3
*1
*1
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
*1
100ms (setting range: 20 to 500ms)
*1
100ms (setting range: 20 to 500ms)
0: Execute
, 1: Not execute
1
OVERVIEW
2
Input dark test selection X4, 5
Input dark test pulse OFF time
Method of wiring of output Y2
Output dark test selection Y2
Output dark test pulse OFF time Y2
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
*1
time according to the installation environment and wiring length. Set Doubling input discrepancy
detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
0: Execute
0: 400 s
0: No Use, , 2: Doubling wiring
(Source+Source)
0: Execute
0: 400 s,, 2: 2ms
, 1: Not execute
, 1: 1ms, 2: 2ms
1: Doubling wiring (Source + Sink)
, 1: Not execute
1: 1ms
(4) Device numbers to be used
Use the following device numbers for creating sequence programs.
Table5.8 Device numbers to be used
Safety/StandardExternal deviceDevice number
SafetyEmergency stop switchX204 or X205
SafetySafety relayY202
SafetySafety relay (check for welding)X202 or X203
StandardStart switchX142
StandardReset switchX140
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
5.6 Case Examples
5.6.1 Emergency stop circuit
5 - 11
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(5) Sequence program
Make the following processing on sequence programs.
Ladder which checks the off fall of the reset
switch, accepts reset request, and clears the
interlock for the CC-Link Safety.
Ladder which confirms the interlock processing
completion and cancels interlock clear request.
Ladder which checks the off fall of the start
switch and accepts start request.
Ladder which checks safety relays for welding.
T0 is a delay timer which waits for safety
relays to actually be turned off after the off
output of the safety relays.
Ladder which checks whether a robot can
start and continue operation.
Ladder which clears start request/reset
request when safety cannot be confirmed.
Ladder which controls outputs to safety relays.
Figure5.8 Sequence program
The following shows the constant and internal devices used in the program.
(a) Way of using the constant
K : indicates decimal number.
Example) K1 indicates 1 of decimal number.
5 - 12
5.6 Case Examples
5.6.1 Emergency stop circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(b) Way of using the internal devices
Table5.9 Way of using the internal devices
InternalDetails
T0
D0
D1
Designates a timer device.
Times out after a lapse of the time specified at K .
Designates a word device.
In the program, this is used as restart status.
(1) D0 = 0 designates that the system is in initial status or start processing is completed.
(2) D0 = 1 (D0.0: ON) designates that the reset switch is pressed.
(3) D0 = 2 (D0.1: ON) designates that the reset switch is released in (2) status and
restart processing is completed.
Designates a word device.
In the program, this is used as start status.
(1) D1 = 0 designates that the system is in initial status or safety is not confirmed.
(2) D1 = 1 (D1.0: ON) designates that the start switch is pressed.
(3) D1= 2 (D1.1: ON) designates that the start switch is released in (2) status and
start processing is completed.
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
(c) Way of using word device bit specification
(6) Timing chart
Reset SW (X140)
Restart status (D0.0)
Restart status (D0.1)
Start SW (X142)
Start status (D1.0)
Start status (D1.1)
Interlock status (SD1272.0)
Interlock clear (SD1276.0)
CC-Link status (SD1204.0)
D. : designates the th bit data of word device D .
Example) D0.0 indicates 0 bits in D0.
F0
0000000000000001
Figure5.9 Word device bit specification
Pressing
the reset
SW
Pressing the
emergency
stop SW
Pressing
the start
SW
Turing OFF the emergency SW
Pressing
the reset
SW
Pressing
the start
SW
CC-Link
remote (4)
error
CC-Link
error
Pressing
the reset
SW
Pressing
the reset
SW
Pressing the
emergency
stop SW
Pressing
the start
SW
Detecting
relay welding
Pressing
the reset
SW
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Emergency stop SW (X204)
Safety information (M5)
Safety relay output (Y202)
Safety relay output check (X202)
Figure5.10 Timing chart
Detecting welding
5.6 Case Examples
5.6.1 Emergency stop circuit
5 - 13
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
5.6.2 Door lock circuit
(1) Application overview
The door lock circuit is the application that keeps the door closed until the power
source of a robot stops with the spring lock type safety switch attached to the door of
the safety barrier.
The safety switch is normally locked by spring power. When voltage is applied to the
solenoid, the lock is released and the door can be opened. Specifically, the lock is
released with the status signal, indicating such as the stop status of a robot.
The robot cannot be started during unlocking or opening the door.
The application controls the start and stop of a robot by turning on or off the main
contact of the contactor which opens and closes the power source of a robot at the
safety relay contact.
The safety switches and the safety relays are connected to the safety PLC.
The safety PLC controls the ON/OFF status of the safety relays with a sequence
program.
When the safety PLC detects an error using the self-diagnostics, the outputs to the
safety relays are turned off independent of the sequence program.
When the outputs are turned off with the self-diagnostics, the OFF status is
maintained regardless of the sequence program until the safety CPU module or safety
remote I/O module is reset.
The following functions are realized with the sequence program.
1) When the safety switch is on, pushing the reset switch, then the start
switch turning the safety relays on.
2) When the safety relays are welding, input the close contacts of the safety
relays to the safety PLC for avoiding the start, and check for welding.
3) The reset switch and start switch are set to start only when changed from
ON to OFF for avoiding an accidental start of the switches at welding or
short-circuit.
4) The safety relay outputs are turned off when the stop switch is pressed.
5) The safety relay outputs are turned off when an error is detected in the
safety remote I/O station after the operation is started.
5 - 14
Figure5.11 Door lock circuit
(Partially quoted from "Safety Guide Book - the safety measures of machinery in the workplace"
: Nippon Electric Control Equipment Industries Association.)
5.6 Case Examples
5.6.2 Door lock circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(2) Connection of safety devices
Wiring: Indicated in
Figure5.12.
Figure 5.12.
Paremeters: Indicated
in Table 5.10.
Table5.12
CC-Link Safety
Remote (1):SR_IO1
X100-10F
Y100-103
CC-Link Safety
Remote (4):SR_IO4
X200-20F
Y200-203
Remote (2):SR_IO2
X120-12F
Y120-123
Wiring: Indicated in
Figure 5.14.
Figure5.14
Paremeters: Indicated
in Table 5.11.
Table5.11
Remote (3):SR_IO3
X140-14F
Y140-143
: Safety remote I/O module
used in this case example
Wiring: Indicated in
Figure 5.4.
Figure5.4
Paremeters: Indicated
in Table 5.6.
Table5.6
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
Figure5.12 Safety device connection diagram
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.2 Door lock circuit
5 - 15
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
Wire the door switch
with lock structure
having two NC
contacts of direct
opening action to the
input terminal and test
pulse terminal.
(3) Wiring diagram and parameter settings
Safety switch
2NC
(a) Remote (1): SR_IO1
Wire the spring lock type safety switch to the safety remote I/O module as follows.
Remote(1)
QS0J65BTB2-12DT(1)
Lock release
DoorOpen
0V+24V
(LinkID=0, Station number 1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
38
39
40
41
+24V
42
43
44
COM-
45
46
COM-
47
48
COM-
49
50
COM-
51
52
COM-
53
54
COM-
55
56
COM-
57
58
COM-
59
I/O24V
60
I/O24G
61
DA
DB
DG
SLD
FG
24G
Y0+
Y0-
Y1+
Y1-
Y2+
Y2-
Y3+
Y3-
24VDC
24VDC
Figure5.13 Remote (1) SR_IO1 wiring
For the spring lock type safety switch, set the parameters as follows.
Table5.10 Remote (1) SR_IO1 parameter settings
ItemSetting range
Time of noise removal filter X0, 1
Doubling input discrepancy detection time X0, 1
Input dark test selection X0, 1
Input dark test pulse OFF time
*1
*1
*1: Adjust Time of noise removal filter and Input dark test pulse OFF time according to the installation
environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the
mechanical switch and 20ms for the sensor input as a guideline.
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
*1
100ms (setting range: 20 to 500ms)
0: Execute
0: 400 s
, 1: Not execute
, 1: 1ms, 2: 2ms
5 - 16
5.6 Case Examples
5.6.2 Door lock circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(b) Remote (4): SR_IO4
Wire the relay with forcibly guided (mechanically linked) contacts to the safety
remote I/O module as follows.
Connect the close
contact of the safety
relay between the Input
terminal and the test
pulse.
Rermote(4)
QS0J65BTB2-12DT(4)
(LinkID=1, Station number1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
24VDC
Figure5.14 Remote (4) SR_IO4 wiring
Connect two relays
with forcibly guided
(mechanically
linked) contacts.
Safety relay4
Safety relay5
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
For the relay with forcibly guided (mechanically linked) contacts, set the
parameters as follows.
Table5.11 Remote (4) SR_IO4 parameter settings
ItemSetting range
Time of noise removal filter X2, 3
Doubling input discrepancy detection time X2, 3
Input dark test selection X2, 3
Input dark test pulse OFF time
Method of wiring of output Y2
Output dark test selection Y2
Output dark test pulse OFF time Y2
*1
*1
*1
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
time according to the installation environment and wiring length. Set Doubling input discrepancy
detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
0: 1ms
*1
100ms (setting range: 20 to 500ms)
0: Execute
0: 400 s
0: No Use, , 2: Doubling wiring
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
, 1: Not execute
, 1: 1ms, 2: 2ms
1: Doubling wiring (Source + Sink)
(Source+Source)
0: Execute
0: 400 s, , 2: 2ms
, 1: Not execute
1: 1ms
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.2 Door lock circuit
5 - 17
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(4) Device numbers to be used
Use the following device numbers for creating sequence programs.
Table5.12 Device numbers to be used
Safety/StandardExternal deviceDevice number
SafetySafety switchX100 or X101
SafetySafety relayY202
SafetySafety relay (check for welding)X202 or X203
StandardReset switchX140
StandardStart switchX142
StandardStop switchX144
(5) Sequence program
Make the following processing on sequence programs.
Ladder which checks the off fall of the reset
switch, accepts reset request, and clears the
interlock for the CC-Link Safety.
Ladder which confirms the interlock processing
completion and cancels interlock clear request.
Ladder which checks the off fall of the start
switch and accepts start request.
Ladder which checks safety relays for welding.
T0 is a delay timer which waits for safety
relays to actually be turned off after the off
output of the safety relays.
Ladder which checks whether a robot can
start and continue operation.
Ladder which clears start request/reset
request when safety cannot be confirmed.
5 - 18
Ladder which controls outputs to safety relays.
Figure5.15 Sequence program
The following shows the constant and internal devices used in the program.
(a) Way of using the constant
K : indicates decimal number.
Example) K1 indicates 1 of decimal number.
5.6 Case Examples
5.6.2 Door lock circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(b) Way of using the internal devices
Table5.13 Way of using the internal devices
InternalDetails
T0
Designates a timer device.
Times out after a lapse of the time specified at K .
Designates a word device.
In the program, this is used as restart status.
D0
(1) D0 = 0 designates that the system is in initial status or start processing is completed.
(2) D0 = 1 (D0.0: ON) designates that the reset switch is pressed.
(3) D0 = 2 (D0.1: ON) designates that the reset switch is released in (2) status and
restart processing is completed.
Designates a word device.
In the program, this is used as start status.
D1
(1) D1 = 0 designates that the system is in initial status or safety is not confirmed.
(2) D1 = 1 (D1.0: ON) designates that the start switch is pressed.
(3) D1 = 2 (D1.1: ON) designates that the start switch is released in (2) status and
start processing is completed.
(c) Way of using word device bit specification
D. : designates the th bit data of word device D.
Example) D0.0 indicates 0 bits in D0.
F0
0000000000000001
Figure5.16 Word device bit specification
(6) Timing chart
Reset SW (X140)
Restart status (D0.0)
Pressing
the reset
SW
Pressing
the start
SW
Pressing
the stop
SW
Pressing
the reset
SW
Opening
the door
Pressing
the start
SW
Closing
the door
Pressing
the reset
SW
Pressing
the start
SW
CC-Link
remote (4)
error
Pressing
the reset
SW
Pressing
the reset
SW
Pressing
the stop
SW
Pressing
the start
SW
Detecting
relay
welding
Pressing
the reset
SW
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
Restart status (D0.1)
Start SW (X142)
Start status (D1.0)
Start status (D1.1)
Interlock status
(SD1272.0)
Interlock clear
(SD1276.0)
CC-Link status
(SD1204.0)
Stop SW (X144)
Safety door SW (X100)
Safety information (M5)
Safety relay output
Safety relay output check
(Y202)
(X202)
Turing OFF the stop SW
Figure5.17 Timing chart
CC-Link
error
Detecting welding
5.6 Case Examples
5.6.2 Door lock circuit
APPENDIXINDEX
5 - 19
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
5.6.3 Entering detection and existence detection circuit 1
(1) Application overview
The entering detection and existence detection circuit is the safety application that
detects the entrance and existence of a human in a hazardous area and turns off the
power source of a robot.
The entrance of human to the hazardous area is detected with a light shielding of the
light curtain.The existence of human in the hazardous area is detected with a laser
scanner. When the entrance or existence of human has been detected, a robot is
stopped.
The robot cannot be started until the human leaves the hazardous area.
The light curtain, laser scanner, and contactors are connected to the safety PLC.
The safety PLC controls ON/OFF status of the contactors with a sequence program.
When the safety PLC detects an error using the self-diagnostics, the outputs to the
contactors are turned off independent of the sequence program.
When the outputs are turned off with the self-diagnostics, the OFF status is
maintained regardless of the sequence program until the safety CPU module or safety
remote I/O module is reset.
The following functions are realized with the sequence program.
1) After safety is ensured (The light curtain and laser scanner signals are
both on), pushing the reset button, then the start button turning the
contactor on.
2) When the contactors are welding, input the close contacts of the safety
relays to the safety PLC for avoiding the start, and check for welding.
3) The reset switch and start switch are set to start only when changed from
ON to OFF for avoiding an accidental start of the switches at welding or
short-circuit.
4) The contactor outputs are turned off when the light curtain signal or laser
scanner signal is turned off or an error is detected in the safety remote I/O
station after the operation is started.
5 - 20
Figure5.18 Entering detection and existence detection circuit
(Partially quoted from "Safety Guide Book - the safety measures of machinery in the workplace"
: Nippon Electric Control Equipment Industries Association.)
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(2) Connection of safety devices
Wiring: Indicated in
Figure 5.20.
Figure5.20
Parameters: Indicated
Table5.14
in Table 5.14.
CC-Link Safety
Remote(1):SR_IO1
X100-10F
Y100-103
CC-Link Safety
Remote(4):SR_IO4
X200-20F
Y200-203
Remote(2):SR_IO2
X120-12F
Y120-123
Wiring: Indicated in
Figure5.21
Figure 5.21.
Parameters: Indicated
Table5.15
in Table 5.15.
Remote(3):SR_IO3
X140-14F
Y140-143
: Safety remote I/O module
used in this case example
Wiring: Indicated in
Figure 5.4.
Figure5.4
Parameters: Indicated
Table5.6
in Table 5.6.
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
Figure5.19 Safety device connection diagram
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5 - 21
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(3) Wiring diagram and parameter settings
Wire the light curtain and the laser scanner to the safety remote I/O module as
follows.
(a) Remote (1): SR_IO1
Optical transmitter
Connect two control output
points (PNP output) of type 4
light curtain between the input
terminal and COM- terminal.
Connect two control output
points (PNP output) of type 3
laser scanner between the input
terminal and COM- terminal.
FG
Optical receiver
FG
Light curtain
Laser scanner
Figure5.20 Remote (1) SR_IO1 wiring
DC24V
DC24V
0V
Synchronization negative
Synchronization positive
Synchronization positive
Synchronization negative
DC24V
Control output1
Control output2
0V
DC24V
Control output1
Control output2
Create dual wiring
Create dual wiring
QS0J65BTB2-12DT(1)
(LinkID=0, Station numner1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
Remote(1)
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
24VDC
5 - 22
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the light curtain and the laser scanner, set the parameters as follows.
Table5.14 Remote (1) SR_IO1 parameter settings
ItemSetting range
Time of noise removal filter X4, 5
Time of noise removal filter X6, 7
Doubling input discrepancy detection time X4, 5
Doubling input discrepancy detection time X6, 7
Input dark test selection X4, 5
*1
*1
0: 1ms
0: 1ms
*1
20ms (setting range: 20 to 500ms)
*1
20ms (setting range: 20 to 500ms)
0: Execute,
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
1: Not execute
1
OVERVIEW
2
Input dark test selection X6, 7
Input dark test pulse OFF time*1
(b) Remote (4): SR_IO4
Connect the close contact
of the contactor between
the input terminal and
test pulse terminal.
0: Execute,
0: 400 s
1: Not execute
, 1: 1ms, 2: 2ms
*1: Adjust Time of noise removal filter according to the installation environment and wiring length. Set
Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the
sensor input as a guideline.
Wire the contactors to the safety remote I/O module as follows.
Remote(4)
QS0J65BTB2-12DT(4)
(LinkID=1, Station number1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
Use two contactors
which can be activated
with 24VDC, 0.5A.
Contactor1
L3L2L
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
1
Contactor2
24VDC
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Figure5.21 Remote (4) SR_IO4 wiring
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5 - 23
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the contactors, set the parameters as follows.
ItemSetting range
Time of noise removal filter X8, 9
Doubling input discrepancy detection
time X8, 9
Input dark test selection X8, 9
Input dark test pulse OFF time
Method of wiring of output Y0
Method of wiring of output Y1
*1
*1
*1
Table5.15 Remote (4) SR_IO4 parameter settings
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
100ms (setting range: 20 to 500ms)
0: Execute
0: 400 s
0: No Use,1: Doubling wiring (Source+Sink),
0: No Use,1: Doubling wiring (Source+Sink),
, 1: Not execute
, 1: 1ms, 2: 2ms
2: Doubling wiring (Source + Source)
2: Doubling wiring (Source + Source)
Output dark test selection Y0
Output dark test selection Y1
Output dark test pulse OFF time Y0
Output dark test pulse OFF time Y1
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
0: Execute
0: Execute
*1
0: 400 s, , 2: 2ms
*1
0: 400 s, , 2: 2ms
time according to the installation environment and wiring length. Set Doubling input discrepancy
detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
, 1: Not execute
, 1: Not execute
1: 1ms
1: 1ms
(4) Device numbers to be used
Use the following device numbers for creating sequence programs.
Table5.16 Device numbers to be used
Safety/StandardExternal deviceDevice number
SafetyLight curtainX104 or X105
SafetyLaser scannerX106 or X107
SafetyContactorY200 and Y201
SafetyContactor (check for welding)X208 or X209
StandardReset switchX140
StandardStart switchX142
5 - 24
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(5) Sequence program
Make the following processing on sequence programs.
Ladder which checks the off fall of the reset
switch, accepts reset request, and clears the
interlock for the CC-Link Safety.
Ladder which confirms the interlock processing
completion and cancels interlock clear request.
Ladder which checks the off fall of the start
switch and accepts start request.
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
Ladder which checks contactors for welding.
T0 is a delay timer which waits for contactors
to actually be turned off after the off output of
the contactors.
Ladder which checks whether a robot can
start and continue operation.
Ladder which clears start request/reset
request when safety cannot be confirmed.
Ladder which controls outputs to contactors.
Figure5.22 Sequence program
The following shows the constant and internal devices used in the program.
(a) Way of using the constant
K : indicates decimal number.
Example) K1 indicates 1 of decimal number.
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5 - 25
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(b) Way of using the internal devices
Table5.17 Way of using the internal devices
InternalDetails
T0
D0
D1
Designates a timer device.
Times out after a lapse of the time specified at K .
Designates a word device.
In the program, this is used as restart status.
(1) D0 = 0 designates that the system is in initial status or start processing is completed.
(2) D0 = 1 (D0.0: ON) designates that the reset switch is pressed.
(3) D0 = 2 (D0.1: ON) designates that the reset switch is released in (2) status and
restart processing is completed.
Designates a word device.
In the program, this is used as start status.
(1) D1 = 0 designates that the system is in initial status or safety is not confirmed.
(2) D1 = 1 (D1.0: ON) designates that the start switch is pressed.
(3) D1 = 2 (D1.1: ON) designates that the start switch is released in (2) status and
start processing is completed.
(c) Way of using word device bit specification
D. : designates the th bit data of word device D.
Example) D0.0 indicates 0 bits in D0.
F0
0000000000000001
Figure5.23 Word device bit specification
5 - 26
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(6) Timing chart
SW
CC-Link
remote (4)
error
Pressing
the reset
SW
Pressing
the reset
SW
Pressing
the start
SW
Reset SW (X140)
Restart status (D0.0)
Restart status (D0.1)
Start SW (X142)
Start status (D1.0)
Start status (D1.1)
Pressing
the reset
SW
ApproachExitApproach
Pressing
the start
SW
Pressing
the reset
SW
Pressing
the start
Detecting
relay welding
Pressing
the reset
SW
1
2
APPLICATION
3
OVERVIEW
EXAMPLE
Interlock status (SD1272.0)
Interlock clear (SD1276.0)
CC-Link status (SD1204.0)
Light curtain (X104)
Laser scanner (X106)
Safety information (M5)
Contactor 1 output (Y200)
Contactor 2 output (Y201)
Safety contactor output check (X208)
Light shielding of
the light curtain
Light shielding of
the laser scanner
Figure5.24 Timing chart
CC-Link
error
Detecting welding
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
APPENDIXINDEX
5 - 27
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
5.6.4 Entering detection and existence detection circuit 2
(1) Application overview
The entering detection and existence detection circuit is the safety application that
detects the entrance and existence of a human in a hazardous area and turns off the
power source of a robot.
The entrance of human to the hazardous area is detected with a light shielding of the
light curtain. The existence of human in the hazardous area is detected with mat
switch. When the entrance or existence of human has been detected, a robot is
stopped.
The robot cannot be started until the human leaves the hazardous area.
The application controls the start and stop of a robot by turning on or off the main
contact of the contactor which opens and closes the power source of a robot.
The safety PLC controls ON/OFF status of the contactors with a sequence program.
The light curtain and the contactors are connected to the safety PLC.
The relay is connected between the mat switch and safety PLC.
The safety PLC controls ON/OFF status of the contactors with a sequence program.
When the safety PLC detects an error using the self-diagnostics, the outputs to the
contactors are turned off independent of the sequence program.
When the outputs are turned off with the self-diagnostics, the OFF status is
maintained regardless of the sequence program until the safety CPU module or safety
remote I/O module is reset.
The following functions are realized with the sequence program.
1) After safety is ensured (The light curtain and mat switch signals are both
on), pushing the reset button, then the start button turning the contactor
on.
2) When the contactors are welding, input the close contacts of the safety
relays to the safety PLC for avoiding the start, and check for welding.
3) The reset switch and start switch are set to start only when changed from
ON to OFF for avoiding an accidental start of the switches at welding or
short-circuit.
4) The contactor output is turned off when the light curtain signal or the relay
input of mat switch is turned off or an error is detected in the safety remote
I/O station after the start.
5 - 28
Figure5.25 Entering detection and existence detection
(Partially quoted from "Safety Guide Book - the safety measures of machinery in the workplace"
: Nippon Electric Control Equipment Industries Association.)
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(2) Connection of safety devices
Wiring: Indicated in
Figure 5.27.
Figure5.27
Parameters: Indicated
in Table 5.18.
Table5.18
CC-Link Safety
Remote(1):SR_IO1
X100-10F
Y100-103
CC-Link Safety
Remote(4):SR_IO4
X200-20F
Y200-203
Remote(2):SR_IO2
X120-12F
Y120-123
Wiring: Indicated in
Figure5.28
Figure 5.28.
Parameters: Indicated
Table5.19
in Table 5.19.
Remote(3):SR_IO3
X140-14F
Y140-143
: Safety remote I/O module
used in this case example
Wiring: Indicated in
Figure5.4
Figure 5.4.
Parameters: Indicated
Table5.6
in Table 5.6.
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
Figure5.26 Safety device connection diagram
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5 - 29
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(3) Wiring diagram and parameter settings
(a) Remote (1): SR_IO1
Wire the light curtain and the mat switch to the safety remote I/O module as
follows.
Optical transmitter
Connect two control output
points (PNP output) of type 4
light curtain between the
input terminal and COMÂterminal.
Connect a 4-wire mat to
the relay and connect the
two relay contacts between
the input terminal and test
pulse terminal.
5.6.4 Entering detection and existence detection circuit 2
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the light curtain and the mat switch, set the parameters as follows.
Table5.18 Remote (1) SR_IO1 parameter settings
ItemSetting range
Time of noise removal filter X4, 5
Time of noise removal filter X8, 9
Doubling input discrepancy detection time X4, 5
Doubling input discrepancy detection time X8, 9
Input dark test selection X4, 5
*1
*1
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
*1
20ms (setting range: 20 to 500ms)
*1
20ms (setting range: 20 to 500ms)
0: Execute,
1: Not execute
1
OVERVIEW
2
Input dark test selection X8, 9
Input dark test pulse OFF time
Connect the close contact
of the contactor between
the input terminal and
test pulse terminal.
0: Execute
*1
0: 400 s
, 1: Not execute
, 1: 1ms, 2: 2ms
*1: Adjust Time of noise removal filter and Input dark test pulse OFF time according to the installation
environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the
mechanical switch and 20ms for the sensor input as a guideline.
(b) Remote (4): SR_IO4
Wire the contactors to the safety remote I/O module as follows.
Remote(4)
QS0J65BTB2-12DT(4)
(LinkID=1, Station number1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
Use two contactors
which can be activated
with 24VDC, 0.5A.
Contactor1
L3L2L
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
1
Contactor2
24VDC
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Figure5.28 Remote (4) SR_IO4 wiring
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5 - 31
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the contactors, set the parameters as follows.
Table5.19 Remote (4) SR_IO4 parameter settings
ItemSetting range
Time of noise removal filter X8, 9
Doubling input discrepancy detection time X8, 9
Input dark test selection X8, 9
Input dark test pulse OFF time
Method of wiring of output Y0
Method of wiring of output Y1
*1
*1
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
*1
100ms (setting range: 20 to 500ms)
0: Execute
0: 400 s
0: No Use,1: Doubling wiring (Source+Sink),
2: Doubling wiring (Source + Source )
0: No Use,1: Doubling wiring (Source+Sink),
2: Doubling wiring (Source + Source )
, 1: Not execute
, 1: 1ms, 2: 2ms
Output dark test selection Y0
Output dark test selection Y1
Output dark test pulse OFF time Y0
Output dark test pulse OFF time Y1
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
*1
*1
time according to the installation environment and wiring length. Set Doubling input discrepancy
detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
0: Execute
0: Execute
0: 400 s, , 2:2ms
0: 400 s, , 2: 2ms
, 1: Not execute
, 1: Not execute
1: 1ms
1: 1ms
(4) Device numbers to be used
Use the following device numbers for creating sequence programs.
Table5.20 Device numbers to be used
Safety/StandardExternal deviceDevice number
SafetyLight curtainX104 or X105
SafetyMat switchX108 or X109
SafetyContactor 1 and 2Y200 and Y201
SafetyContactor (check for welding)X208 or X209
StandardReset switchX140
StandardStart switchX142
5 - 32
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(5) Sequence program
Make the following processing on sequence programs.
OVERVIEW
Ladder which checks the off fall of the reset
switch, accepts reset request, and clears the
interlock for the CC-Link Safety.
Ladder which confirms the interlock processing
completion and cancels interlock clear request.
Ladder which checks the off fall of the start
switch and accepts start request.
Ladder which checks contactors for welding.
T0 is a delay timer which waits for contactors
to actually be turned off after the off output of
the contactors.
Ladder which checks whether a robot can
start and continue operation.
Ladder which clears start request/reset
request when safety cannot be confirmed.
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
Ladder which controls outputs to contactors.
Figure5.29 Sequence program
The following shows the constant and internal devices used in the program.
(a) Way of using the constant
K : indicates decimal number.
Example) K1 indicates 1 of decimal number.
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5 - 33
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(b) Way of using the internal devices
Table5.21 Way of using the internal devices
InternalDetails
T0
D0
D1
Designates a timer device.
Times out after a lapse of the time specified at K .
Designates a word device.
In the program, this is used as restart status.
(1) D0 = 0 designates that the system is in initial status or start processing is completed.
(2) D0 = 1 (D0.0: ON) designates that the reset switch is pressed.
(3) D0 = 2 (D0.1: ON) designates that the reset switch is released in (2) status and
restart processing is completed.
Designates a word device.
In the program, this is used as start status.
(1) D1 = 0 designates that the system is in initial status or safety is not confirmed.
(2) D1 = 1 (D1.0: ON) designates that the start switch is pressed.
(3) D1 = 2 (D1.1: ON) designates that the start switch is released in (2) status and
start processing is completed.
(c) Way of using word device bit specification
D. : designates the th bit data of word device D.
Example) D0.0 indicates 0 bits in D0.
F0
0000000000000001
Figure5.30 Word device bit specification
5 - 34
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(6) Timing chart
CC-Link
remote (4)
error
Pressing
the reset
SW
Pressing
the reset
SW
Pressing
Reset SW (X140)
Restart status (D0.0)
Restart status (D0.1)
Start SW (X142)
Start status (D1.0)
Start status (D1.1)
Pressing
the reset
SW
ApproachExitApproach
Pressing
the start
SW
Pressing
the reset
SW
Pressing
the start
SW
the start
SW
Detecting
relay welding
Pressing
the reset
SW
1
2
APPLICATION
3
OVERVIEW
EXAMPLE
Interlock status (SD1272.0)
Interlock clear (SD1276.0)
CC-Link status (SD1204.0)
Light curtain (X104)
Safety mat (X108)
Safety information (M5)
Contactor 1 output (Y200)
Contactor 2 output (Y201)
Safety contactor output check (X208)
Light shielding of
the light curtain
Stepping on a safety mat
Figure5.31 Timing chart
CC-Link
error
Detecting welding
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
APPENDIXINDEX
5 - 35
APPENDIX
APPENDIX
Appendix.1 Calculation Method of Safety Response Time
This manual explains about the maximum value of safety response time.
When employing the calculation formula, use the following GX Developer and modules.
For calculation formula other than the following combination, refer to the following manual.
CC-Link Safety System Master Module User's Manua
GX Developer
version
Ver. 8.65T or later10032 or later10032 or later10031 or later10032 or later
Safety CPU module
Safety master
module
First five digits of serial number
Safety remote I/O station
QS0J65BTS2-8D, QS0J65BTS2-4TQS0J65BTB2-12DT
(1) Calculation method
The maximum value of the safety response time will be the sum of (a) to (e) in
TableApp.1.
For timing when the safety response time will be the maximum value, refer to
FigureApp.1.
TableApp.1 Calculation method for the maximum value of safety response time
ItemMaximum
(a) Input device response timeDT1
(b) Safety remote station input response timeRefer to User's Manual for the safety remote station.
(c) Monitoring time from safety input to safety outputSafety data monitoring time
(d) Safety remote station output response timeRefer to User's Manual for the safety remote station.
(e) Output device response timeDT2
To ta l
DT1 + DT2 + Safety remote station input response time + Safety
data monitoring time + Safety remote station output response time
App - 1
Appendix.1 Calculation Method of Safety Response Time
APPENDIX
LS:
n:
m:
DT1, DT2: Response time of sensor or output destination controlling device. Check and add the
Safety refresh monitoring time: Time set in network parameter.
Safety data monitoring time:Time set in network parameter
WDT (Watchdog timer):Time set in PLC parameter.
Synchronous mode:Mode which performs data link when sequence scan is synchronized with link scan.
Asynchronous mode:Mode which performs data link without synchronizing sequence program.
Link Scan Time (This Item (1) (a))
Value after the decimal point of (LS/WDT) is rounded up
Value after the decimal point of (Safety refresh response processing time/(WDT n)) is
rounded up
Safety refresh response processing time: Refer to User's Manual for the safety remote
station.
response time of the device to be used.
Use the value gained by the following calculation formula as measure.
In synchronous mode
(WDT n) 3 + ((WDT n) m 2 + (WDT ) [ms]
: 0 when LS 1.5ms, 1 1.5ms
In asynchronous mode
(WDT n) 3 + LS + ((WDT n) m 2 + (WDT ) [ms]
: 0 when LS 1.5ms, 1 when LS 1.5ms
Use the value gained by the following calculation formula as measure.
Safety refresh monitoring time 2 - ((WDT n) m) - 10 [ms]
Calculate SM (Scan time) with referring to the QSCPU User's Manual (Function
Explanation, Program Fundamentals), and set the watchdog timer value more equal to or
more than the gained value.
In the synchronous mode, sequence scan and link scan start simultaneously.
CC-Link Safety System Master Module User's Manual
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
CC-Link Safety System Master Module User's Manual
SAFETY
APPLICATION
CONFIGURATION
APPENDIX
Appendix.1 Calculation Method of Safety Response Time
App - 2
APPENDIX
POINT
POINT
(1) If setting value of the safety data monitoring time is equal to or less than the
value gained by the calculation formula above, an error may occur even in
normal communication status.
If setting value of the safety data monitoring time is needlessly long, the time
taken for (c) in TableApp.1 may lengthen in the case of a safety
programmable controller error, resulting in excessive delay of safety response
performance.
(2) To show the maximum value of safety response time, this manual uses WDT,
the maximum value of SM (Scan time), instead of SM to the calculating
formula.
For the usual calculation, substitute for WDT, SM is used.
(3) When the safety CPU module detects CC-LINK DATA RECEPTION
TIMEOUT (error code: 8320 to 8322), increase the safety refresh monitoring
time and safety data monitoring time as needed.
NI : Final station No. in A and B (Higher value between A and B)
(Including the number of occupied stations and excluding reserved stations,
in multiples of 8.)
NW : Final station No. in B
(Including the number of occupied stations and excluding reserved stations,
in multiples of 8.)
A: Final station No. of standard remote I/O stations
(When not connecting standard remote station, put 0 to A.)
B: Final station No. of safety remote I/O stations and remote device stations
Final station No.1 to 89 to 1617 to 24 25 to 32 33 to 4041 to 48 49 to 56 57 to 64
NI,NW816243240485664
N: Number of connected modules (excluding reserved stations)
ni: a + b (excluding reserved stations)
a: Total number of occupied standard remote I/O stations
b: Total number of occupied safety remote I/O stations and remote device
stations
nw : b (excluding reserved stations)
TR : Constant
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
ConstantNumeric value
TR38.4
ST : Constant
(for asynchronous mode only. For synchronous mode, ST = 0. )
(1) or 2), whichever is greater. Ignore 2) when B = 0.)
1) 800 + (A 15)
2) 900 + (B 50)
RT : Retry processing time (only when there is a faulty station)
+
(Number of detected faulty stations - 1)
:
Return processing time for 1
BT ((200 + R)
R: 51.6+(NI
:
Return processing time for 2
BT ((200 + P)
Set number of retries + 200)
4.8)+(NW 9.6)
Set number of retries + 200)
st
module
nd
or sebsequent module
P: 10.8
F : Return to system processing time (only when communication faulty station
exists)
BT
218 Number of automatic return modules
SAFETY
APPLICATION
CONFIGURATION
APPENDIX
Appendix.1 Calculation Method of Safety Response Time
App - 4
APPENDIX
POINT
(2) Calculation example of response time
POINT
If connecting the remote station to the station with the reserved station setting,
and then clear the setting, the valus of NI, NW, N, ni, and nw in the LS calculation
formula will change.
When the reserved station was changed, recalculate the LS and safety response
performance.
For the reserved station function, refer to the CC-Link Safety System Master
Module User's Manual.
The following shows calculation example of the response time when WDT setting
value: 10ms, link scan time (synchronous mode): 0.3ms, link scan time
(asynchronous mode): 1.4ms, safety remote station input response time: 12.2ms,
safety remote station output response time: 10.4ms, and safety refresh response
processing time: 9.6ms.
(a) Calculation example of safety refresh monitoring time
Safety refresh monitoring time 2 - ((WDT n) m) - 10
= 50 2 - (10 1) 1 - 10
= 80 [ms]
1.5 ms 0
1
1
1
1
1
App - 5
2) In asynchronous mode
Safety refresh monitoring time 2 - ((WDT n) m) - 10
= 51.8 2 - (10 1) 1 - 10
= 82.8 [ms]
Appendix.1 Calculation Method of Safety Response Time
APPENDIX
(c) Calculation example for the maximum value of response time
1) In synchronous mode
DT1 + DT2 + Safety remote station input response time + Safety data
monitoring time + Safety remote station output response time
= DT1 + DT2 + 12.2 + 80 + 10.4
= 102.6 [ms]
2) In asynchronous mode
DT1 + DT2 + Safety remote station input response time + Safety data
monitoring time + Safety remote station output response time
= DT1 + DT2 + 12.2 + 82.8 + 10.4
= 105.4 [ms]
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIX
Appendix.1 Calculation Method of Safety Response Time
App - 6
APPENDIX
(3) Calculation example of link scan time
(2) The following shows the calculation example of LS (Link scan time) used in the
calculation of response time.
The following shows the calculation example when the transmission speed is 10
Mbps in the following system configuration example (It is assumed that there is no
faulty stations).
Safety
master
station
Station No.1
Safety remote
I/O station
*1
Station No.2
Standard remote
I/O station
*1: 1 occupied station *2: 2 occupied station
BT = 0.8
NI = 5 8
NW = 5 8
N = 4
ni = 5
nw = 4
A = 2, B = 5
ST = 1350
Please confirm the following product warranty details before using this product.
1. Limited Warranty and Product Support.
a. Mitsubishi Electric Company ("MELCO") warrants that for a period of eighteen (18) months after date of delivery from the point
of manufacture or one year from date of Customer's purchase, whichever is less, Mitsubishi MELSEC Safety programmable
controllers (the "Products") will be free from defects in material and workmanship.
b. At MELCO's option, for those Products MELCO determines are not as warranted, MELCO shall either repair or replace them or
issue a credit or return the purchase price paid for them.
c. For this warranty to apply:
(1) Customer shall give MELCO (i) notice of a warranty claim to MELCO and the authorized dealer or distributor from whom the
Products were purchased, (ii) the notice shall describe in reasonable details the warranty problem, (iii) the notice shall be
provided promptly and in no event later than thirty (30) days after the Customer knows or has reason to believe that
Products are not as warranted, and (iv) in any event, the notice must given within the warranty period;
(2) Customer shall cooperate with MELCO and MELCO's representatives in MELCO's investigation of the warranty claim,
including preserving evidence of the claim and its causes, meaningfully responding to MELCO's questions and investigation
of the problem, grant MELCO access to witnesses, personnel, documents, physical evidence and records concerning the
warranty problem, and allow MELCO to examine and test the Products in question offsite or at the premises where they are
installed or used; and
(3) If MELCO requests, Customer shall remove Products it claims are defective and ship them to MELCO or MELCO's
authorized representative for examination and, if found defective, for repair or replacement. The costs of removal, shipment
to and from MELCO's designated examination point, and reinstallation of repaired or replaced Products shall be at
Customer's expense.
(4) If Customer requests and MELCO agrees to effect repairs onsite at any domestic or overseas location, the Customer will
pay for the costs of sending repair personnel and shipping parts. MELCO is not responsible for any re-commissioning,
maintenance, or testing on-site that involves repairs or replacing of the Products.
d. Repairs of Products located outside of Japan are accepted by MELCO's local authorized service facility centers ("FA Centers").
Terms and conditions on which each FA Center offers repair services for Products that are out of warranty or not covered by
MELCO's limited warranty may vary.
e. Subject to availability of spare parts, MELCO will offer Product repair services for (7) years after each Product model or line is
discontinued, at MELCO's or its FA Centers' rates and charges and standard terms in effect at the time of repair. MELCO
usually produces and retains sufficient spare parts for repairs of its Products for a period of seven (7) years after production is
discontinued.
f. MELCO generally announces discontinuation of Products through MELCO's Technical Bulletins. Products discontinued and
repair parts for them may not be available after their production is discontinued.
2. Limits of Warranties.
a. MELCO does not warrant or guarantee the design, specify, manufacture, construction or installation of the materials,
construction criteria, functionality, use, properties or other characteristics of the equipment, systems, or production lines into
which the Products may be incorporated, including any safety, fail-safe and shut down systems using the Products.
b. MELCO is not responsible for determining the suitability of the Products for their intended purpose and use, including
determining if the Products provide appropriate safety margins and redundancies for the applications, equipment or systems
into which they are incorporated.
c. Customer acknowledges that qualified and experienced personnel are required to determine the suitability, application, design,
construction and proper installation and integration of the Products. MELCO does not supply such personnel.
d. MELCO is not responsible for designing and conducting tests to determine that the Product functions appropriately and meets
application standards and requirements as installed or incorporated into the end-user's equipment, production lines or systems.
e. MELCO does not warrant any Product:
(1) repaired or altered by persons other than MELCO or its authorized engineers or FA Centers;
(2) subjected to negligence, carelessness, accident, misuse, or damage;
(3) improperly stored, handled, installed or maintained;
(4) integrated or used in connection with improperly designed, incompatible or defective hardware or software;
(5) that fails because consumable parts such as batteries, backlights, or fuses were not tested, serviced or replaced;
(6) operated or used with equipment, production lines or systems that do not meet applicable and commensurate legal, safety
and industry-accepted standards;
(7) operated or used in abnormal applications;
(8) installed, operated or used in contravention of instructions, precautions or warnings contained in MELCO's user, instruction
and/or safety manuals, technical bulletins and guidelines for the Products;
(9) used with obsolete technologies or technologies not fully tested and widely accepted and in use at the time of the Product's
manufacture;
(10) subjected to excessive heat or moisture, abnormal voltages, shock, excessive vibration, physical damage or other
improper environment; or
(11) damaged or malfunctioning due to Acts of God, fires, acts of vandals, criminals or terrorists, communication or power
failures, or any other cause or failure that results from circumstances beyond MELCO's control.
f. All Product information and specifications contained on MELCO's website and in catalogs, manuals, or technical information
materials provided by MELCO are subject to change without prior notice.
g. The Product information and statements contained on MELCO's website and in catalogs, manuals, technical bulletins or other
SH(NA)-080613ENG-C
materials provided by MELCO are provided as a guide for Customer's use. They do not constitute warranties and are not
incorporated in the contract of sale for the Products.
h. These terms and conditions constitute the entire agreement between Customer and MELCO with respect to warranties,
remedies and damages and supersede any other understandings, whether written or oral, between the parties. Customer
expressly acknowledges that any representations or statements made by MELCO or others concerning the Products outside
these terms are not part of the basis of the bargain between the parties and are not factored into the pricing of the Products.
i. THE WARRANTIES AND REMEDIES SET FORTH IN THESE TERMS ARE THE EXCLUSIVE AND ONLY WARRANTIES
AND REMEDIES THAT APPLY TO THE PRODUCTS.
j. MELCO DISCLAIMS THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
3. Limits on Damages.
a. MELCO'S MAXIMUM CUMULATIVE LIABILITY BASED ON ANY CLAIMS FOR BREACH OF WARRANTY OR CONTRACT,
NEGLIGENCE, STRICT TORT LIABILITY OR OTHER THEORIES OF RECOVERY REGARDING THE SALE, REPAIR,
REPLACEMENT, DELIVERY, PERFORMANCE, CONDITION, SUITABILITY, COMPLIANCE, OR OTHER ASPECTS OF THE
PRODUCTS OR THEIR SALE, INSTALLATION OR USE SHALL BE LIMITED TO THE PRICE PAID FOR PRODUCTS NOT AS
WARRANTED.
b. Although MELCO has obtained the certification for Product's compliance to the international safety standards IEC61508 and
EN954-1/ISO13849-1 from TUV Rheinland, this fact does not guarantee that Product will be free from any malfunction or
failure. The user of this Product shall comply with any and all applicable safety standard, regulation or law and take appropriate
safety measures for the system in which the Product is installed or used and shall take the second or third safety measures
other than the Product. MELCO is not liable for damages that could have been prevented by compliance with any applicable
safety standard, regulation or law.
c. MELCO prohibits the use of Products with or in any application involving power plants, trains, railway systems, airplanes, airline
operations, other transportation systems, amusement equipments, hospitals, medical care, dialysis and life support facilities or
equipment, incineration and fuel devices, handling of nuclear or hazardous materials or chemicals, mining and drilling, and
other applications where the level of risk to human life, health or property are elevated.
d. MELCO SHALL NOT BE LIABLE FOR SPECIAL, INCIDENTAL, CONSEQUENTIAL, INDIRECT OR PUNITIVE DAMAGES,
FOR LOSS OF PROFITS, SALES, OR REVENUE, FOR INCREASED LABOR OR OVERHEAD COSTS, FOR DOWNTIME OR
LOSS OF PRODUCTION, FOR COST OVERRUNS, OR FOR ENVIRONMENTAL OR POLLUTION DAMAGES OR CLEAN-UP
COSTS, WHETHER THE LOSS IS BASED ON CLAIMS FOR BREACH OF CONTRACT OR WARRANTY, VIOLATION OF
STATUTE, NEGLIGENCE OR OTHER TORT, STRICT LIABILITY OR OTHERWISE.
e. In the event that any damages which are asserted against MELCO arising out of or relating to the Products or defects in them,
consist of personal injury, wrongful death and/or physical property damages as well as damages of a pecuniary nature, the
disclaimers and limitations contained in these terms shall apply to all three types of damages to the fullest extent permitted by
law. If, however, the personal injury, wrongful death and/or physical property damages cannot be disclaimed or limited by law or
public policy to the extent provided by these terms, then in any such event the disclaimer of and limitations on pecuniary or
economic consequential and incidental damages shall nevertheless be enforceable to the fullest extent allowed by law.
f. In no event shall any cause of action arising out of breach of warranty or otherwise concerning the Products be brought by
Customer more than one year after the cause of action accrues.
g. Each of the limitations on remedies and damages set forth in these terms is separate and independently enforceable,
notwithstanding the unenforceability or failure of essential purpose of any warranty, undertaking, damage limitation, other
provision of these terms or other terms comprising the contract of sale between Customer and MELCO.
4. Delivery/Force Majeure.
a. Any delivery date for the Products acknowledged by MELCO is an estimated and not a promised date. MELCO will make all
reasonable efforts to meet the delivery schedule set forth in Customer's order or the purchase contract but shall not be liable for
failure to do so.
b. Products stored at the request of Customer or because Customer refuses or delays shipment shall be at the risk and expense
of Customer.
c. MELCO shall not be liable for any damage to or loss of the Products or any delay in or failure to deliver, service, repair or
replace the Products arising from shortage of raw materials, failure of suppliers to make timely delivery, labor difficulties of any
kind, earthquake, fire, windstorm, flood, theft, criminal or terrorist acts, war, embargoes, governmental acts or rulings, loss or
damage or delays in carriage, acts of God, vandals or any other circumstances reasonably beyond MELCO's control.
5. Choice of Law/Jurisdiction.
These terms and any agreement or contract between Customer and MELCO shall be governed by the laws of the State of New
York without regard to conflicts of laws. To the extent any action or dispute is not arbitrated, the parties consent to the exclusive
jurisdiction and venue of the federal and state courts located in the Southern District of the State of New York. Any judgment there
obtained may be enforced in any court of competent jurisdiction.
6. Arbitration.
Any controversy or claim arising out of, or relating to or in connection with the Products, their sale or use or these terms, shall be
settled by arbitration conducted in accordance with the Center for Public Resources (CPR) Rules for Non-Administered Arbitration
of International Disputes, by a sole arbitrator chosen from the CPR's panels of distinguished neutrals. Judgment upon the award
rendered by the Arbitrator shall be final and binding and may be entered by any court having jurisdiction thereof. The place of the
arbitration shall be New York City, New York. The language of the arbitration shall be English. The neutral organization designated
to perform the functions specified in Rule 6 and Rules 7.7(b), 7.8 and 7.9 shall be the CPR.
Loading...
+ hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.