Mitsubishi Electric Melsec-QS Safety Application Manual

SAFETY PRECAUTIONS

(Always read these instructions before using this equipment.)
Before using the product, please read this manual, the relevant manuals introduced in this manual, standard PLC manuals, and the safety standards carefully and pay full attention to safety to handle the product correctly.
In this manual, the safety instructions are ranked as "DANGER" and "CAUTION".
DANGER
CAUTION
Note that the CAUTION level may lead to a serious consequence according to the circumstances.
Always follow the instructions of both levels because they are important to personal safety.
Please save this manual to make it accessible when required and always forward it to the end user.
Indicates that incorrect handling may cause hazardous conditions, resulting in death or severe injury.
Indicates that incorrect handling may cause hazardous conditions, resulting in medium or slight personal injury or physical damage.
A - 1
[Design Precautions]
DANGER
When a safety PLC detects an error in an external power supply or a failure in PLC main module, it
turns off all the outputs. Create an external circuit to securely stop the power of hazard by turning off the outputs. Incorrect configuration may result in an accident.
Create short current protection for a safety relay, and a protection circuit such as a fuse, and
breaker, outside a safety PLC.
If load current more than the rating or overcurrent due to a short circuit in the load has flowed in the
CC-Link Safety remote I/O module, the module defines it as a fault and turns off all the outputs. However, if overcurrent flows in the CC-Link Safety remote I/O module for a long time, it may cause smoke or a fire. To prevent it, create a safety circuit such as a fuse outside the module.
When data/program change, or status control is performed from a PC to a running safety PLC,
create an interlock circuit outside the sequence program and safety PLC to ensure that the whole system always operates safely. For the operations to a safety PLC, pay full attention to safety by reading the relevant manuals carefully, and establishing the operating procedure. Furthermore, for the online operations performed from a PC to a safety CPU module, the corrective actions against a communication error due to a cable connection fault, etc. should be predetermined as a system.
All output signals from a safety CPU module to the CC-Link Safety system master module are
prohibited to use. These signals can be found in the CC-Link Safety System Master Module User's Manual. Do not turn ON or OFF these signals by sequence program, since turning ON/OFF these output signals of the PLC system may cause malfunctions and safety operation cannot be guaranteed.
When a safety remote I/O module has detected CC-Link Safety error, it turns off all the outputs. Note
that the outputs in a sequence program are not automatically turned off. If CC-Link Safety error has been detected, create a sequence program that turns off the outputs in the program. If the CC-Link Safety is restored with the outputs on, it may suddenly operate and result in an accident.
To inhibit restart without manual operation after safety functions was performed and outputs were
turned OFF, create an interlock program which uses a reset button for restart.
A - 2
[Design Precautions]
CAUTION
Do not bunch the wires of external devices or communication cables together with the main circuit or power lines, or install them close to each other. They should be installed 100 mm (3.94 inch) or more from each other. Not doing so could result in noise that would cause malfunctions.
Select the external devices to be connected to the CC-Link Safety remote I/O module, considering the maximum inrush current with reference to the CC-Link Safety System Remote I/O Module User's Manual.
[Installation Precautions]
CAUTION
Use a safety PLC in the environment that meets the general specifications described in the QSCPU User's Manual (Hardware Design, Maintenance and Inspection). Using this PLC in an environment outside the range of the general specifications could result in electric shock, fire, erroneous operation, and damage to or deterioration of the product.
While pressing the installation lever located at the bottom of module, insert the module fixing tab into the fixing hole in the base unit until it stops. Then, securely mount the module with the fixing hole as a supporting point. Incorrect loading of the module can cause a failure or drop. Secure the module to the base unit with screws. Tighten the screw in the specified torque range. If the screws are too loose, it may cause a drop of the screw or module. Over tightening may cause a drop due to the damage of the screw or module.
Make sure to fix the CC-Link Safety remote I/O module with a DIN rail or mounting screws and tighten the screws with the specified torque. If the screws are too loose, it may cause a drop of the screw or module. Over tightening may cause a drop due to the damage of the screw or module.
Completely turn off the external supply power used in the system before mounting or removing the module. Not doing so could result in damage to the product.
Do not directly touch the module's conductive parts or electronic components. Doing so may cause malfunctions or a failure.
A - 3
[Wiring Precautions]
DANGER
Be sure to shut off all phases of the external supply power used by the system before wiring.
Not completely turning off all power could result in electric shock or damage to the product.
When energizing or operating the module after installation or wiring, be sure to close the attached terminal cover. Not doing so may result in electric shock.
CAUTION
Ground the FG and LG terminals correctly. Not doing so could result in electric shock or malfunctions.
Use a solderless terminal with insulation sleeve for wiring of a terminal block. Use up to two solderless terminals for a single terminal.
Use applicable solderless terminals and tighten them with the specified torque. If any solderless spade terminal is used, it may be disconnected when the terminal screw comes loose, resulting in a failure.
Wire the module correctly after confirming the rated voltage and terminal layout. Connecting a power supply of a different rated voltage or incorrect wiring may cause a fire or failure.
Tighten a terminal block mounting screw, terminal screw, and module mounting screw within the specified torque range. If the terminal block mounting screw or terminal screw is too loose, it may cause a short circuit, fire, or malfunctions. If too tight, it may damage the screw and/or the module, resulting in a drop of the screw or module, a short circuit or malfunctions. If the module mounting screw is too loose, it may cause a drop of the screw or module. Over tightening the screw may cause a drop due to the damage of the screw or module.
Be sure there are no foreign substances such as sawdust or wiring debris inside the module. Such debris could cause a fire, failure, or malfunctions.
The module has an ingress prevention label on its top to prevent foreign matter, such as wire offcuts, from entering the module during wiring. Do not peel this label during wiring. Before starting system operation, be sure to peel this label because of heat dissipation.
A - 4
[Wiring Precautions]
CAUTION
Be sure to fix the communication cables or power cables by ducts or clamps when connecting them to the module. Failure to do so may cause damage of the module or cables due to a wobble, unintentional shifting, or accidental pull of the cables, or malfunctions due to poor contact of the cable.
When removing the connected communication cables or power cables, do not pull the cable with grasping the cable part. Remove the cable connected to the terminal block after loosening the terminal block screws. Pulling the cable connected to a module may result in malfunctions or damage of the module or cable.
For the cables to be used in the CC-Link Safety system, use the ones specified by the manufacturer. Otherwise, the performance of the CC-Link Safety system is not guaranteed. As to the maximum overall cable length and station - to station cable length, follow the specifications described in the CC-Link Safety System Master Module User's Manual. If not following the specification, the normal data transmission is not guaranteed.
Install our PLC in a control panel for use. Wire the main power supply to the power supply module installed in a control panel through a distribution terminal block. Furthermore, the wiring and replacement of a power supply module have to be performed by a maintenance worker who acquainted with shock protection. (For the wiring methods, refer to the QSCPU User's Manual (Hardware Design, Maintenance and Inspection).
A - 5
[Stratup and Maintenance precautions]
DANGER
Do not touch the terminals while power is on.
Doing so could could result in electric shock.
Correctly connect the battery. Also, do not charge, disassemble, heat, place in fire, short circuit, or solder the battery. Mishandling of battery can cause overheating, cracks, or ignition which could result in injury and fires.
Turn off all phases of the external supply power used in the system when cleaning the module or retightening the terminal block mounting screws, terminal screws, or module mounting screws. Not doing so could result in electric shock. Tighten a terminal block mounting screw, terminal screw, and module mounting screw within the specified torque range. If the terminal block mounting screw or terminal screw is too loose, it may cause a short circuit, fire, or malfunctions. If too tight, it may damage the screw and/or the module, resulting in a drop of the screw or module, a short circuit or malfunctions. If the module mounting screw is too loose, it may cause a drop of the screw or module. Over tightening the screw may cause a drop due to the damage of the screw or module.
CAUTION
The online operations performed from a PC to a running safety PLC (Program change when a safety CPU is RUN, device test, and operating status change such as RUN-STOP switching) have to be executed after the manual has been carefully read and the safety has been ensured. Following the operating procedure predetermined at designing, the operation has to be performed by an instructed person. When changing a program while a safety CPU is RUN (Write during RUN), it may cause a program breakdown in some operating conditions. Fully understand the precautions described in the GX Developer's manual before use.
Do not disassemble or modify the modules. Doing so could cause a failure, malfunctions, injury, or fire. If the product is repaired or remodeled by other than the specified FA centers or us, the warranty is not covered.
Use any radio communication device such as a cellular phone or a PHS phone more than 25cm (9.85 inch) away in all directions of safety PLC. Not doing so can cause malfunctions.
A - 6
[Stratup and Maintenance precautions]
CAUTION
Completely turn off the external supply power used in the system before mounting or removing the module. Not doing so may result in a failure or malfunctions of the module.
Restrict the mounting/removal of a module, base unit, and terminal block up to 50 times (IEC61131-2-compliant), after the first use of the product. Failure to do so may cause the module to malfunction due to poor contact of connector.
Do not drop or give an impact to the battery mounted to the module. Doing so may damage the battery, causing the battery fluid to leak inside the battery. If the battery is dropped or given an impact, dispose of it without using.
Before touching the module, always touch grounded metal, etc. to discharge static electricity from human body, etc. Not doing so may result in a failure or malfunctions of the module.
Since the module case is made of resin, do not drop or apply any strong impact to the module. Doing so may damage the module.
Completely turn off the external supply power used in the system before mounting or removing the module to/from the panel. Not doing so may result in a failure or malfunctions of the module.
[Disposal Precautions]
CAUTION
When disposing of this product, treat it as industrial waste.
[Transportation Precautions]
CAUTION
When transporting lithium batteries, make sure to treat them based on the transport regulations. (For details of the controlled models, refer to the QSCPU User's Manual (Hardware).
A - 7

REVISIONS

The manual number is given on the bottom left of the back cover.
Print date Manual number Revision
Sep., 2006 SH(NA)-080613ENG-A First edition
Mar., 2007 SH(NA)-080613ENG-B
Apr., 2008 SH(NA)-080613ENG-C
Partial correction
CHAPTER1, Section 4.2, 5.5, 5.6.3, 5.6.4
Partial correction
Section 4.1, Appendix 1
Japanese Manual Version SH-080611-C
This manual confers no industrial property rights or any rights of any other kind, nor does it confer any patent licenses.
Mitsubishi Electric Corporation cannot be held responsible for any problems involving industrial property rights which may
occur as a result of using the contents noted in this manual.
2006 MITSUBISHI ELECTRIC CORPORATION
A - 8

INTRODUCTION

Thank you for purchasing the Mitsubishi safety programmable controller MELSEC-QS series. Before using the equipment, please read this manual carefully to develop full familiarity with the functions
and performance of the QS series PLC you have purchased, so as to ensure correct use.

CONTENTS

SAFETY PRECAUTIONS ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 1
REVISIONS•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••A - 8
INTRODUCTION •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 9
CONTENTS••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 9
ABOUT MANUALS ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 11
HOW THIS MANUAL IS ORGANIZED ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 13
HOW TO USE THIS MANUAL ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 14
GENERIC TERMS AND ABBREVIATIONS ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 15
TERMINOLOGY •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• A - 16
Chapter1 OVERVIEW 1 - 1 to 1 - 2
Chapter2 APPLICATION EXAMPLE 2 - 1 to 2 - 2
Chapter3 RISK ASSESSMENT AND SAFTY LEVEL 3 - 1 to 3 - 5
3.1 Risk Assessment•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 3 - 1
3.1.1 Risk reduction••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••3 - 2
3.2 Safety Category •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••3 - 3
3.3 SIL ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 3 - 5
Chapter4 PRECAUTIONS FOR USE OF SAFETY PLC 4 - 1 to 4 - 11
4.1 Precautions for Designing Safety Application ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 4 - 1
4.2 Precautions for Programming •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 4 - 5
4.3 Precautions for Startup •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 4 - 10
4.4 Precautions for Safety Functions Maintenance ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 4 - 10
Chapter5 SAFETY APPLICATION CONFIGURATION EXAMPLE 5 - 1 to 5 - 35
5.1 System Configuration ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••5 - 1
5.2 Network-Related Switch Settings of Module••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 2
5.2.1 Safety Power supply module••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••5 - 2
5.2.2 Safety CPU module•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••5 - 2
5.2.3 Safety master module •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 2
5.2.4 Safety remote I/O module ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 3
5.3 CC-Link Parameter Settings •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 4
5.3.1 CC-Link station information settings••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 4
A - 9
5.3.2 Safety remote station parameter settings ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••5 - 5
5.4 Relationship between the Safety CPU Module Devices and Remote I/O •••••••••••••••••••••••••••••••• 5 - 6
5.5 Wiring Diagram and Parameter Setting of Standard Input •••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 7
5.6 Case Examples•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 8
5.6.1 Emergency stop circuit •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••5 - 8
5.6.2 Door lock circuit•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 14
5.6.3 Entering detection and existence detection circuit 1 ••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 20
5.6.4 Entering detection and existence detection circuit 2 ••••••••••••••••••••••••••••••••••••••••••••••••• 5 - 28
APPENDIX Appendix- 1 to Appendix - 8
Appendix.1Calculation Method of Safety Response Time••••••••••••••••••••••••••••••••••••••••••••••••• Appendix - 1
Appendix.2Checklist •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Appendix - 8
INDEX INDEX - 1
A - 10

ABOUT MANUALS

Related manuals
The following manuals are related to this product. If necessary, order them by quoting the details in the tables below.
Manual name
QSCPU User's Manual (Hardware)
Explains the specifications of the QSCPU, safety power supply module and safety base unit, etc.
(Supplied with the product)
QSCPU User's Manual (Hardware Design, Maintenance and Inspection)
Explains the specifications of the QSCPU, safety power supply module, safety base unit, etc.
(Sold separately)
QSCPU User's Manual (Function Explanation, Program Fundamentals)
Explains the functions, programming methods, devices, etc. that are necessary to create programs
with the QSCPU.
(Sold separately)
QSCPU Programming Manual (Common Instructions)
Explains how to use the sequence instructions, basic instructions, application instructions, and
QSCPU dedicated instructions.
(Sold separately)
CC-Link Safety System Master Module User's Manual (Hardware)
QS0J61BT12
Explains the specifications of the QS0J61BT12 type CC-Link Safety system master module.
(Supplied with the product)
CC-Link Safety System Master Module User's Manual QS0J61BT12
Explains the specifications, procedures and settings up to operation, parameter settings and trouble
shootings of the QS0J61BT12 type CC-Link Safety system master module.
(Sold separately)
CC-Link Safety System Remote I/O Module User's Manual (Hardware)
QS0J65BTB2-12DT
Explains the specifications of the QS0J65BTB2-12DT type CC-Link Safety system remote I/O module.
(Supplied with the product)
CC-Link Safety System Remote I/O Module User's Manual QS0J65BTB2-12DT
Explains the specifications, procedures and settings up to operation, parameter settings and
trouble shootings of the QS0J65BTB2-12DT type CC-Link Safety system remote I/O module.
(Sold separately)
Q Corresponding MELSECNET/H Network System Reference Manual (PLC to PLC network)
Explains the specifications for a MELSECNET/H network system for PLC to PLC network, the
procedures and settings up to operation, parameter settings, programming and troubleshooting.
(Sold separately)
GX Developer Version 8 Operating Manual (Startup)
Explains the system configration, installation and starting methods of GX Developer.
(Sold separately)
GX Developer Version 8 Operating Manual
Explains the online functions of the GX Developer, such as the programming, printout, monitoring, and
debugging methods.
(Sold separately)
GX Developer Version 8 Operating Manual (Safety PLC)
Explains the functions of GX Developer that are added or changed to support the safety PLC.
(Sold separately)
Manual number
(Model code)
IB-0800340ENG
(13JR91)
SH-080626ENG
(13JR92)
SH-080627ENG
(13JR93)
SH-080628ENG
(13JW01)
IB-0800344ENG
(13JP95)
SH-080600ENG
(13JP88)
IB-0800345ENG
(13JP96)
SH-080612ENG
(13JR89)
SH-080026ENG
(13JD04)
SH-080372ENG
(13JU40)
SH-080373ENG
(13JU41)
SH-080576ENG
(13JU53)
A - 11
Remark
If you would like to obtain a manual individually, printed materials are available separately. Order the manual by quoting the manual number on the table above (model code).
A - 12

HOW THIS MANUAL IS ORGANIZED

In this manual,
( Section 3.5) A reference destination is indicated as ( Section 3.5).
In addition, this manual provides the following explanations.
POINT
Remark
Explains the matters to be especially noted, the functions and others related to the description on that page. Provides the reference destination related to the description on that page and the useful information.
A - 13

HOW TO USE THIS MANUAL

This manual describes the points to be concerned when configuring safety application that meets the safety standards using the safety PLC. Although the safety application configuration example is shown in CHAPTER 5 of this manual, authentication is not obtained. The safety standards conformance approval must be obtained for the user with the entire safety-related system.
This manual is classified roughly into five chapters as shown below.
Chapter 1 Describes the outline of the safety PLC.
Chapter 2 Describes the safety application that is configured using the safety PLC. Chapter 3 Describes the risk assessment, Category, and SIL.
Chapter 4 Describes the cautions for use of the safety PLC.
Chapter 5 Describes the safety application examples.
For the detailed specifications and functions of each module, refer to the related manuals.
A - 14

GENERIC TERMS AND ABBREVIATIONS

Unless otherwise specified, this manual uses the following generic terms and abbrevia­tions. When a clear indication of target model name is required, the module name is indi­cated.
Generic term/
abbreviation
GX Developer
RWr
RWw
RX
RY
SB
SW
Safety remote I/O station
Standard remote I/O
station
Remote I/O station Generic term for safety remote I/O station and standard remote I/O station
Remote device station
Safety master module Other name for the QS0J61BT12 type CC-link Safety system master module.
Safety remote I/O module
Safety main base unit Abbreviation for the QS034B(-E) type safety main base unit.
Safety CPU module Abbreviation for the QS001CPU type safety CPU module.
Safety power supply
module
Safety PLC
Standard PLC
Safety input Generic term for the signals that are input to the safety PLC for realizing the safety functions.
Safety output
Safety application
Generic product name for models SWnD5C-GPPW, SWnD5C-GPPW-A, SWnD5C-GPPW-V,
and SWnD5C-GPPW-VA.
Remote register (Read area for CC-Link Safety system)
Information entered in 16-bit units from the remote device station to the master station.
(Expressed as RWr for convenience.)
Remote register (Write area for CC-Link Safety system)
Information output in 16-bit units from the master station to the remote device station.
(Expressed as RWw for convenience.)
Remote input (for CC-Link Safety system)
Information entered in bit units from the remote station to the master station. (Expressed as RX
for convenience.)
Remote output (for CC-Link Safety system)
Information output in bit units from the master station to the remote station. (Expressed as RY
for convenience.)
Link special relay (for CC-Link Safety system)
Bit information that indicates the module operating status and data link status of the master
station. (Expressed as SB for convenience.)
Link special register (for CC-Link Safety system)
16-bit information that indicates the module operating status and data link status of the master
station. (Expressed as SW for convenience.)
Remote station which handles only the informaion in bit units.
Compatible with the safety-related system.
Remote station which handles only the information in bit units.
Not compatible with the safety
Remote station which handles information in both bit and word units.
Not compatible with the safety-related system.
Other name for the QS0J65BTS2-8D, QS0J65BTS2-4T and QS0J65BTB2-12DT type CC-Link
Safety system remote I/O module.
Abbreviation for the QS061P-A1 and QS061P-A2 type safety power supply modules.
Generic term for safety CPU module, safety power supply module, safety main base unit,
CC-Link safety master module and CC-Link safety remote I/O module.
General name of each module for MELSEC-Q series, MELSEC-QnA series, MELSEC-A series
and MELSEC-FX series. (Used for distinction from safety PLC.)
Generic term for the signals that are output from the safety PLC for realizing the safety
functions.
Generic term for the applications that are operated using the safety PLC for realizing the safety
functions.
-related system.
Description
A - 15

TERMINOLOGY

Term Description
Safety component Equipment such as the safety compatible sensor and actuator. Safety-related system
Safety functions Functions to be realized for protecting a human from machinery hazards.
Safety measure Measure for reducing the risk.
Category Safety level standardized in EN954-1. The safety level is classified into 5 levels of B and 1 to 4.
SIL
Risk
Risk assessment To clarify hazards in machinery and assess the degree of the hazards.
Link ID Unique network identifier which is given to each network of the CC-Link Safety system.
Target failure measure
NC
NO
Close contact Same as NC.
Open contact Same as NO.
Dark test
System executing a safety functions to be required.
Safety level which is standardized in IEC61508. The safety level is classified into 4 levels of SIL1
to SIL4.
Degree of hazards, which is the combination of the occurrence probability and degree of an injury
and a health problem.
Target value of reliability for each SIL level standardized in IEC61508. There are PFD and PFH
depending on the operation frequency of the safety functions.
Abbreviation for normal close contact which is normally closed, but opened when a switch or other
function is operated.
Abbreviation for normal open contact which is normally opened, but closed when a switch or other
function is operated.
Outputs a pulse to turn OFF the input/output when it is ON, and performs the failure diagnostics to
contacts including external equipment.
A - 16
1
OVERVIEW

CHAPTER1 OVERVIEW

This chapter describes the overview of the safety PLC. The safety PLC is a PLC that acquired the safety approval of EN954-1/ISO13849-1 Category 4 and IEC61508 SIL3. The safety PLC can be used in safety-related system configuration up to Category 4 of EN954-1 and SIL3 of IEC61508. The system configuration diagram of the safety PLC is shown in Figure1.1.
• Install the safety power supply module, safety CPU module, and safety master module to the safety main base unit.
• Connect the safety master module and the safety remote I/O module to a network.
• Connect a personal computer with GX Developer installed to the safety CPU module via USB when setting programs and parameters.
Power supply/CPU/CC-Link Safety master module
CC-Link Safety remote I/O station
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
GX Developer (Version 8.40S or later)*1
Standard remote I/O station
*1 : The available functions vary depending on the version. For details, refer to the following manual.
CC-Link Safety
Emergency stop switch
Standard Remote device station
Figure1.1 System configuration of safety PLC
QSCPU User's Manual(Function Explanation,Program Fundamentals)
CC-Link Safety remote I/O station
Emergency stop switch
Light curtain
CC-Link Safety remote I/O station
Safety relay
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
1 - 1
1
Memo
OVERVIEW
1 - 2
2
APPLICATION EXAMPLE

CHAPTER2 APPLICATION EXAMPLE

The application image for the car welding line is shown as an application example of the safety PLC in Figure2.1.
The safety application operated by the safety PLC is configured for the following purposes. When the safe state signal can be confirmed, supply the power to a robot. When the safe state signal cannot be confirmed, turn off the power to a robot . Confirm the safe state signal using an emergency stop switch or a light curtain.
The safety PLC is operated as follows. The safe state signal is connected to a safety remote I/O module. The safe state signal is sent from the safety remote I/O module to the safety CPU module. The safety CPU module processes the received safe state signal with the sequence program and sends the safety output to the safety remote I/O module. The safety output stops the power of a robot.
Integrated control panel First process Second process n-th process
MELSECNET/H(10),
Ethernet, etc.
(Communication between
standard CPUs)
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
Safety PLC
(Safety control)
Line integrated control Line control network
MELSECNET/H
Safety remote
I/O module
Standard input
Restart
switch
Safety input Safety input
Standard output
Emergency
stop switch
Safety remote
I/O module
Warning
light
Process control CPU
Light curtain
Line control networkLine control network
Safety remote
I/O module
Safety output
Robot Robot
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Body welding line
Figure2.1 Application image for car welding line
2 - 1
2
Memo
APPLICATION EXAMPLE
2 - 2
3
t
RISK ASSESSMENT AND SAFTY LEVEL

CHAPTER3 RISK ASSESSMENT AND SAFTY LEVEL

Conforming to EN954-1 and IEC61508, select the risk assessment, safety category, and SIL to reduce the risk. This chapter briefly describes the risk assessment, risk reduction and safety category, and SIL. For details, refer to each standard.

3.1 Risk Assessment

The risk assessment is to clarify hazards in a machine and assess the degree of the hazards. The risk assessment procedure is shown in Figure3.1. This procedure is standardized in ISO12100 and 14121.
1
2
APPLICATION
3
OVERVIEW
EXAMPLE
Risk reduction
( Section 3.1.1)
Section 3.1.1
1) Machine analysis, target equipment confirmation, and operation status check
2) Hazard identidication
3) Risk estimation
4) Risk evalution Safety category
Section 3.2
( Section 3.2) SIL ( Section 3.3)
No
machinery safe?
Yes
Start
Section 3.3
Is the
END
Risk assesmen
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Figure3.1 Risk assessment procedure
(Referred to ISO12100.)
3.1 Risk Assessment
3 - 1
3
RISK ASSESSMENT AND SAFTY LEVEL

3.1.1 Risk reduction

As a result of the risk assessment, when the machinery is judged as unsafe, the risk reduction must be performed. The measures for the risk reduction are standardized in ISO12100 and ISO14121 as shown in Figure3.2.
1) Inherently safety design
2) Safeguarding
Risk reduction
3) Additional precautions
4) Risk reduction with cautions for use
According to the procedure of Figure3.1, combine and execute the several risk reduction measures until the machine is safe.
Protection by isolation
Protection by stop
Emergency stop device
Ensuring of the energy zero status
Risk condition indication and warning
Attached document and instruction manual
Figure3.2 Risk reduction
Safety barrier
Protective device
(Referred to ISO12100 and 14121.)
3 - 2
3.1 Risk Assessment
3.1.1 Risk reduction
3
RISK ASSESSMENT AND SAFTY LEVEL

3.2 Safety Category

The safety category is standardized in EN954-1. The risk graph to be used for the safety category selection is shown in Figure3.3.
Risk analysis result
Safety category selection
1
OVERVIEW
2
Safety category
selection starting point
Severity of the injury
(S)
S1
Minor (normally
recoverable) trouble
S2
Major (normally
unrecoverable) trouble
Frequency and time of
exposure to hazard
(F)
F1
Rare, considerable,
often, or short
time exposures
F2
Frequent to
continuous, or long
time exposures
Definition of symbols:
Symbol Definition
Safety category which is desirable as a reference
point
Safety category which may be over-specification
— Insufficient safety category
Possibility of
avoidance
P1
Available under a
specific condition
P2
Almost impossible
P1
Available under a
specific condition
P2
Almost impossible
hazard
(P)
Safety category
B 1 2
3 4
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
Figure3.3 Safety category selection relevant to safety related sections of control system
(Referred to EN954-1.)
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
3.2 Safety Category
3 - 3
3
Category
RISK ASSESSMENT AND SAFTY LEVEL
The requirements of standards for the safety category are shown in Table3.1.
Table3.1 Summary of safety category requirements
*1
Safety-related parts of control systems and/or
their protective equipment, as well as their
B
1
2
3
4
components, shall be designed, constructed,
selected, assembled and combined in
accordance with relevant standards so that
they can withstand the expected influence.
Requirements of B shall apply.
Well-tried components and well-tried safety
principles shall be used.
Requirements of B and the use of well-tried
safety principles shall apply.
Safety function shall be checked at suitable
intervals by the machine control system.
Requirements of B and the use of well-tried
safety principles shall apply.
-- a single fault in any of these parts does not
lead to loss of the safety function, and
-- whenever reasonably practicable the single
fault is detected.
Requirements of B and the use of well-tried
safety principles shall apply.
-- a single fault in any of these parts does not
lead to loss of the safety function, and
-- the single fault is detected at or before the
next demand upon the safety function. If
this is not possible, then an accumulation
of faults shall not lead to loss of the safety
function.
Summary of requirements
*1:The categories are not intended to be used in any given order or in any given hierarchy in respect of safety requirements. *2:The risk assessment will indicate whether the total or partial loss of the safety function(s) arising from faults is acceptable.
System behaviour
The occurrence of a fault
can lead to loss of the
safety function.
The occurrence of a fault
can lead to loss of the
safety function, but the
probability of occurrence is
lower than for category B.
-- The occurrence of a
fault can lead to loss of
the safety function
between the checks.
-- The loss of safety
function is detected by
the check.
-- When a single fault
occurs, the safety
function is always
performed.
-- Some but not all faults
will be detected.
-- Accumulation of
undetected faults can
lead to loss of the safety
function.
-- When te faults occur the
safety function is always
performed.
-- The faults will be
detected in time to
prevent loss of the
safety function.
Principles to achieve
*2
Mainly characterized by
selection of components
Mainly characterized by
structure
safety
(Referred to EN954-1.)
3 - 4
3.2 Safety Category
3

3.3 SIL

RISK ASSESSMENT AND SAFTY LEVEL
SIL is standardized in IEC61508. The risk graph to be used for the SIL selection is shown in Figure3.4.
Degree of influence
Minor
Moderate
SIL selection starting point
Major
Enormous
Exposure frequency
Low
High
Low
High
Low
High
Possibility of risk event avoidance
Avoidable
Hard to avoid
Avoidable
Hard to avoid
Avoidable
Hard to avoid
Avoidable
Hard to avoid
Probability of risk
event occurrence
Frequent
Moderate
a
1
2
3
4
b
a
1
2
3
4
Infrequent
a
1
2
3
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
Definition of symbols:
Symbol Definition
-,a No safety requirements.
b Not sufficient with a single safety-related system.
1,2,3,4
Figure3.4 SIL risk graph
Safety integrity level
Stands for SIL1, SIL2, SIL3 and SIL4 respectively.
(Referred to IEC61508-5.)
In SIL, the following target failure measure is defined according to the level.
Table3.5 Target failure measure (PFD,PFH)
SIL
4
3
2
1
Low demand mode of operation*1High demand mode of operation
-5
10
PFD 10
-4
PFD 10
10
-3
PFD 10
10
-2
10
PFD 10
*1: For the low and high demand modes of operation, refer to IEC61508.
-4
-3
-2
-1
10
10
10
10
-9
PFH 10
-8
PFH 10
-7
PFH 10
-6
PFH 10
-8
-7
-6
-5
(Referred to IEC61508-1.)
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
*1
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
3.3 SIL
3 - 5
4
POINT
PRECAUTIONS FOR USE OF SAFETY PLC

CHAPTER4 PRECAUTIONS FOR USE OF SAFETY PLC

The safety standards conformance approval must be made by the user for the entire safety-related system. The safety system inspection is made for the entire safety-related system including safety components and a sequence program. The sample program is shown in Chapter 5. However, the safety standards approval is not obtained. And all work for safety-related system construction (e.g. design, installation, operation, maintenance) has to be handled by the person who has an enough education concerning safety standards, safety devices, and safety PLC.

4.1 Precautions for Designing Safety Application

(1) Response time
The response time is a time from the safety input OFF to the safety output OFF using the safety PLC. The response time is needed for determining the safety distance for a safety-related system. Calculate the response time of a system to be configured with referring to Appendix.1.
POINT
For the safety PLC, connecting GX Developer makes the response time longer.Do not constantly connect GX Developer during the safety-related system operation.
(2) Target failure measure (PFD/PFH) calculation
Target failure measure (PFD/PFH) is the target value of reliability for each SIL level
standardized in IEC61508.( Section 3.3) Calculate the target failure measure (PFD/PFH) with the following formula for each
safety function.
PFD/PFH = A + B + C + D Calculation formula of PFD/PFH
Table4.1 Definition of each variable
Var iabl e Definition
PFD/PFH of safety CPU module, safety power supply module, safety main base unit, and
CC-Link Safety master module
A
B1 PFD/PFH of the safety remote I/O module to which the safety input device is connected
B2 PFD/PFH of the safety remote I/O module to which the safety output device is connected
*1
C
*1
D
(1) The safety input device and safety output device are connected to the same safety
remote I/O module.
(2) The safety input device and safety output device are connected to the different safety
remote I/O modules.
PFD/PFH of safety input equipment
PFD/PFH of safety output equipment
*1: For PFD/PFH of C and D, refer to the manuals, etc. of the used safety components.
4 - 1
4.1 Precautions for Designing Safety Application
4
PRECAUTIONS FOR USE OF SAFETY PLC
PFD/PFH of the safety PLC is listed in Table4.2.
Table4.2 PFD/PFH of safety PLC
Module/unit PFD PFH (/h)
PFD/PFH of safety CPU module, safety power supply module, safety main base
unit, and CC-Link Safety master module
*2
QS0J65BTB2-12DT (DC input
transistor output combined module)
PFD/PFH of safety remote I/O module
QS0J65BTS2-8D (DC input module)
QS0J65BTS2-4T (transistor output
module)
*2: The number of the safety master modules is not relevant to the values of PFD or PFH.
(a) When using one QS0J65BTB2-12D
PFD = (PFD of A) + (PFD of B) + (PFD of C) + (PFD of D)
= (1.39 10 -4) + (2.57 10 -5) + (PFD of C) + (PFD of D)
= 1.65 10
PFH = (PFD of A) + (PFD of B) + (PFD of C) + (PFD of D)
= (4.95 10
= 6.10 10
-4
+ (PFD of C) + (PFD of D)
-9
) + (1.15 10
-9
+ (PFH of C) + (PFH of D)
-9
) + (PFH of C) + (PFH of D)
1.39 10
2.57 10
1.68 10
1.68 10
1
-4
-5
-5
-5
4.95 10
1.15 10
7.46 10
7.46 10
-9
-9
-9
-9
2
APPLICATION
OVERVIEW
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
Input Output
Emergency stop switch Safety relay
Figure4.1 Example when using one QS0J65BTB2-12DT
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
4.1 Precautions for Designing Safety Application
4 - 2
4
PRECAUTIONS FOR USE OF SAFETY PLC
(b) When using one QS0J65BTS2-8D and one QS0J65BTS2-4T
PFD = (PFD of A) + (PFD of B) + (PFD of C) + (PFD of D)
=(1.39 10
= 1.73 10
PFH = (PFH of A) + (PFH of B) + (PFH of C) + (PFH of D)
=(4.95 10 -9) + ((7.46 10
= 6.44 10
-4
) + ((1.68 10 -5) + (1.68 10 -5)) + (PFD of C) + (PFD of D)
-4
+ (PFD of C) + (PFD of D)
-10
) + (7.46 10
-9
+ (PFH of C) + (PFH of D)
-10
)) + (PFH of C) + (PFH of D)
Input Output
Emergency stop switch Safety relay
Figure4.2 Example when using one QS0J65BTS2-8D and one QS0J65BTS2-4T
4 - 3
4.1 Precautions for Designing Safety Application
4
POINT
POINT
PRECAUTIONS FOR USE OF SAFETY PLC
1
(3) Connecting safety components
Make a doubling wiring for safety components as shown in Figure4.3.
Dual input
Dual output
OVERVIEW
2
L
Safety relay
Safety relay
L
APPLICATION
EXAMPLE
Safety PLC
Figure4.3 Wiring of safety components
3
POINT
Use the doubling input signal to the safety remote I/O module with the following combinations of input terminals. For combinations other than the followings, an error is detected by doubling input discrepancy detection. {X00, X01}, {X02, X03}, {X04, X05}, {X06, X07} {X08, X09}, {X0A, X0B}, {X0C, X0D}, {X0E, X0F}
RISK ASSESSMENT
AND SAFTY LEVEL
4
To execute the Input dark test function, connect the safety components using a test pulse terminal.
POINT
To execute the Input dark test function, use the test pulse terminals and input terminals of the safety remote I/O module with the following combinations. Connecting to the incorrect test pulse terminal is identified as a wire break and causes an error. Correct combination {X00, X02, X04, X06, X08, X0A, X0C, X0E} and T0 {X01, X03, X05, X07, X09, X0B, X0D, X0F} and T1
For wiring and setting methods, refer to Chapter 5. For details of doubling wiring and Input dark test function, refer to the following manual.
CC-Link Safety System Remote I/O Module User's Manual
(4) Using the monitor data of GX Developer
The monitor data of GX Developer should not be used for the operation related to the safety. (For example, the operations for the safety such as starting a machine or resetting the stop status should not be performed with checking the monitor data of GX Developer.)
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
4.1 Precautions for Designing Safety Application
4 - 4
4
PRECAUTIONS FOR USE OF SAFETY PLC

4.2 Precautions for Programming

(1) Basic programming
Configure a program for realizing safety functions with attention to the following points.
• Program so that a machine is started only when safe state can be confirmed at the time the start switch is pressed.
• Program so that a machine is stopped if the safe state is not confirmed.
• Program so that a machine is started at the fall (ON OFF) of the signal of the start switch. The programming can prevent a machine from accidentally starting at the switch failure (such as contact welding, spring damage).
• To inhibit restart without manual operation after safety functions were performed and outputs were turned OFF, create an interlock program which uses a reset button for restart.
Operation function
(Non-safety related parts)
Operation command
Start switch Reset switch
Start request
Safety PLC
(Start command signal)
Safety
output data
Machine operation
(startup)
Safety
input data
No entering detection to hazardous area No emergency stop request The Safety PLC and components are not faulty status.
Figure4.4 Configuration example of safety-related system
For the program example, refer to Chapter 5.
Safety status
Interlock
4 - 5
4.2 Precautions for Programming
4
Station No.1
Station No.2
Station No.3
Station No.1
Station No.2
Station No.3
PRECAUTIONS FOR USE OF SAFETY PLC
(2) Devices used in a program for realizing the safety functions
Data can be used as safety I/O data are the following safety refresh devices. Use the safety refresh devices to create a program for realizing the safety functions.
(a) Safety refresh device
The data of internal device refreshed by communicating to the safety remote I/O station is the safety I/O data.
Safety CPU module
X10F - X100
X11F - X110
X12F - X120
X13F - X130
X14F - X140
X15F - X150
X16F - X160
X17F - X170
Y10F - Y100
Y11F - Y110
Y12F - Y120
Y13F - Y130
Y14F - Y140
Y15F - Y150
Y16F - Y160
Y17F - Y170
Safety master station
RX0F - RX00
RX1F - RX10
RX2F - RX20
RX3F - RX30
RX4F - RX40
RX5F - RX50
RX6F - RX60
RX7F - RX70
RY0F - RY00
RY1F - RY10
RY2F - RY20
RY3F - RY30
RY4F - RY40
RY5F - RY50
RY6F - RY60
RY7F - RY70
Figure4.5 I/O data of safety remote station
*1: Figure4.5 shows a case where X100 and Y100 are set with the auto refresh parameter.
The following device ranges actually not input/output to the safety remote I/O station are included. Station No. 1: X110 to X11F, Y110 to Y11F, Station No. 3: X150 to X15F, Y150 to Y15F
Station No.1 Safety remote I/O station
Station No.2 Standard remote I/O station
Station No.3 Safety remote I/O station
Station No.3 Safety remote I/O station
(input)
RX0F - RX00
(input)
RX0F - RX00
(input)
RX0F - RX00
(output)
RY0F - RY00
1
OVERVIEW
2
APPLICATION
EXAMPLE
Turn on/off the emergency stop switch, safety switch, light curtain, etc.
Turn on/off the power source of a robot.
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
:Indicates the safety device range.
*1
SAFETY
APPLICATION
CONFIGURATION
(b) Special relay (SM), special register (SD)
Only SM1000 to SM1299 and SD1000 to SD1299, which are CC-Link Safety­related devices, can be used in a program for realizing the safety functions.
4.2 Precautions for Programming
APPENDIXINDEX
4 - 6
4
PRECAUTIONS FOR USE OF SAFETY PLC
(3) Error detection of CC-Link Safety
Errors concerning CC-Link Safety can be detected by safety station refresh communication status which is described in Table4.3. Create a proper sequence program using the information for error detection (SD) which turns safety outputs OFF.
(a) Safety station refresh communication status
Names and numbers of the special registers for confirming the safety station refresh communication status are shown in Table4.3.
Table4.3 Register names and compatible numbers
Definition for bits of special register (safety station refresh
communication status)
Name No.
0: Normal, reserved station select, not connected, or standard remote
1: Safety station communication error
Definition of each bit indicated as station No. in the table
station
Safety station refresh
communication status
(1st safety master module)
Safety station refresh
communication status
(2nd safety master module)
SD1004 to
SD1007
SD1204 to
SD1207
b15 b14
SD1004 16 15 to 2 1
SD1005 32 31 to 18 17
SD1006 48 47 to 34 33
SD1007 64 63 to 50 49
1 to 64 in the table indicate the station numbers.
b15 b14
SD1204 16 15 to 2 1
SD1205 32 31 to 18 17
SD1206 48 47 to 34 33
SD1207 64 63 to 50 49
1 to 64 in the table indicate the station numbers.
–
–
b1 b0
b1 b0
For details, refer to the following manual.
QSCPU User's Manual (Function Explanation, Program Fundamentals)
(b) Program example
The program for handling the error detection of CC-Link Safety is shown in Figure4.6. Figure4.6 shows the program used when outputting from the safety remote I/O station of station No.1 connected to the first module of the safety master module using SD1004.0.
4 - 7
SD1004.0
Safety station refresh communication status
Figure4.6 Program for handling error detection of CC-Link Safety
4.2 Precautions for Programming
Other safety
status
Output
4
PRECAUTIONS FOR USE OF SAFETY PLC
(4) Reset of CC-Link Safety error
Name No. Definition for bits special register (Safety station interlock status)
Safety station interlock status
(1st safety master module)
Safety station
interlock clear request
(1st safety master module)
Safety station interlock status
(2nd safety master module)
Safety station
interlock clear request
(2nd safety master module)
When an CC-Link Safety error is detected, the safety station interlock status shown in Table4.4 turns on. To resume communications of the CC-Link Safety, turn on the safety station interlock clear request. Create the program which requests the safety station interlock clear by manual operation using a reset button.
Table4.4 Register names and compatible numbers
0: Does not interlocked.
1: During interlock (head station number only)
b15 b14 – b1 b0
SD1072 to
SD1075
SD1076 to
SD1079
SD1272 to
SD1275
SD1276 to
SD1279
SD1072 16 15 to 2 1
SD1073 32 31 to 18 17
SD1074 48 47 to 34 33
SD1075 64 63 to 50 49
1 to 64 in the table indicate the station numbers.
0: Does not clear I/O interlock in safety station.
1: Clears I/O interlock in safety station.
(head station number only)
b15 b14 – b1 b0
SD1076 16 15 to 2 1
SD1077 32 31 to 18 17
SD1078 48 47 to 34 33
SD1079 64 63 to 50 49
1 to 64 in the table indicate the station numbers.
0: Does not interlocked.
1: During interlock (head station number only)
b15 b14 – b1 b0
SD1272 16 15 to 2 1
SD1273 32 31 to 18 17
SD1274 48 47 to 34 33
SD1275 64 63 to 50 49
1 to 64 in the table indicate the station numbers.
0: Does not clear I/O interlock in safety station.
1: Clears I/O interlock in safety station.
(head station number only)
b15 b14 – b1 b0
SD1276 16 15 to 2 1
SD1277 32 31 to 18 17
SD1278 48 47 to 34 33
SD1279 64 63 to 50 49
1 to 64 in the table indicate the station numbers.
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
For details, refer to the following manual.
QSCPU User's Manual (Function Explanation, Program Fundamentals)
4.2 Precautions for Programming
4 - 8
4
PRECAUTIONS FOR USE OF SAFETY PLC
(a) Program example
Figure4.7 shows the program when the interlock for the safety remote I/O station
of station 1, connected to the first safety master module is cleared.
SD1072.0
SET SD1076.0
Reset switch
Safety station
interlock status
Figure4.7 Program example when interlock for the CC-Link Safety is cleared
Safety station
interlock status
SD1076.0SD1072.0
Safety station interlock
clear request
(5) Version management of GX Developer project file
Fill in the created date and author at the top of sequence program using the statement function of GX Developer. When the program will be modified, fill in the modified date, modified person, and modified description at the modified place using the statement function of GX Developer for change history management. And manage the data which was downloaded to the PLC by storing the hard disk of personal computer or CD.
Safety station interlock
clear request
RST SD1076.0
Safety station interlock
clear request
Figure4.8 Version management of GX Developer project file
(6) User registration
Define the user who handles the corresponding project, then register the user information and authorization required for the login authentication in the project. For the user registration, refer to the following manual.
GX Developer Version 8 Operating Manual (Safety PLC)
4 - 9
4.2 Precautions for Programming
4
PRECAUTIONS FOR USE OF SAFETY PLC

4.3 Precautions for Startup

When new safety-related system will be started up or existing safety-related system will be changed, confirm the below points.
1
OVERVIEW
(1) Confirmation of network connection configuration
Confirm that the safety remote I/O module used is set as designed. The confirmation items are shown below.
1) Link ID
2) Station No.
3) Transmission speed
For the switch settings of the safety remote station, refer to the following manual.
CC-Link Safety System Remote I/O Module User's Manual
(2) Confirmation before writing parameters and program
Confirm the parameters and program to be written are as designed before writing them to a PLC. For the parameter settings by using GX Developer, refer to the following manual.
GX Developer Version 8 Operating Manual (Safety PLC) For parameter definition and setting range for parameter settings of GX Developer, refer to the following manual.
CC-Link Safety System Master Module User's Manual
(3) Usage of a checklist
Before operation, check if the safety-related system is correctly configured with the checklist in Appendix.2.
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5

4.4 Precautions for Safety Functions Maintenance

(1) Periodic inspection
To confirm whether the emergency stop switch, safety sensor, etc. are not faulty, execute a periodic inspection every one year for meeting Category 3, every six month for meeting Category 4. As well as diagnostics of the safety PLC, perform a test from the emergency stop request to machine stop as safety functions.
(2) Module/unit replacement
For the safety PLC, execute the module/unit replacement according to the replacement cycle in Table4.5.
Table4.5 Module/unit replacement period
Module/unit Module/unit replacement cycle
Safety power supply module 5 years
Safety CPU module 10 years
Safety master module 10 years
Safety remote I/O module 5 years
Safety main base unit 10 years
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
4.3 Precautions for Startup
4 - 10
4
PRECAUTIONS FOR USE OF SAFETY PLC
(3) Operation mode while a safety PLC is in operation
Set the operation mode of the safety PLC to SAFETY MODE when the PLC is in operation.
(4) ROM information management of a safety CPU
Confirm the ROM information at regular intervals whether the programs and parameters in the safety CPU module are illegally rewritten.
1) When writing a project file to ROM, check the ROM information using GX Developer, and separately save the information.
2) With reference to the ROM information of GX Developer at regular intervals,
confirm whether the information is illegally rewritten.
3) When the information is illegally rewritten, stop the operation. Then, recover the project using the backup project file.
For confirming the ROM information, refer to the following manual.
GX Developer Version 8 Operating Manual (Safety PLC)
(5) Password management
The project files for GX Developer and safety CPU module are protected by password. Manage the registered password properly and do not leak the password except authorized person in order to prevent the unauthorized access.
4 - 11
4.4 Precautions for Safety Functions Maintenance
5
SAFETY APPLICATION CONFIGURATION EXAMPLE

CHAPTER5 SAFETY APPLICATION CONFIGURATION EXAMPLE

This chapter describes the configuration example of the safety application using the safety PLC.

5.1 System Configuration

1
OVERVIEW
2
Parameters Programs
GX Developer
This section describes the safety application using the system configuration of Figure5.1 as an example.
Master (1)
Safety master station (Link ID: 0, Station number: 0)
Master (2)
Safety master station (Link ID: 1, Station number: 0)
CC-Link Safety
Remote (1)
Safety remote I/O station (Link ID: 0, Station number: 1)
Code name SR_IO1
Remote (4) Code name SR_IO4
Safety remote I/O station (Link ID: 1, Station number: 1)
Safety input Emergency stop switch
Safety output Safety relay MC
L
Safety relay
Remote (2)
Safety remote I/O station (Link ID: 0, Station number: 2)
Code name SR_IO2
Remote (3)
Safety remote I/O station (Link ID: 0, Station number: 3)
Code name SR_IO3
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
Safety input Safety switch Light curtain Laser scanner Mat switch
CC-Link Safety
Figure5.1 System configuration
Standard input Reset switch Start switch Stop switch
5.1 System Configuration
APPENDIXINDEX
5 - 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.2 Network-Related Switch Settings of Module

Set the switch settings of each main module as follows

5.2.1 Safety Power supply module

No switch on the safety power supply module

5.2.2 Safety CPU module

No network-related switch on the safety CPU module

5.2.3 Safety master module

No switch on the safety master module
5 - 2
5.2 Network-Related Switch Settings of Module
5.2.1 Safety Power supply module
5
POINT
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.2.4 Safety remote I/O module

Set the link ID, station No. setting switch, and transmission speed setting switch.
123456789ABCDEF
X0
L RUN
POWER
L ERR.
RUN
SD
SAFETY
RD
ERR.
QS0J65BTB2-12DT
RESET SET
STATION NO. B RATE
LINK ID
LBT EL
0
0
0
0
1
1
1
1
2
2
2
2
3
3
3
37
456
4
456
456
X10 X1
1) 2) 3)
Figure5.2 Switch position of safety remote I/O module
Y0 1 2 3
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
Switch numbers
in the Figure
1) Link ID 0 0 0 1
2) Station number setting switch 1 2 3 1
3) Transmission speed setting switch 2 (2.5Mbps) 2 (2.5Mbps) 2 (2.5Mbps) 2 (2.5Mbps)
Table5.1 Switch settings of safety remote I/O module
Remote I/O module number
POINT
For the procedure to enable the switch settings of the safety remote I/O module, refer to the following manual.
CC-Link Safety System Remote I/O Module User's Manual QS0J65BT2­12DT
Remote (1)
SR_I01
Remote (2)
SR_I02
Remote (3)
SR_I03
Remote (4)
SR_I02
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.2 Network-Related Switch Settings of Module
5.2.4 Safety remote I/O module
5 - 3
5
POINT
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.3 CC-Link Parameter Settings

Set the CC-Link parameters as follows. For the definition or setting range of each parameter, refer to the following manual.
CC-Link Safety System Master Module User's Manual QS0J61BT12
Table5.2 CC-Link parameter setting example
Module Master (1) Master (2)
Start I/O No. 00H 20H
Operational setting
Mode Safety remote net(Ver. 1 mode) Safety remote net(Ver. 1 mode)
Transmission speed 2.5Mbps 2.5Mbps
Safety refresh monitoring time 300ms 300ms
Link ID 0 1
All connect count 3 1
Remote input (RX) X100 X200
Remote input (RY) Y100 Y200
Remote register (RWr) – –
Remote register (RWw) – –
Special relay (SB) SB0 SB200
Special relay (SW) SW0 SW200
Retry count 3 3
Automatic reconnection station count 1 1
Station information
setting
Remote device station initial setting None None
Case of CPU STOP setting
Station information setting
Safety remote station
settings
*1: Fixed to "Clears compulsorily" when the safety CPU operation mode is set to SAFETY MODE.
*1
Clears compulsorily Clears compulsorily
Section 5.3.1
Section 5.3.2
POINT
Make the same settings between the link ID and transmission speed in the CC­Link parameter of GX Developer and those of the switches on remote I/O main module to be connected.

5.3.1 CC-Link station information settings

Set the CC-Link station information settings as follows.
Table5.3 Setting example of master (1) station information /
Module Station No. Station type Exclusive station count Reserve station count
1/1 Safety remote I/O station Exclusive station 1 No setting
Master (1)
Module Station No. Station type Exclusive station count Reserve station count
Master (2) 1/1 Safety remote I/O station Exclusive station 1 No setting
5 - 4
2/2 Safety remote I/O station Exclusive station 1 No setting
3/3 Safety remote I/O station Exclusive station 1 No setting
Table5.4 Setting example of master (2) station information
5.3 CC-Link Parameter Settings
5.3.1 CC-Link station information settings
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1

5.3.2 Safety remote station parameter settings

Set the safety remote station parameter settings as follows.
Table5.5 Safety remote station parameter settings
Module
Model name QS0J65BTB2-12DT QS0J65BTB2-12DT QS0J65BTB2-12DT QS0J65BTB2-12DT
Module technical
*1
version
Specify production
information to find
module
Production
information
Parameter Indicated in each case example of Section 5.6 or later.
*2
1100000000000010 – – 1100000000000020
(1) (2) (3) (4)
SR_IO1 SR_IO2 SR_IO3 SR_IO4
AAAA
Yes (check) No (no check) No (no check) Yes (check)
*1: For Module technical version, check the rated plate on the module side in the corresponding safety
remote station.
CC-Link Safety System Remote I/O Module User's Manual QS0J65BTB2-12DT
*2: Enter Production information field referring to the rated plate on the module side in the
corresponding safety remote station.
CC-Link Safety System Remote I/O Module User's Manual QS0J65BTB2-12DT
The use of production information is needed to maintain a proper function after module exchange or to detect any incorrect station number settings such as station number duplication. Use the production information to use safety PLC properly and safely.
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
5.3 CC-Link Parameter Settings
5.3.2 Safety remote station parameter settings
5 - 5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.4 Relationship between the Safety CPU Module Devices and Remote I/O

The following shows the relationship between the safety CPU module devices and the remote I/O stations in the settings of Table5.2. The shaded device numbers are used to create sequence programs.
Station number 1
Station number 2
Station number 3
Station number 1
Station number 2
Station number 3
Safety CPU
X010F - X0100
X011F - X0110
X012F - X0120
X013F - X0130
X014F - X0140
X015F - X0150
Y010F - Y0104
Y011F - Y0110
Y012F - Y0124
Y013F - Y0130
Y014F - Y0144
Y015F - Y0150
Y0103 - Y0100
Y0123 - Y0120
Y0143 - Y0140
Link ID: 0
Remote (1)
SR_IO1
Remote (2)
SR_IO2
Remote (3)
SR_IO3
Safety remote I/O station
(Link ID: 0, Station number: 1)
QS0J65BTB2-12DT
X0F - X00
Safety remote I/O station
(Link ID: 0, Station number: 2)
QS0J65BTB2-12DT
X0F - X00
Safety remote I/O station
(Link ID: 0, Station number: 3)
QS0J65BTB2-12DT
X0F - X00
Y03 - Y00
Y03 - Y00
Y03 - Y00
Station number 1
Station number 1
Link ID: 1
Remote (4)
SR_IO4
X020F - X0200
X021F - X0210
Y020F - Y0204
Y021F - Y0210
Figure5.3 Relationship between safety CPU devices and remote I/O
Y0203 - Y0200
Safety remote I/O station
(Link ID: 1, Station number: 1)
QS0J65BTB2-12DT
X0F - X00
Y03 - Y00
5 - 6
5.4 Relationship between the Safety CPU Module Devices and Remote I/O
5
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.5 Wiring Diagram and Parameter Setting of Standard Input

Wire the reset switch, start switch, and stop switch as follows.
1
Remote (3):SR_IO3
QS0J65BTB2-12DT(3)
(LinkID: 1, Station number: 3)
COM-
1
X0
Reset switch (NO)
Start switch (NO)
Stop switch (NC)
2
T0
3
X1
4
COM-
5
X2
6
T1
7
X3
8
COM-
9
X4
10
T0
11
X5
12
COM-
13
X6
14
T1
15
X7
16
COM+
17
COM+
18
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
Figure5.4 Remote (3) SR_IO3 standard input wiring
OVERVIEW
2
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
APPLICATION
EXAMPLE
3
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
24VDC
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
For the reset switch, start switch, and stop switch, set the parameters as follows.
Table5.6 Remote (3) SR_IO3 parameter settings
Item Setting
Time of noise removal filter X0, 1
Time of noise removal filter X2, 3
Time of noise removal filter X4, 5
Doubling input discrepancy detection time X0, 1
Doubling input discrepancy detection time X2, 3
Doubling input discrepancy detection time X4, 5
Input dark test selection X0, 1
Input dark test selection X2, 3
Input dark test selection X4, 5
Input dark test pulse OFF time
*1
*1
*1
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
time according to the installation environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
SAFETY
APPLICATION
CONFIGURATION
0: 1ms
0: 1ms
0: 1ms
*1
*1
*1
100ms (setting range: 20 to 500ms)
100ms (setting range: 20 to 500ms)
100ms (setting range: 20 to 500ms)
0: Execute,
0: Execute,
0: Execute,
0: 400 s
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
APPENDIXINDEX
1: Not execute
1: Not execute
1: Not execute
, 1: 1ms, 2: 2ms
5.5 Wiring Diagram and Parameter Setting of Standard Input
5 - 7
5
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.6 Case Examples

5.6.1 Emergency stop circuit

(1) Application overview
The emergency stop circuit is the safety application that turns off the power source of a robot with the emergency stop switch. The application controls the start and stop of a robot by turning on or off the main contact of the contactor which opens and closes the power source of a robot at the safety relay contact.
The emergency stop switch and safety relays are connected to the safety PLC. The safety PLC controls the ON/OFF status of the safety relays with a sequence program. When the safety PLC detects an error using the self-diagnostics, the outputs to the safety relays are turned off independent of the sequence program. When the outputs are turned off with the self-diagnostics, the OFF status is maintained regardless of the sequence program until the safety CPU module or safety remote I/O module is reset.
The following functions are realized with the sequence program.
1) After safety is ensured (Emergency stop signal is on), pushing the reset switch, then the start switch turning the safety relays on.
2) When the safety relays are welding, input the close contacts of the safety relays to the safety PLC for avoiding the start, and check for welding.
3) The reset switch and start switch are set to start only when changed from ON to OFF for avoiding an accidental start of the switches at welding or short-circuit.
4) The safety relay outputs are turned off when the emergency stop switch input is turned off or an error is detected in the safety remote I/O station after the operation is started.
5 - 8
Figure5.5 Emergency stop switch
(Partially quoted from "Safety Guide Book - the safety measures of machinery in the workplace"
: Nippon Electric Control Equipment Industries Association.)
5.6 Case Examples
5.6.1 Emergency stop circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(2) Connection of safety devices
Remote (4):SR_IO4
X200-20F Y200-203
CC-Link Safety
Remote (1):SR_IO1 Remote (2):SR_IO2
X100-10F Y100-103
CC-Link Safety
X120-12F Y120-123
Figure5.6 Safety device connection diagram
Wiring: Indicated in Figure
.
Figure5.7
5.7. Parameters: Indicated in
Table5.7
Table 5.7.
Remote (3):SR_IO3
X140-14F Y140-143
: Safety remote I/O module used in this case example
Wiring: Indicated in Figure
Figure5.4.
5.4. Parameters: Indicated in
Table5.6
Table 5.6.
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
5.6 Case Examples
5.6.1 Emergency stop circuit
5 - 9
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(3) Wiring diagram and parameter settings
Wire the emergency stop switch and safety relays to the safety remote I/O module as follows.
Connect the close contact of the safety relay between the input terminal and the test pulse terminal.
Connect the emergency stop switch with two NC contacts of direct opening action between the input terminal and the test pulse terminal.
Emergency stop switch3
Remote(4)
QS0J65BTB2-12DT(4)
(LinkID: 1, Station number: 1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
24VDC
Connect two relays with forcibly guided (mechanically linked) contacts.
Safety relay4
Safety relay5
24VDC
Figure5.7 Remote (4) SR_IO4 wiring
5 - 10
5.6 Case Examples
5.6.1 Emergency stop circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the emergency stop switch and the safety relay, set the parameters as follows.
Table5.7 Remote (4) SR_IO4 parameter settings
Item Setting
Time of noise removal filter X2, 3
Time of noise removal filter X4, 5
Doubling input discrepancy detection time X2, 3
Doubling input discrepancy detection time X4, 5
Input dark test selection X2, 3
*1
*1
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
*1
100ms (setting range: 20 to 500ms)
*1
100ms (setting range: 20 to 500ms)
0: Execute
, 1: Not execute
1
OVERVIEW
2
Input dark test selection X4, 5
Input dark test pulse OFF time
Method of wiring of output Y2
Output dark test selection Y2
Output dark test pulse OFF time Y2
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
*1
time according to the installation environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
0: Execute
0: 400 s
0: No Use, , 2: Doubling wiring (Source+Source)
0: Execute
0: 400 s, , 2: 2ms
, 1: Not execute
, 1: 1ms, 2: 2ms
1: Doubling wiring (Source + Sink)
, 1: Not execute
1: 1ms
(4) Device numbers to be used
Use the following device numbers for creating sequence programs.
Table5.8 Device numbers to be used
Safety/Standard External device Device number
Safety Emergency stop switch X204 or X205
Safety Safety relay Y202
Safety Safety relay (check for welding) X202 or X203
Standard Start switch X142
Standard Reset switch X140
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
5.6 Case Examples
5.6.1 Emergency stop circuit
5 - 11
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(5) Sequence program
Make the following processing on sequence programs.
Ladder which checks the off fall of the reset switch, accepts reset request, and clears the interlock for the CC-Link Safety.
Ladder which confirms the interlock processing completion and cancels interlock clear request.
Ladder which checks the off fall of the start switch and accepts start request.
Ladder which checks safety relays for welding. T0 is a delay timer which waits for safety relays to actually be turned off after the off output of the safety relays.
Ladder which checks whether a robot can start and continue operation.
Ladder which clears start request/reset request when safety cannot be confirmed.
Ladder which controls outputs to safety relays.
Figure5.8 Sequence program
The following shows the constant and internal devices used in the program.
(a) Way of using the constant
K : indicates decimal number.
Example) K1 indicates 1 of decimal number.
5 - 12
5.6 Case Examples
5.6.1 Emergency stop circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(b) Way of using the internal devices
Table5.9 Way of using the internal devices
Internal Details
T0
D0
D1
Designates a timer device.
Times out after a lapse of the time specified at K .
Designates a word device.
In the program, this is used as restart status.
(1) D0 = 0 designates that the system is in initial status or start processing is completed.
(2) D0 = 1 (D0.0: ON) designates that the reset switch is pressed.
(3) D0 = 2 (D0.1: ON) designates that the reset switch is released in (2) status and
restart processing is completed.
Designates a word device.
In the program, this is used as start status.
(1) D1 = 0 designates that the system is in initial status or safety is not confirmed.
(2) D1 = 1 (D1.0: ON) designates that the start switch is pressed.
(3) D1= 2 (D1.1: ON) designates that the start switch is released in (2) status and
start processing is completed.
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
(c) Way of using word device bit specification
(6) Timing chart
Reset SW (X140)
Restart status (D0.0)
Restart status (D0.1)
Start SW (X142)
Start status (D1.0)
Start status (D1.1)
Interlock status (SD1272.0)
Interlock clear (SD1276.0)
CC-Link status (SD1204.0)
D . : designates the th bit data of word device D .
Example) D0.0 indicates 0 bits in D0.
F0
0000000000000001
Figure5.9 Word device bit specification
Pressing the reset
SW
Pressing the
emergency
stop SW
Pressing the start
SW
Turing OFF the emergency SW
Pressing the reset
SW
Pressing
the start
SW
CC-Link
remote (4)
error
CC-Link error
Pressing the reset
SW
Pressing the reset
SW
Pressing the
emergency
stop SW
Pressing
the start
SW
Detecting
relay welding
Pressing the reset
SW
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Emergency stop SW (X204)
Safety information (M5)
Safety relay output (Y202)
Safety relay output check (X202)
Figure5.10 Timing chart
Detecting welding
5.6 Case Examples
5.6.1 Emergency stop circuit
5 - 13
5
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.6.2 Door lock circuit

(1) Application overview
The door lock circuit is the application that keeps the door closed until the power source of a robot stops with the spring lock type safety switch attached to the door of the safety barrier. The safety switch is normally locked by spring power. When voltage is applied to the solenoid, the lock is released and the door can be opened. Specifically, the lock is released with the status signal, indicating such as the stop status of a robot. The robot cannot be started during unlocking or opening the door.
The application controls the start and stop of a robot by turning on or off the main contact of the contactor which opens and closes the power source of a robot at the safety relay contact.
The safety switches and the safety relays are connected to the safety PLC. The safety PLC controls the ON/OFF status of the safety relays with a sequence program. When the safety PLC detects an error using the self-diagnostics, the outputs to the safety relays are turned off independent of the sequence program. When the outputs are turned off with the self-diagnostics, the OFF status is maintained regardless of the sequence program until the safety CPU module or safety remote I/O module is reset.
The following functions are realized with the sequence program.
1) When the safety switch is on, pushing the reset switch, then the start switch turning the safety relays on.
2) When the safety relays are welding, input the close contacts of the safety relays to the safety PLC for avoiding the start, and check for welding.
3) The reset switch and start switch are set to start only when changed from ON to OFF for avoiding an accidental start of the switches at welding or short-circuit.
4) The safety relay outputs are turned off when the stop switch is pressed.
5) The safety relay outputs are turned off when an error is detected in the safety remote I/O station after the operation is started.
5 - 14
Figure5.11 Door lock circuit
(Partially quoted from "Safety Guide Book - the safety measures of machinery in the workplace"
: Nippon Electric Control Equipment Industries Association.)
5.6 Case Examples
5.6.2 Door lock circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(2) Connection of safety devices
Wiring: Indicated in
Figure5.12.
Figure 5.12. Paremeters: Indicated in Table 5.10.
Table5.12
CC-Link Safety
Remote (1):SR_IO1
X100-10F Y100-103
CC-Link Safety
Remote (4):SR_IO4
X200-20F Y200-203
Remote (2):SR_IO2
X120-12F Y120-123
Wiring: Indicated in Figure 5.14.
Figure5.14
Paremeters: Indicated in Table 5.11.
Table5.11
Remote (3):SR_IO3
X140-14F Y140-143
: Safety remote I/O module used in this case example
Wiring: Indicated in Figure 5.4.
Figure5.4
Paremeters: Indicated in Table 5.6.
Table5.6
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
Figure5.12 Safety device connection diagram
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.2 Door lock circuit
5 - 15
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
Wire the door switch with lock structure having two NC contacts of direct opening action to the input terminal and test pulse terminal.
(3) Wiring diagram and parameter settings
Safety switch
2NC
(a) Remote (1): SR_IO1
Wire the spring lock type safety switch to the safety remote I/O module as follows.
Remote(1)
QS0J65BTB2-12DT(1)
Lock release
Door Open
0V +24V
(LinkID=0, Station number 1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37 38 39 40 41
+24V 42 43
44
COM-
45 46
COM-
47 48
COM-
49 50
COM-
51 52
COM-
53 54
COM-
55 56
COM-
57 58
COM-
59
I/O24V
60
I/O24G
61
DA DB DG
SLD
FG
24G
Y0+
Y0-
Y1+
Y1-
Y2+
Y2-
Y3+
Y3-
24VDC
24VDC
Figure5.13 Remote (1) SR_IO1 wiring
For the spring lock type safety switch, set the parameters as follows.
Table5.10 Remote (1) SR_IO1 parameter settings
Item Setting range
Time of noise removal filter X0, 1
Doubling input discrepancy detection time X0, 1
Input dark test selection X0, 1
Input dark test pulse OFF time
*1
*1
*1: Adjust Time of noise removal filter and Input dark test pulse OFF time according to the installation
environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
*1
100ms (setting range: 20 to 500ms)
0: Execute
0: 400 s
, 1: Not execute
, 1: 1ms, 2: 2ms
5 - 16
5.6 Case Examples
5.6.2 Door lock circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(b) Remote (4): SR_IO4
Wire the relay with forcibly guided (mechanically linked) contacts to the safety remote I/O module as follows.
Connect the close contact of the safety relay between the Input terminal and the test pulse.
Rermote(4)
QS0J65BTB2-12DT(4)
(LinkID=1, Station number1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
24VDC
Figure5.14 Remote (4) SR_IO4 wiring
Connect two relays with forcibly guided (mechanically linked) contacts.
Safety relay4
Safety relay5
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
For the relay with forcibly guided (mechanically linked) contacts, set the parameters as follows.
Table5.11 Remote (4) SR_IO4 parameter settings
Item Setting range
Time of noise removal filter X2, 3
Doubling input discrepancy detection time X2, 3
Input dark test selection X2, 3
Input dark test pulse OFF time
Method of wiring of output Y2
Output dark test selection Y2
Output dark test pulse OFF time Y2
*1
*1
*1
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
time according to the installation environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
0: 1ms
*1
100ms (setting range: 20 to 500ms)
0: Execute
0: 400 s
0: No Use, , 2: Doubling wiring
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
, 1: Not execute
, 1: 1ms, 2: 2ms
1: Doubling wiring (Source + Sink)
(Source+Source)
0: Execute
0: 400 s, , 2: 2ms
, 1: Not execute
1: 1ms
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.2 Door lock circuit
5 - 17
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(4) Device numbers to be used
Use the following device numbers for creating sequence programs.
Table5.12 Device numbers to be used
Safety/Standard External device Device number
Safety Safety switch X100 or X101
Safety Safety relay Y202
Safety Safety relay (check for welding) X202 or X203
Standard Reset switch X140
Standard Start switch X142
Standard Stop switch X144
(5) Sequence program
Make the following processing on sequence programs.
Ladder which checks the off fall of the reset switch, accepts reset request, and clears the interlock for the CC-Link Safety.
Ladder which confirms the interlock processing completion and cancels interlock clear request.
Ladder which checks the off fall of the start switch and accepts start request.
Ladder which checks safety relays for welding. T0 is a delay timer which waits for safety relays to actually be turned off after the off output of the safety relays.
Ladder which checks whether a robot can start and continue operation.
Ladder which clears start request/reset request when safety cannot be confirmed.
5 - 18
Ladder which controls outputs to safety relays.
Figure5.15 Sequence program
The following shows the constant and internal devices used in the program.
(a) Way of using the constant
K : indicates decimal number.
Example) K1 indicates 1 of decimal number.
5.6 Case Examples
5.6.2 Door lock circuit
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(b) Way of using the internal devices
Table5.13 Way of using the internal devices
Internal Details
T0
Designates a timer device.
Times out after a lapse of the time specified at K .
Designates a word device.
In the program, this is used as restart status.
D0
(1) D0 = 0 designates that the system is in initial status or start processing is completed.
(2) D0 = 1 (D0.0: ON) designates that the reset switch is pressed.
(3) D0 = 2 (D0.1: ON) designates that the reset switch is released in (2) status and
restart processing is completed.
Designates a word device.
In the program, this is used as start status.
D1
(1) D1 = 0 designates that the system is in initial status or safety is not confirmed.
(2) D1 = 1 (D1.0: ON) designates that the start switch is pressed.
(3) D1 = 2 (D1.1: ON) designates that the start switch is released in (2) status and
start processing is completed.
(c) Way of using word device bit specification
D . : designates the th bit data of word device D .
Example) D0.0 indicates 0 bits in D0.
F0 0000000000000001
Figure5.16 Word device bit specification
(6) Timing chart
Reset SW (X140)
Restart status (D0.0)
Pressing the reset
SW
Pressing
the start
SW
Pressing
the stop
SW
Pressing the reset
SW
Opening the door
Pressing
the start
SW
Closing
the door
Pressing the reset
SW
Pressing
the start
SW
CC-Link
remote (4)
error
Pressing the reset
SW
Pressing the reset
SW
Pressing
the stop
SW
Pressing
the start
SW
Detecting
relay
welding
Pressing the reset
SW
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
Restart status (D0.1)
Start SW (X142)
Start status (D1.0)
Start status (D1.1)
Interlock status
(SD1272.0)
Interlock clear
(SD1276.0)
CC-Link status
(SD1204.0)
Stop SW (X144)
Safety door SW (X100)
Safety information (M5)
Safety relay output
Safety relay output check
(Y202)
(X202)
Turing OFF the stop SW
Figure5.17 Timing chart
CC-Link
error
Detecting welding
5.6 Case Examples
5.6.2 Door lock circuit
APPENDIXINDEX
5 - 19
5
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.6.3 Entering detection and existence detection circuit 1

(1) Application overview
The entering detection and existence detection circuit is the safety application that detects the entrance and existence of a human in a hazardous area and turns off the power source of a robot. The entrance of human to the hazardous area is detected with a light shielding of the light curtain.The existence of human in the hazardous area is detected with a laser scanner. When the entrance or existence of human has been detected, a robot is stopped. The robot cannot be started until the human leaves the hazardous area.
The light curtain, laser scanner, and contactors are connected to the safety PLC. The safety PLC controls ON/OFF status of the contactors with a sequence program. When the safety PLC detects an error using the self-diagnostics, the outputs to the contactors are turned off independent of the sequence program. When the outputs are turned off with the self-diagnostics, the OFF status is maintained regardless of the sequence program until the safety CPU module or safety remote I/O module is reset.
The following functions are realized with the sequence program.
1) After safety is ensured (The light curtain and laser scanner signals are both on), pushing the reset button, then the start button turning the contactor on.
2) When the contactors are welding, input the close contacts of the safety relays to the safety PLC for avoiding the start, and check for welding.
3) The reset switch and start switch are set to start only when changed from ON to OFF for avoiding an accidental start of the switches at welding or short-circuit.
4) The contactor outputs are turned off when the light curtain signal or laser scanner signal is turned off or an error is detected in the safety remote I/O station after the operation is started.
5 - 20
Figure5.18 Entering detection and existence detection circuit
(Partially quoted from "Safety Guide Book - the safety measures of machinery in the workplace"
: Nippon Electric Control Equipment Industries Association.)
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(2) Connection of safety devices
Wiring: Indicated in Figure 5.20.
Figure5.20
Parameters: Indicated
Table5.14
in Table 5.14.
CC-Link Safety
Remote(1):SR_IO1
X100-10F Y100-103
CC-Link Safety
Remote(4):SR_IO4
X200-20F Y200-203
Remote(2):SR_IO2
X120-12F Y120-123
Wiring: Indicated in
Figure5.21
Figure 5.21. Parameters: Indicated
Table5.15
in Table 5.15.
Remote(3):SR_IO3
X140-14F Y140-143
: Safety remote I/O module used in this case example
Wiring: Indicated in Figure 5.4.
Figure5.4
Parameters: Indicated
Table5.6
in Table 5.6.
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
Figure5.19 Safety device connection diagram
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5 - 21
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(3) Wiring diagram and parameter settings
Wire the light curtain and the laser scanner to the safety remote I/O module as follows.
(a) Remote (1): SR_IO1
Optical transmitter
Connect two control output points (PNP output) of type 4 light curtain between the input terminal and COM- terminal.
Connect two control output points (PNP output) of type 3 laser scanner between the input terminal and COM- terminal.
FG
Optical receiver
FG
Light curtain
Laser scanner
Figure5.20 Remote (1) SR_IO1 wiring
DC24V
DC24V
0V
Synchronization negative
Synchronization positive
Synchronization positive
Synchronization negative
DC24V
Control output1
Control output2
0V
DC24V
Control output1
Control output2
Create dual wiring
Create dual wiring
QS0J65BTB2-12DT(1)
(LinkID=0, Station numner1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
Remote(1)
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
24VDC
5 - 22
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the light curtain and the laser scanner, set the parameters as follows.
Table5.14 Remote (1) SR_IO1 parameter settings
Item Setting range
Time of noise removal filter X4, 5
Time of noise removal filter X6, 7
Doubling input discrepancy detection time X4, 5
Doubling input discrepancy detection time X6, 7
Input dark test selection X4, 5
*1
*1
0: 1ms
0: 1ms
*1
20ms (setting range: 20 to 500ms)
*1
20ms (setting range: 20 to 500ms)
0: Execute,
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
1: Not execute
1
OVERVIEW
2
Input dark test selection X6, 7
Input dark test pulse OFF time*1
(b) Remote (4): SR_IO4
Connect the close contact of the contactor between the input terminal and test pulse terminal.
0: Execute,
0: 400 s
1: Not execute
, 1: 1ms, 2: 2ms
*1: Adjust Time of noise removal filter according to the installation environment and wiring length. Set
Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
Wire the contactors to the safety remote I/O module as follows.
Remote(4)
QS0J65BTB2-12DT(4)
(LinkID=1, Station number1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
Use two contactors which can be activated with 24VDC, 0.5A.
Contactor1
L3L2L
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
1
Contactor2
24VDC
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Figure5.21 Remote (4) SR_IO4 wiring
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5 - 23
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the contactors, set the parameters as follows.
Item Setting range
Time of noise removal filter X8, 9
Doubling input discrepancy detection
time X8, 9
Input dark test selection X8, 9
Input dark test pulse OFF time
Method of wiring of output Y0
Method of wiring of output Y1
*1
*1
*1
Table5.15 Remote (4) SR_IO4 parameter settings
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
100ms (setting range: 20 to 500ms)
0: Execute
0: 400 s
0: No Use,1: Doubling wiring (Source+Sink),
0: No Use,1: Doubling wiring (Source+Sink),
, 1: Not execute
, 1: 1ms, 2: 2ms
2: Doubling wiring (Source + Source)
2: Doubling wiring (Source + Source)
Output dark test selection Y0
Output dark test selection Y1
Output dark test pulse OFF time Y0
Output dark test pulse OFF time Y1
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
0: Execute
0: Execute
*1
0: 400 s, , 2: 2ms
*1
0: 400 s, , 2: 2ms
time according to the installation environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
, 1: Not execute
, 1: Not execute
1: 1ms
1: 1ms
(4) Device numbers to be used
Use the following device numbers for creating sequence programs.
Table5.16 Device numbers to be used
Safety/Standard External device Device number
Safety Light curtain X104 or X105
Safety Laser scanner X106 or X107
Safety Contactor Y200 and Y201
Safety Contactor (check for welding) X208 or X209
Standard Reset switch X140
Standard Start switch X142
5 - 24
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(5) Sequence program
Make the following processing on sequence programs.
Ladder which checks the off fall of the reset switch, accepts reset request, and clears the interlock for the CC-Link Safety.
Ladder which confirms the interlock processing completion and cancels interlock clear request.
Ladder which checks the off fall of the start switch and accepts start request.
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
Ladder which checks contactors for welding. T0 is a delay timer which waits for contactors to actually be turned off after the off output of the contactors.
Ladder which checks whether a robot can start and continue operation.
Ladder which clears start request/reset request when safety cannot be confirmed.
Ladder which controls outputs to contactors.
Figure5.22 Sequence program
The following shows the constant and internal devices used in the program.
(a) Way of using the constant
K : indicates decimal number.
Example) K1 indicates 1 of decimal number.
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5 - 25
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(b) Way of using the internal devices
Table5.17 Way of using the internal devices
Internal Details
T0
D0
D1
Designates a timer device.
Times out after a lapse of the time specified at K .
Designates a word device.
In the program, this is used as restart status.
(1) D0 = 0 designates that the system is in initial status or start processing is completed.
(2) D0 = 1 (D0.0: ON) designates that the reset switch is pressed.
(3) D0 = 2 (D0.1: ON) designates that the reset switch is released in (2) status and
restart processing is completed.
Designates a word device.
In the program, this is used as start status.
(1) D1 = 0 designates that the system is in initial status or safety is not confirmed.
(2) D1 = 1 (D1.0: ON) designates that the start switch is pressed.
(3) D1 = 2 (D1.1: ON) designates that the start switch is released in (2) status and
start processing is completed.
(c) Way of using word device bit specification
D . : designates the th bit data of word device D .
Example) D0.0 indicates 0 bits in D0.
F0
0000000000000001
Figure5.23 Word device bit specification
5 - 26
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(6) Timing chart
SW
CC-Link
remote (4)
error
Pressing the reset
SW
Pressing the reset
SW
Pressing
the start
SW
Reset SW (X140)
Restart status (D0.0)
Restart status (D0.1)
Start SW (X142)
Start status (D1.0)
Start status (D1.1)
Pressing the reset
SW
Approach Exit Approach
Pressing
the start
SW
Pressing the reset
SW
Pressing
the start
Detecting
relay welding
Pressing the reset
SW
1
2
APPLICATION
3
OVERVIEW
EXAMPLE
Interlock status (SD1272.0)
Interlock clear (SD1276.0)
CC-Link status (SD1204.0)
Light curtain (X104)
Laser scanner (X106)
Safety information (M5)
Contactor 1 output (Y200)
Contactor 2 output (Y201)
Safety contactor output check (X208)
Light shielding of
the light curtain
Light shielding of the laser scanner
Figure5.24 Timing chart
CC-Link
error
Detecting welding
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
5.6 Case Examples
5.6.3 Entering detection and existence detection circuit 1
APPENDIXINDEX
5 - 27
5
SAFETY APPLICATION CONFIGURATION EXAMPLE

5.6.4 Entering detection and existence detection circuit 2

(1) Application overview
The entering detection and existence detection circuit is the safety application that detects the entrance and existence of a human in a hazardous area and turns off the power source of a robot. The entrance of human to the hazardous area is detected with a light shielding of the light curtain. The existence of human in the hazardous area is detected with mat switch. When the entrance or existence of human has been detected, a robot is stopped. The robot cannot be started until the human leaves the hazardous area.
The application controls the start and stop of a robot by turning on or off the main contact of the contactor which opens and closes the power source of a robot. The safety PLC controls ON/OFF status of the contactors with a sequence program.
The light curtain and the contactors are connected to the safety PLC. The relay is connected between the mat switch and safety PLC. The safety PLC controls ON/OFF status of the contactors with a sequence program. When the safety PLC detects an error using the self-diagnostics, the outputs to the contactors are turned off independent of the sequence program. When the outputs are turned off with the self-diagnostics, the OFF status is maintained regardless of the sequence program until the safety CPU module or safety remote I/O module is reset.
The following functions are realized with the sequence program.
1) After safety is ensured (The light curtain and mat switch signals are both on), pushing the reset button, then the start button turning the contactor on.
2) When the contactors are welding, input the close contacts of the safety relays to the safety PLC for avoiding the start, and check for welding.
3) The reset switch and start switch are set to start only when changed from ON to OFF for avoiding an accidental start of the switches at welding or short-circuit.
4) The contactor output is turned off when the light curtain signal or the relay input of mat switch is turned off or an error is detected in the safety remote I/O station after the start.
5 - 28
Figure5.25 Entering detection and existence detection
(Partially quoted from "Safety Guide Book - the safety measures of machinery in the workplace"
: Nippon Electric Control Equipment Industries Association.)
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(2) Connection of safety devices
Wiring: Indicated in Figure 5.27.
Figure5.27
Parameters: Indicated in Table 5.18.
Table5.18
CC-Link Safety
Remote(1):SR_IO1
X100-10F Y100-103
CC-Link Safety
Remote(4):SR_IO4
X200-20F Y200-203
Remote(2):SR_IO2
X120-12F Y120-123
Wiring: Indicated in
Figure5.28
Figure 5.28. Parameters: Indicated
Table5.19
in Table 5.19.
Remote(3):SR_IO3
X140-14F Y140-143
: Safety remote I/O module used in this case example
Wiring: Indicated in
Figure5.4
Figure 5.4. Parameters: Indicated
Table5.6
in Table 5.6.
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
Figure5.26 Safety device connection diagram
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5 - 29
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(3) Wiring diagram and parameter settings
(a) Remote (1): SR_IO1
Wire the light curtain and the mat switch to the safety remote I/O module as follows.
Optical transmitter
Connect two control output points (PNP output) of type 4 light curtain between the input terminal and COM­terminal.
Connect a 4-wire mat to the relay and connect the two relay contacts between the input terminal and test pulse terminal.
FG
Optical receiver
FG
Light curtain
Mat switch
R
24VDC
Create dual wiring
24VDC
0V
Synchronization negative
Synchronization positive
Synchronization positive
Synchronization negative
24VDC
Control output1
Control output2
0V
Create dual wiring
24V
Relay(2c)
0V
Figure5.27 Remote (1) SR_IO1 wiring
Remote(1)
QS0J65BTB2-12DT(1)
(LinkID=0, Station number1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37 38 39 40 41 42 43
44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61
DA
DB DG SLD
+24V
FG 24G
Y0+
COM-
Y0-
COM-
Y1+
COM-
Y1-
COM-
Y2+
COM-
Y2-
COM-
Y3+
COM-
Y3-
COM­I/O24V I/O24G
24VDC
24VDC
5 - 30
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the light curtain and the mat switch, set the parameters as follows.
Table5.18 Remote (1) SR_IO1 parameter settings
Item Setting range
Time of noise removal filter X4, 5
Time of noise removal filter X8, 9
Doubling input discrepancy detection time X4, 5
Doubling input discrepancy detection time X8, 9
Input dark test selection X4, 5
*1
*1
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
*1
20ms (setting range: 20 to 500ms)
*1
20ms (setting range: 20 to 500ms)
0: Execute,
1: Not execute
1
OVERVIEW
2
Input dark test selection X8, 9
Input dark test pulse OFF time
Connect the close contact of the contactor between the input terminal and test pulse terminal.
0: Execute
*1
0: 400 s
, 1: Not execute
, 1: 1ms, 2: 2ms
*1: Adjust Time of noise removal filter and Input dark test pulse OFF time according to the installation
environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
(b) Remote (4): SR_IO4
Wire the contactors to the safety remote I/O module as follows.
Remote(4)
QS0J65BTB2-12DT(4)
(LinkID=1, Station number1)
1
COM-
2
X0
3
T0
4
X1
5
COM-
6
X2
7
T1
8
X3
9
COM-
10
X4
11
T0
12
X5
13
COM-
14
X6
15
T1
16
X7
17
COM+
18
COM+
COM-
19
X8
20
T0
21
X9
22
COM-
23
XA
24
T1
25
XB
26
COM-
27
XC
28
T0
29
XD
30
COM-
31
XE
32
T1
33
XF
34
COM+
35
COM+
36
37
DA
38
DB
39
DG
40
SLD
41
+24V
42
FG
43
24G
24VDC
Use two contactors which can be activated with 24VDC, 0.5A.
Contactor1
L3L2L
Y0+
44
COM-
45
Y0-
46
COM-
47
Y1+
48
COM-
49
Y1-
50
COM-
51
Y2+
52
COM-
53
Y2-
54
COM-
55
Y3+
56
COM-
57
Y3-
58
COM-
59
I/O24V
60
I/O24G
61
1
Contactor2
24VDC
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
Figure5.28 Remote (4) SR_IO4 wiring
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5 - 31
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
For the contactors, set the parameters as follows.
Table5.19 Remote (4) SR_IO4 parameter settings
Item Setting range
Time of noise removal filter X8, 9
Doubling input discrepancy detection time X8, 9
Input dark test selection X8, 9
Input dark test pulse OFF time
Method of wiring of output Y0
Method of wiring of output Y1
*1
*1
0: 1ms
, 1: 5ms, 2: 10ms, 3: 20ms, 4: 50ms
*1
100ms (setting range: 20 to 500ms)
0: Execute
0: 400 s
0: No Use,1: Doubling wiring (Source+Sink),
2: Doubling wiring (Source + Source )
0: No Use,1: Doubling wiring (Source+Sink),
2: Doubling wiring (Source + Source )
, 1: Not execute
, 1: 1ms, 2: 2ms
Output dark test selection Y0
Output dark test selection Y1
Output dark test pulse OFF time Y0
Output dark test pulse OFF time Y1
*1: Adjust Time of noise removal filter, Input dark test pulse OFF time, and Output dark test pulse OFF
*1
*1
time according to the installation environment and wiring length. Set Doubling input discrepancy detection time to 100ms for the mechanical switch and 20ms for the sensor input as a guideline.
0: Execute
0: Execute
0: 400 s, , 2:2ms
0: 400 s, , 2: 2ms
, 1: Not execute
, 1: Not execute
1: 1ms
1: 1ms
(4) Device numbers to be used
Use the following device numbers for creating sequence programs.
Table5.20 Device numbers to be used
Safety/Standard External device Device number
Safety Light curtain X104 or X105
Safety Mat switch X108 or X109
Safety Contactor 1 and 2 Y200 and Y201
Safety Contactor (check for welding) X208 or X209
Standard Reset switch X140
Standard Start switch X142
5 - 32
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
1
(5) Sequence program
Make the following processing on sequence programs.
OVERVIEW
Ladder which checks the off fall of the reset switch, accepts reset request, and clears the interlock for the CC-Link Safety.
Ladder which confirms the interlock processing completion and cancels interlock clear request.
Ladder which checks the off fall of the start switch and accepts start request.
Ladder which checks contactors for welding. T0 is a delay timer which waits for contactors to actually be turned off after the off output of the contactors.
Ladder which checks whether a robot can start and continue operation.
Ladder which clears start request/reset request when safety cannot be confirmed.
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
Ladder which controls outputs to contactors.
Figure5.29 Sequence program
The following shows the constant and internal devices used in the program.
(a) Way of using the constant
K : indicates decimal number.
Example) K1 indicates 1 of decimal number.
SAFETY
APPLICATION
CONFIGURATION
APPENDIXINDEX
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5 - 33
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(b) Way of using the internal devices
Table5.21 Way of using the internal devices
Internal Details
T0
D0
D1
Designates a timer device.
Times out after a lapse of the time specified at K .
Designates a word device.
In the program, this is used as restart status.
(1) D0 = 0 designates that the system is in initial status or start processing is completed.
(2) D0 = 1 (D0.0: ON) designates that the reset switch is pressed.
(3) D0 = 2 (D0.1: ON) designates that the reset switch is released in (2) status and
restart processing is completed.
Designates a word device.
In the program, this is used as start status.
(1) D1 = 0 designates that the system is in initial status or safety is not confirmed.
(2) D1 = 1 (D1.0: ON) designates that the start switch is pressed.
(3) D1 = 2 (D1.1: ON) designates that the start switch is released in (2) status and
start processing is completed.
(c) Way of using word device bit specification
D . : designates the th bit data of word device D .
Example) D0.0 indicates 0 bits in D0.
F0
0000000000000001
Figure5.30 Word device bit specification
5 - 34
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
5
SAFETY APPLICATION CONFIGURATION EXAMPLE
(6) Timing chart
CC-Link
remote (4)
error
Pressing the reset
SW
Pressing the reset
SW
Pressing
Reset SW (X140)
Restart status (D0.0)
Restart status (D0.1)
Start SW (X142)
Start status (D1.0)
Start status (D1.1)
Pressing the reset
SW
Approach Exit Approach
Pressing the start
SW
Pressing the reset
SW
Pressing the start
SW
the start
SW
Detecting
relay welding
Pressing the reset
SW
1
2
APPLICATION
3
OVERVIEW
EXAMPLE
Interlock status (SD1272.0)
Interlock clear (SD1276.0)
CC-Link status (SD1204.0)
Light curtain (X104)
Safety mat (X108)
Safety information (M5)
Contactor 1 output (Y200)
Contactor 2 output (Y201)
Safety contactor output check (X208)
Light shielding of
the light curtain
Stepping on a safety mat
Figure5.31 Timing chart
CC-Link
error
Detecting welding
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
5.6 Case Examples
5.6.4 Entering detection and existence detection circuit 2
APPENDIXINDEX
5 - 35

APPENDIX

APPENDIX

Appendix.1 Calculation Method of Safety Response Time

This manual explains about the maximum value of safety response time. When employing the calculation formula, use the following GX Developer and modules. For calculation formula other than the following combination, refer to the following manual.
CC-Link Safety System Master Module User's Manua
GX Developer
version
Ver. 8.65T or later 10032 or later 10032 or later 10031 or later 10032 or later
Safety CPU module
Safety master
module
First five digits of serial number
Safety remote I/O station
QS0J65BTS2-8D, QS0J65BTS2-4T QS0J65BTB2-12DT
(1) Calculation method
The maximum value of the safety response time will be the sum of (a) to (e) in TableApp.1. For timing when the safety response time will be the maximum value, refer to FigureApp.1.
TableApp.1 Calculation method for the maximum value of safety response time
Item Maximum
(a) Input device response time DT1
(b) Safety remote station input response time Refer to User's Manual for the safety remote station.
(c) Monitoring time from safety input to safety output Safety data monitoring time
(d) Safety remote station output response time Refer to User's Manual for the safety remote station.
(e) Output device response time DT2
To ta l
DT1 + DT2 + Safety remote station input response time + Safety
data monitoring time + Safety remote station output response time
App - 1
Appendix.1 Calculation Method of Safety Response Time
APPENDIX
LS:
n: m:
DT1, DT2: Response time of sensor or output destination controlling device. Check and add the
Safety refresh monitoring time: Time set in network parameter.
Safety data monitoring time: Time set in network parameter
WDT (Watchdog timer): Time set in PLC parameter.
Synchronous mode: Mode which performs data link when sequence scan is synchronized with link scan.
Asynchronous mode: Mode which performs data link without synchronizing sequence program.
Link Scan Time ( This Item (1) (a)) Value after the decimal point of (LS/WDT) is rounded up
Value after the decimal point of (Safety refresh response processing time/(WDT n)) is rounded up Safety refresh response processing time: Refer to User's Manual for the safety remote station.
response time of the device to be used.
Use the value gained by the following calculation formula as measure.
In synchronous mode
(WDT n) 3 + ((WDT n) m 2 + (WDT ) [ms]
: 0 when LS 1.5ms, 1 1.5ms
In asynchronous mode
(WDT n) 3 + LS + ((WDT n) m 2 + (WDT ) [ms]
: 0 when LS 1.5ms, 1 when LS 1.5ms
Use the value gained by the following calculation formula as measure.
Safety refresh monitoring time 2 - ((WDT n) m) - 10 [ms]
Calculate SM (Scan time) with referring to the QSCPU User's Manual (Function
Explanation, Program Fundamentals), and set the watchdog timer value more equal to or
more than the gained value.
In the synchronous mode, sequence scan and link scan start simultaneously.
CC-Link Safety System Master Module User's Manual
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
CC-Link Safety System Master Module User's Manual
SAFETY
APPLICATION
CONFIGURATION
APPENDIX
Appendix.1 Calculation Method of Safety Response Time
App - 2
APPENDIX
POINT
POINT
(1) If setting value of the safety data monitoring time is equal to or less than the
value gained by the calculation formula above, an error may occur even in normal communication status. If setting value of the safety data monitoring time is needlessly long, the time taken for (c) in TableApp.1 may lengthen in the case of a safety programmable controller error, resulting in excessive delay of safety response performance.
(2) To show the maximum value of safety response time, this manual uses WDT,
the maximum value of SM (Scan time), instead of SM to the calculating formula. For the usual calculation, substitute for WDT, SM is used.
(3) When the safety CPU module detects CC-LINK DATA RECEPTION
TIMEOUT (error code: 8320 to 8322), increase the safety refresh monitoring time and safety data monitoring time as needed.
(a)+(b)
Master station
CC-Link
Safety
Remote
station
(Input
side)
CC-Link
Safety
Remote
station
(Output
side)
Master
station monitoring timer start
Input signal
WDT
(SM)
Ladder Ladder Ladder Ladder Ladder Ladder Ladder Ladder Ladder
LS
Master station
monitoring
time-out decision
Safety refresh
monitoring time
(a) to (e) in the figure corresponds to (a) to (e) in Table App. 1.
(WDT n) m
Safety data monitoring time
TableApp.1.
(C) (d)+(e)
FigureApp.1 Timing chart
Master station
time-out decision
Safety refresh
monitoring time
monitoring
(WDT n) m
Safety
power supply
module
CC-Link Safety
remote I/O station
Safety input
signal
Output
signal
Safety
CC-Link
CPU
Safety master
module
module
CC-Link Safety
CC-Link Safety
remote I/O station
Safety master
Safety output
Safety relayEmergency stop switch
CC-Link
module
signal
App - 3
Appendix.1 Calculation Method of Safety Response Time
APPENDIX
1
(a) Link scan time (LS)
The following shows the formula for the CC-Link Safety link scan time (LS)[ s].
LS = BT (27+(NI 4.8) + (NW 9.6) + (N 30) + (ni 4.8) + (nw 9.6)+ TR) + ST + RT+ F [ s] LS calculation formula
BT: Constant
Transmission speed 156kbps 625kbps 2.5Mbps 5Mbps 10Mbps
BT 51.2 12.8 3.2 1.6 0.8
NI : Final station No. in A and B (Higher value between A and B)
(Including the number of occupied stations and excluding reserved stations, in multiples of 8.)
NW : Final station No. in B
(Including the number of occupied stations and excluding reserved stations, in multiples of 8.)
A : Final station No. of standard remote I/O stations
(When not connecting standard remote station, put 0 to A.)
B : Final station No. of safety remote I/O stations and remote device stations
Final station No. 1 to 8 9 to 16 17 to 24 25 to 32 33 to 40 41 to 48 49 to 56 57 to 64
NI,NW 8 16 24 32 40 48 56 64
N : Number of connected modules (excluding reserved stations) ni : a + b (excluding reserved stations) a : Total number of occupied standard remote I/O stations b : Total number of occupied safety remote I/O stations and remote device
stations nw : b (excluding reserved stations) TR : Constant
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
Constant Numeric value
TR 38.4
ST : Constant
(for asynchronous mode only. For synchronous mode, ST = 0. )
(1) or 2), whichever is greater. Ignore 2) when B = 0.)
1) 800 + (A 15)
2) 900 + (B 50)
RT : Retry processing time (only when there is a faulty station)
+
(Number of detected faulty stations - 1)
:
Return processing time for 1
BT ((200 + R)
R: 51.6+(NI
:
Return processing time for 2
BT ((200 + P)
Set number of retries + 200)
4.8)+(NW 9.6)
Set number of retries + 200)
st
module
nd
or sebsequent module
P: 10.8
F : Return to system processing time (only when communication faulty station
exists)
BT
218 Number of automatic return modules
SAFETY
APPLICATION
CONFIGURATION
APPENDIX
Appendix.1 Calculation Method of Safety Response Time
App - 4
APPENDIX
POINT
(2) Calculation example of response time
POINT
If connecting the remote station to the station with the reserved station setting, and then clear the setting, the valus of NI, NW, N, ni, and nw in the LS calculation formula will change. When the reserved station was changed, recalculate the LS and safety response performance. For the reserved station function, refer to the CC-Link Safety System Master Module User's Manual.
The following shows calculation example of the response time when WDT setting value: 10ms, link scan time (synchronous mode): 0.3ms, link scan time (asynchronous mode): 1.4ms, safety remote station input response time: 12.2ms, safety remote station output response time: 10.4ms, and safety refresh response processing time: 9.6ms.
(a) Calculation example of safety refresh monitoring time
1) In synchronous mode
n : LS/WDT = 0.3/10
m : (Safety refresh reponse processing time/(WDT n)) = 9.6/(10 1)
: LS = 0.3
(WDT n) 3 + ((WDT n) m) 2 + (WDT ) [ms]
= (10 1) 3 + ((10 1) 1) 2 + (10 0) = 50 [ms]
2) In asynchronous mode
n : LS/WDT = 1.4/10
m : (Safety refresh reponse processing time/(WDT n)) = 9.6/(10 1)
: LS = 1.4 1.5 ms
(WDT n) 3 + LS + ((WDT n) m) 2 + (WDT ) [ms]
= (10 1) 3 + 1.4 + ((10 1) 1) 2 + (10 0) = 51.4 [ms]
(b) Safety data monitoring time
1) In synchronous mode
Safety refresh monitoring time 2 - ((WDT n) m) - 10
= 50 2 - (10 1) 1 - 10 = 80 [ms]
1.5 ms 0
1
1
1
1
1
App - 5
2) In asynchronous mode
Safety refresh monitoring time 2 - ((WDT n) m) - 10
= 51.8 2 - (10 1) 1 - 10 = 82.8 [ms]
Appendix.1 Calculation Method of Safety Response Time
APPENDIX
(c) Calculation example for the maximum value of response time
1) In synchronous mode
DT1 + DT2 + Safety remote station input response time + Safety data monitoring time + Safety remote station output response time = DT1 + DT2 + 12.2 + 80 + 10.4 = 102.6 [ms]
2) In asynchronous mode
DT1 + DT2 + Safety remote station input response time + Safety data monitoring time + Safety remote station output response time = DT1 + DT2 + 12.2 + 82.8 + 10.4 = 105.4 [ms]
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
APPENDIX
Appendix.1 Calculation Method of Safety Response Time
App - 6
APPENDIX
(3) Calculation example of link scan time
(2) The following shows the calculation example of LS (Link scan time) used in the calculation of response time.
The following shows the calculation example when the transmission speed is 10 Mbps in the following system configuration example (It is assumed that there is no faulty stations).
Safety
master
station
Station No.1
Safety remote
I/O station
*1
Station No.2
Standard remote
I/O station
*1: 1 occupied station *2: 2 occupied station
BT = 0.8 NI = 5 8 NW = 5 8 N = 4 ni = 5 nw = 4 A = 2, B = 5 ST = 1350
1) 800 + (2 15) = 830
2) 900 + (5 50) = 1150
1) In synchronous mode
LS = BT (27 + (NI 4.8) + (NW 9.6) + (N 30) + (ni 4.8) + (nw 9.6)
+ TR) + RT + F
= 0.8 (27 + (8 4.8) + (8 9.6) + (4 30) + (5 4.8) + (4 9.6) + 38.4) + 0 + 0 = 290.4 [ s] = 0.4 [ms]
*1
Station No.3
Remote device
station
*2
Station No.5
Safety remote
I/O station
*1
Station No.6
Reserved
station
*2
App - 7
2) In asynchronous mode
LS = BT (27 + (NI 4.8) + (NW 9.6) + (N 30) + (ni 4.8) + (nw 9.6)
+ TR) + ST + RT + F
= 0.8 (27 + (8 4.8) + (8 9.6) + (4 30) + (5 4.8) + (4 9.6) + 38.4) + 1150 + 0 + 0 = 1440.4 [ s] = 1.4 [ms]
Appendix.1 Calculation Method of Safety Response Time
APPENDIX

Appendix.2 Checklist

TableApp.2 Checklist
No. Description Reference Check
Backup and version management of a file
Were the created date and author entered at the top of the sequence program using the
1
statement function of GX Developer?
When modifying the sequence program, were the created date, author, and modified
2
description entered at the modified place using the statement function?
Were the data downloaded to the PLC stored into the hard disk of a personal computer or
3
CD?
Checking the setting
Was it confirmed that the link ID, station number, and transmission speed of the safety
4
remote I/O module on the site were set as designed?
5 Were the appropriate values set to Safety refresh monitoring time and WDT Setting? Appendix.1
When the safety system is shifted to the actual operation, is the operation mode set to the
6
SAFETY MODE?
Operation check
Were all safety application functions (e.g. emergency stop function, restart interlock)
7
inspected?
8 Were the response time of the safety application inspected? ---
Checking write data
Before writing the data to the PLC, was it confirmed that sequence program and
9
parameter setting values were configured as desired?
Was it confirmed that the ROM information of CPU corresponds with that of the project file
10
with the ROM information screen of GX Developer?
Others
Was it confirmed that there are no errors with the LEDs on the module and the PLC
11
diagnostics screen of GX Developer?
In output signals from a safety CPU module to the CC-Link Safety master module on
sequence program, was it confirmed that "prohibited to use" signal was not mistakenly
12
turned on or off? (For "prohibited to use" signal, refer to the CC-Link Safety System
Master Module User's Manual.)
Are the registered passwords (Login password, CPU access password) managed
13
properly?
Section 4.2(5)
Section 4.2(5)
Section 4.2(5)
Section 4.3(1)
Section 4.4(3)
---
Section 4.3(2)
Section 4.4(4)
---
---
Section 4.4(5)
1
OVERVIEW
2
APPLICATION
EXAMPLE
3
RISK ASSESSMENT
AND SAFTY LEVEL
4
PRECAUTIONS FOR
USE OF SAFETY
PLC
5
SAFETY
APPLICATION
CONFIGURATION
Appendix.2 Checklist
APPENDIX
App - 8

INDEX

[A]
Application example .............................................. 2-1
[C]
Case examples
Door lock circuit................................................ 5-14
Emergency stop circuit....................................... 5-8
Light curtain, laser scanner .............................. 5-20
Light curtain, mat switch................................... 5-28
Category ........................................................A-16,3-3
CC-Link Parameter Settings.................................. 5-4
Checklist ........................................... 4-10,Appendix-8
[E]
EN954-1 ................................................................ 3-3
Error detection of CC-Link Safety .......................... 4-7
[H]
High demand mode of operation ........................... 3-5
[I]
IEC61508......................................................... 1-1,3-5
ISO12100 ........................................................ 3-1,3-2
ISO14121 ........................................................ 3-1,3-2
[L]
Link scan time........................................... Appendix-2
Low demand mode of operation ............................ 3-5
LS ............................................................. Appendix-2
[M]
Module replacement ............................................ 4-10
Risk assessment............................................A-16,3-1
Risk graph........................................................ 3-3,3-5
Risk reduction ........................................................ 3-2
ROM information management............................ 4-11
[S]
Safety component................................................A-16
Safety functions ...................................................A-16
Safety input....................................................A-15,4-6
Safety output..................................................A-15,4-6
Safety precautions .................................................A-1
Safety refresh monitoring time.................. Appendix-2
Safety status .......................................................... 4-5
Safety-related system ....................................A-16,4-5
Scan time.................................................. Appendix-2
SIL .................................................................A-16,3-5
SM (Scan time) ......................................... Appendix-2
Standard remote .................................................. A-15
Switch setting......................................................... 5-2
System configuration ............................................. 1-1
[T]
Target failure measure(PFD, PFH)......... A-16,3-5,4-1
[U]
Unit replacement.................................................. 4-10
User registration .................................................... 4-9
[W]
Watchdog timer......................................... Appendix-2
WDT.......................................................... Appendix-2
[N]
NI .............................................................. Appendix-4
Symbols
NW............................................................ Appendix-4
[P]
Password management....................................... 4-11
Periodic inspection .............................................. 4-10
PFD .........................................................A-16,3-5,4-1
PFH .........................................................A-16,3-5,4-1
Production information........................................... 5-5
[R]
Related manuals.................................................. A-11
Reset of CC-Link Safety error ............................... 4-8
Response time....................................................... 4-1
Risk...................................................................... A-16
Index - 1

WARRANTY

Please confirm the following product warranty details before using this product.
1. Limited Warranty and Product Support.
a. Mitsubishi Electric Company ("MELCO") warrants that for a period of eighteen (18) months after date of delivery from the point
of manufacture or one year from date of Customer's purchase, whichever is less, Mitsubishi MELSEC Safety programmable controllers (the "Products") will be free from defects in material and workmanship.
b. At MELCO's option, for those Products MELCO determines are not as warranted, MELCO shall either repair or replace them or
issue a credit or return the purchase price paid for them.
c. For this warranty to apply:
(1) Customer shall give MELCO (i) notice of a warranty claim to MELCO and the authorized dealer or distributor from whom the
Products were purchased, (ii) the notice shall describe in reasonable details the warranty problem, (iii) the notice shall be provided promptly and in no event later than thirty (30) days after the Customer knows or has reason to believe that Products are not as warranted, and (iv) in any event, the notice must given within the warranty period;
(2) Customer shall cooperate with MELCO and MELCO's representatives in MELCO's investigation of the warranty claim,
including preserving evidence of the claim and its causes, meaningfully responding to MELCO's questions and investigation of the problem, grant MELCO access to witnesses, personnel, documents, physical evidence and records concerning the warranty problem, and allow MELCO to examine and test the Products in question offsite or at the premises where they are installed or used; and
(3) If MELCO requests, Customer shall remove Products it claims are defective and ship them to MELCO or MELCO's
authorized representative for examination and, if found defective, for repair or replacement. The costs of removal, shipment to and from MELCO's designated examination point, and reinstallation of repaired or replaced Products shall be at Customer's expense.
(4) If Customer requests and MELCO agrees to effect repairs onsite at any domestic or overseas location, the Customer will
pay for the costs of sending repair personnel and shipping parts. MELCO is not responsible for any re-commissioning, maintenance, or testing on-site that involves repairs or replacing of the Products.
d. Repairs of Products located outside of Japan are accepted by MELCO's local authorized service facility centers ("FA Centers").
Terms and conditions on which each FA Center offers repair services for Products that are out of warranty or not covered by MELCO's limited warranty may vary.
e. Subject to availability of spare parts, MELCO will offer Product repair services for (7) years after each Product model or line is
discontinued, at MELCO's or its FA Centers' rates and charges and standard terms in effect at the time of repair. MELCO usually produces and retains sufficient spare parts for repairs of its Products for a period of seven (7) years after production is discontinued.
f. MELCO generally announces discontinuation of Products through MELCO's Technical Bulletins. Products discontinued and
repair parts for them may not be available after their production is discontinued.
2. Limits of Warranties.
a. MELCO does not warrant or guarantee the design, specify, manufacture, construction or installation of the materials,
construction criteria, functionality, use, properties or other characteristics of the equipment, systems, or production lines into which the Products may be incorporated, including any safety, fail-safe and shut down systems using the Products.
b. MELCO is not responsible for determining the suitability of the Products for their intended purpose and use, including
determining if the Products provide appropriate safety margins and redundancies for the applications, equipment or systems into which they are incorporated.
c. Customer acknowledges that qualified and experienced personnel are required to determine the suitability, application, design,
construction and proper installation and integration of the Products. MELCO does not supply such personnel.
d. MELCO is not responsible for designing and conducting tests to determine that the Product functions appropriately and meets
application standards and requirements as installed or incorporated into the end-user's equipment, production lines or systems.
e. MELCO does not warrant any Product:
(1) repaired or altered by persons other than MELCO or its authorized engineers or FA Centers; (2) subjected to negligence, carelessness, accident, misuse, or damage; (3) improperly stored, handled, installed or maintained; (4) integrated or used in connection with improperly designed, incompatible or defective hardware or software; (5) that fails because consumable parts such as batteries, backlights, or fuses were not tested, serviced or replaced; (6) operated or used with equipment, production lines or systems that do not meet applicable and commensurate legal, safety
and industry-accepted standards; (7) operated or used in abnormal applications; (8) installed, operated or used in contravention of instructions, precautions or warnings contained in MELCO's user, instruction
and/or safety manuals, technical bulletins and guidelines for the Products; (9) used with obsolete technologies or technologies not fully tested and widely accepted and in use at the time of the Product's
manufacture; (10) subjected to excessive heat or moisture, abnormal voltages, shock, excessive vibration, physical damage or other
improper environment; or
(11) damaged or malfunctioning due to Acts of God, fires, acts of vandals, criminals or terrorists, communication or power
failures, or any other cause or failure that results from circumstances beyond MELCO's control.
f. All Product information and specifications contained on MELCO's website and in catalogs, manuals, or technical information
materials provided by MELCO are subject to change without prior notice.
g. The Product information and statements contained on MELCO's website and in catalogs, manuals, technical bulletins or other
SH(NA)-080613ENG-C
materials provided by MELCO are provided as a guide for Customer's use. They do not constitute warranties and are not incorporated in the contract of sale for the Products.
h. These terms and conditions constitute the entire agreement between Customer and MELCO with respect to warranties,
remedies and damages and supersede any other understandings, whether written or oral, between the parties. Customer expressly acknowledges that any representations or statements made by MELCO or others concerning the Products outside these terms are not part of the basis of the bargain between the parties and are not factored into the pricing of the Products.
i. THE WARRANTIES AND REMEDIES SET FORTH IN THESE TERMS ARE THE EXCLUSIVE AND ONLY WARRANTIES
AND REMEDIES THAT APPLY TO THE PRODUCTS.
j. MELCO DISCLAIMS THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
3. Limits on Damages.
a. MELCO'S MAXIMUM CUMULATIVE LIABILITY BASED ON ANY CLAIMS FOR BREACH OF WARRANTY OR CONTRACT,
NEGLIGENCE, STRICT TORT LIABILITY OR OTHER THEORIES OF RECOVERY REGARDING THE SALE, REPAIR, REPLACEMENT, DELIVERY, PERFORMANCE, CONDITION, SUITABILITY, COMPLIANCE, OR OTHER ASPECTS OF THE PRODUCTS OR THEIR SALE, INSTALLATION OR USE SHALL BE LIMITED TO THE PRICE PAID FOR PRODUCTS NOT AS WARRANTED.
b. Although MELCO has obtained the certification for Product's compliance to the international safety standards IEC61508 and
EN954-1/ISO13849-1 from TUV Rheinland, this fact does not guarantee that Product will be free from any malfunction or failure. The user of this Product shall comply with any and all applicable safety standard, regulation or law and take appropriate safety measures for the system in which the Product is installed or used and shall take the second or third safety measures other than the Product. MELCO is not liable for damages that could have been prevented by compliance with any applicable safety standard, regulation or law.
c. MELCO prohibits the use of Products with or in any application involving power plants, trains, railway systems, airplanes, airline
operations, other transportation systems, amusement equipments, hospitals, medical care, dialysis and life support facilities or equipment, incineration and fuel devices, handling of nuclear or hazardous materials or chemicals, mining and drilling, and other applications where the level of risk to human life, health or property are elevated.
d. MELCO SHALL NOT BE LIABLE FOR SPECIAL, INCIDENTAL, CONSEQUENTIAL, INDIRECT OR PUNITIVE DAMAGES,
FOR LOSS OF PROFITS, SALES, OR REVENUE, FOR INCREASED LABOR OR OVERHEAD COSTS, FOR DOWNTIME OR LOSS OF PRODUCTION, FOR COST OVERRUNS, OR FOR ENVIRONMENTAL OR POLLUTION DAMAGES OR CLEAN-UP COSTS, WHETHER THE LOSS IS BASED ON CLAIMS FOR BREACH OF CONTRACT OR WARRANTY, VIOLATION OF STATUTE, NEGLIGENCE OR OTHER TORT, STRICT LIABILITY OR OTHERWISE.
e. In the event that any damages which are asserted against MELCO arising out of or relating to the Products or defects in them,
consist of personal injury, wrongful death and/or physical property damages as well as damages of a pecuniary nature, the disclaimers and limitations contained in these terms shall apply to all three types of damages to the fullest extent permitted by law. If, however, the personal injury, wrongful death and/or physical property damages cannot be disclaimed or limited by law or public policy to the extent provided by these terms, then in any such event the disclaimer of and limitations on pecuniary or economic consequential and incidental damages shall nevertheless be enforceable to the fullest extent allowed by law.
f. In no event shall any cause of action arising out of breach of warranty or otherwise concerning the Products be brought by
Customer more than one year after the cause of action accrues.
g. Each of the limitations on remedies and damages set forth in these terms is separate and independently enforceable,
notwithstanding the unenforceability or failure of essential purpose of any warranty, undertaking, damage limitation, other provision of these terms or other terms comprising the contract of sale between Customer and MELCO.
4. Delivery/Force Majeure.
a. Any delivery date for the Products acknowledged by MELCO is an estimated and not a promised date. MELCO will make all
reasonable efforts to meet the delivery schedule set forth in Customer's order or the purchase contract but shall not be liable for failure to do so.
b. Products stored at the request of Customer or because Customer refuses or delays shipment shall be at the risk and expense
of Customer.
c. MELCO shall not be liable for any damage to or loss of the Products or any delay in or failure to deliver, service, repair or
replace the Products arising from shortage of raw materials, failure of suppliers to make timely delivery, labor difficulties of any kind, earthquake, fire, windstorm, flood, theft, criminal or terrorist acts, war, embargoes, governmental acts or rulings, loss or damage or delays in carriage, acts of God, vandals or any other circumstances reasonably beyond MELCO's control.
5. Choice of Law/Jurisdiction.
These terms and any agreement or contract between Customer and MELCO shall be governed by the laws of the State of New York without regard to conflicts of laws. To the extent any action or dispute is not arbitrated, the parties consent to the exclusive jurisdiction and venue of the federal and state courts located in the Southern District of the State of New York. Any judgment there obtained may be enforced in any court of competent jurisdiction.
6. Arbitration.
Any controversy or claim arising out of, or relating to or in connection with the Products, their sale or use or these terms, shall be settled by arbitration conducted in accordance with the Center for Public Resources (CPR) Rules for Non-Administered Arbitration of International Disputes, by a sole arbitrator chosen from the CPR's panels of distinguished neutrals. Judgment upon the award rendered by the Arbitrator shall be final and binding and may be entered by any court having jurisdiction thereof. The place of the arbitration shall be New York City, New York. The language of the arbitration shall be English. The neutral organization designated to perform the functions specified in Rule 6 and Rules 7.7(b), 7.8 and 7.9 shall be the CPR.
Loading...