Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety Guidelines
for the Application, Installation and Maintenance of Solid State Controls (publication SGI-1.1
Automation sales office or online at http://www.rockwellautomation.com/literature/
between solid state equipment and hard-wired electromechanical devices. Because of this difference, and also because of the
wide variety of uses for solid state equipment, all persons responsible for applying this equipment must satisfy themselves that
each intended application of this equipment is acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use
or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for
actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software
described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is
prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNING
Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property damage, or economic loss.
available from your local Rockwell
) describes some important differences
IMPORTANT
ATTENTION
SHOCK HAZARD
BURN HAZARD
Allen-Bradley, Rockwell Automation, GuardPLC, GuardPLC 1200, GuardPLC 1600, GuardPLC 1800, GuardPLC 2000, RSLogix Guard PLUS!, RSNetWorx, RSNetWorx for EtherNet/IP, RSLinx, RSLogix,
RSLogix 5, RSLogix 5000, PLC-5, ControlLogix, FlexLogix, CompactLogix, SLC 500, PanelView, PanelView Plus, VersaView, FLEX I/O, POINT I/O, PanelBuilder 32, Rockwell Software, and
TechConnect are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
Identifies information that is critical for successful application and understanding of the product.
Identifies information about practices or circumstances that can lead to personal injury or death, property damage,
or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence
Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may
be present.
Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach
dangerous temperatures.
Summary of Changes
The information below summarizes the changes to this manual since
the last publication.
To help you find new and updated information in this release of the
manual, we have included change bars as shown to the right of this
paragraph.
For Information AboutSee
Configuring Communication Between the Controller and a
PanelView PLUS Terminal
Updated GuardPLC 1800 specifications 286
Added service life specifications for 1753-OW8 module294
Updated information on battery replacementAppendix D
Various updates to style and formatthroughout
205
3Publication 1753-UM001C-EN-P - March 20103
Summary of Changes
Notes:
4Publication 1753-UM001C-EN-P - March 2010
Overview of Safety Controllers
Table of Contents
Preface
Who Should Use This Manual . . . . . . . . . . . . . . . . . . . . . . . 17
Use this manual if you are responsible for designing, installing,
programming, or troubleshooting control systems that use GuardPLC
controllers.
Personnel responsible for installation, programming, operation, and
troubleshooting of safety-related controllers must be familiar with
relevant safety standards for programmable electronic systems (PES).
The manual only briefly describes the safety concept of the GuardPLC
family of controllers. Its purpose is to provide information on
installing and operating your controller system.
For detailed information on the safety policy regarding GuardPLC
controllers, including information on the controller’s central functions,
input and output channels, operating system, application program
safety and regulations for use, refer to the GuardPLC Controller
Systems Safety Reference Manual, publication 1753-RM002
For procedural information on programming and configuring
GuardPLC Controller Systems with RSLogix Guard PLUS! programming
software, refer to Using RSLogix Guard PLUS! Software with GuardPLC
Controllers, publication 1753-PM001
.
.
Additional Resources
The table on the following page lists documents that contain
additional information concerning Rockwell Automation GuardPLC
products.
You can view or download publications at
http://www.rockwellautomation.com/literature
of technical documentation, contact your local Rockwell Automation
distributor or sales representative.
. To order paper copies
17Publication 1753-UM001C-EN-P - March 201017
Preface Preface
ResourceDescription
Using RSLogix Guard PLUS! Software with GuardPLC
Controllers Programming Manual, publication 1753-PM001
GuardPLC Controller Systems Safety Reference Manual,
publication 1753-RM002
DeviceNet Safety Scanner for GuardPLC Controllers User
Manual, publication 1753-UM002
DeviceNet Safety I/O User Manual, publication
1791DS-UM001
GuardPLC Certified Function Blocks Safety Reference Manual,
publication 1753-RM001
EtherNet/IP Performance and Application Guide, publication
ENET-AP001
Industrial Automation Wiring and Grounding Guidelines,
publication 1770-4.1
Application Considerations for Solid-State Controls,
publication SGI-1.1
National Electrical Code - Published by the National Fire
Protection Association of Boston, MA.
Provides procedural information for programming GuardPLC Controller
Systems Using RSLogix Guard PLUS! Programming Software
Contains in-depth information on the safety concept of GuardPLC
controller systems, including the DeviceNet Safety Scanner for GuardPLC
Controller.
Provides information on installing, configuring, and operating a DeviceNet
Safety Scanner in a GuardPLC application
Provides information on operating 1791DS DeviceNet Safety I/O Modules
Provides information on using Certified Function Blocks in your GuardPLC
safety application
Information on EtherNet/IP protocol
In-depth information on grounding and wiring Allen-Bradley
programmable controllers
A description of important differences between solid-state programmable
controller products and hard-wired electromechanical devices
An article on wire sizes and types for grounding electrical equipment
18Publication 1753-UM001C-EN-P - March 2010
Introduction
Chapter
Overview of Safety Controllers
TopicPage
Safety Concept19
Safe States21
GuardPLC System Hardware21
Communication Capabilities27
1
Safety Concept
GuardPLC controllers feature a fail-safe CPU according to IEC 61508
(SIL 3) and ISO 13849-1 (PLe/Cat. 4). Faults that cause loss of safety
function are detected within the safety time you specify. Faults that
cause loss of safety function only in combination with another fault,
are detected at least within the multiple error occurrence time (24
hours).
This results in these requirements for the safety concept:
• You specify the safety time and the watchdog time. The multiple
error occurrence time is preset to 24 hours.
• Even upon the detection of an error, the controller continues to
react in a safety-related way.
• Faulty input signals (for example, incorrectly transmitted input
values) do not affect the safe function of the controller. Faulted
input signals have a 0 value.
• An error in a non-safety-related module does not affect the
safety of the controller.
• The failure of the controller has no effect on the safety of other
safety-related modules.
For more information on the safety concept, refer to the GuardPLC
Controllers Safety Reference Manual, publication
19Publication 1753-UM001C-EN-P - March 201019
1753-RM002.
Chapter 1 Overview of Safety Controllers
Response to Faults
Type of I/O ErrorController Behavior
PermanentIf an error occurs at an I/O point, only this I/O point is considered faulty and not the entire module.
In case of faulty input points, ‘0’ is assumed to be the safe value. Faulty output channels are de-energized. If it
is not possible to de-energize a single point, the entire module is considered to be faulty, the entire module is
de-energized, and the corresponding error status is set. The controller reports the error to the user program. If
the entire module cannot be de-energized, the controller goes to Failure_Stop.
TransientA transient error is an error that occurs in an I/O module and then disappears by itself. If a transient error
occurs, the module performs a self test. If the test is successful, the status of the I/O module is set to ‘good’
and the module’s normal function continues.
In the process, the GuardPLC controller performs a statistical evaluation of the frequency of errors. The I/O
module is permanently set to ‘faulty’ if the pre-set error frequency is exceeded. In this case, the module does
not resume its normal function after the error has disappeared. To resume normal function, you must cycle
power or change the controller to Stop and then Run.
If an error persists for a period of time exceeding that of the multiple error occurrence time (24 hours), the I/O
module is permanently set to ‘faulty’ and does not continue normal function after the disappearance of the
error. The I/O module can only resume normal function after you cycle power or Stop/Start the controller.
For faulty modules, the controller uses safe values (0, LOW).
ControllerUpon the detection of an error, the controller goes to Failure_Stop and all output channels are set to the safe
state (value = 0).
In some cases in which a Failure_Stop occurs, a power cycle will not enable normal operation. A manual reset
from Stop to Run, using RSLogix Guard PLUS! software, is required. Cat. 4 faults typically require manual
resets.
An error in the user program is not considered an error of the controller.
The controller also monitors the timing and consistency of the:
• hardware self-tests and software self-tests of the controller.
• cycle of the user program.
• processing of the I/O signals including I/O tests.
• run cycle of the controller.
• transition from Run to Stop.
20Publication 1753-UM001C-EN-P - March 2010
Overview of Safety Controllers Chapter 1
Safe States
GuardPLC System
Hardware
Inputs
The safe state of an input is indicated by a 0 signal being passed to
the user program logic. When a fault occurs, the inputs are switched
off (0).
Outputs
An output is in the safe state when it is de-energized. In the event of a
fault, all outputs are switched off. This includes faults in Ethernet
communication.
GuardPLC 1200 System
The GuardPLC 1200 controller is a compact system consisting of a
CPU, watchdog, and on-board digital I/O. The GuardPLC 1200
controller features 20 digital inputs, 8 digital outputs, and 2
high-speed counters. An RS-232 serial port supports ASCII
communication and an Ethernet port provides safety-related
communication. A user-supplied 24V DC power supply is required.
See page
45 for power supply connections.
GuardPLC 1200 Controller
Upper Terminal Block
Back-up Battery
Compartment
ASCII Serial Port
Lower Terminal Block
PLC
1200
Ethernet Port
(on Bottom of Controller)
RJ-45 Port
Port for
Factory
Use Only
Ethernet Dongle
Required
Publication 1753-UM001C-EN-P - March 201021
Chapter 1 Overview of Safety Controllers
GuardPLC 1600 and GuardPLC 1800 System
GuardPLC 1600 Controller
RJ-45 Ethernet Ports
Voltage Supply
Connection
RS-485 Serial Ports
(See Page 23)
(on Top of Controller)
Digital Outputs
RJ-45 Ethernet Ports
Voltage Supply
Connection
RS-485 Serial Ports
(See Page 23)
RJ-45 Ethernet Ports (on Bottom of Controller)
RJ-45 Ethernet Ports (on Bottom of Controller)
Digital Inputs
GuardPLC 1800 Controller
(on Top of Controller)
Digital Outputs
Analog Inputs
Digital Inputs
High Speed
Counter
The GuardPLC 1600 system features 20 digital inputs and 8 digital
outputs with the addition of optional distributed Safety I/O. The
GuardPLC 1800 system features 24 digital inputs, 8 digital outputs, 8
safety-related analog inputs, and 2 high-speed counters, as well as
optional distributed Safety I/O. The status of inputs and outputs is
indicated via status indicators. A user-supplied 24V DC power supply
is required. See page
45 for information on power supply
requirements.
Each controller features four 10/100BaseT, RJ-45 connectors to
provide safety-related communication via the GuardPLC Ethernet
network to distributed I/O and other GuardPLC controllers, OLE for
(1)
Process Control (OPC) servers
, and with RSLogix Guard PLUS!
programming software. The four connectors and the controller are
connected via an internal Ethernet switch.
(1)
The OPC server is not suitable for safety-related communication.
22Publication 1753-UM001C-EN-P - March 2010
Overview of Safety Controllers Chapter 1
Three ports are located on the front of the controller, providing these
non-safety-related communication options.
Serial Port
Designation
COMM1
(RS-485)
COMM2not used
COMM3
(RS-485)
Function
Modbus RTU Slave (1753-L28BBBM or 1753-L32BBBM-8A)
Profibus-DP-Slave (1753-L28BBBP or 1753-L32BBBP-8A) Read/Write
The COMM3 (RS-485) also supports High-Speed Safety Protocol (HSP)
for high-integrity communication with the 1753-DNSI DeviceNet
Safety Scanner.
Refer to the DeviceNet Safety Scanner for GuardPLC Controllers User
Manual, publication 1753-UM002
, for more information.
GuardPLC Distributed I/O
The following modules are available for use with the GuardPLC 1600
controllers, GuardPLC 1800 controllers, and series C GuardPLC 1200
controllers, and with series C GuardPLC 2000 CPUs. Module status is
indicated via status indicators.
Cat. No. DescriptionInputsOutputs
1753-IB16Input Module16 digital (not isolated)
4 pulse test sources
1753-OB16Output ModuleNA16 digital (not isolated)
1753-IB20XOB8Input/Output
Module
1753-IB8XOB8Input/Output
Module
1753-IB16XOB8Input/Output
Module
1753-OW8Relay Output
Module
1753-IF8XOF4Analog
Input/Output
Module
20 digital (not isolated)8 digital (not isolated)
8 digital (not isolated)
2 pulse test sources
16 digital (not isolated)
2 pulse test sources
NA8 relay
8 analog4 standard analog
NA
8 positive-switching digital
2 negative-switching digital
(not isolated)
The GuardPLC 2000 controller is a modular system consisting of a
controller (1755-L1), which provides central CPU and communication
functions, and a separate power supply and I/O residing in a
GuardPLC 1755-A6 chassis. A maximum of six I/O modules may be
used in a single system.
The GuardPLC 2000 controller has one active RS-232 serial port for
non-safety related communication. It also features an Ethernet port for
configuration and safety-related communication. The lower DB9 port
supports RS-232 ASCII (read-only) communication; the upper port is
inactive.
Publication 1753-UM001C-EN-P - March 201025
Chapter 1 Overview of Safety Controllers
GuardPLC 2000 Controller, Power Supply, and I/O Modules
GuardPLC 2000 Power Supply
Ethernet Port
Back-up Battery
Compartment
RS-232 Serial Port
(Inactive)
RS-232 Serial Port
(Active)
GuardPLC 2000
1755-
PB720
GuardPLC 2000
24V
FAULT
3,3V
5V
RESTA RT
1
2
3
FAULT
L+
DC 24V
L-
PS
GuardPLC 2000 I/O Modules
Controller
1755-
1755-
L1
IB24XOB16
RUN ERRRUNRUNRUN ERR RUN ERRERR
RUN ERR
1
LS+
2
I1
3
I2
4
I3
5
I4
6
I5
7
I6
8
I7
9
I8
Tx COL
10
LS+
11
I9
12
I10
13
I11
14
I12
10/100BaseT
15
I13
16
I14
17
I15
18
I16
LS+
19
I17
20
I18
21
I19
22
I20
23
I21
24
I22
25
I23
26
I24
27
28
L-
29
O1
30
O2
31
O3
32
O4
33
O5
34
O6
FB1
35
O7
36
O8
FB2
37
L-
38
O9
39
O10
40
O11
41
O12
42
O13
43
O14
44
O15
45
O16
CPUDIOAIAOCO
DIO
3V DC
LITH-BATT.
RUN STOP
PROG FAULT
FORCE
1755-
1755-
1755-
1755-
IB24XOB16
IF8
OF8
ERR
1
1
LS+
1
2
2
I1
2
3
3
I2
3
4
4
I3
4
5
5
I4
5
6
6
I5
6
7
7
I6
7
8
8
I7
8
9
9
I8
9
10
LS+
10
11
I9
11
12
I10
12
13
I11
13
14
I12
14
15
I13
15
16
I14
16
17
I15
17
18
I16
18
LS+
19
I17
20
I18
21
I19
22
I20
23
I21
24
I22
25
I23
26
I24
27
L-
28
O1
29
O2
30
O3
31
O4
32
O5
33
O6
34
O7
35
O8
36
L-
37
O9
38
O10
39
O11
40
O12
41
O13
42
O14
43
O15
44
O16
45
O1+
1
I1+
1
2
O1-
2
I-
O2+
3
I2+
3
O2-
4
I-
4
O3+
5
I3+
5
O3-
6
I-
6
O4+
7
I4+
7
O4-
8
I-
8
9
9
I5+/1-
O5+
10
10
I-
O5-
11
11
O6+
I6+/2-
12
12
I-
O6-
13
13
I7+/3-
O7+
14
14
I-
O7-
15
15
I8+/4-
O8+
16
16
I-
O8-
17
17
18
18
1755-
HSC
HSC
RUN ERR
C-
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
C-
1
A1
2
A1
B1
B1
3
Z1
Z1
4
C1
C1
5
C-
C-
6
C-
C-
7
C-
C-
8
C-
C-
9
C-
C-
10
A2
A2
11
B2
B2
12
Z2
Z2
13
C2
C2
14
C-
C-
15
C-
C-
16
C-
C-
17
C-
C-
18
L-
L-
19
1
1
20
2
2
21
3
3
22
4
4
23
L-
L-
24
L-
L-
25
L-
L-
26
L-
L-
27
CO
GuardPLC 2000 Power Supply
The 1755-PB720 power supply module provides two voltages
(3.3V DC and 5V DC) for the GuardPLC 2000 controller. They are
electrically isolated from the supply voltage, 24V DC.
1755-IB24XOB16 I/O Module
The 1755-IB24XOB16 digital input/output module provides 24 digital
inputs and 16 digital outputs. The status of each I/O signal is
displayed with a status indicator located on the right side of the front
plate connectors. Inputs and outputs are electrically isolated from the
supply voltage, 24V DC.
1755-IF8 Analog Input Module
The 1755-IF8 analog input module has eight inputs. These inputs can
be used as either eight single-ended inputs or four differential analog
inputs that are electrically isolated from the logic side of the GuardPLC
module. The measured input value can be either voltage or current. If
you use the input module for current, you need a shunt resistor. The
measured value is digitally transferred to the processor system as a
value between 0 and 2000.
26Publication 1753-UM001C-EN-P - March 2010
Overview of Safety Controllers Chapter 1
1755-OF8 Analog Output Module
The 1755-OF8 analog output module provides eight outputs,
galvanically isolated in groups of 2 (that is, 2 outputs per power
supply). They are electrically isolated from the processor system. Each
analog output can operate as a current source or a voltage source.
1755-HSC High Speed Counter Module
The 1755-HSC counter module provides two counters and four digital
outputs. They are electrically isolated from the processor system. The
status of the four output signals is displayed with status indicators
located at the right side of the front plate output connector.
Communication
Capabilities
GuardPLC Ethernet Network
The GuardPLC Ethernet network provides safe communication via
Ethernet protocol for distributed I/O and peer-to-peer communication
for all GuardPLC controllers. It also provides non-safety-related
communication with the OPC server. Programming and configuration
of controllers is accomplished via the GuardPLC Ethernet network.
Various GuardPLC systems can be networked together on the
GuardPLC Ethernet network, using star or daisy-chain configurations.
A programming device running RSLogix Guard PLUS! software can
also be connected wherever required.
IMPORTANT
Make sure that a network loop is not generated. Data packets
must only be able to reach a node via a single path.
GuardPLC 1600 and GuardPLC 1800 controllers support EtherNet/IP
communication. Able to run EtherNet/IP communication at the same
time as safety-rated GuardPLC Ethernet network, the GuardPLC
controller uses the EtherNet/IP network to communicate status about
the safety control system to other standard devices such as PLCs
(ControlLogix, FlexLogix, CompactLogix, SLC 500, or PLC-5
controllers), HMIs (PanelView, PanelView Plus, and VersaView
terminals) and others. The GuardPLC controller can even control
standard I/O, like FLEX I/O and POINT I/O modules, on an
EtherNet/IP network.
ASCII
This read-only, non-safety-related protocol can be used to extract
diagnostic and status information from the GuardPLC controllers.
ASCII protocol is available over the RS-232 port on the GuardPLC 1200
and GuardPLC 2000 controllers and via the RS-485 Comm 3 port on
GuardPLC 1600 and GuardPLC 1800 controllers.
See Chapter 21 for details on communication with ASCII devices.
28Publication 1753-UM001C-EN-P - March 2010
Overview of Safety Controllers Chapter 1
High-speed Safety Protocol
GuardPLC 1600 and 1800 controllers support High-speed Safety
Protocol (HSP), which allows them to connect to the DeviceNet safety
network via the 1753-DNSI DeviceNet Safety Scanner.
Refer to the DeviceNet Safety Scanner for GuardPLC Controllers User
Manual, publication
1753-UM002, for more information.
Modbus RTU Slave
Modbus is a standard industrial non-safety-related serial protocol in
which the Modbus master can communicate with a maximum of 255
slave devices. The Modbus master initiates and controls all
communication on the network.
Modbus RTU Slave protocol is available via the RS-485 Comm 1 port
on GuardPLC 1600 and GuardPLC 1800 controllers with catalog
numbers ending in ‘M’.
Modbus RTU Slave protocol allows both the reading and writing of
data.
For more information on the Modbus RTU Slave protocol, see the
Modbus Protocol Specifications, available from
www.modbus.org/specs.
PROFIBUS DP Slave
PROFIBUS DP protocol is a non-safety-related serial protocol,
designed for high-speed data transmission between automation
systems and distributed peripherals.
PROFIBUS DP slave protocol is available via the RS-485 Comm 1 port
on GuardPLC 1600 and GuardPLC 1800 controllers with catalog
numbers ending in ‘P’.
PROFIBUS DP Slave protocol allows both the reading and writing of
data.
Publication 1753-UM001C-EN-P - March 201029
Chapter 1 Overview of Safety Controllers
OPC Server
The GuardPLC 1600, GuardPLC 1800, series C GuardPLC 1200, and
series C GuardPLC 2000 controllers are OPC clients. An OPC server,
catalog number 1753-OPC, is available from Rockwell Automation and
lets personal computer applications read and write data to and from
the GuardPLC controller (non-safety-related communication only).
30Publication 1753-UM001C-EN-P - March 2010
Loading...
+ 326 hidden pages
You need points to download manuals.
1 point = 1 manual.
You can buy points or you can get point for every manual you upload.