Application Technique
Safety Function: Light Curtain with Optical Sensors and a GuardLogix® Controller
Products: GuardShield® Safety Light Curtain, Photoelectric Sensor, Compact GuardLogix Controller
Safety Rating: CAT. 4, PLe to ISO 13849-1: 2008
Top ic Pa ge
Important User Information 2
General Safety Information 3
Introduction 3
Safety Function Realization: Risk Assessment 4
Light Curtain Safety Function 4
Safety Function Requirements 5
Functional Safety Description 5
Bill of Material 6
Setup and Wiring 6
Configurat ion 11
Calculation of the Performance Level 19
Veri ficat ion an d Valid ation Plan 21
Additional Resources 24
Safety Function: Light Curtain with Optical Sensors and a GuardLogix® Controller
Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to
familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,
and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are
required to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may
be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from
the use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNIN G: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal
injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, proper ty damage, or economic loss.
Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT
Identifies information that is critical for successful application and understanding of the product.
Labels may also be on or inside the equipment to provide specific precautions.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.
BURN HAZARD: Labe ls may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash will
cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and for
Personal Protective Equipment (PPE).
2 Rockwell Automation Publication SAFETY-AT057C-EN-P - April 2016
General Safety Information
Safety Function: Light Curtain with Optical Sensors and a GuardLogix® Controller
IMPORTANT
This application example is for advanced users and assumes that you are trained and experienced in safety system requirements.
Risk Assessments
ATT EN TI ON : Perform a risk assessment to make sure that all task and hazard combinations have been identified and addressed. The risk assessment can require
additional circuitry to reduce the risk to a tolerable level. Safety circuits must consider safe distance calculations.
Contact Rockwell Automation to learn more about our safety-risk assessment services.
Safe Distance Calculations
ATT EN TI ON : Compliant safety circuits must often consider a safe distance or access time calculation.
Non-separating safeguards provide no physical barrier to prevent access to a hazard. Publications that offer guidance for
calculating compliant safe distances for safety systems that use non-separating safeguards, such as light curtains, scanners,
two-hand controls, or safety mats, include the following:
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of
parts of the human body)
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
Separating safeguards monitor a moveable, physical barrier that guards access to a hazard. Publications that offer
guidance for calculating compliant access times for safety systems that use separating safeguards, such as gates with limit
switches or interlocks (including SensaGuard™ switches), include the following:
IEC 61496-1:2012 (Safety of machinery - Electro-sensitive protective equipment - Part 1: General requirements
and tests)
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of
parts of the human body)
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
In addition, consult relevant national or local safety standards to assure compliance.
Introduction
This safety function application technique explains how to wire, configure, and program a Compact GuardLogix®
controller and a POINT Guard I/O™ module to monitor a GuardShield® 440L light curtain in a muting application. If a
demand is placed on the light curtain when it is not muted, or a fault is detected in the monitoring circuit, the
GuardLogix controller de-energizes the final control device, in this case, a redundant pair of 100S contactors.
If the light curtain is muted, then the demand on the light curtain is ignored if the muting sensors and light curtain are
broken in the proper order.
Rockwell Automation Publication SAFETY-AT057C-EN-P - April 2016 3
Safety Function: Light Curtain with Optical Sensors and a GuardLogix® Controller
From: Risk Assessment (ISO 12100)
1. Identification of safety functions
2. Specification of characteristics of each function
3. Determination of required PL (PLr) for each safety function
To: Realization and PL Evaluation
This example uses a Compact GuardLogix controller, but is applicable to any GuardLogix® controller. This example uses
a GuardShield 440L light curtain, but is applicable to light curtains that pulse test the OSSD1 and OSSD2 outputs. This
example uses RightSight™ optical sensors, but is applicable to any sensors that can be wired into Allen-Bradley® safety
inputs in a mode that provides a high (1) signal when not blocked. The SISTEMA calculations shown later in this
document would have to be recalculated using the actual products.
Safety Function Realization: Risk Assessment
The required performance level is the result of a risk assessment and refers to the amount of the risk reduction to be
carried out by the safety-related parts of the control system. Part of the risk reduction process is to determine the safety
functions of the machine. In this application, the performance level required (PLr) by the risk assessment is Category 3,
Performance Level d (CAT. 3, PLd), for each safety function. A safety system that achieves CAT. 3, PLd, or higher, can
be considered control reliable. Each safety product has its own rating and can be combined to create a safety function that
meets or exceeds the PLr.
Light Curtain Safety Function
This application technique describes the operation of a light curtain with muting functionality. There is no muting
override in this example.
4 Rockwell Automation Publication SAFETY-AT057C-EN-P - April 2016
Safety Function: Light Curtain with Optical Sensors and a GuardLogix® Controller
Safety Function Requirements
Interrupting the light curtain stops and prevents hazardous motion by removal of power to the motor. When the light
curtain is reset, hazardous motion and power to the motor do not resume until a secondary action (start button
depressed) occurs. Muting of the light curtain is done to allow automatically-fed material to enter the area. Multiple
sensors are configured to detect the incoming material and to initiate the muting function. Faults at the light curtain,
muting sensors, wiring terminals, or safety controller are detected before the next safety demand.
The safe-distance location of the light curtain must be established so that the hazardous motion can be stopped before
the user reaches the hazard.
The safety functions in this application technique each meet or exceed the requirements for Category 3, Performance
Level d (CAT. 3, PLd), per ISO 13849-1 and control reliable operation per ANSI B11.19.
Functional Safety Description
Hazardous motion is interrupted or prevented by interrupting the light curtain. The 440L light curtain is wired to a pair
of safety inputs of a 1734-IB8S module. The RightSight muting sensors are wired to inputs on the 1734-IB8S module as
well. The I/O module is connected via CIP Safety™ over an EtherNet/IP™ network to the Compact GuardLogix® safety
controller, catalog number 1768-L43S.
The safety code in the safety processor monitors the status of the safety input using the pre-certified safety instruction
Dual Channel Input Stop (DCS). The output of the DCS, along with the two muting sensors, is used as an input to the
two sensor asymmetrical muting (TSAM) function block to handle the muting safety function.
When all safety-input interlocks are satisfied, no faults are detected, and the reset button is pressed, a second, certified
function block called Configurable Redundant Output (CROUT) controls and monitors feedback for a pair of 100S
redundant contactors.
In summary, when the unmuted light curtain is blocked, the contactors drop out. When the light curtain is unblocked,
and the reset button is pressed, the contactors are energized.
A properly-muted light curtain can be broken without dropping out the safety contactors. When the light curtain is
muted, the muting lamp is energized.
Rockwell Automation Publication SAFETY-AT057C-EN-P - April 2016 5
Safety Function: Light Curtain with Optical Sensors and a GuardLogix® Controller
Bill of Material
This application technique uses these products.
Cat. No. Description Quantity
440L-P4JL0640YD GuardShield™ safety light curtain, Res 14 mm (.55 in.), Pt Ht 640 mm (25.2 in.), 64 beams, integrated laser alignment 1
42EF-B1KBBE-F4 Diffuse background suppression, dark operate, PNP photoelectric sensor, high (1) when target absent 2
889D-F4AC-2 DC micro (M12), female, straight, 4-pin, PVC cable, yellow, unshielded, 22 AWG, 2 m (6.6 ft) 3
889D-F8AB-2 DC micro (M12), female, straight, 8-pin, PVC cable, yellow, unshielded, 24 AWG, 2 m (6.6 ft) 1
800FM-G611MX10 800F reset push button - metal, guarded, blue, R, metal latch mount, one N.O. contact, standard 1
100S-C09ZJ23C Bulletin 100S-C - safety contactors 2
1768-ENBT CompactLogix™ EtherNet/IP bridge module 1
1768-L43S Compact GuardLogix processor, 2.0 MB standard memory, 0.5 MB safety memory 1
1768-PA3 Power supply, 120/240V AC input, 3.5 A @ 24V DC 1
1769-ECR Right end cap/terminator 1
1734-AENT 24V DC Ethernet adapter 1
1734-TB Module base with removable IEC screw terminals 4
1734-IB8S POINT Guard safety input module 1
1734-OB8S POINT Guard safety output module 1
1783-US05T Stratix 2000™ unmanaged Ethernet switch 1
800T-QTH24G Pilot light, 24V DC 2
Setup and Wiring
For detailed information on how to install and wire a safety system, refer to the publications listed in the Additional
Resources.
System Overview
The 1734-IB8S input module monitors OSSD1 and OSSD2 from the 440L light curtain, and the two RightSight
muting sensors. If muting is not active and the light curtain is blocked, OSSD1 and OSSD2 go low (0), and the
controller reacts by dropping out the safety contactors.
The 440L light curtain has onboard diagnostics to dynamically test the signal wiring for shorts to 24V DC and channelto-channel shorts. If a fault occurs, either or both OSSD1 and OSSD2 are set to low (0), and the controller reacts by
dropping out the safety contactors.
Shorts to 0V DC (and wire off) are seen as an open circuit by the 1734-IB8S input module, and the controller reacts by
dropping out the safety contactors. If the inputs remain discrepant for longer than the discrepancy time, then the
function block (DCS) in the controller declares a fault.
Only after the fault is cleared and the light curtain is cycled (blocked, then unblocked), does the function block reset.
The muting sensors are high (1) when the sensors are not blocked. If any fault occurs, such as a wire being off, the fault
causes one of the muting sensors to go low (0) in an improper muting sequence, then the controller reacts by dropping
out the safety contactors.
6 Rockwell Automation Publication SAFETY-AT057C-EN-P - April 2016
Safety Function: Light Curtain with Optical Sensors and a GuardLogix® Controller
Only if the muting sensors and light curtain are blocked in the proper sequence, is muting active. When muting is active,
the muting lamp is energized. If the muting lamp is not drawing any current (due to a broken wire or burnt out bulb), the
TSAM diagnostic code indicates this condition. This diagnostic is available because the muting sensor is wired from a
test output that can be configured for the MUTING LAMP (test outputs 1 and 3 on a 1734-IB8S module).
The final control device in this case is a pair of 100S safety contactors, K1 and K2. The contactors are controlled by a
1734-OBS safety output module. The contactors are wired in a redundant-series configuration. A feedback circuit is
wired through the N.O. contacts and back to an input on the 1734-IB8S module to monitor the contactors for proper
operation. The contactors cannot restart if the feedback circuit is not in the correct state.
The system has individual reset buttons for resetting faults and safety outputs.
The reset buttons and the contactor feedback circuit are all wired to the 1734-IB8S module in this example. This
configuration is not required for functional safety. These three inputs could be wired to a standard input module.
The Clear Area (CA) lamp is wired to test output 1 in this example. This configuration is not required for functional
safety. This lamp could be wired to a standard output module.
Safe Distance Calculation
The user must perform a calculation by using this formula to determine the distance between the light curtain and the
hazard. The user must use values based on their application, rather than the example calculation shown here.
S = (K x T) + C
K = 1600 mm per second (63 in. per second), constant from B11.19-1990
T = stopping time
C = Depth penetration factor = 25 mm (.98 in.) for 14 mm (.55 in.) resolution (from documentation)
Stopping time (T) for this example is a summation of the following:
a. Light curtain delay = 25 ms (from documentation)
b. 1734-IB8S module delay = 16 ms (from documentation)
c. The input module connection delay defaults to 4 x RPI; assuming an RPI of 10 ms, the maximum delay = 40
ms
d. Safety controller delay = safety task watchdog (5 ms) + safety task period (10 ms)
e. The output module connection delay defaults to 3 x RPI; assuming an RPI of 10 ms, the maximum delay = 30
ms
f. 1734-OB8S delay = 6 ms (from documentation)
g. Contactor response time = 15 ms (from documentation)
h. Actual machine stop time = assume 900 ms for this example
The worst-case reaction time may be calculated assuming there is only a single fault in the control system. This means
that only the higher of the two connection-delay values shown above must be included in the time calculation. For this
example, 40 ms is used, and the 30 ms is excluded. If you wish to account for multiple faults occurring simultaneously, use
both values in the calculation.
The safety controller delay is a combination of the safety task period plus the safety task watchdog. The watchdog
accounts for the possibility that the safety code runs right up to, but does not trip, the watchdog. The safety task period
accounts for the possibility that the asynchronous scan just ended when the input changed state.
Rockwell Automation Publication SAFETY-AT057C-EN-P - April 2016 7
Safety Function: Light Curtain with Optical Sensors and a GuardLogix® Controller
So to calculate T, add the following:
Light curtain delay = 25 ms
1734-IB8S module delay = 16 ms
Higher of input/output module connection delay = 40 ms
Safety controller delay = 10+5 = 15 ms
1734-OB8S delay = 6 ms
Contactor response time = 15 ms
Measured actual machine stop time = 900 ms
This makes the total stop time (T) = 1017 ms
S = (K x T) + C = (63 x 1.017) + 1 = 65.071 in.
Given this example, the light curtain must be placed 65 in. from the hazard.
Safe Distance Calculation to 13855
S = (K x T) + C
S = minimum distance, in millimeters (mm)
K: a parameter, in millimeters per second (mm/s), derived from data on approach speeds of the body or parts of
the body
T: the overall stopping performance in seconds
C: the intrusion distance in mm
In this application technique, the values are:
K =1600 mm per second (63 in. per second)
T = Sum of light curtain delay = 25 ms
1734-IB8S module delay = 16 ms
Higher of input/output module connection delay = 40 ms
Safety controller delay = 10 + 5 = 15 ms
1734-OB8S delay = 6 ms
Contactor response time = 15 ms
Measured actual machine stop time = 900 ms
This makes the total stop time (T) = 1017 ms
C = 8 (d - 14) but not less than 0, where d is the resolution of the light curtain
S = 1600 x 1.017 + 8(14 - 14)
The light curtain must not be mounted closer than 1628 mm (approx. 64 in.) from the hazardous motion being guarded
against.
8 Rockwell Automation Publication SAFETY-AT057C-EN-P - April 2016
Loading...