Hazardous Location Switch Amplifiers with Safeguarding Devices · Rockwell Automation Publication...

Wiring DiagramOriginal Instructions

Hazardous Location Switch Amplifiers with Safeguarding DevicesBulletin Number 937TH

Topic PageSummary of Changes 2Introduction 3Switch Amplifiers 5Interlock with Mechanical Contacts 7Safety Mats 13Safedge 17Transistor Output 23Two-hand Control with a CR30 Software Configurable Safety Relay 29

Hazardous Location Switch Amplifiers with Safeguarding Devices Wiring Diagram

Summary of Changes

This publication contains the following new or updated information. This list includes substantive updates only and is not intended to reflect all changes. Translated versions are not always available for each revision.

Topic PageUpdated Safety Ratings section 6Updated Figure 2 7Updated Figure 5 10Updated Figure 10 13Updated Safety Ratings section 15Updated Figure 12 15Updated Safety Ratings section 16Updated Figure 13 17Updated Safety Ratings section 18Updated Figure 14 19Updated Safety Ratings section 20Updated Figure 15 21Updated Safety Ratings section 22Updated Figure 16 23Updated Schematic section 23Added GuardLink Tap with E-stop chapter 25Added Two-hand Control with a CR30 Software Configurable Safety Relay chapter 29

2 Rockwell Automation Publication 937TH-WD001B-EN-P - June 2020

Preface

Introduction

The purpose of this publication is two-fold:1. Shows examples of how certain safeguarding devices should be connected to the Bul. 937TH isolating switch amplifiers when

safeguarding device are needed in Class l, Division 1 (Zones 0 and 1) hazardous locations.2. Indicates what Category and Performance Level can be achieved in accordance with ISO 13849-1.

These switch amplifiers have a SIL 2 rating per IEC 61508.

The switch amplifiers that are listed in the following table are included in this publication. These amplifiers require 24V DC supply. We also offer these same products in 115V AC and 230V AC supply. The amplifiers are available with either transistor outputs or relay outputs. The relays can switch loads as low as 1 mA at 24V DC.

In this publication, the safeguarding devices and E-stop are considered simple devices. They act as simple switches, and do not require external power sources to execute their function. This includes these types of products:

• Interlocks that contain only mechanically actuated contacts (not guard locking or solid-state outputs). For example, Elf ™, Cadet™, Trojan™, MT-GD2 switches

• Safety mats• Safety edges• 800T and 800F E-stop

This application guide uses a dual-input solid-state output (DIS) Guardmaster® safety relay as the interface to the switch amplifiers. The DIS safety relay has two dual-channel inputs and performs pulse testing of its inputs when mechanical contacts are used. Many other safety relays can be substituted for the DIS safety relay. The GuardLink® example in Chapter 6 on page 25 must use the Guardmaster Dual GuardLink (DG) safety relay.

The circuits show four resistors, R1…R4. To optimize fault detection (especially changes in circuit resistance) in the hazardous area, the resistors R1…R4 must be located as close as possible to the safeguarding device and E-stop.

ATTENTION: You are responsible for confirming and documenting that your safety system meets all requirements of either ISO 13849-1 or IEC 61508 and the hazardous location requirements, as applicable.

Cat. No. Description937TH-DISAR-DC2 Dual channel with relay output937TH-DISRS-DC1 Single channel with relay output937TH-DISAT-DC2 Dual channel with transistor output937TH-DISTS-DC1 Single channel with transistor output

WARNING: You must determine that the switch amplifier is approved for the intended hazardous location

Rockwell Automation Publication 937TH-WD001B-EN-P - June 2020 3

Preface Introduction

Notes:


Chapter 1

Switch Amplifiers

Block Diagrams

The block diagrams of the dual output switch amplifiers are shown in Figure 1.

Figure 1 - Block Diagrams

Key characteristics include the following:• The hazardous location side terminals are: 1/2 and 3/4. Note the ‘+’ and ‘-’ notations. The output voltage on the hazardous side is 10V

max, and the current is limited to 17.1 mA.• All have the same nonhazardous location side terminals: 5/6, 7/8. The maximum rating of the transistors is 30V DC.• Both have four switch setting on the front: These switch settings are marked S1, S2, S3, and S4. They can be set to positions I or II.

The single channel unit only uses S1…S3.• Both have DIN Rail connections: power, ground, and an error output.• This document shows most wiring examples with the relay output to take advantage of the pulse testing diagnostics of the

downstream safety relay. The transistor output units provide the same safety Performance Level, but with fewer diagnostics.

SwitchSettings

S1 IS2 IS3 IS4 I

SwitchSettings

S1 IS2 IS3 IS4 I

+

-

+

-

U 9

65

87

DIN Rail Connections

21

43

10

937TH-DISAR-DC2Dual Channel

937TH-DISRS-DC1Single Channel

+

-

U 9

65

87


21

10

+

-

+

-

SwitchSettings

S1 IS2 IS3 IS4 I

SwitchSettings

S1 IS2 IS3 IS4 I

+

-

+

-

U 9

65

87


21

43

10

937TH-DISAT-DC2Dual Channel

937TH-DISTS-DC1Single Channel

+

-

U 9

65

87


21

10

+

-

+

-

Relay Output Transistor Output

Err Err Err Err


Chapter 1 Switch Amplifiers

Safety Ratings

These amplifiers are rated up to SIL 2 for safety performance against IEC61508. Based on their SIL 2 data, the following data can be used to determine their Performance Level in accordance with ISO13849-1.

These amplifiers have a hardware fault tolerance (HFT) of 0, which means that one fault can lead to a dangerous failure. As such, they can only achieve a maximum rating of cat. 2 per ISO13849-1, provided a testing capability is added. If no testing is added, then the rating is cat. 1. However, if two amplifiers are used in parallel, the circuit structure can meet cat. 3 or cat. 4.

Switch Amplifier Status Indicators

The description of the status indicators applies to the example schematics in this document.

Characteristic Relay Output Transistor OutputHardware Fault Tolerance (HFT) 0 0

ISO13849-1 Category 1 if only one is used3 or 4 if two are used in parallel

1 if only one is used3 or 4 if two are used in parallel

λtotal (safety function)Single ChannelDual Channel

254 FIT309 FIT 137 FIT

Status Indicator Color Description

PWRGreen 24V DC power is applied between terminals 9 and 10.Off No power is applied between terminals 9 and 10.

OUT/CHKAmber Input is closed or a low resistance or short circuit exists across R2 or R4 when the input is open.Off Input is open or R1 or R3 is exhibiting a high resistance with the input closed. Flashing Red A low resistance or short circuit across R1or R3 when the input is closed.


Chapter 2

Interlock with Mechanical Contacts

The Trojan T15 safety interlock switch has two mechanical contacts. These contacts are normally closed when the gate is closed. The four switch settings on the switch amplifier must be set for normal operation and line fault detection.

Cat. 1, PLc Example SchematicFigure 2 - Example Schematic

Circuit Operation

With the safety gate closed, the contacts of the interlock are closed. With the E-stop reset, the DIS safety relay is ready for Reset. Press the Reset button to enable the drive. Press the Start button to start the drive. Opening the safety gate or pressing the E-stop initiates a Category 0 stop. The motor coasts to a stop.

Gate controlpower supply

Gate controlcircuit

M

4 Gnd

S1

S2

1 Stop

L1 L2 L3

PowerFlex525

2 Start

R TS

U WV

+24V DC

24V DC Com

Reset

DIS

440R-D22S2

S21S11S22S12 S42

Y32

S32 A1

L12L11 A2 34 44 14 24

S34

LOGICA1

01

2

34

567

8

Status

To PLC

E-stop

800FM-MT44

800F-MX02S

9

6

5

8

7

Switch Amplifier

937TH-DISAR-DC2

Non-hazardous LocationHazardous Location


SwitchSettings

2

1

4

3

+

-

+

-

U

S1 I

S2 I

S3 I

S4 I

Trojan T15

440K-T11395

1012

22

11

21

S1, S2: Normal Output

S3, S4: Enable Line Fault Detection

R1, R3: 1492-JD3RB102 (1K)

R2, R4: 1492-JD3RB103 (10K)

R210K

R11K

R410K

R31K


Chapter 2 Interlock with Mechanical Contacts

Fault Analysis1. An open circuit on either of the Trojan T15 circuits immediately causes the safety relay to issue a stop command to the

PowerFlex® 525 drive if it is running or prevents the starting of the motor.2. A short circuit across either of the T15 contacts is detected when the safety gate goes from an open to closed state.3. The pulse testing of the DIS safety relay detects short circuits at terminals 5, 6, 7, and 8 to 24V or to ground and immediately results

in a safe state.4. The pulse testing of the DIS safety relay detects short circuits between any two of terminals 5, 6, 7, and 8 and immediately results in

a safe state.5. The Bul. 937TH switch amplifier has a hardware fault tolerance of 0, so one fault can lead to both outputs being on, and therefore

the PowerFlex 525 drive does not turn off when the safety gate is opened.

Although the Bul. 937TH switch amplifier has a hardware fault tolerance of 0, the use of the dual-channel switch amplifier along with using both contacts of the interlock switch is preferred over the single-channel switch amplifier.

Safety Rating

The safety function that the Trojan T15 interlock switch initiates has a maximum rating of cat. 1, PLc per ISO 13849-1. This rating is due to the zero hardware fault tolerance of the Bul. 937TH switch amplifier.

The safety function that the E-stop initiates has a maximum rating cat. 3, PLd per ISO 13849-1. This rating is limited by the rating of the PowerFlex 525 drive.



SISTEMA Help

When entering the Bul. 937TH switch amplifier into SISTEMA, the subsystem must be assigned Category 1, due to the zero hardware fault tolerance. Verify that the three checkboxes under Requirements for Category are checked.

Figure 3 - Cat. 1, PLc Requirement for Category

At the Element level, enter 309 as the Rate of dangerous failure.

Figure 4 - Rate of Dangerous Failure



Cat 3, PLd Example Schematic

Two single-channel switch amplifiers are required to achieve a cat. 3, PLd. One contact from the interlock switch is connected to one of the switch amplifiers; the other contact is connected to the second switch amplifier.

Figure 5 - Example Schematic

Circuit Operation

With the safety gate closed, the contacts of the interlock are closed. With the E-stop reset, the DIS safety relay is ready for Reset. Press the Reset button to enable the drive. Press the Start button to start the drive. Opening the safety gate or pressing the E-stop initiates a Category 0 stop. The motor coasts to a stop.


Gate controlcircuit

M

4 Gnd

S1

S2

1 Stop

L1 L2 L3

PowerFlex525

2 Start

R TS

U WV

+24V DC

24V DC Com

Reset

DIS

440R-D22S2

S21S11S22S12 S42

Y32

S32 A1

L12L11 A2 34 44 14 24

S34

LOGICA1

01

2

34

567

8

Status

To PLC

E-stop

800FM-MT44

800F-MX02S

Switch Amplifier

937TH-DISRS-DC1


Trojan T15

440K-T11395

12

22

11

21

+

-

U 9

6

5

8

7


2

1

10

+

-

U 9

6

5

8

7

937TH-DISRS-DC1


2

1

10

SwitchSettings

S1 I

S2 I

S3 I

S4 --

SwitchSettings

S1 I

S2 I

S3 I

S4 --

S1: Normal Output

S2: Output 2 Follows Output 1

S3: Enable Line Fault Detection

S4: Not Used

R1, R3: 1492-JD3RB102 (1K)

R2, R4: 1492-JD3RB103 (10K)

R2

10K

R1

1K

R4

10K

R3

1K



Fault Analysis1. An open circuit on either of the Trojan T15 circuits causes the safety relay to issue a stop command to the PowerFlex 525 drive if it

is running or prevents the starting of the motor.2. A short circuit across either of the T15 contacts is detected when the safety gate goes from an open to closed state.3. The pulse testing of the DIS safety relay detects short circuits at terminals 5 and 6 to 24V or to ground and immediately results in a

safe state.4. The pulse testing of the DIS safety relay detects short circuits between any two of terminals 5 and 6 of both amplifiers and

immediately results in a safe state.5. If one of the Bul. 937TH switch amplifiers fail to danger with its output on, the DIS safety relay performs the safety function due to

the proper performance of the second amplifier.

Safety Rating

The safety function that the Trojan T15 interlock switch initiates has a maximum rating cat. 3, PLd per ISO 13849-1. With two Bul. 937TH switch amplifiers connected in parallel, the hardware fault tolerance is 1. The DIS safety relay performs diagnostics on the two switch amplifiers to raise the diagnostic coverage to >60%.

The safety function that the E-stop initiates has a maximum rating cat. 3, PLd per ISO 13849-1. This rating is limited by the rating of the PowerFlex 525 drive.

SISTEMA Help

When entering the Bul. 937TH switch amplifier into SISTEMA, the subsystem must be assigned category 3, due to the single-hardware fault tolerance. Verify that the three checkboxes under Requirements for Category are checked.

Figure 6 - Cat. 3, PLd Requirements for Category

Since we are using the single channel device, use 254 as the Rate of dangerous failure.



Figure 7 - Rate of Dangerous Failure

The DIS safety relay performs diagnostic coverage of at least 60%.

Figure 8 - Diagnostic Coverage

With the dual channel device, a Common Cause Failure number must be entered. You must confirm that their practices employed reach a value of 65.

Figure 9 - CCF Number


Chapter 3

Safety Mats

Guardmaster® safety mats are constructed as two parallel plates. Two wires are attached to each plate. As such, the following special conditions must be considered.

• When you step on the mat, a short circuit condition is created. The interfacing device must be able to detect and handle the difference between the open and short circuit conditions.

• The parallel plates of the mat act as a capacitor. The bigger the mat systems; the larger the capacitance value. Therefore the interfacing device must be able to ignore the influence of the capacitor effect.

Cat. 1, PLc Example SchematicFigure 10 - Example Schematic

One plate of the mat is connected to both of the ‘+’ sides (terminals 1 and 3) of the switch amplifier, and the other plate is connected to the ‘-’ sides (terminals 2 and 4).

Switches S1 and S2 are set to Inverted Operation and S3 and S4 are set for enable Line Fault detection.


Gate controlcircuit

M

4 Gnd

S1

S2

1 Stop

L1 L2 L3

PowerFlex525

2 Start

R TS

U WV

+24V DC

24V DC Com

Reset

DIS

440R-D22S2

S21S11S22S12 S42

Y32

S32 A1

L12L11 A2 34 44 14 24

S34

LOGICA1

01

2

34

567

8

Status

To PLC

E-stop

800FM-MT44

800F-MX02S

9

6

5

8

7

Switch Amplifier

937TH-DISAR-DC2



440F-M2030BYNNParallel Plate

Safety Mat

S1, S2: Inverted Output


R1, R3: 1492-JD3RB102 (1K)

R2, R4: 1492-JD3RB103 (10K)

SwitchSettings

2

1

4

3

+

-

+

-

U

S1 II

S2 II

S3 I

S4 I 10

R210K

R11K

R410K

R31K


Chapter 3 Safety Mats

Operating Performance

Figure 11 shows an example of the input switch signal for a large safety mat system. A capacitance substitution box was connected in parallel with a sample mat to simulate the large mat system. The switch amplifier performed properly with capacitance values up to 59 µF, which far exceeds that maximum allowable mat size for safety relays, which is 100 square meters.

When stepping on the mat, a short circuit condition exists and the signal goes directly to 0 volts. When stepping off the mat, the switch amplifier must charge the capacitance of the plates, so the turn on signal is a little slower, depending on the capacitance of the safety mat.

Figure 11 - Large Safety Mat System Input Switch Signal

Fault Analysis1. An open circuit of any mat wires is not detected immediately; the open circuit is detected when the operator steps on the mat

(demand is placed on the safety function). Stepping on the mat causes the safety relay to turn off. When the operator steps off the mat, the switch amplifier does not reset.

2. Since the connections are between + and -, a short circuit across these connections is the same as stepping on the mat. The outputs turn OFF and the machine goes to a safe (OFF) state.

3. The pulse testing of the DIS safety relay detects short circuits at terminals 5, 6, 7, and 8 to 24V or to ground and immediately results in a safe state.

4. The pulse testing of the DIS safety relay detects short circuits between any two of terminals 5, 6, 7, and 8 and immediately results in a safe state.

5. The Bul. 937TH switch amplifiers have a hardware fault tolerance of 0, so one fault can lead to both outputs being on, and therefore the PowerFlex® 525 drive does not turn off when someone is stepping on the safety mat.



Safety Rating

The safety function that the safety mat initiates has a maximum safety rating of cat. 1, PLc per ISO 13849-1, due to the single 937TH switch amplifier.

The safety function that the E-stop initiates has a maximum safety rating of cat. 3, PLd per ISO 13849-1. This safety rating is limited by the safety rating of the PowerFlex 525 drive.

Cat. 3, PLd Example SchematicFigure 12 - Example Schematic

One plate of the mat is connected to both of the ‘+’ sides (terminals 1) of the switch amplifier, and the other plate is connected to the ‘-’ sides (terminals 2).

Switch S1 is set to Inverted Operation, and S3 is set to enable Line Fault detection.

440F-M2030BYNN

Parallel Plate

Safety Mat

S1: Inverted Output



S4: Not Used

R1, R3: 1492-JD3RB102 (1K)

R2, R4: 1492-JD3RB103 (10K)


Gate controlcircuit

M

4 Gnd

S1

S2

1 Stop

L1 L2 L3

PowerFlex525

2 Start

R TS

U WV

+24V DC

24V DC Com

Reset

DIS

440R-D22S2

S21S11S22S12 S42

Y32

S32 A1

L12L11 A2 34 44 14 24

S34

LOGICA1

01

2

34

567

8

Status

To PLC

E-stop

800FM-MT44

800F-MX02SSwitch Amplifier

937TH-DISRS-DC1


+

-

U 9

6

5

8

7


2

1

10

+

-

U 9

6

5

8

7

937TH-DISRS-DC1


2

1

10

SwitchSettings

S1 II

S2 I

S3 I

S4 --

SwitchSettings

S1 II

S2 I

S3 I

S4 --

R210K

R11K

R410K

R31K




With the absence of anyone on the mat, the outputs of the switch amplifiers are on. With the E-stop reset, the DIS safety relay is ready for reset. Press the Reset button to enable the PowerFlex 525 drive. Press the Start button to start the motor turning.

Stepping on the mat causes the outputs of the switch amplifiers to turn OFF, which causes the outputs of the DIS safety relay to turn OFF. The PowerFlex 525 drive executes a category 0 stop and the motor coasts to a stop.

Fault Analysis1. An open circuit of any of the mat wires is not detected immediately; the open circuit is detected when the operator steps on the mat

(demand is placed on the safety function). Stepping on the mat causes the safety relay to turn off. When the operator steps off the mat, the switch amplifier does not reset.

2. Since the connections are between + and -, a short circuit across these connections is the same as stepping on the mat. The outputs turn OFF, and the machine goes to a safe (OFF) state.

3. The pulse testing of the DIS safety relay detects short circuits at terminals 5, 6, 7, and 8 to 24V or to ground and immediately results in a safe state.

4. If one of the Bul. 937TH switch amplifiers fail to danger with its output ON, the DIS safety relay performs the safety function due to the proper performance of the second amplifier.

Safety Rating

The safety function that the safety mat initiates has a maximum safety rating of cat. 3, PLd per ISO 13849-1, due to the safety rating of the mat and PowerFlex 525 drive.



Chapter 4

Safedge

Guardmaster® Safedge™ safety edges are constructed with conductive and non-conductive rubber. Two wires run the full length of the edge. As such, the following special conditions must be considered.

• When you depress the edge, a small resistance is created. As you further depress the edge, the resistance drops. The interfacing device must be able to detect the small resistance.

• The energy that is provided by the interfacing device must not cause the Safedge to burn. For example, do not connect the Safedge directly across 24V.

Cat. 1, PLc with Internal Resistor Example Schematic

Since the Safedge is a normally open safety device, two resistors are required in the hazardous location side to detect faults.

The Safedge can be ordered with either a 6K or 15K internal terminating resistor. Although both resistors will work, the 6K termination is recommended because the 15K resistor causes a delay in turning off (that is, increased response time).

The 1K series resistor has tolerance from 400…2K.


1492-

LD4RB102

(1.0K)

S1: Inverted Output



S4: Not Used


Gate controlcircuit

M

4 Gnd

S1

S2

1 Stop

L1 L2 L3

PowerFlex525

2 Start

R TS

U WV

+24V DC

24V DC Com

Reset

DIS

440R-D22S2

S21S11S22S12 S42

Y32

S32 A1

L12L11 A2 34 44 14 24

S34

LOGICA1

01

2

34

567

8

Status

To PLC

E-stop

800FM-MT44

800F-MX02S

Switch Amplifier

937TH-DISRS-DC1


+

-

U 9

6

5

8

7


2

1

10

SwitchSettings

S1 II

S2 I

S3 I

S4 --

440F Safedge

Pressure Sensitive Sensing Edge

e.g., 440F-EAAAV01000

(the V specifies the 6K terminating resistor)

6K

+ -


Chapter 4 Safedge


With no pressure applied to the edge, the output of the switch amplifier is closed. With the E-stop released, the DIS safety relay is ready for reset. Press the Reset button, and the PowerFlex® 525 drive is ready to run. Use the Start and Stop buttons to turn the motor on and off.

When enough pressure is applied to the edge, the circuit inside the edge is closed. The switch amplifier turns off its outputs and the DIS safety relay commands the PowerFlex 525 drive to execute a Category 0 (coast to) stop.

Failure Analysis1. The Bul. 937TH switch amplifier immediately detects an open circuit on the edge. The amplifier turns off its output and initiates a

coast-to-stop command to the PowerFlex 525 drive.2. A short circuit in the edge circuit is similar to applying pressure to the edge. The Bul. 937TH switch amplifier immediately detects

the short circuit and initiates a stop command.3. A short circuit of terminals 1 or 2 to +24V or to ground has no effect on the performance of the safety system because these

terminals are galvanically isolated from the power supply. 4. The pulse testing of the DIS safety relay detects short circuits at terminals 5, 6, 7, and 8 to 24V or to ground and immediately results

in a safe state.5. The Bul. 937TH switch amplifier has a hardware fault tolerance of 0, so one fault can lead to both outputs being on, and therefore

the PowerFlex 525 drive does not turn off when the edge is pressed.

Safety Rating

The safety function that the safety edge initiates has a maximum safety rating of cat. 1, PLc per ISO 13849-1, due to the single 937TH switch amplifier.


IMPORTANT Fast actuations (5…28 ms) of the edge can cause the DIS safety relay to turn OFF and stay OFF. To resolve, press the edge again.


Chapter 4 Safedge

Cat. 1, PLc without Internal Resistor Example Schematic

The Safedge product can also be ordered with entrance and exit wires and no internal resistor. When ordered this way, the Safedge can be connected to a dual-input switch amplifier.


The positive connection of the edge must be connected to the positive voltage terminals of the switch amplifier.

Switches S1 and S2 are set to Inverted Operation, and S3 and S4 are set to enable Line Fault detection.


With no pressure applied to the edge, the output of the switch amplifier is closed. With the E-stop released, the DIS safety relay is ready for reset. Press the Reset button, and the PowerFlex 525 drive is ready to run. Use the Start and Stop buttons to turn the motor on and off.

When enough pressure is applied to the edge, the circuit inside the edge is closed. The switch amplifier turns off its outputs, and the DIS safety relay commands the PowerFlex 525 drive to execute a Category 0 (coast to) stop.


R1, R3: 1492-JD3RB102 (1K)

R2, R4: 1492-JD3RB103 (10K)

R210K

R11K

R410K

R31K


Gate controlcircuit

M

4 Gnd

S1

S2

1 Stop

L1 L2 L3

PowerFlex525

2 Start

R TS

U WV

+24V DC

24V DC Com

Reset

DIS

440R-D22S2

S21S11S22S12 S42

Y32

S32 A1

L12L11 A2 34 44 14 24

S34

LOGICA1

01

2

34

567

8

Status

To PLC

E-stop

800FM-MT44

800F-MX02S


440F Safedge

Pressure Sensitive

Sensing Edge

e.g., 440F-EAAAA01000

-+

-+

9

6

5

8

7

Switch Amplifier

937TH-DISAR-DC2


S1, S2: Inverted Output


SwitchSettings

2

1

4

3

+

-

+

-

U

S1 II

S2 II

S3 I

S4 I

10


Chapter 4 Safedge

Failure Analysis1. The DIS safety relay detects an open circuit on the edge when the edge is pressed. When the edge is released, the DIS safety relay

turns OFF and remains OFF until the fault is corrected and the edge is cycled.2. A short circuit in the edge circuit is similar to applying pressure to the edge. The Bul. 937TH switch amplifier immediately detects

the short circuit and initiates a stop command.3. A short circuit of terminals 1 or 2 to +24V or to ground has no effect on the performance of the safety system because these

terminals are galvanically isolated from the power supply. 4. The pulse testing of the DIS safety relay detects short circuits at terminals 5, 6, 7, and 8 to 24V or to ground and immediately results

in a safe state.5. The Bul. 937TH switch amplifier has a hardware fault tolerance of 0, so one fault can lead to both outputs being on, and therefore

the PowerFlex 525 drive does not turn off when the edge is pressed.

Safety Rating

The safety function that the safety edge initiates has a maximum safety rating of cat. 1, PLc per ISO 13849-1, due to the single 937TH switch amplifier.



Chapter 4 Safedge

Cat. 3, PLd Example Schematic

Using the Safedge with entrance and exit wires and two single channel switch amplifiers, a cat. 3, PLd rating can be achieved.


The positive connection of the edge must be connected to the positive voltage of the switch amplifiers.

Switch S1 is set to Inverted Operation, and S3 is set to enable Line Fault detection.


With no pressure applied to the edge, the outputs of the switch amplifiers are closed. With the E-stop released, the DIS safety relay is ready for reset. Press the Reset button, and the PowerFlex 525 drive is ready to run. Use the Start and Stop buttons to turn the motor on and off.

When enough pressure is applied to the edge, the circuit inside the edge is closed. The switch amplifier turns off its outputs and the DIS safety relay commands the PowerFlex 525 drive to execute a Category 0 (coast to) stop.


R1, R3: 1492-JD3RB102 (1K)

R2, R4: 1492-JD3RB103 (10K)

R210K

R11K

R410K

R31K

S1: Inverted Output



S4: Not Used


Gate controlcircuit

M

4 Gnd

S1

S2

1 Stop

L1 L2 L3

PowerFlex525

2 Start

R TS

U WV

+24V DC

24V DC Com

Reset

DIS

440R-D22S2

S21S11S22S12 S42

Y32

S32 A1

L12L11 A2 34 44 14 24

S34

LOGICA1

01

2

34

567

8

Status

To PLC

E-stop

800FM-MT44

800F-MX02SSwitch Amplifier

937TH-DISRS-DC1


+

-

U 9

6

5

8

7


2

1

10

SwitchSettings

440F Safedge

Pressure Sensitive

Sensing Edge

e.g., 440F-EAAAA01000

937TH-DISRS-DC1

+

-

U 9

6

5

8

7


2

1

10

SwitchSettings

S1 II

S2 I

S3 I

S4 --

S1 II

S2 I

S3 I

S4 --

-+

-+


Chapter 4 Safedge

Fault Analysis1. The DIS safety relay detects an open circuit on the edge when the edge is pressed. When the edge is released, the DIS safety relay

remains OFF until the fault is corrected and the edge is cycled.2. Since the connections are between ‘+’ and ‘-’, a short circuit across these connections is the same as applying pressure to the edge.

The outputs turn OFF and the machine goes to a safe (OFF) state. 3. The pulse testing of the DIS safety relay detects short circuits at terminals 5, 6, 7, and 8 to 24V or to ground and immediately results

in a safe state.4. The pulse testing of the DIS safety relay detects short circuits between any two of terminals 5, 6, 7, and 8 and immediately results in

a safe state.5. If one of the Bul. 937TH switch amplifiers fail to danger with its output on, the DIS safety relay performs the safety function due to

the proper performance of the second amplifier.

Safety Rating

The safety function that the safety edge initiates has a maximum safety rating of cat. 3, PLd per ISO 13849-1.



Chapter 5

Transistor Output

The transistor output switch amplifier can be used instead of the relay output. The safety rating remains the same. Some faults are not detected, but do not lead to the loss of the safety function.

Schematic

In Figure 16, the dark lines are different as compared to the switch amplifier with relay outputs. To minimize potential EMC noise interference, the amplifier ground should be connected to the same point as the DIS safety relay ground and PowerFlex® 525 drive ground.



Gate controlcircuit

M

4 Gnd

S1

S2

1 Stop

L1 L2 L3

PowerFlex525

2 Start

R TS

U WV

+24V DC

24V DC Com

Reset

DIS

440R-D22S2

S21S11S22S12 S42

Y32

S32 A1

L12L11 A2 34 44 14 24

S34

LOGICA1

01

2

34

567

8

Status

To PLC

E-stop

800FM-MT44

800F-MX02S

9

6

5

8

7

Switch Amplifier

937TH-DISAT-DC2


SwitchSettings

2

1

4

3

+

-

+

-

U

S1 I

S2 I

S3 I

S4 I

10


Chapter 5 Transistor Output

Fault Analysis

Table 1 - Fault Analysis

Fault DIS Safety Relay Output Status Before Fault

Status After Fault Result

S12 to 24V DC ON Not detected. The DIS safety relay detects on next demand. OK

S12 to 24V Common ON Detected - DIS safety relay output turns OFF

No change to 937TH switch amplifier

OK

S22 to 24V DC ON Not detected. The DIS safety relay detects on next demand. OK

S22 to 24V Common ON Detected—DIS safety relay output turns OFF

No change to 937TH switch amplifier

OK

S12 to S22 ON Not detected OK

S12 to 24V DC OFF Not detected immediately. The DIS safety relay detects this fault after the next demand. OK

S12 to 24V Common OFF Not detected immediately. The DIS safety relay detects this fault after the next demand. OK

S22 to 24V DC OFF Not detected immediately. The DIS safety relay detects this fault after the next demand. OK

S22 to 24V Common OFF Not detected immediately. The DIS safety relay detects this fault after the next demand. OK

S12 to S22 OFF Not detected OK

IMPORTANT OK status means that the output of the DIS safety relay was in a safe state after the fault was introduced.


Chapter 6

GuardLink Tap with E-stop

The 937TH switch amplifiers can interface with a GuardLink® tap. This connection allows a cascaded string of safety devices to include a branch into a hazardous location.

The switch amplifiers must be connected to the 440S-SF8D taps. The 440S-SF8D tap provides the following: • Power to the 937TH• Pulse tests to detect potential short circuits between the input channels to the 24V and to the ground

The schematic in Figure 17 on page 26 shows a GuardLink tap connected to two 937TH-DISRS-DC1 switch amplifiers, which have relay outputs. These two switch amplifiers can be replaced with 937TH-DISTS-DC1 switch amplifiers, which have transistor outputs. If the 937TH-DISTS-DC1 amplifiers are used, the ground connection of the amplifier must be the same as the DG relay.

Cat. 4, PLe Example Schematic

Figure 17 on page 26 shows a schematic of an example circuit that achieves a cat. 4, PLe rating. Two single channel switch amplifiers are required to achieve a cat. 4, PLe rating. One E-stop can have two normally closed contacts and still meet cat. 4 as it is considered a complementary safety device per Table D8 in ISO13849-2. One contact from the E-stop is connected to one of the switch amplifiers; the other contact is connected to the second switch amplifier.


Chapter 6 GuardLink Tap with E-stop


Circuit Operation

With the E-stop released, the amplifier contacts are closed. The DG relay is ready for reset. Press the Reset button to energize the 700S safety control relays.

Press the E-stop to de-energize the 700S safety control relays.

Fault Analysis1. Short circuits and open circuits on the E-stop are detected as an inconsistency on the outputs of the amplifiers, and the DG safety

relay de-energizes its outputs.2. The pulse testing of the 440S tap detects short circuits and open circuits at terminals 5 and 6 of the amplifiers, and DG safety relay

immediately de-energizes its outputs.3. The DG safety relay monitors the 700S-CF safety control relays. If either relay faults in an energized position, the other relay

de-energizes, and the DG safety relay does not restart due to the open monitoring circuit.

+24V DC

24V DC Com


S1: 1=Normal Output, II=Inverted Output

S2: 1=Output 2 Follows Output 1, II= Fault Signal Outpuy


S4: Not Used

R2

10K

R1

1K

R4

10K

R3

1K

Tap 1

Black

SR1

From the

Power Supply

To Controlled Devices

SR2

Reset

BrownBlue

700S-CF

White

440S-SF8D

8-Pin OSSD

Tap 2 Tap 3

A1

S32 X2

X4

X1 14S42

13 23

24

S11 S12S21 S22

X3A2

DG

440R-DG2R2T

IN1

IN 2

OUT X

IN X

Reset

FB

OUT

Brown

Blue

Red

Yellow

Pink

Gray

White

GreenNC

NC 889D-M8NB-2 (Red)

889D-M8AB-2 (Black)

SR1 SR2

R1, R3: 1492-JD3RB102 (1K)

R2, R4: 1492-JD3RB103 (10K)

800T-FXT6A5 or

800FM-MT64 with

two 800F-X01S

9

6

5

8

7

Switch Amplifier

937TH-DISTS-DC1


SwitchSettings

2

1 +

-

U

S1 I

S2 I

S3 I

S4 I

10

9

6

5

8

7

Switch Amplifier

937TH-DISTS-DC1


SwitchSettings

2

1 +

-

U

S1 I

S2 I

S3 I

S4 I

10



Safety Rating

The safety function that the E-stop initiates has a rating cat. 4, PLe per ISO 13849-1. With two Bul. 937TH switch amplifiers connected in parallel, the hardware fault tolerance is 1. The DG safety relay performs diagnostics on the two switch amplifiers to raise the diagnostic cover to > 60%.

SISTEMA Help

Figure 18 shows an example SISTEMA project. The circuit meets PLe and has a PFHD = 4.7E-8.

The Guardmaster® DG safety relays, GuardLink taps, and safety control relays are listed in the Rockwell Automation library in VDMA66413_2_07_20190408_Rockwell_Automation.xml library. Look for the taps under ‘440S’ and look for the relay under ‘Monitoring Safety Relay.’

Figure 18 - SISTEMA GuardLink Project Subsystem Status



Figure 19 shows the SIL rating that is applied to the 937TH barriers. Since two Bulletin 937TH barriers are used, the SIL must be manually calculated using ‘basic subsystem architecture B’ according to IEC 62061.

Figure 19 - SIL Rating of the 937TH


Chapter 7

Two-hand Control with a CR30 Software Configurable Safety Relay

The 937TH switch amplifiers can interface with two-hand control devices that have mechanical contacts.

This example uses the catalog number 800P-S1CG1AV palm-operated push button. They have the PenTUFF™ contacts to accommodate the low current from the 937TH switch amplifiers. Each switch has a normally open and a normally closed contact.

Type IIIC Configuration

Figure 20 on page 30 shows a schematic of an example circuit that achieves a Type IIIC configuration in accordance with ISO 13851. Type IIIC is used in high risk safety systems. Both switches must be activated with 500 ms of each other.

Figure 21 on page 30 shows the Connected Components Workbench™ configuration for the example schematic.


Chapter 7 Two-hand Control with a CR30 Software Configurable Safety Relay

Figure 20 - Type IIIC Two-hand Control Schematic

Figure 21 - Connected Components Workbench Configuration for Two-hand Control Type IIIC

05CR30 440C-CR30-22BBB

020100 03 04

A1 15 20 2116

06

18A2

07

19

08 10 11

12 13 14

09

17

+24V DC

24V DC Com


9

6

5

8

7

Switch Amplifier

937TH-DISAR-DC2


SwitchSettings

2

1

4

3

+

-

+

-

U

S1 I

S2 I

S3 I

S4 I

10

9

6

5

8

7

Switch Amplifier

937TH-DISAR-DC2


S1: Normal Output

S2: Normal Output


SwitchSettings

2

1

4

3

+

-

+

-

U

S1 I

S2 I

S3 I

S4 I

10

K1 K2

R210K

R11K

R410K

R31K 800P-S1CG1AV

R210K

R11K

R410K

R31K 800P-S1CG1AV

R1, R3: 1492-JD3RB102 (1K)

R2, R4: 1492-JD3RB103 (10K)



SISTEMA Help

Figure 22 shows an example SISTEMA project. The circuit meets PLe and has a PFHD = 4.7E-8.

The two-hand control is based on the circuit design and the rated operation of the contacts with a limit of 100,000 operations per year for 20 years. The 440C-CR30 and the safety control relays are listed in the Rockwell Automation library in VDMA66413_2_07_20190408_Rockwell_Automation.xml library. Look for the CR30 safety relay under ‘Software Configurable.’

Figure 22 - SISTEMA Two-hand Project Subsystem Status

Figure 23 shows the SIL rating that is applied to the 937TH barriers. Since two Bulletin 937TH barriers are used, the SIL must be manually calculated using ‘basic subsystem architecture B’ according to IEC 62061.

Figure 23 - SIL Rating of the 937TH



Notes:



Hazardous Location Switch Amplifiers with Safeguarding Devices Wiring Diagram

Additional Resources

These documents contain additional information concerning related products from Rockwell Automation.

You can view or download publications at rok.auto/literature.

Resource DescriptionIntrinsic Safety Modules Selection Guide, publication 937-SG001 Provides selection information and specifications for intrinsic safety modules.Bulletin 937 Intrinsic Safety Modules Product Profile, publication 937-PP001 Provides features and benefits of intrinsic safety modules.

EtherNet/IP Network Devices User Manual, publication ENET-UM006 Describes how to configure and use EtherNet/IP™ devices to communicate on the EtherNet/IP network.

Ethernet Reference Manual, publication ENET-RM002 Describes basic Ethernet concepts, infrastructure components, and infrastructure features.

System Security Design Guidelines Reference Manual, publication SECURE-RM001

Provides guidance on how to conduct security assessments, implement Rockwell Automation products in a secure system, harden the control system, manage user access, and dispose of equipment.

Industrial Components Preventive Maintenance, Enclosures, and Contact Ratings Specifications, publication IC-TD002

Provides a quick reference tool for Allen-Bradley industrial automation controls and assemblies.

Safety Guidelines for the Application, Installation, and Maintenance of Solid-State Control, publication SGI-1.1

Designed to harmonize with NEMA Standards Publication No. ICS 1.1-1987 and provides general guidelines for the application, installation, and maintenance of solid-state control in the form of individual devices or packaged assemblies incorporating solid-state components.

Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines for installing a Rockwell Automation industrial system.Product Certifications website, rok.auto/certifications Provides declarations of conformity, certificates, and other certification details.

https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/secure-rm001_-en-p.pdf

https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/secure-rm001_-en-p.pdf

https://literature.rockwellautomation.com/idc/groups/literature/documents/td/ic-td002_-en-p.pdf

https://literature.rockwellautomation.com/idc/groups/literature/documents/sg/937-sg001_-en-p.pdf

http://literature.rockwellautomation.com/idc/groups/literature/documents/in/1770-in041_-en-p.pdf

https://rok.auto/certifications

https://literature.rockwellautomation.com/idc/groups/literature/documents/in/sgi-in001_-en-p.pdf

https://rok.auto/literature

https://literature.rockwellautomation.com/idc/groups/literature/documents/um/enet-um006_-en-p.pdf

https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/enet-rm002_-en-p.pdf

https://literature.rockwellautomation.com/idc/groups/literature/documents/pp/937-pp001_-en-p.pdf


https://rok.auto/literature


Publication 937TH-WD001B-EN-P - June 2020Supersedes Publication 937TH-WD001A-EN-P - October 2014 Copyright © 2020 Rockwell Automation, Inc. All rights reserved. Printed in the U.S.A.

Rockwell Automation Support

Use these resources to access support information.

Documentation Feedback

Your comments help us serve your documentation needs better. If you have any suggestions on how to improve our content, complete the form at rok.auto/docfeedback.

Technical Support Center Find help with how-to videos, FAQs, chat, user forums, and product notification updates. rok.auto/support

Knowledgebase Access Knowledgebase articles. rok.auto/knowledgebase

Local Technical Support Phone Numbers Locate the telephone number for your country. rok.auto/phonesupport

Literature Library Find installation instructions, manuals, brochures, and technical data publications. rok.auto/literature

Product Compatibility and Download Center (PCDC)

Get help determining how products interact, check features and capabilities, and find associated firmware. rok.auto/pcdc

Rockwell Automation maintains current product environmental information on its website at rok.auto/pec.

Allen-Bradley, Cadet, Connected Components Workbench, Elf, expanding human possibility, GuardLink, Guardmaster, PenTUFF, PowerFlex, Rockwell Automation, Safedge, and Trojan are trademarks of Rockwell Automation, Inc.EtherNet/IP is a trademark of ODVA, Inc.Trademarks not belonging to Rockwell Automation are property of their respective companies.

Rockwell Otomasyon Ticaret A.Ş. Kar Plaza İş Merkezi E Blok Kat:6 34752, İçerenkÖy, İstanbul, Tel: +90 (216) 5698400 EEE YÖnetmeliğine Uygundur

https://rok.auto/support

https://rok.auto/knowledgebase

https://rok.auto/phonesupport

www.rockwellautomation.com/literature

https://rok.auto/pcdc

http://literature.rockwellautomation.com/idc/groups/literature/documents/du/ra-du002_-en-e.pdf

https://rok.auto/docfeedback

https://rok.auto/pec

https://www.instagram.com/rokautomation/

http://https://www.linkedin.com/company/rockwell-automation

http://https://twitter.com/ROKAutomation

https://www.facebook.com/ROKAutomation/

https://www.rockwellautomation.com/

Hazardous Location Switch Amplifiers with Safeguarding Devices · Rockwell Automation Publication...

Documents

Transcript of Hazardous Location Switch Amplifiers with Safeguarding Devices · Rockwell Automation Publication...