1 - Overview. Allen-Bradley Guardmaster GuardLink
Advertisement
Advertisement
Chapter
1
Overview
What Is a GuardLink System?
A GuardLink system is a collection of components to simplify a series connection of safety devices while achieving the highest industrial safety rating. The system has these important features:
• Simplifies the connection of series connected safety devices.
• Facilitates the scalability of the safety series connections.
• Provides diagnostic information about each device in the system without having to run a separate status wire back to the machine control system.
• Allows the simultaneous or individual lock and unlock of guard locking interlocks in the series connected system. No need for an additional wire from the machine control system to lock and unlock the safety gate.
• Helps ease communication to the machine control system over
EtherNet/IP. Communication includes sending non-safety commands to the devices and receiving status information back from the safety devices.
Figure 1 on page 12 shows the basic components of a typical application. The
GuardLink tap has M12 quick disconnect terminations to facilitate wiring with cordsets and patchcords. The DG safety relay can accommodate one or two GuardLink circuits or a combination of GuardLink and individual safety devices.
Each GuardLink circuit can accommodate up to 32 taps. The DG safety relay operates and monitors two safety contactors and has a monitored manual reset.
A typical GuardLink system consists of the following:
• One DG (dual GuardLink) Guardmaster® safety relay (GSR)
• One GuardLink SmartTap for each safety device
• One terminator for each GuardLink circuit
• Patchcords and cordsets
• An optional Ethernet interface
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018 11
Chapter 1 Overview
Taps
12
Figure 1 - Typical GuardLink System
Each DG safety relay can accommodate up to two GuardLink circuits, each containing up to 32 devices.
One DG safety relay
One GuardLink tap for each safety device.
One terminator for each
GuardLink circuit.
Cordsets and patchcords
RR
Single Wire Safety for Expansion
Output monitoring
One optional Ethernet interface
(Required if guard locking is used)
Taps create nodes in the GuardLink circuit. A safety device is connected to each tap. Two types of taps are available:
• Taps that interface with devices having voltage-free safety contacts
• Taps that interface with devices that have OSSD signals
Each type is available in an 8-pin and 5-pin device connection version.
The taps are intended to be mounted on the machine, near the location of the device it monitors. The different types and versions can be connected in any order and can be mixed.
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018
DG Safety Relay
Overview Chapter 1
The DG safety relay is the host of the GuardLink system. By using a sequence of push buttons on the front face, the DG safety relay can be configured for many types of safety applications. The DG safety relay can do the following:
• Monitor up to two GuardLink circuits, two safety devices or a combination
• Use Single Wire Safety (SWS) input and output for expansion
• Execute Stop Categories 0 or 1 (immediate and delayed outputs)
• Monitor the status of output safety devices, like contactors
• Be configured for automatic or monitored manual reset
• Be configured to initiate a lock function for guard locking with a
GuardLink circuit
• Be configured to initiate an unlock function for guard locking with a
GuardLink circuit
Safety Device Inputs
The DG safety device inputs can be configured in one of the following arrangements:
• One GuardLink circuit
• Two GuardLink circuits
• One GuardLink circuit and one safety device
• Two safety devices
• One safety device
The DG safety relay applies AND logic to all used inputs. Unused inputs are ignored.
Single Wire Safety (SWS) Input
The DG safety relay then applies AND logic to the SWS input if configured for use. The single wire safety input is ignored if not included in the configuration.
Output Monitoring
The DG safety relay monitors the status of external safety output devices. After all safety inputs are satisfied, the DG safety relay checks the monitoring input terminal. If 24V is present, the DG safety relay proceeds to execute the reset function.
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018 13
Chapter 1 Overview
14
Reset
The DG safety relay reset function can be applied one of three ways:
• Automatic reset (no connection needed)
• Monitored manual reset by a momentary push button that is connected to an input terminal
• With an Ethernet interface, the machine control system can initiate the reset function.
The DG safety relay allows both an input terminal and the machine control system to perform the monitored manual reset function. The reset signal must transition from LO to HI and back to LO within a window of 0.25…3 seconds.
The reset occurs on the trailing edge. When using a programmable logic controller (PLC) to generate the reset signal, use a narrower window
(0.26…2.99 s) for more reliable reset action.
ATTENTION: The reset function must not be used to start or restart the machine.
, the DG safety relay has one GuardLink circuit and one safety device input. The EtherNet/IP interface reports status information to the machine control system. The DG safety relay monitors the status of the two output contactors and uses monitored manual reset to energize the contactors.
Figure 2 - One GuardLink Circuit and One Safety Device
GuardLink circuit - one tap for each safety device
Safety device (E-stop, mechanical interlock, light curtain, scanner, OSSD interlocks)
EtherNet/IP interface
DG safety relay
RR
Monitored
Manual
Reset
Output monitoring
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018
Overview Chapter 1
Figure 3 shows an example of a DG safety relay operating as the equivalent of a
, the DG safety relay is configured to accept two input devices, control and monitor two contactors with a manual reset input.
The 440R-ENETR interface reports the status to the machine control system.
The machine control system can also initiate a reset command.
Figure 3 - Two Safety Devices
Two safety devices (E-stops, mechanical interlocks, light curtains, scanners, OSSD interlocks)
RR
Cordsets or patchcords
DG safety relay
Optional
EtherNet/IP interface
GuardLink Principle of
Operation
The GuardLink circuit is a continuous chain of safety devices that are connected in series with only four wires. Two wires provide power and ground to the taps and devices.
The third wire (GuardLink Safety Signal) performs the diagnostics on the taps and the devices that are connected to each tap while in the safe state. It also carries the dynamic safety signal while in an operational state.
The fourth wire (CLU) provides the lock/unlock commands to guard locking devices on the circuit.
GuardLink State
The GuardLink chain can be in one of four states:
• Initialization
• Safe
• Operational
• Fault
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018 15
Chapter 1 Overview
Initialization State
The initialization state starts when power is applied to the GuardLink circuit and ends when the GuardLink circuit enters the safe state. If no errors exist, the
GuardLink circuit transitions to the safe state; the initialization state cannot transition to the operational state.
During initialization, the DG safety relay establishes and verifies the validity of the circuit by checking the following items:
• All devices set their node number
• Not more than 32 devices exist
• The firmware of the taps is compatible with the DG safety relay firmware.
• The DG safety relay detects node type and position automatically.
When a 440R-ENETR interface is used, it acquires the node types and positions from the DG safety relay. The 440R-ENETR interface validates the correct type and position against the setup that is provided by the Studio 5000® Add-On-Profile (AOP). If validation is not successful, the 440R-ENETR interface reports an error.
• Validates a terminator is attached to the GuardLink circuit.
Safe State
The GuardLink safety signal commands the DG safety relay to a safe state, which turns all safety outputs OFF. The GuardLink safety signal monitors the circuit for changes of state from the taps.
The CLU signal is HI (if guard locking devices are not used) or sending a dynamic unlock signal (if guard locking devices are used). The taps indicate this state by a solid red Link indicator.
Operational State
The GuardLink operational state is described as the GuardLink safety signal that generates a specific dynamic signal to the DG safety relay and the CLU signal being LO. The state of the DG safety relay safety outputs can be OFF or
ON. The state depends on the configuration, other safety device inputs, the feedback monitoring input, and the reset input.
16 Rockwell Automation Publication 440R-UM015C-EN-P - April 2018
Overview Chapter 1
Fault State
The DG safety relay and the taps have two fault states: recoverable and non-recoverable. When a fault occurs, the taps and DG safety relay are in a safe state. Diagnostic information is provided by the indicators. The DG safety relay also sends diagnostic information to the EtherNet/IP interface.
Recoverable faults can be cleared by cycling the faulted input devices. Nonrecoverable faults require the power to the cycled and can also require troubleshooting and correction of the fault. When an EtherNet/IP interface is used, the machine control system can issue a fault reset (equivalent to a power cycle).
GuardLink Transition from Safe State to Operational State
When the GuardLink signal is in the safe state, the DG safety relay holds the
CLU signal in the high or dynamic unlocking state. The DG safety relay puts all taps in the safe state. For the GuardLink signal to return to the operational state, the DG safety relay must know that all taps are ready to go to the operational state. If the taps are ready to go, the CLU signal is set to LO.
Now that the CLU is set to LO, the last tap generates the safety signal. Each successive upstream device verifies that the previous device is in a safe state, confirms that its own device is in a safe state, and sends an inverted safe state signal to the next device.
When the DG safety relay receives the safety signal, the GuardLink circuit is in an operational state, and the DG safety relay continues with the evaluation of the other inputs, output monitoring, and reset inputs.
GuardLink Transition from Operational State to Safe State
Once an input device has a demand on its safety function, the tap stops sending the safety signal. When the DG safety relay no longer detects the safety signal, the CLU signal is set to HI to make all taps enter the safe state.
GuardLink Fault Reset Command
Devices with OSSD outputs can sometimes go to a fault state that requires power cycling. The Ethernet interface can be used to send a fault reset signal from the machine control system to individual or all devices. This reset signal cycles the power to the device connected to the specified tap.
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018 17
Chapter 1 Overview
18
OSSD Tap
The OSSD tap is designed to specifically interface with safety products that generate OSSD outputs. The OSSD tap does not perform testing on the
OSSD signals as the input device must perform the test.
The OSSD tap is looking to see if the outputs of the connected device are energized or de-energized. If the outputs are de-energized, then the tap goes to a safe state, and the input indicator is red. If the outputs of the device are energized, then the tap shows a solid or flashing green input indicator.
If the OSSD tap inputs are not the same state for three or more seconds, then the tap enters a recoverable fault state. Both inputs must go to LO and then back to HI to recover.
EMSS Tap
The EMSS tap is designed to interface with two voltage-free contacts. The tap applies 24V to one side of the contact on both channels and looks for the 24V on the monitoring input. These contacts are pulse tested by the tap, see
Testing Functions on page 57 for pulse details.
The tap is looking to see if both contacts are closed or open. When the contacts open, the tap goes to a safe state, and the input indicator is red. When the contacts close, the tap goes to an operational state, which turns the input indicator either solid or flashing green.
The EMSS tap has a 10 second simultaneity window. If one contact opens, the second contact must open within 10 seconds. Similarly, if one contact closes, the second contact must close within 10 seconds. If the simultaneity window requirement is not met, the tap goes to a recoverable fault state. To recover, both contacts must be cycled open and then closed again within 10 seconds.
Guard Locking with GuardLink Systems
Only Power-to-Release guard locking devices can be connected to the
GuardLink taps. When guard locking devices are connected, a 440R-ENETR interface must be used. The lock and unlock commands can only be issued to the guard locking devices through the 440R-ENETR interface.
When an unlock request is issued, the DG safety relay turns off OUT X
(terminal X2) immediately and starts the off-delay timer. When the off-delay timer expires, the DG safety relay issues an unlock command to the GuardLink circuit and turns off its safety outputs (terminals 13/14 and 23/24).
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018
Overview Chapter 1
When multiple guard locking devices are installed on a GuardLink system, the
DG safety relay inserts a short delay between commands to each successive device to minimize the momentary inrush current to the solenoids. The device closest to the DG safety relay receives the command first. The device furthest away from the DG safety relay receives the command last.
The delay between commands is between 135…300 ms. When a few guard locking devices are used, the delay is 135 ms. As more guard locking devices are included in the circuit, the delay increases. When 32 guard locking devices are used, the delay can be up to 300 ms between each device.
Figure 4 shows an example timing diagram. The delay switch is set to
position 5 (1 second delay). The first guard unlocking command starts at
1000 ms. The second unlock signal occurs at 1135 ms. The third unlock signal occurs at 1270 ms. If 32 guard locking devices are installed, the last one receives the unlock command at 10,600 ms.
Figure 4 - Unlock Command Timing Diagram
32
5
4
3
2
OUT (13/14, 23/24)
1
OUT X (X2)
Unlock Request
0 1000 1135 1270 1405 1540
Time [ms]
10,600
Guard Locking Application Example
Figure 5 on page 20 shows a typical guard locking application example. The
DG safety relay has four taps on the GuardLink circuit:
• First tap — SensaGuard™ integrated-latch interlock switch
• Second tap — 440G-LZ guard locking interlock switch
• Third tap — TLS –ZR guard locking switch
• Fourth tap — SensaGuard flat-pack interlock switch
The TIME switch on the DG safety relay is set to position 9, which provides a
5 second delay to allow the motor to coast to a full stop.
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018 19
Chapter 1 Overview
Schematic
+24V DC
+ +
DC ok
1606-XLP95E
N L
24V DC Com
INPUT
440S-SF8D
The SensaGuard switches allow immediate access to the machine. Additional risk reduction measures must be provided to prevent access to the hazards during the timing period.
Because guard locking is used, a 440R-ENETR interface must be included in the application. The unlock and lock control commands are initiated by an
HMI and PLC. The PLC sends the command to the 440R-ENETR interface.
Over the optical bus, the 440R-ENETR interface instructs the DG safety relay to generate the unlock and lock commands through the GuardLink circuit.
The DG and EM safety relays report status information over the optical bus back to the PLC through the 440R-ENETR interface.
Figure 5 - Guard Locking Application Example Schematic and Logic
Logic
440N-Z21SS3PH
SensaGuard
Interlock
440G-LZS21SPRH
Guard Locking
Safety Switch
440G-TZS21UPRH
Guard Locking
Safety Switch
440N-Z21SS2JN9
SensaGuard
Interlock
SMF Level IN 1
LOGIC Level
INPUT
440S-SF8D
INPUT
440S-SF8D
INPUT
440S-SF5D 898D-418U-DM2
Terminator
SOF Level
R R
FB FB
OUT X OUT 14/24
K1
Start K2
Host PC
HMI
Reset
Stop
Ethernet
PLC
Ethernet
A
+
B
C
440R-ENETR
S11 S21 S12 S22
TIME
Control
Status
DG
440R-DG2R2T
S32 S42 X1
.14
0.12
.
0.2.4.6
9
X2
A1
A2
13 23 X4
14 24 X3
OUT X
SWS
A1 X32 13 23 33 43
Immediate
Acting
Loads
Status
EM
440R-EM4R2
A2 L12 L11 14 24 34 44
K1 K2
100S
Contactors
Feedback
L1 L2 L3
M
K1
K2
Table 2 - Guard Locking Application Example Configuration
Indicator
OUT
IN 1
IN 2
OUT X
IN X
Reset
FB
Function
Safety Functions
Input Type
Input Type
Output Type
Input Mode
Reset Type
Reset Assignment
Configuration ID: 0x6A
IN1
GuardLink
Not used
SWS
SWS Disabled
Monitored Manual
SOF
20 Rockwell Automation Publication 440R-UM015C-EN-P - April 2018
Overview Chapter 1
• Circuit Status
The gates monitored by the SensaGuard interlock switches are closed.
The guard locking switches are closed and locked. The DG and EM safety relays are OFF and ready for reset.
• Starting
Press the Reset button to energize the DG and EM safety relays. Their output contacts close. Press the Start button to start the motor via contactors K1 and K2 and energize the two immediate acting loads.
• Stopping
Press the Stop button to turn the motor and immediate acting loads off.
The immediate acting loads and contactors K1 and K2 de-energize immediately, and the motor coasts to a stop. This action does not unlock the guard locking switches.
IMPORTANT The Start/Stop circuit can be replaced by an equivalent machine controlled system to start or restart the hazards after the safety system is reset.
• SensaGuard Switches
Opening either SensaGuard interlock turns off the DG and EM safety relays. The EM safety relay turns off K1 and K2 immediately, and the motor coasts to a stop. With the Time switch on the DG safety relay set to 9, the 13/14 and 23/24 outputs on the DG safety relay turn off after
5 seconds. This action does not unlock the guard locking switches.
• Unlock the Guard Locking Switches
Use the HMI to unlock the guard locking switches. The EM safety relay turns off K1 and K2 immediately, and the motor coasts to a stop. After
5 seconds, both the 13/14 and 23/24 outputs of the DG safety relay turn off the immediate acting loads and the guard locking switches are unlocked.
IMPORTANT The outputs of the DG safety relay (13/14 and 23/24) turn off and the unlock command occurs after the time delay expires. The immediate acting loads must remove the hazards they control quickly before you can open the gate and reach the hazard.
• Restart
Close the safety gates. If the gates were unlocked, use the HMI to initiate a lock command. Both gates are locked and the GuardLink circuit is satisfied. Press the Reset button. Press the Start button to energize the immediate acting loads and turn on the motor.
Rockwell Automation Publication 440R-UM015C-EN-P - April 2018 21
Chapter 1 Overview
Notes:
22 Rockwell Automation Publication 440R-UM015C-EN-P - April 2018

Public link updated
The public link to your chat has been updated.
Advertisement