Safety Output
250 ms
Max.
250 ms
Max.
250 ms
Max.
250 ms
Max.
250 ms
Max.
250 ms
Max.
Don’t Care
Closed
Open
Closed
Open
EDM 1
EDM 2
Figure 72. Timing logic: Two-channel EDM, timing between channels
Safety Output
Must Match EDM 2
Must Match EDM 2
ON
OFF
Closed
Open
EDM 1
Must Match EDM 1
Must Match EDM 1
Closed
Open
EDM 2
Figure 73. Timing logic: Two-channel EDM status, with respect to
Safety Output
FSD Interfacing Connections
Final switching devices (FSDs) interrupt the power in the circuit to the Machine Primary Control Element (MPCE) when the
Safety Outputs go to the Off-state. FSDs may play different roles, though the most common are forced-guided
(mechanically linked) relays or Interfacing Modules. The mechanical linkage between the contacts allows the device to be
monitored by the external device monitoring circuit for certain failures.
Depending on the application, the use of FSDs can facilitate controlling voltage and current that differs from the Safety
Outputs of the Controller. FSDs may also be used to control an additional number of hazards by creating multiple safety
stop circuits.
Safety (Protective) Stop Circuits
A safety stop allows for an orderly cessation of motion or hazardous situation for safeguarding purposes, which results in a
stop of motion and removal of power from the MPCEs (assuming this does not create additional hazards). A safety stop
circuit typically comprises a minimum of two normally open contacts from forced-guided (mechanically linked) relays
(external device monitoring), which are monitored to detect certain failures so that the loss of the safety function does not
occur. Such a circuit can be described as a “safe switching point.”
Typically, safety stop circuits are a series connection of at least two N.O. contacts coming from two separate, positive-
guided relays, each controlled by one separate safety output of the Controller. The safety function relies on the use of
redundant contacts to control a single hazard, so that if one contact fails On, the second contact stops the hazard and
prevents the next cycle from occurring.
Interfacing safety stop circuits must be wired so that the safety function cannot be suspended, overridden, or defeated,
unless accomplished in a manner at the same or greater degree of safety as the machine’s safety-related control system
that includes the Controller.
The normally open outputs from an interfacing module are a series connection of redundant contacts that form safety stop
circuits and can be used in either single-channel or dual-channel control methods.
Dual-Channel Control. Dual-channel (or two-channel) control has the ability to electrically extend the safe switching
point beyond the FSD contacts. With proper monitoring, such as EDM, this method of interfacing is capable of detecting
certain failures in the control wiring between the safety stop circuit and the MPCEs. These failures include a short-circuit of
one channel to a secondary source of energy or voltage, or the loss of the switching action of one of the FSD outputs,
which may lead to the loss of redundancy or a complete loss of safety if not detected and corrected.
The possibility of a wiring failure increases as the physical distance between the FSD safety stop circuits and the MPCEs
increase, as the length or the routing of the interconnecting wires increases, or if the FSD safety stop circuits and the
MPCEs are located in different enclosures. Thus, dual-channel control with EDM monitoring should be used in any
installation where the FSDs are located remotely from the MPCEs.
Single-Channel Control. Single-channel (or one-channel) control uses a series connection of FSD contacts to form a safe
switching point. After this point in the machine’s safety-related control system, failures that would result in the loss of the
safety function can occur, for example, a short-circuit to a secondary source of energy or voltage.
Thus, this method of interfacing should be used only in installations where FSD safety stop circuits and the MPCEs are
physically located within the same control panel, adjacent to each other, and are directly connected to each other; or
where the possibility of such a failure can be excluded. If this cannot be achieved, then two-channel control should be
used.
Methods to exclude the possibility of these failures include, but are not limited to:
•
Physically separating interconnecting control wires from each other and from secondary sources of power
•
Routing interconnecting control wires in separate conduit, runs, or channels
XS/SC26-2 Safety Controller
92
