SSP North AB
30/08/2018
Manual V2f
16
3 Safety Precautions when using Safety Simplifier
Warning!
Read this information carefully as it is essential information on how to design and
use the Safety Simplifier System in a safe way.
The Safety Simplifier system has three modes of operation:
1. Normal mode: The Safety Simplifier PLC controls the outputs according to inputs and logic.
2. Safe state: a state during which outputs are in safe state.
3. PLC Configuration mode. The Safety Simplifier is off-line, and all outputs are in safe state.
This is the only mode where a new configuration can be downloaded from a PC.
Safe state is defined as a state when outputs are turned off (goes low = 0V) and the output relays are
deenergised (all contacts open).
In a system of more than one Safety Simplifier, if a node loses communication from another node, it
will consider all the safety information from that node as 0 (off, open, deenergised). It is important to
design the system so that loss of communication results in the relevant outputs turning off (0V).
If an internal dangerous failure is detected the affected Safety Simplifier unit goes to safe state. The
safety communication via radio and CAN-bus is turned off. The other nodes in the system will lose
connection to the affected Safety Simplifier unit and all safety information from that unit are set to 0.
Information on the cause of the dangerous failure is available on the LED-panel and via USB on the
actual unit. Information is not available wirelessly via radio or via CAN as this communication is shut
off.
If an external dangerous failure is detected (such as a short circuit on an OSSD output or an input that
detects an invalid coded signal), the affected inputs and/or outputs turn off. The error information is
available on the LED-panel, wirelessly, via CAN and USB, and as an internal signal in logic. If more
actions are required, the logic can be programmed to set the device in safe state, turn off other
functions, or perform other actions, in case an input or output function detects an external error. This
choice must be taken by the system integrator.
The system is designed for applications where; 0V, open circuit, logic “0”, low signal, loss of radio
signal, loss of bus communication etc generates a safe state (stop/off). The application must be
designed according to the “de-energisation” principle, meaning that stop functions shall operate by de-
energizing as well as with safe state conditions.
Safe state = “0”. A fault in the system can set inputs, outputs, memories etc. to logic “0” which is
regarded as a safe state. Logic “1” must therefore normally not be used to generate a safe state
(stop/off). An exception is a dual or multiple channel function with logic “1” combined with logic “0”.
28It is essential that loss of radio communication and CAN-bus communication lead to safe state. This
must the principle when programming a system with two or more Safety Simplifiers communicating
between each other through radio or CAN-bus.
For control devices which starts a function when they are actuated it is important to use the start-up
function for the inputs connected to the devices and to use the start-up function for global and CAN
memories used between Safety Simplifiers. The start-up function requires a control device to be
released and activated again after loss of power, loss of communication and loss of one or more input
signals.
