GSR Applications and Wiring Diagrams

Safety Applications and Wiring Diagrams
N e x t G e n e ra tio n
GSR - Guardmaster Safety Relays
16 iring NEW W s m Diagra
Next Generation Safety Monitoring Relays

Table of Contents
SIL CL 2 2 2 3 3 3 3 3 2 3 3 3 3 2 3 2 2 3 2 2,3 3 2 2 2 2 2 2 2 3 3 2 2 2 2 2 2 2 2 2 PL Safety Page Relay Modules 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 SI SI SI, EM, EMD SI, EMD SI, EMD SI, DI, DIS SI, MSR35H SI, DIS CI CI DI DI DI DI DI DI DI, EMD DI, EMD DI, EMD DI, DI, DI DI DI DI DI DIS DIS DIS DIS DIS, MSR41 DIS, MSR42 GLP GLP GLP GLP GLP, DIS GLP, DI GLP, DI GLP, DI GLP, DI, EMD Input Devices E-Stop Trojan T15 4 E-Stops E-Stop GuardShield Safe 4 3 E-Stops, Trojan T15, Safety Mat GuardShield, 800Z 3 SensaGuards with Integrated Latch, 2 E-Stops Trojan T15, Elf, E-Stop, PLC on Ch2 3 SensaGuards GuardShield 2 GuardShields 2 Lifeline 4 5 SensaGuards, Distribution Block, E-Stop GuardShield, E-Stop SensaGuard with Integrated Latch, E-Stop MT-GD2, GripSwitch TLS1-GD2, Trojan T15, E-Stop 440G-MT, MT-GD2, GripSwitch 2 E-Stops, 2 GuardShield Safe 4, Mat, SensaGuard E-Stop SafeZone Mini, E-Stop SafeZone Multizone, E-Stop SC300 Safety Sensor, E-Stop Galvanic Isolator 897H, Trojan T15, E-Stop Galvanic Isolator 897H, Safedge, MatGuard, E-Stop Trojan 5, MT-GD2 Trojan 5 Micro 400 GuardShield, E-Stop Micro 400 GuardShield, SensaGuard, E-Stop 871TM, TLS3-GD2 872C, TLS-ZR 871TM, TLS-ZR 872C 872C, TLS3-GD2, E-Stops 872C, TLS3-GD2, E-Stops 872C, TLS3-GD2, E-Stops 872C, TLS3-GD2, E-Stops 872C, TLS-ZR, E-Stops Output Devices PowerFlex 525 Flex IO 100S-C, 700S-DCP
Kinetix 6000 Guardmotion w/ RBM
Cat. Stop # Cat.
100S, 700S-C 100S, 700S-C 100S-C PowerFlex 525 100S-C 100S-C 100S-C 100S-C 100S-C Kinetix K350 Pneumatic Safety Valve PowerFlex 525 PowerFlex 70 700S-CF 100S-D 100S-C PowerFlex 755 Kinetix 350 Kinetix 350 Kinetix 350 PowerFlex 525 PowerFlex 525 PowerFlex 70 2 PowerFlex 70 100S-C 100S-C PowerFlex 70 PowerFlex 525 PowerFlex 70 PowerFlex 525 PowerFlex 70 PowerFlex 525 100S Kinetix K300 PowerFlex 525
d 3 0 d 3 0 d 3 0 e 4 1 e 4 0 e 4 0 e 4 0 e 4 0 d 3 0 e 4 0 0 e 4 0 e 4 0 e 4 d 3 0 e 4 0 0 d 3 d 3 0 0 e 4 d 3 0 d,e 3,4 0 e 3 0 d 3 0 d 3 0 d 3 0 d 3 0 c/d 1/3 0 d 3 0 d 3 0 e 4 0 e 4 0 d 3 1 d 3 1 d 3 SLS d 3 0 d 3 1 d 3 SLS d 3 0 d 3 SLS d 3 0
- 01 R
Safeguarding Applications and Wiring Diagrams
Next Generation GSR Safety Monitoring Relays

Notes for Example Wiring Diagrams
Note 1
In the following circuits the type of Allen-Bradley/Guardmaster device is shown as an example to illustrate the circuit principle. For specific applications the choice of device type should be based on the suitability of its characteristics for its intended use.
Note 2
In most of the following examples showing dual channel applications, one interlock switch is shown switching both channels (one contact set per channel). If it is foreseeable that damage to the guard (e.g., at the actuator mounting point) could allow it to be opened without operating the switch then two separate switches may be required. The electrical principle of the circuit will remain the same.
Note 3
In most cases the circuits are shown with the guard door closed and ready for motor starting by operating the normal start control. It must be possible to start the machine only by voluntary actuation of the control provided for the purpose (see ISO 12100-2 4.11.8). For the purposes of these examples the use of a conventional contactor latching circuit has been assumed. If this is not the case, then a restart interlock will be required to prevent an automatic or unintended starting of the motor when the guard is closed. For example, a Minotaur safety relay with a momentary action push button installed in the output monitoring circuit can be used to achieve this. If the guard is designated as a Control Guard (see ISO 12100-2 5.3.2.5) these requirements do not apply but the use of control guards is only allowed under certain conditions including: A control guard can only be used where there is no possibility of an operator or part of his body staying in or reaching into the danger zone whilst the guard is closed. The control guard must be the only access to the hazard area. The interlocking system must have the highest possible reliability. It is often advisable to use a solenoid locking switch such as the Guardmaster Atlas or TLS-GD2.
Note 4
Safety monitoring relay units used in dual channel circuits with infrequent operation or with more than one switching device connected. This note applies to all monitoring devices which use the technique of comparing the signal at the change of state of dual channels. Certain faults are only detected at a change of state of the input switching device (interlock switch or E-Stop switch). If the re are long periods (e.g. months as opposed to days) between switching actions, it may be possible for multiple faults to accumulate which could lead to a dangerous situation. Therefore a regular check should be performed on the system in order to detect single faults before an accumulation occurs. This check may be manual or initiated by part of the machines control system. If, for example, 3 interlock switches are connected to the monitoring unit, certain faults will only be detected at the switch on the first guard to be opened and the switch on the last guard to be closed. This is because any switching between the first opening/last closing will not change the state of the monitoring unit input circuits. Therefore in some applications it may be necessary to use one monitoring device per switch. Most of the following examples show an interlock switch and an emergency stop switch combined in the circuit. When a monitoring safety relay (e.g. Guardmaster Minotaur) is used for fault detection it is important to note the following: All safety critical single faults, except for certain faults over the contact sets at the E-Stop, will be detected at the next opening of the guard. All safety critical single faults, except for certain faults over the contact sets at the interlock switch, will be detected at the next operation of the E-Stop. Because the E-Stop device is not likely to be operated frequently, it is recommended that its function is checked (with the gua rd closed) on a regular basis (start of shift or daily) to enable the Minotaur to detect single faults. If the guard is rarely opened, the interlock switch should be checked in a similar manner.
Note 5
This symbol indicates that the associated component or device features direct opening (positive opening) operation. In the even t of a fault, welded contacts will be forced open by the motion of the safety guard. This symbol denotes mechanically linked contacts; if one contact welds closed, all other dependent (auxiliary) contacts remain in position, i.e. they cannot change state.
General Safety Information
IMPORTANT ATTENTION
This application example is for advanced users and assumes that you are trained and experienced in safety system requirements. Contact Rockwell Automation to find out more about our safety risk assessment services.
A risk assessment should be performed to make sure all tasks and hazard combinations have been identified and addressed. The ri sk assessment may require additional circuitry to reduce the risk to a tolerable level. Safety circuits must take into consideration safety distance calculations which are not part of the scope of this document.
For other Important User Information and Safety Guidelines, please review pages G-2 and G-3 in the General section of the S117 Safety Catalog
- 02 R
SI with E-stop to 525 Drive

E-Stop, SI, and PowerFlex 525
24V DC
Reset
L1 L2 L3
PowerFlex R S T 525 11 +24V DC 1 Stop
E-Stop 800FM-MT44 800F-MX02S
S11 S21 S34

RESET 0 AM
A1 13
23
2 Start
SI 440R-S12R2
Gate control power supply Gate control circuit

S1 S2
MM
S22 S12 Y32 L11 A2
14
24
UV W
Status To PLC
24V DC Com
Circuit Status
The SI Logic is set to MM, monitored manual reset. The e-stop is released. The SI safety outputs (13/14 and 23/24) are off. The PowerFlex 525 drive is powered but disabled. The motor is off.
Operating Principle
STARTING: Press the Reset button to turn on the SI safety outputs. This enables the drive and also applies power to the Start and Stop buttons. Press the Start buttons to start the motor. STOPPING: Press the Stop button to stop the motor for production stops. Press the e-stop to initiate a safety stop; the motor coasts to a stop.
Fault Detection
Upon successful completion of internal checks by the SI and PowerFlex 525 drive, the drive awaits the closure of the safety outputs. If the SI fails, the drive will not energize the motor, and the fault will be detected by non-operation of the motor. The sI generates test pulses through the E-stop circuits to detect cross channel shorts and shorts to power and ground. A fault in the safe-circuit of the drive will be detected by the drive and the drive will execute a safe torque off stop.
Ratings
The safety function initiated by the e-stop meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006. The circuit executes a Safe Torque Off (i.e., a Category 0) stop.
- 03 R
Safety Relay to Flex I/O

Trojan T15 GD2, 800F, SI, Flex I/O
+24V DC Reset 800FM-F6MX10 Brown Black Limited to 6 Amps 34 35 36 24 37 38 . . . 50 51 C 12 Start 800FMF3MX10 11 700-HLT2Z24 700-TBR24 16 17 18 19 20 . . . 32 33 CR CR1 0 1 2 3 4 . . . 14 0 1 2 3 4 . . . 14 15 A 16 17 18 19 20 . . . 32 33 B 34 35 36 37 38 . . . 50 51 C Stop 800FME4MX01
S11 S21 A1 11 21
RESET
S34
0 MM
13
23
12 22 Trojan T15 GD2 440K-T11390 889D-F4AC-2 Blue
SI 440R-S12R2
AM
S12 S22 A2 L11 Y32 14 White
CR
B 1794-TB3 & 1794-OB16 FLEX Output Module
Machine 15 Actuators A
1794-TB3 & 1794-I16 FLEX Input Module
24V DC Com
Circuit Status
The safety gate is closed. The outputs of the SI safety relay are open and the machine actuators are off. Control Relay CR1 is de-energized and its 11/12 contact is closed.
Operating Principle
The SI is chosen for this application because its thermal (non-switching) current carrying capacity is 6A in one circuit. The Flex output module performs the normal switching of the machine actuators during the manufacturing process. The safety system enables the machine functions by providing power to the FLEX Output Module. One of the Flex outputs must drive an electro-mechanical device (CR1) whose normally closed contact is in the monitoring loop of the safety relay. The machine logic must energize this output while the machine is running, as it is used by the SI to confirm that power is removed from the output module, before restarting. STARTING: Press the reset button to energize the output contacts 13/14 of the SI. This connects the 24V supply to terminal C34 of Flex 1974-OB16 output module and also sends a signal to the A3 terminal of the 1794-IB16. The logic system is informed that the gate is closed and the machine is ready to run. Press the Start button to start the machine process. STOPPING: Press the Stop button to stop the machine. Then, open the gate to access the machine. While the gate is open, the machine actuators cannot operate because power is removed from the output module. If the gate is inadvertently opened while the machine is running, power will be removed from output module and the machine actuators will be de-energized.
Fault Detection
Upon successful completion of internal checks on power up, the SI checks the input circuits. With the gates closed, the SI checks the dual circuits and then waits for the reset signal. A single fault, a short from 24V to terminal 14 of the SI, may lead to the loss of the safety function. With the SI and Flex system mounted in the same cabinet and with proper validation, this fault may be excluded. If not mounted in the same cabinet, a signal from the output (A0) should be fed back into the input module (A2). The logic can perform a comparison of input A2 and A3, and turn the machine off if these signals are not in agreement. If CR1 is not de-energized when the gate is closed, the SI will not close its outputs.
Ratings
The safety function initiated by the Trojan T15-GD2 gate interlock meets the safety performance requirements of SIL CL 2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Category 0 stop.
- 04 R
Expansion Modules with Immediate and Delayed Outputs

800F, SI, EM , EMD, 100S, 700S
+24V DC Reset 800FM-F6MX10 K6 K1 K7 K2 K8 K3 K9 K4 K10 K5
S11 S21 E-Stops 800FM-MT44MX02L

RESET AM SI 440R-S12R2
S34
0
A1 13
23
X32 A1 13 23 33 43
B1 B2 X32 A1 17 27 37 47
RANGE 9 8 7 0 4 1 2 3
TIME 10 9 1 8 5 2 3 4
6 5
7 6
MM
EM 440R-EM4R2
EMD 440R-EM4R2D L12 L11 A2 18 28 38 48
S12 S22 Y32 L11
A2 14
24
L12 L11 A2 14 24 34 44
K1
100SC43EJ14BC
K2
K3 K4
K5
100SC09EJ14BC
K6
K7 K8
K9
700SDCP310DZ24 with 199-FSMZ-1

K10
24VC DC Com
Circuit Status
The e-stops are reset. The safety outputs of the SI, EM and EMD are de-energized. All of the contactors are off. The EMD Range setting is 2 (10s OFF Delay) and the Time setting is 2 (20%), therefore the time delay is 2 seconds. The reset and monitoring circuit are connected to S34 for monitored manual reaset.
Operating Principle
Additional outputs are added to the SI (CI, DI, or DIS) relay by the EM (Expansion Module with immediate outputs) and the EMD (Expansion Module with Delayed outputs). A single wire, safety-rated signal from terminal L11 of the SI communicates the output status to L12 of the EM and EMD relays. STARTING: Press and release the reset button to energize the outputs of the SI, EM and EMD. K1-K10 safety contactors or safety control relays energize to control the hazardous portion of the machine. STOPPING: When an e-stop is pressed, the safety outputs of the SI and EM turn off immediately and de-energize K1 - K6. Four seconds later, the safety outputs of the EMD turn off and de-energize K7 through K10.
Fault Detection
Upon power-up, the SI, EM and EMD perform internal checks. The SI then looks for dual signals from the e-stop circuit. A crossfault on the e-stop circuit will be detected by the SI. With the E-stop signals made, closing the reset button places a voltage to the S34 terminal. The external devices (K1 through K10) are checked to confirm they are off. A fault in K1 through K10 will cause their normally closed contacts to remain open, and this fault will be detected by the SI.
Ratings
The safety function initiated by the series connection of the 800F e-stop buttons meets the safety performance requirements of SIL CL 2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. The Category 3 rating requires the redundant usage of K1-K10 to de-energize the machine actuators, and the contactors must be monitored by the safety system. This circuit executes a Category 0 stop (coast to stop).
- 05 R
Safety Motion - Delayed Braking

800F, SI, EMD, Kinetix GuardMotion, RBM
+24 VDC E-Stop 800FM-MT44 800F-MX02S Reset 800FM-F6MX10 Kinetix 6000 with GuardMotion 2099-BMxx-s EN1+ EN1EN2R2 EN2+ 28 38 48 FBK1 FBK1 FBK2 FBK2 R1 R1 Gate Control Enable U V W Gate Control Power Supply R2 R1 Safety Monitor Gate Control Circuit L1 L2 L3
S11 S21
S34
RESET 0
A1 13
23
B1 B2 X32 A1 17
RANGE 0 1 TIME
9 8 7 6 5 4 2 10 3 9
8 7 6 1 2 3 4 5
27 37 47
SI 440R-S12R2 S12 S22 Y32 L11 To PLC
AM
MM
A2 14 24
EMD 440R-EM4R2D L12 L11 A2 18
R2
Resistor Braking Module COIL A1 CONSTAT41 CONSTAT42 COIL A2 T1 K1
100S-C Contactor
U V W M
24V DC Com
Circuit Status
The e-stop is reset. The outputs of the safety relay are open, and the motor is off. The EMD Range switch is set to 1 (1s OFF Delay) and the Time is set to 10 (100%), therefore the off delay time is 1s.
Operating Principle
STARTING: Press and release the reset button to energize the outputs of the SI. This action energizes the feedback relays in the Kinetix. The L11 signal from the SI to the EMD instructs the EMD to close its safety outputs, which energizes the 100S contactor in the resistor braking module. The motor is now connected to the drive. When the Kinetix drive is enabled, an internal signal is sent back to its controller (not shown) to inform it that the drive is enabled. The motor is then controlled by its controller. STOPPING: When the e-stop is pressed, the immediate outputs of the SI open and disable the drive. The motor begins to execute a stop. The L11 signal from the SI to the EMD turns off and the EMD begins its timing cycle. After the time delay of the EMD expires, the delayed outputs open and drop out the 100S contactor in the Resistor Braking Module. This disconnects the motor from the drive and engages the braking resistors, which rapidly stop the motor.
Fault Detection
Upon power-up, the Kinetix drive and SI and EMD perform internal checks. The SI then looks for dual signals from the e-stop. The e-stop has a self-monitoring contact, which opens if the contact block falls off the control panel. With the e-stop signals made, the SI checks the S34 monitoring circuit when the reset button is pressed. If these checks are OK, the output energizes. If the delayed outputs of the SI fault to the ON state, the motor is stopped by the SI immediate outputs. The fault will be detected by the S34 monitoring circuit on the next attempt to re-start because K1 will remain energized. If the drive faults to an ON state, the motor will stop because it will be disconnected by K1. This fault will be detected by the S34 monitoring circuit on the next attempt to re-start because the Kinetix feedback circuit will remain off. If K1 gets stuck or welded closed, the motor will stop by the drive and the fault will be detected by the S34 monitoring circuit of the TD on the next attempt to re-start.
Ratings
The safety function initiated by the 800F e-stop meets the safety performance requirements of SIL CL3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This circuit executes a Category 1 stop.
- 06 R
Light Curtain with Immediate and Delayed Outputs

Safe 4, SI, EMD, 100S, 700S
+24V DC
Reset 800FM-F6MX10 Transmitter Brown 1 2 4 Receiver 1 K1 Brown K2 K3 K4 K5 K6
Black 4 White 2 3 5 Blue Grey
S11 S21
RESET AM SI 440R-S12R2
S34
0
A1 13
23
B1 B2 X32 A1 17 27 37 47
RANGE 9 8 7 0 4 1 2 3
TIME 10 9 1 2 3 4
Blue Grey
6 5
7 6
3 5
MM
EMD 440R-EM4R2D
POC Type 4 Safe 4 445L-P4S1200YD Patchcord: 2 x 889D-F5AC-2
S12 S22 Y32 L11
A2 14
24
L12 L11 A2 18 28 38 48
K1
100SC43EJ14BC
K2
K3 K4
K5
700SCFB440EJC
K6
24VC DC Com
Circuit Status
The light curtain is clear. The safety outputs of the SI and EMD are de-energized. All of the contactors are off. The EMD Range setting is 2 (10s OFF Delay) and the Time setting is 2 (20%), therefore the time delay is 2 seconds. The reset and monitoring circuit are connected to S34 for monitored manual reaset.
Operating Principle
Additional outputs are added to the SI relay by the EMD (Expansion Module with Delayed outputs). A single wire, safety-rated signal from terminal L11 of the SI communicates the output status to L12 of the EMD relay. STARTING: Press and release the reset button to energize the outputs of the SI and EMD. K1-K6 safety contactors or safety control relays energize to control the hazardous portion of the machine. STOPPING: When the light curtain is interrupted, the safety outputs of the SI turn off immediately and de-energize K1 - K2. Two seconds later, the safety outputs of the EMD turn off and de-energize K3 through K6.
Fault Detection
Upon power-up, the SI and EMD perform internal checks. The SI then looks for dual signals from the light curtain. A crossfault on the light curtain will be detected by the light curtain. With the light curtain signals made, closing the reset button places a voltage to the S34 terminal. The external devices (K1 through K6) are checked to confirm they are off. A fault in K1 through K6 will cause their normally closed contacts to remain open, and this fault will be detected by the SI.
Ratings
The safety function initiated by the slight curtain meets the safety performance requirements of SIL CL 3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. The Category 4 rating requires the redundant usage of K1-K6 to de-energize the machine actuators, and the contactors must be monitored by the safety system. This circuit executes a Category 0 stop (coast to stop).
- 07 R
Global E-Stop, Cascaded Safety Functions

800F, Trojan T15, MatGuard, SI, DI, DIS, 100S, 700S
+24V DC K1 K2 Start Trojan T15-GD2 440K-T11287 Start K3 K4 11 Reset 800FMF6MX10 Stop 21 12 22 11 21 12 22 Stop Reset 800FMF6MX10 23 S34 MatGuard Safety Mat & Trim 440F-M2030BYNN 440F-T2030 K5 K6
Aux. to PLC
S11 S12 A1 RESET 0
S34 13
23
S11 S12 S21 S22 A1 13

0 LOGIC 8 7 1 2 3 4
S11 S21 S12 S22 A1 A2 Y32 S34

0 LOGIC 8 7 1 2 3 4
AM SI MM 440R-S12R2 S21 S22 A2 L11 Y32 14
24
6 5 DI 440R-D22R2 S32 S42 L11 L12 A2 14
24 Y32
6 5 DIS 440R-D22S2 S32 S42 L11 L12 34 44 14
24 K5 K6
Aux. to PLC E-Stop 800FM-MT44 800F-MX02S

K1 K2
Aux. to PLC E-Stop 800FM-MT44 800F-MX02S

K3 K4
K5 K6 Start Stop
24 DC Com
100SC09EJ14BC
700SCFB440EJC
100SK5 C43EJ14BC
K6
Circuit Status
The E-Stops are reset. The safety gate is closed. The safety mat is unoccupied. The outputs of all three controls are off. K1-K6 are ready to be energized. The SI is set for monitored manual reset. The DI has logic set to 4 [(IN1 AND IN2) AND L12] with monitored manual reset because the safet gate provides full body access. The DIS has logic set to 8 [(IN1AND IN2) AND L12] with automatic reset as operators cannot get between the safety mat and the hazard.
Operating Principle
The SI is connected to provide a Global E-Stop function. The DI and DIS safety relays are cascaded from the SI relay. STARTING: Press the reset button for the SI to energize its outputs. Then press the Start button energize K1 and K2 and send the L11 link signal to the DI Relay. This enables the DI relay. Press the reset button to energize to energize the DI relay. This sends a L11 link signal to the DIS relay. The outputs of the DIS energize automatically. Press the respective Start buttons to energize the contactors K3, K4, K5 and K6. STOPPING: Pressing the E-Stop of the SI shuts down all three relays. Opening the interlocked gate or pressing the E-Stop of the DI turns off the outputs of both the DI and DIS, while the SI is unaffected. Pressing the E-Stop or stepping on the safety mat of the DIS turns off the outputs of the DIS only.
Fault Detection
Upon successful completion of internal checks on power up, the SI, DI and DIS relays check their input circuits. Shorts from the inputs to power, ground or other inputs will be detected immediately and will prevent energization or will de-energize the respective outputs. If one of the contactors (K1 - K6) is stuck in an actuated state, the respective control will prevent startup because the S34 feedback loop will remain open.
Ratings
The safety functions initiated by the e-stop devices and the two Trojan interlocks meet the safety performance requirements of SIL CL3 per IEC 62061:2005 and have Category 4 structures that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. The safety function initiated by the safety mat meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Category 0 stop.
- 08 R
GuardShield, 800Z
GuardShield, 800Z, MSR35H, SI,100S
+24V DC Transmitter Brown 1 Receiver 2 Brown 6 Pink 5 Grey Blue Blue 3 7 GuardShield 440L-P4J0640YD 889D-F4AC-2 889D-F8AC-2
Reset 800FM-F6MX10
Brown White Black
To PLC L1 L2 L3 S21 S11 S34 Y41 A1 Y2 S11 S12 A1 RESET AM S34 13 0 MM 24 23 K1 K2
800Z-GL3Q5 S1 889N-F5AE-6F Blue Grey
Brown White Black
Two-Hand Control
24VDC
MSR35H 440R-D23202 S12 S22 A2 14 24 32
SI 440R-S12R2
S21 S22 A2 L11 Y32 14 To PLC
800Z-GL3Q5 S2 889N-F5AE-6F Blue Grey
M
K1 K2
24V DC Com
100S-C09EJ14BC
Circuit Status
The operator's hands are not on the two 800Z palm buttons. The outputs of the MSR35H are off. The light curtain is configured with the factory default settings (Guard only mode) and is unobstructed. The outputs of the SI safety relay are off. The motor is off and ready to run. The light curtain is protecting one portion of the machine. An operator, using two-hand control is accessing a different portion of the machine and has full view of his or her area.
Operating Principle
STARTING: Press the Reset button to energize the output of the SI. The operator places both hands on the 800Z buttons simultaneously (within 0.5s). The outputs of the MSR35H (terminals 14, 24) and energize the 100S contactors, which start the motor. STOPPING: Removing one or both hands from the 800Z palm buttons causes the outputs of the MSR35H to turn off, which drops out K1 and K2 and stops the motor. Obstructing the light curtain de-energizes the safety outputs of the SI, which in turn drops out K1 and K2 and turns the motor off. Clearing the light curtain does not restart the motor, even if the operator has their hands on the palm buttons. The reset button must be pressed after the light curtain is cleared.
Fault Detection
Upon power up, the 800Z, GuardShield, MSR35H and SI perform internal checks. After passing internal checks, the MSR35H waits for a change of state of its inputs. Faults (opens and shorts) at the inputs will be detected by the MSR35H and prevent the outputs fro being energized. the GuardShield light curtain also performs checks on its OSSD output signals for crossfaults, shorts and opens. The SI looks for dual signals at its inputs. It then checks the status of the contactors. If one contactors fails in the actuated state, the other contactor will stop the motor. The SI will detect if one of the contactors are stuck in the energized position, and prevents restart.
Ratings
The safety function provided by the GuardShield light curtain meets the safety performance requirements of SIL CL 3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This circuit executes a Category 0 stop.
- 09 -
Interlock Switch - Multiple Gate Access

+24V DC Trojan T15-GD2 440K-T11287 ELF-GD2 440K-E33046 Start 800FMF3MX10 Stop 800FME4MX01 L1 L2 L3 K1 K1 K2 Machine control system can replace this circuit arrangement.

Trojan T15, Elf-GD2, 800F, CI, 100S
E-stop 800FMMT44MX02L
11 21
12 22
11 21
12 22 S11 S12 A1
S34
0 MM
13
23
33
41
Output PLC Input 1756-IB16 Processor 1756-OW16I 1769-OW8 1769-IQ16 1746-OW4 1746-IB16 1734-OW2 1734-IB4 1793-OW4 1793-IB6 24V DC Com
RESET
CI 440R-S13R2
AM
K2
S21 S22 A2 L11 Y32 14

K1
24
34
42
K2 100S-
C09EJ14BC
Circuit shown with the safety gates closed and e-stop released. The CI safety relay is de-energized. The motor is off. The monitoring circuit is connected to S34 for automatic reset of the CI relay.
Circuit Status
With 2NC + 1NO interlocks, a potential exists for the gate to be slightly open which results in the auxiliary contact being closed and the safety being open. The machine cannot start and the PLC does not know which gate is open. By sending the second safety channel through the PLC, the machine control system knows which door is open, when the safety system is off due to a gate that may be slightly open. The infinite simultaneity feature of safety relays like the CI allow enough time for the PLC to process all the gates and close the second channel of the safety relay without creating a lockout condition. When a safety gate is opened, the interlock opens Ch1 directly to the safety relay and opens Ch2 which is connected to the input of a PLC. The PLC must then open Ch2 of the safety relay. The logic in the PLC must open the Ch2 signal if any one or more of the safety gates are open and must only close the Ch2 circuit when all of the safety gates and e-stop are closed. The PLC can also use the information on the inputs on PanelView or similar device. The auxiliary signal (Y32) from the CI must be an input to the PLC. This PLC program must only close its output when all the safety inputs are closed and the auxiliary signal from the CI is closed. This allows the PLC to indirectly confirm that its own output is working properly. STARTING: Channel 1 input (S11/S12) of the SI is satisfied. Using isolated relay contacts in its output module, the PLC closes the second safety channel (21/22 of the SI). The safety outputs of the SI close. Press the Start button to start the motor. STOPPING: Opening any one of the safety gates or pressing the e-stop causes the motor to turn off. Closing the gate or releasing the e-stop does not cause the motor to start due to the start-stop interlocking circuit. To restart the motor, close the safety gate or release the e-stop. Then press the start button.
Operating Principle
If the PLC fails with its output closed, the safety relay will detect the difference between the safety gate and the PLC and stop the motor. A single fault (open or short) across one of the interlocks will be detected by the safety relay and the motor will be turned off. The motor will remain off until the fault is corrected or power is cycled. If either contactor K1 or K2 sticks ON - the motor will stop on command due to the other contactor, but the SI cannot be reset (thus the fault is revealed to the operator). A single fault detected on the SI input circuits will result in the lock-out of the system to a safe state (OFF) at the next operation of the safety gate or e-stop device. Contactors K1 and K2 are controlled by the safety system. Contactor K2 is controlled by both the machine control system and the safety system. This increases the probability of performance of the safety function because K1 is significantly less likely to weld at the same time as K2 due to the diversity of expected wear out times.
Fault Detection
The safety function initiated by the Trojan T15 and ELF-GD2 safety gate interlocks and the 800F e-stop meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Category 0 stop.
Ratings
- 10 R
SI, DIS, SensaGuard, E-Stops, PF525 with Contactor

SensaGuard Integrated Latch, E-Stop, SI, DI, 100S and PowerFlex 525
24V DC
SensaGuard Integrated Latches 440N-Z21SS3PA

Grey Red Pink Yellow
E-Stops 800FM-MT44 800F-MX02S

Grey Pink
Brown Red Yellow
Brown
Brown
K1
Grey Red Pink Yellow
L1 L2 L3
PowerFlex R S T 525 1 Stop 2 Start
Reset White Blue
Blue White
Gate Open Gate Open Gate Open
White Blue
4 Gnd
S12 S22 A1
RESET AM
S34 13 23
0
S12 S22 S11 S21 S42 S32 A1 S34 LOGIC

8 0 1 2 3
A1
SI 440R-S12R2
MM
DIS 440R-D22S2
6 5

S1 S2
S11 S21 A2 L11 Y32 14 24
L11 L12 A2 34 44 14 24 Y32
Status To PLC
K1
UV W K1
Status To PLC
100S-C09EJ14BC
24V DC Com
Circuit Status
The DIS Logic is set to 4: [(IN1 AND IN2) AND L12] with monitored reset. The SI is set for automatic reset. The SensaGuard Intgreated Latch interlocks are connected in series to the SI. The two e-stops are connected to inputs 1 (S12 and S22) and 2 (S32 and S42) of the DIS. The three gates, monitored by the SensaGuard Intergrated Latch interlocks, are closed and safety outputs of the SI (L11, 13/14 and 23/24) are ON. Both e-stops are released. The DIS safety outputs (14, 24, 34 and 44) are off and waiting for a reset signal. The PowerFlex 525 drive is powered but disabled. Contactor K1 is de-energized. The motor is off.
Operating Principle
STARTING: Press the Reset button to turn on the DIS safety outputs. This energizes K1, enables the drive and also applies power to the Start and Stop buttons. Press the Start buttons to start the motor. STOPPING: Press the Stop button to stop the motor for production stops. Press either e-stop or open any safety gate to initiate a safety stop; the motor coasts to a stop.
Fault Detection
Upon successful completion of internal checks by the SI, DIS, SensaGuard and PowerFlex 525 drive, the drive awaits the closure of the safety outputs. If the DIS fails, the drive will not energize the motor, and the fault will be detected by non-operation of the motor. The DIS generates test pulses through the e-stop circuits to detect cross channel shorts and shorts to power and ground. The SensaGuard interlocks generate test pulses on their outputs to detect cross channel shorts and shorts to power and ground. A fault in the safe-circuit of the drive will be detected by the drive and issue a safety stop. The mechanically linked contacts of K1 are monitored by the DIS to ensure that the contactor is de-energized before resetting the safety system.
Ratings
The safety functions initiated by the SensaGuard Integrated Latch interlocks and the e-stop meets the safety performance requirements of SIL CL3 per IEC 62061:2005 and a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO 13849-1: 2006. The circuit executes a Category 0 stop.
- 11R
Safeguarding Applications andWiring Diagrams
SensaGuard
SensaGuard, CI, 800F, 100S
+24V DC
Shown Open SensaGuard 2 3 7 1 4 8 56 SensaGuard 2 3 7 1 4 8 56 Start 800FMF3MX10 Stop 800FME4MX01 L1 L2 L3 41 K1 K1 K2
2 3 7 1 4 8 5 6 Brown Green Blue White (Aux) Yellow Red Gray (OSSD1) Pink (OSSD2) 18mm Cylindrical Plastic SensaGuard 440N-Z21S26H Cordset 889D-F8AB-2
Machine Control PLC Input (1756-IB16 1769-IQ16 1746-IB16 1792-IB16 I0 1734-IB4 I1 1793-IB6 I2 or similar) I3 Com
A1 S11 S12 L11 13 Auxiliary Signals to Machine Control System

RESET AM CI MM 440R-S13R2 S21 S22 S34 A2 14
23
33
RP
24
44
42
K2
M
K1 K2 100S-C43EJ14BC
24V DC Com
The first and third gates are closed. The second gate is open. The CI safety relay S12 and S22 inputs are open due to the open gate, and therefore, the CI safety outputs are open. The machine control PLC has a 24V auxiliary signal at terminal I1 from the second gate because the gate is open. The first and third auxiliary signals are off, as their gates are closed. The PLC also has an auxiliary signal from the CI indicating that the safety system is not ready. The motor is off.
Circuit Status
Operating Principle
STARTING: Closing the second gate satisfies the input of the CI. The CI verifies that both K1 and K2 contactors are off and energizes its safety outptus. Pressing the start button energizes the motor. The Stop/Start circuit is not part of the safety system and can be replaced by the machine control system (e.g., a PLC). STOPPING: Press the Stop button to turn the motor off, without affecting the status of the safety system. Opening any of the gates will cause the safety system to stop the motor.
Fault Detection
Upon successful completion of internal checks on power up, the SensaGuard interlocks check for 24V at pins 4 and 8. If the actuator is within range, the SensaGuard will activate its OSSD outputs. The OSSD outputs perform continuous checking for short circuits to 24V, ground and crossfaults. Upon detection of a fault, the OSSD outputs turn off. The CI also performs internal checks on powerup. It then checks for input signals. If OK, the CI checks the K1/K2/S34 monitoring circuit to determine whether both contactors are off. If one of the contactors gets stuck on, the other contactor will de-energize the motor, and the CI will detect the fault at the next attempt to start the motor. The contactors have mechanically linked auxiliary contacts to help ensure fault detection of the contactors.
Ratings
This safety performance of this circuit meets the requirements of SIL CL 3 per IEC 62061:2005 and has Category 4 structure and can be used in systems requiring Performance Levels up to PLe per ISO 13849-1:2006. The SensaGuard interlocks are designed to meet Category 4 when connected in series. The CI is rated to Category 4. The design and connection of the contactors meets category 4. This example circuit performs a Stop Category 0 function (coast to stop).
- 12 R
Light Curtain - Point of Operation Control

GuardShield, 800F, DI, 100S
+24V DC Start 800FMF3MX10 Restart (not used) EDM (not used) Aux Signal to PLC L1L2 L3 S11 S21 S12 S22
LOGIC
K1 K2
Transmitter 1 Brown
Receiver 2 8 4 6 5 1 7 3
Brown Red Yellow Pink Grey White Blue Green
Machine control system can replace this circuit arrangement.
Stop 800FME4MX01
Blue
440L-P4KL0960YD 889D-F4AC-2 889D-F8AC-2
A1
0 1 2 3 4
13
23 S34 K1
8 DI 7 6 5 440R-D22R2 S32 S42 L11 L12 A2
K2 14 24 Y32 Aux Signal to PLC

K1 K2 100S-C43EJ14BC
24V DC Com
Circuit Status
The lgiht curtain is clear and the motor is ready to run. The DI Relay is set for Logic 5 (L12 or IN1 or IN2 with Automatic Reset).
Operating Principle
STARTING: Press the Start button to energize contactors K2. The motor starts with the two normally open contacts of K1 and K2 holding circuit energized. STOPPING: Obstructing the light curtain de-energizes the safety outputs of the DI which in turn drops out K1 and K2. The contactors disconnect the motor from its power source, and the motor coasts to a stop. Clearing the obstruction in the light curtain does not cause the motor to
Upon successful completion of internal checks on power up, the GuardShield light curtain energizes its outputs with no objects present. The successful completion of internal checks, the DI checks the signals from the light curtain. If OK, the DI then checks the status of the K1 and K2 contactors. If either K1 or K2 fails in the actuated state, the other contactor will disconnect the motor. The DI will detect the faulted contactor and will not allow the motor to restart until the fault is corrected. Contactors K1 and K2 are controlled by the safety system. Contactor K2 is controlled by both the machine control system and the safety system. diversity of expected wear out times.
Fault Detection
Ratings
The safety function initiated by the GuardShield light curtain meets the safety performance requirements of SIL CL 3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This circuit executes a Category 0 stop.
- 13 R
Two Light Curtains - Point of Operation Control

GuardShield, 800F, DI, 100S
+24V DC Start 800FMF3MX10 K1 K2 Machine control system can replace this circuit arrangement.
Transmitter Brown 1
Blue 3
Receiver Brown 2 Pink 6 Grey 5 Blue 7 3 Green
Stop 800FME4MX01
440L-P4KL0960YD 889D-F4AC-2 889D-F8AC-2 S11 S21 S12 S22

LOGIC
A1
0 1 2 3 4
13
23 S34 K1
L1L2 L3
Transmitter Brown 1
Blue 3
8 DI 7 6 5 440R-D22R2 S32 S42 L11 L12 A2
14
24 Y32 Aux Signal to PLC
K2
440L-P4KL0960YD 889D-F4AC-2 889D-F8AC-2 24V DC Com
K1
K2
100S-C43EJ14BC
Circuit Status
The light curtains are configured with the factory default settings (Guard only mode) and is unobstructed. The outputs of the safety relay are closed, and the motor is ready to run. The DI Relay is set for Logic 6: [(IN1 AND IN2) OR L12] with Automatic Reset.
Operating Principle
STARTING: Press the Start button to energize contactor K2. The motor starts with the two normally open contacts of K1 and K2 holding the circuit energized. STOPPING: Obstructing either light curtain deenergizes the safety outputs of the DI which in turn drops out K1 and K2. The contactors disconnect the motor from its power source, and the motor coasts to a stop. Clearing the obstruction in either light curtain does not cause the motor to energize (the Start button must be pressed). The motor can also be turned off by pressing the stop button.
Fault Detection
Upon successful completion of internal checks on power up, the GuardShield light curtains energize their outputs with no objects present. If a crossfault is detected, the GuardShield light curtain goes to a lockout state with its outputs off. After successful completion of internal checks, the DI checks the signals from the light curtains. If OK, the DI then checks the status of the K1 and K2 contactors. If either K1 or K2 fails in the actuated state, the other contactor will disconnect the motor. The DI will detect the faulted contactor and will not allow the motor to restart until the fault is corrected. Contactors K1 and K2 are controlled by the safety system. Contactor K2 is controlled by both the machine control system and the safety system. This increases the probability of performance of the safety function because K1 is significantly less likely to weld at the same time as K2 due to the diversity of expected wear out times.
Ratings
The safety function initiated by the GuardShield light curtains meets the safety performance requirements of SIL CL 3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This circuit executes a Category 0 stop.
- 14 R
Lifeline
Lifeline, 800F, DI, 100S
+24V DC Start 800FMF3MX10 Stop 800FME4MX01
11 21 31 43 12 22 32 44
K1 K2
43 31 21 11 44 32 22 12
LifeLine 440E-L13042 (M20)
LifeLine 440E-L13043 (1/2in NPT)

Cable
L1 L2 L3 K1 K2
S11 S21 S12 S22 A1 13 23 S34

0 LOGIC 8 7 1 2 3 4
DI 440R-D22R2
6 5
S32 S42 L11 L12 A2 14 24 Y32

Aux Signal To PLC
K1
440A-A17173 800E-N157R 24V DC Com
855D-T10SC20B24Y4
K2 100S-C09EJ413BC
Circuit Status
Both Lifeline cable pull switches are taut and reset; their contacts are closed. The DI Logic setting is 6: [(IN1 AND IN2) OR L12] with automatic reset. The DI safety relay is energized, as its inputs and monitoring circuits are satisfied. The motor is off and ready to run.
Operating Principle
Two cable pull switches are used to protect an area from 10m to 70m in length. Auxiliary lights provide indication as to which switch has been actuated to stop the motor. The difference between the two switches is the conduit thread and shown for examples purposes. STARTING: Press the Start button to energize contactors K1 and K2. The motor starts and the two normally open contacts of K1 and K2 close to hold the circuit energized across the Start button. STOPPING: Pull the Lifeline cable or press the e-stop button on the Lifeline switch to de-energize the outputs of the DI and turn off the motor. To restart the motor, make sure the area is clear of hazards, pull out the e-stop button (if pressed) and rotate the reset knob to the Run position. Then press the Start button to start the motor. As an alternative, the motor can be stopped by pressing the Stop pushbutton. It can then be restarted by pressing the Start pushbutton.
Fault Detection
Upon successful completion of internal checks on power up, the DI checks its input curcuits. With both Lifeline switches reset, the DI checks the output contactors through the K1/K2/S34 circuit. If the contactors are off, the DI energizes its outputs and turns on the contactors which turn on the motor. A short or open circuit fault in the Lifeline cable pull switches will be detected by the DI. If either the K1 or K2 faults in the energized state, the motor will be stopped by the other contactor and the fault will be detected by the DI on the next attempt to restart. An internal fault in the DI will be detected by itself. Depending on the type of fault, the result wil be de-energization of the K1 and K2 contactors or prevention of re-start.
Ratings
The safety function initiated by the Lifeline cable pull switches meets the safety performance requirements of SIL CL3 per IEC 62061:2005 and has Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO 13849-1: 2006. The circuit executes a Category 0 stop.
- 15 R
Safety Distribution Block and DI with Kinextix 350

SensaGuard, Safety Distribution Block, E-stops, DI, Kinetix 350
Brown Red Yellow
24V DC SensaGuard 440N-Z21SS2HN
Status Signals
SensaGuard 440N-Z21S17H
Grey/Pink Red/Blue White/Green Brown/Green White/Yellow Yellow/Brown White/Grey Grey/Brown
Input 1756-IB16 1769-IQ16 1746-IB16 1734-IB4 1793-IB6
Input Output 1756-IV16 1756-OB16 1769-IV16 1769-OB8 PLC 1746-IV16 Processor 1746-OB4 1734-IV4 1734-OB2 1793-IV16 1793-OB4 +
Reset

889D-P88RT-M19
S11 S21 S22 S12 A1 13

LOGIC 0 1 2 3
23 S34
L1 L2 L3 Kinetix 350 Drive 1 +24V DC 2 Com 3 Status 4 Safety Input 1 5 Safety Common 6 Safety Input 2
Device Patchcord 889D-F8ABDM-2
Shorting Plugs 889D-81RU-DM
8 DI 4 7 6 5 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32

Pink Grey
Blue
Homerun Patchcord 889M-R19RMMU-2 Bulk Head use with bulkhead Receptacle or 888M-F19AE-1 Homerun Cordset 889M-R19RM-2
24V DC Com
Circuit Status
The Logic setting of the DI is set to 2 - monitored manual reset with [(Input 1 AND Input 2) OR L12]. The two E-Stops are in the released position and are connected in series to Input 1 (S12 and S22). The SensaGuards are closed and are connected in series through the Distribution Block to Input 2 (S32 and S42). The status of each SensaGuard is monitored by the PLC. The DI safety outputs (14 and 24) are OFF. The Kinetix 350 Drive is powered but the safety inputs are off; therefore the motor is OFF. The Y32 Aux Signal and 3 Status signal are OFF and inform the PLC that the safety system is ready to run. The PLC turns ON an output that enables the Reset of the safety system.
Operating Principle
STARTING: Press the Reset button to energize the safety outputs of the DI. The Y32 and 3 Status signals turn OFF. The Kinetix 350 drive is enabled. The PLC can not turn the motor ON (this circuit is not shown). STOPPING: Openting any gate or pressing any e-stop will de-energize the safety outputs of the DI, which in turn cause the output of the Kinetix drive to turn OFF . The motor will coast to a stop.
Fault Detection
Upon successful completion of internal checks on power up, the DI, Kinetix 350 and SensaGuard components are prepared for operation. The SensaGuard interlocks generate test pulses to check for short circuit faults to power and ground. The DI generates test pulses through the e-stop circuit to check for short circuit faults to power and ground.
Ratings
The safety functions initiated by the SensaGuard interlocks and the E-Stop buttons can meet the safety performance requirements of SIL CL 2 per IEC 62061:2005 and Performance Level PLd per ISO13849-1:2008. This application executes a Category 0 stop.
-16 R
Safety Valve - Air Supply Release

GuardShield, 800F, DI, Pneumatic Safety Valve
+24V DC E-Stop 800FM-MT44 800F-MX02S Reset 800FMF6MX10 DM2TM CrossflowTM SERPAR Safety Rated Valve Air Exhaust S11 S12 S21 S22 A1 13 23
LOGIC 0 1 2 3 4
Reset 800FMF6MX10
Air Supply
S34
Ch1
8 DI 7 6 5 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
Status Ch2
Transmitter Brown 1
Blue
Aux Signal to PLC
Air Outlet to other pneumatic valves
440L-P4K0960YD 889D-F4AC-2 889D-F8AC-2 24V DC Com
Circuit Status
The light curtain is clear and the e-stop button is released. The DI safety relay outputs are off and the pneumatic valve is closed. The DI safety relay Logic is set to 2: [(IN1 AND IN2) OR L12] with monitored manual reset.
Operating Principle
STARTING: Press the reset button to energize the output contacts of the safety relay. The two solenoids in the valve energize and allow air to flow from the Air Supply to the Air Outlet. STOPPING: Pressing the e-stop button or blocking the light curtain de-energizes the safety outputs of the DI, which in turn drops out the solenoids of the safety valve. The valve closes the Air Supply and releases the air pressure to the Air Exhaust. Releasing the e-stop button or clearing the light curtain does not cause the valve to turn back on.
Fault Detection
Upon successful completion of internal checks on power up, the DI checks the e-stop and light curtain status. If an open or short circuit is detected, the DI will not energize its outputs. If both input circuits are closed, the DI checks the status of the safety valve. If one or both solenoids of the safety valve are energized, the Status contact will be open, and the DI will not energize its outputs. If both solenoids are de-energized, the Status contact will be closed and the DI Reset button energizes the DI safety outputs and opens the safety valve. The safety valve performs its own internal checks. If one of the valves remains actuated, gets stuck or moves too slowly, the Air Outlet flow will be re-directed to the exhaust. To clear the fault condition, both valves must be deenergized and the valve reset button pressed.
Ratings
This safety function initiated by the 800F e-stop and the GuardShield light curtain meets the safety performance requirements of SIL CL 3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This example circuit performs a Stop Category 0 function (coast to stop).
- 17 R
DI with SensaGuard Integrated Latch and 525 Drive

SensaGuard Integrated Latch, E-Stop, DI, and PowerFlex 525
Red Yellow Brown
24V DC
Reset
L1 L2 L3
SensaGuard Integrated Latch 440N-Z21SS3PA White Grey Blue Pink
PowerFlex R S T 525 11 +24V DC
S11 S21 S12 S22 A1 13

LOGIC
8 7 0 1 2 3 4
23 S34
1 Stop 2 Start
6 5 DI 440R-D22R2 S42 S32 L11 L12 A2 14 24 Y32

S1 S2
UV W
Gate Open 24V DC Com
Circuit Status
The DI Logic is set to 2: [(IN1 AND IN2) OR L12] with monitored reset. The SensaGuard Light Latch interlock is connected to input 1 of the DI (S12 and S22). The e-stop is connected to input 2 of the DI (S32 and S42). The gate, monitored by the SensaGuard Light Latch, is closed and the e-stop is released. The DI safety outputs are off. The PowerFlex 525 drive is powered but disabled. The motor is off.
Operating Principle
STARTING: Press the Reset button to turn on the DI safety outputs. This enables the drive and also applies power to the Start and Stop buttons. Press the Start buttons to start the motor. STOPPING: Press the Stop button to stop the motor for production stops. Press the e-stop or open the safety gate to initiate a safety stop; the motor coasts to a stop.
Fault Detection
Upon successful completion of internal checks by the DI, SensaGuard and PowerFlex 525 drive, the drive awaits the closure of the safety outputs. If the DI fails, the drive will not energize the motor, and the fault will be detected by non-operation of the motor. The DI generates test pulses through the E-stop circuits to detect cross channel shorts and shorts to power and ground. The SensaGuard generates test pulses on its outputs to detect cross channel shorts and shorts to power and ground. A fault in the safe-circuit of the drive will be detected by the drive and issue a safety stop.
Ratings
The safety functions initiated by the SensaGuard Integrated Latch and the e-stop meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006. The circuit executes a Category 0 stop.
- 18 R
DI and EMD with Enabling Jog System

440G-MT, Enabling GripSwitch, DI, EMD, PowerFlex DriveGuard
24V DC
GripSwitch 440J N21TMPM-NP Jog Button Machine Controlled Jog Enable 1

3 5 6 2 4
L1 L2 L3
Grip Lever
PowerFlex 70 R S T w/ DriveGuard 9 +24V DC 7 DC Comm
8 Dig Comm
S11 S21 S12 S22 A1 13

11 21 33 43 12 22 34 44 11 21 33 43 12 22 34 44
LOGIC 8 0 1 2 3 4
23 S34 B1 B2 X32 A1 17 27 37 47
RANGE 9 8 1 1 TIME 2 2 3 10 3 4 9 4 5 7 8 6 5 7 6 0
2 Start
1 Stop Power Supply

Safe Off Option 1 3
Gate Control
EMD DI 7 6 5 440R-EM4R2D 440R-D22R2 L11 L12 A2 18 28 S32 S42 L11 L12 A2 14 24 Y32
38 48
4 2 5 Jog 6 Enable Gate Control Circuit
To PLC Input for Jog Enable
MT-GD2 440K-MT55050 440K-MT55026 440J-A04N
Remove Jumper U V W
24V DC Com
Circuit Status
The 440J Enabling Switch is held by two MT-GD2 interlocks. The DI safety outputs are closed. The PowerFlex Enable and Safe-off option are energized. The EMD safety outputs are de-energized. The DI Logic is set to 5: [(IN1 OR IN2) OR L12] with automatic reset. The EMD Range switch is set to 8 (Jog 10s) and the Time is set to 2 (20%), therefore the Jog will occur for 2s. The motor is ready to run.
Operating Principle
The EMD is chosen for its ability to perform timing functions. In this case, the EMD is set up to jog the PowerFlex drive with a single pulse having a duration set between 0.5 to 10 s by adjustments made by potentiometers on the EMD. While in the MT-GD2 holder, the Enabling switch is disabled, and the drive can be controlled by the machine control system. The Jog switch is disabled by the machine control system. STARTING: As shown, the PowerFlex drive is ready to run. Press the Start button. JOGGING: Close the 3-position GripSwitch to close the outputs of the DI and enable the drive. Remove the enabling switch from the MT-GD2 holder. The machine control system is notified that the GripSwitch has been removed and enables the jog switch. Press the Jog button on the GripSwitch to initiate the operation of the EMD. The EMD closes its safety outputs for the set duration. The Jog button must be held closed for the duration of the jog time. STOPPING: The jog function stops after the set time expires. To restart, momentarily release the jog button and then re-close it to repeat the jog. Releasing or squeezing the 3-position GripSwitch opens the outputs of the DI and the PowerFlex drive executes a coast to stop.
Fault Detection
Upon successful completion of internal checks by the DI, EMD and the PowerFlex drive, the drive awaits the closure of the EMD safety outputs. If the DI fails, the drive will not energize the motor and the fault will be detected by non-operation of the motor. The DI uses dual channel to detect faults to power, ground and cross channel faults on the Enabling switch or the MT-GD2. A short across the jog switch will be detected and a subsequent jog attempt will be prevented by the EMD. A fault in the Safe-Off option of the drive will be detected by the DI on the next attempt to restart the drive. Internal faults in the DI will result in non-opeation of the motor. Internal faults of the DI will result in non-operation of the jog function.
Ratings
The safety function initiated by the GripSwitch meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006. The circuit executes a Category 0 stop.
- 19 R
Guardlocking with DI and EMD

800F, TLS1-GD2, Trojan T15-GD2, DI, EMD, 700S
+24V DC CR1 Reset 800FM-F6MX10
L1 L2 L3 K1 K2
Gate Release TLS1 GD2 440G-T27171 Remove internal jumper from 12 to 41 11 21 12 22 41 53 42 54 33
800FM-MT44 800F-X02S
M1
L1 L2 L3
Power to Release
S11 S21 S12 S22 A1 13 23 S34

LOGIC
0 1 2 3 4
RANGE
9 8 7 6 5
B1 B2 X32 A1 17 27 37 47
0
TIME
8
A1 A2
34
1 2 3 4
10 9
7 DI 6 5 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
7 6
2 3 4
K3 K4 38 48
EMD 440R-EM4R2D L11 L12 A2 18 28
M2
11 21 Trojan T15-GD2 440K-T11397 700-HPS2Z24 K1 K2
CR1
K3
K4 700S-CFB440EJC
12 22 24V DC Com
700S-CFB440EJC
Circuit Status
The e-stop is reset and the safety gate is closed and locked. The outputs of the safety relays are open, and the motors are off. The rotary switches of the EMD device have the delay time set to 18 seconds (Range 3: 30 seconds OFF delay, Time 6: 60% of range). The EMD will open its contacts 18 seconds after the signal from the DI L11 output turns off.
Operating Principle
STARTING: Press the Reset button to energize the outputs of the DI. The outputs of the DI energize the K1 and K2 control relays and motor M1 starts. At the same time, the DI sends a signal via L11 to the EMD. The outputs of the EMD energize the K3 and K4 control relays and motor M2 starts. STOPPING: When the e-stop is pressed, the outputs of the DI open and motor M1 coasts to stop. After the time delay of the EMD expires, motor M2 coasts to a stop and the Y32 output energizes. The gate can be unlocked by pressing the Gate Release button. Press the Gate Release button to power the solenoid and open the Gate. Closing the Gate or resetting the e-stop does not re-energise the 700S control relays.
Fault Detection
Upon power-up, the DI and EMD perform internal checks. The DI then looks for signals from the e-stop and the TLS1 GD2 and Trojan T15. The e-stop has a self-monitoring contacts, which open if the contact block falls off the control panel. With the e-stop signals made, the DI checks the K1, K2, K3, K4 and TLS1 monitoring circuit when the reset button is pressed. If these checks are OK, the output energizes. The Reset Button is linked to the delayed Y32 output in order to supply +24V for reset only when delay time has lapsed. If any of the DI contacts faults to the ON state, the motor is stopped by the redundant outputs. The fault will be detected by the Y32, K1, K2, K3, K4 and TLS1 monitoring circuit on the next attempt to re-start. If the Gate is not interlocked by the TLS1 solenoid or one of the 700S control relays faults to the ON state, the DI will detect the fault in the Y32, K1, K2, K3, K4 and TLS1 monitoring circuit on the next attempt to reset. An additional interlock (Trojan T15) is added to the gate to to prevent potential single point failures related to tongue style interlocks.
Ratings
The safety function initiated by the gate interlocks and the e-stop meets the safety performance requirements of SIL CL3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This circuit executes Category 0 stops.
- 20 R
Interlock Switch with Enabling DeviceGuard Locking with Time Delay

GripSwitch, MT-GD2, 400G-MT, 800F, DI, EMD, 100S
24V DC Guardlocking Interlock 440G-MT47045 Primary Safeguard MT-GD2 Latch Release A 11 21 33 43 12 22 34 44 1 3 2 4 GripSwitch 440J-N21TNPM-NP 440J-A04N
K1
MT-GD2 440T-MT55076
K2
Start 800FM-F3MX10
11 21
33 43
12 22
34 44
Reset 800FM-F6MX10
B 11 21 33 43 12 22 34 44 Machine control system can replace this circuit arrangement. Stop 800FM-E4MX01
GripSwitch Jog Button L1 L2 L3
E-Stop 800FM-MT64 800F-X02S
S11 S21 S22 S12 A1 13 23 S34

LOGIC 0 1
B1 B2 X32 A1 17
RANGE 0 1 TIME
9 8 7 6 54 2 10 3 9
8 7 6 1 2 3 4 5
27 37 47
K1 Mirror Contacts K2
Lock Release 8 4 7 6 5 DI 800FM440R-D22R2 F2MX10 S32 S42 L11 L12 A2 14 24 Y32
2 3
EMD 440R-EM4R2D L12 L11 A2 18
28 38 48
M
24V Com
K1 K2 100S-D1405ZJ33LC
Circuit Status
The 440J GripSwitch is held by two MT-GD2 tongue interlocks by its mounting plate accessories. The safety gate is closed and the 440G-MT guard locking interlock is locked. The DI and EMD safety outputs are open. Contactors K1 and K2 are de-energized. The EMD Range switch is set to 8 (Jog 10s) and the Time is set to 2 (20%), therefore the Jog will occur for 2s. The motor is off and the application ready to run.
Operating Principle
The GripSwitch enabling device is used to access the hazardous area while the motor is running. The access is of the full body type. With the safety gate unlocked, the operator walks into the hazardous area with the GripSwitch. Before accessing the hazard area, the motor must be stopped. After entering the hazard area, the motor can be restarted with the GripSwitch. One MT-GD2 interlock is used to bypass the gate interlock safety circuit. The other MT-GD2 is used to reset the safety system and prevent the starting of the motor from outside the cell, when the GripSwitch is used. STOPPING: Press the Safety Stop. The immediate outputs of the DI open and the motor initiates a coast to stop. After the time expires on the EMD, the delayed outputs change state. The EMD outputs close and the safety gate can be unlocked. Press the lock release button to momentarily power the solenoid of the 440G-MT and open the gate. STARTING: Remove the enabling switch from the MT-GD2 holders. Squeeze the GripSwitch trigger to the middle position. The DI resets and closes its safety outputs and the motor is ready to run. Press the jog button on the GripSwitch to momentarily turn on the motor. STOPPING DURING ENABLING: Release the jog switch to stop the motor. Releasing or applying further pressure to the trigger switch on the GripSwitch will stop the motor.
Fault Detection
Upon successful completion of internal checks on power-up, DI checks the e-stop, gate and GripSwitch circuit. If the circuits are closed, the DI checks the reset circuit. Upon closure of the reset button, the DI checks the status of the contactors. Due to the size of the 100S-D contactors, mirrored contacts (on either side of the unit) are used to safely reflect the staus of the armature. If all mirrored contacts are closed, then the DI energizes its outputs. If one contactor welds in the closed state, the second contactor will shut off the motor and the fault will be detected by the DI, upon the next attempt to start the motor. Single channel faults on the input devices (GripSwitch, Interlocks and Stop switch) will be detected by the DI either on or before a demand is placed on the safety system (depending on the nature of the fault).
Ratings
The safety function initiated by the MT-GD2 guard locking interlock and the GripSwitch button meets the safety performance requirements of SIL CL 2 per IEC62061:2005 and has Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006. This example circuit performs a Stop Category 0 function.
- 21 R
Global E-Stop and Zone Control

GuardShield, SensaGuard, MatGuard, 800F, DI,100S
+24VDC E-Stop 800FM-MT44 800F-MX02L K1 K2 Reset 800FMF6MX10 MatGuard Safety Mat & Trim 440F-M2030BYNN 440F-T2030 SensaGuard 440N-Z21S26H K3 K4 Reset 800FMF6MX10 2 8 4 7 3 1
Brown Red Yellow Blue Green White (Aux) To PLC Pink (OSSD2) 6 Gray (OSSD1) 5
K5 K6 Reset 800FMF6MX10
S11 S21 S12 S22 A1 13 23 S34
S11 S21 S12 S22 A1 13 23 S34
S11 S21 S12 S22 A1 13 23 S34
0 LOGIC 8
DI 7 440R-D22R2 6 5 S32 S42 L11 L12 A2 14 24 Y32
1 2 3 4
0 LOGIC 8
DI 7 6 5 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
1 2 3 4
0 LOGIC 8
DI 7 6 5 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
1 2 3 4
Aux Signal to PLC

E-Stop 800FM-MT44 800F-MX02L 24V DC Com
2 1
A
2 4
3 5 3 5
Aux Signal to PLC K3 K4
2 1
B
2 4
3 5 3 5
Aux Signal to PLC K5 K6

100S-C09 EJ14BC
K1 K2
100S-C09 EJ14BC
GuardShield Safe 4 Light Curtain 445L-P4L1920YD
100S-C09 EJ14BC
GuardShield Safe 4 Light Curtain 445L-P4L0240YD
Circuit Status
The light curtains are unobstructed. The safety gate is closed. The e-stops are reset, and the safety mat is unoccupied. The outputs of all three DI relays are off. K1-K6 are ready to be energized.
Operating Principle
The DI is chosen as the safety relay for its zoning capability. The two e-stops operate globally - turning off relays 1, 2 and 3. STARTING: Press the reset button for relay 1 to energize its outputs. Then press the reset button for relays 2 and 3 to energize their respective outputs. STOPPING: Obstructing the light curtain A or stepping on the safety mat turns off the outputs of relay 2 while leaving the outputs of relay 1 and relay 3 energized. Obstructing the light curtain B or opening the safety gate with the SensaGuard interlock turns off the outputs to relay 3 while leaving the outptus of relay 1 and relay 2 energized. . Pressing either e-stop shuts down all three relays.
Fault Detection
Upon successful completion of internal checks on power up, the DI relays check their input circuits. Shorts from the inputs to power, ground or other inputs will be detected immediately and will prevent energization or will de-energize the respective outputs. If one of the 100S or 700S output devices (K1-K6) is stuck in an actuated state, the respective DI will prevent startup because the S34 feedback loop will remain open.
Ratings
The safety functions initiated by the input devices, except the safety mat, meet the safety performance requirements of SIL CL3 per IEC 62061:2005 and have Category 4 structures that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. The safety function initiated by the safety mat meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Category 0 stop.
- 22 R
E-Stops for a PowerFlex 755 Drive

800F, DI, PowerFlex 755
+24V DC L1 L2 L3 PowerFlex 755 Series Stop Status to PLC Start Start/Stop Common 24V DC Com Gate Control Power Supply SP+ SE+ SPSEGate Control Circuit
S11 S12 S21 S22 A1 13 23 S34

LOGIC 8 0 1 2 3
7 6 5 DI 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
Motor 24V DC Com
Circuit Status
The E-Stop is released. The safety outputs of the DI are energized. The PowerFlex 755 is powered and its safety circuit is enabled. The motor is off. The DI has a Logic setting of 5: [(IN1 OR IN2) OR L12] with automatic reset. The connections to Input 2 (S32 and S42) are ignored.
Operating Principle
STARTING: Press the start button or other equivalent machine control system (not shown) to start the motor. Although the DI is set for automatic reset, releasing the E-stop will not cause the motor to start rotating. STOPPING: Normal production is stopped by the Stop switch or other equivalent machine control system (not shown). The E-stop button will initiate a safety stop. The DI removes power to the Start/Stop circuit as well as the Gate Control Circuit. The motor executes a Safe Torque OFF function and the motor coasts to a stop.
Fault Detection
Upon power-up the PowerFlex drive and DI perform internal checks. The DI then looks for dual signals from the e-stop. A crossfault (channel 1 to channel 2) of the E-Stop will be detected immediately. The DI is rated for Category 4 and will not lose the safety function due to an accumulation of faults. The PowerFlex 755 Drive is rated at Category 3, as it will perform the safety function in the presence of a single internal fault.
Ratings
The safety function initiated by the e-stop meets the safety performance requirements of SIL CL3 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This circuit executes a Safe Torque OFF (Category 0) stop.
- 23 R
SafeZone Mini, E-stop and DI with Kinetix 350

SafeZone Mini, E-stop, DI, Kinetix 350
Brown
24V DC
Shield
Blue
Pink
Grey
SafeZone Mini 442L-SFZNMN 442L-ACABL210 (Cable)
White (Warning Field)
Input 1756-IB16 1769-IQ16 1746-IB16 1734-IB4 1793-IB6 Reset
Input Output + 1756-IV16 1756-OB16 1769-IV16 1769-OB8 PLC 1746-IV16 Processor 1746-OB4 1734-IV4 1734-OB2 1793-IV16 1793-OB4 +
S11 S21 S22 S12 A1 13 23 S34

LOGIC 8 0 1 2 3
7 6 5 DI 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
Warning Field
M
24V DC Com
Circuit Status
The Logic setting of the DI is set to 2 - monitored manual reset with [(Input 1 AND Input 2) OR L12]. The E-Stop is in the released position and is connected to Input 2 (S32 and S42) of the DI. The area scanned by the SafeZone Mini is clear and the signals to Input 1 of the DI (S12 and S22) are high. The Warning Field signal is connected to a PLC, which turns on an indicator and may also perform other logic. The DI safety outputs (14 and 24) are OFF. The Kinetix 350 Drive is powered but the safety inputs are off; therefore the motor is OFF. The Y32 Aux Signal is high, which informs the PLC that the safety system is ready to run.
Operating Principle
STARTING: Press the Reset button to energize the safety outputs of the DI. The Y32 status signal turns OFF. The Kinetix 350 drive is enabled. The PLC can not turn the motor ON (this circuitry is not shown). STOPPING: Entering the warning field of the SafeZone Mini scanner does not cause the safety system to turn off; but the PLC turns on an indicator. Entering the protective field of the SafeZone Mini scanner or pressing the E-Stop causes the DI safety relay to turn OFF, which disables the Kinetixt 350 drive. The motor coasts to a stop.
Fault Detection
Upon successful completion of internal checks on power up, the SafeSone Mini, DI, and Kinetix 350 are prepared for operation. The safety outputs of the SafeZone Mini generates test pulses to check for cross channel shorts and short circuit faults to power and ground . The DI generates test pulses through the e-stop circuit to check for cross channel shorts and short circuit faults to power and ground. NOTE: Do not replace the DI with the DIS as the pulse checking on the outputs of the DIS causes an F059 fault on the K350 safety inputs.
Ratings
The safety functions initiated by the SafeZone Mini and the E-Stop buttons can meet the safety performance requirements of SIL CL 2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Level up to PLd per ISO13849-1:2006. This application executes a Category 0 stop.
- 24 R
Multizone Scanner, E-Stop and DI with Kinetix 350

SafeZone Multizone, 800F, DI, Kinetix 350
A1 (Brown)
24V DC
Select Zone A (White/Red & White/Orange) Select Zone B (White/Yellow & White/Green) Warning Field (White/Brown) OSSD2 (Pink) OSSD1 (Grey)
Reset
442L-SFZNMZ Cable & Mem Module 442L-CSFZNMZ-10
SafeZone Multizone
Input Output 1756-IV16 1756-OB16 1769-IV16 1769-OB8 + PLC 1746-IV16 Processor 1746-OB4 1734-IV4 1734-OB2 1793-IV16 1793-OB4 +
A2 (Blue)
S11 S21 S22 S12 A1 13 23 S34

LOGIC 8 0 1
L1 L2 L3
2 3
7 6 5 DI 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
Kinetix 350 Drive 1 +24V DC 2 Com 3 Status 4 Safety Input 1 5 Safety Common 6 Safety Input 2
Warning Field
24V DC Com
Circuit Status
The Logic setting of the DI is set to 2 - monitored manual reset with [(Input 1 AND Input 2) OR L12]. The E-Stop is in the released position and are connected to Input 2 (S32 and S42) of the DI. The area scanned by the SafeZone Multizone is clear and the signals to Input 1 of the DIS (S12 and S22) are high. The Warning Field signal is connected to a PLC, which turns on an indicator and may also perform other logic. The DI safety outputs (14 and 24) are OFF. The Kinetix 350 Drive is powered but the safety inputs are off; therefore the motor is OFF. The Y32 Aux Signal is high, which informs the PLC that the safety system is ready to run.
Operating Principle
The PLC sends a pair of signals (a NC and a NO) to the SafeZone Multizone to switch the active zones between Zones A and B. The OSSD outputs respond to either zone. STARTING: Press the Reset button to energize the safety outputs of the DI. The Y32 status signal turns OFF. The Kinetix 350 drive is enabled. The PLC can not turn the motor ON (this circuitry is not shown). STOPPING: Entering the warning field of the SafeZone Multizone scanner does not cause the safety system to turn off; but the PLC turns on an indicator. Entering the protective field of the SafeZone Multizone scanner or pressing the E-Stop causes the DI safety relay to turn OFF, which disables the Kinetixt 350 drive. The motor coasts to a stop.
Fault Detection
Upon successful completion of internal checks on power up, the SafeSone Multizone, DIS, and Kinetix 350 are prepared for operation. The safety outputs of the SafeZone Multizone generates test pulses to check for cross channel shorts and short circuit faults to power and ground . The DI generates test pulses through the e-stop circuit to check for cross channel shorts and short circuit faults to power and ground. NOTE: Do not replace the DI with the DIS as the pulse checking on the outputs of the DIS causes an F059 fault on the K350 safety inputs.
Ratings
The safety functions initiated by the SafeZone Multizone and the E-Stop buttons can meet the safety performance requirements of SIL CL 2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This application executes a Category 0 stop.
- 25 R
Safety Sensor, E-Stop and DI with Kinetix 350

SC300, 800F, DI, Kinetix 350
24V DC
Brown
White
Green
Teach Pink Grey Reset
Blue Yellow SC300 442L-SAFCAM1 Cable 889D-F8FB-5
Red
Input Output + 1756-IV16 1756-OB16 1769-IV16 1769-OB8 PLC 1746-IV16 Processor 1746-OB4 1734-IV4 1734-OB2 1793-IV16 1793-OB4 +
S11 S21 S22 S12 A1 13 23 S34

LOGIC 8 0 1 2 3
7 6 5 DI 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
M
24V DC Com
Warning Field
Circuit Status
The Logic setting of the DI is set to 2 - monitored manual reset with [(Input 1 AND Input 2) OR L12]. The E-Stop is in the released position and is connected to Input 2 (S32 and S42) of the DI. The area scanned by the SC300 safety sensor is clear and the signals to Input 1 of the DI (S12 and S22) are high. The Warning Field signal is connected to a PLC, which turns on an indicator and may also perform other logic. The DI safety outputs (14 and 24) are OFF. The Kinetix 350 Drive is powered but the safety inputs are off; therefore the motor is OFF. The Y32 Aux Signal is high, which informs the PLC that the safety system is ready to run.
Operating Principle
STARTING: Press the Reset button to energize the safety outputs of the DI. The Y32 status signal turns OFF. The Kinetix 350 drive is enabled. The PLC can not turn the motor ON (this circuitry is not shown). STOPPING: Entering the warning field of the SC300 safety sensor does not cause the safety system to turn off; but the PLC turns on an indicator. Entering the protective field of the SC300 safety sensor or pressing the E-Stop causes the DI safety relay to turn OFF, which disables the Kinetixt 350 drive. The motor coasts to a stop.
Fault Detection
Upon successful completion of internal checks on power up, the SC300 safety sensor, DI, and Kinetix 350 are prepared for operation. The safety outputs of the SC300 safety sensor generates test pulses to check for cross channel shorts and short circuit faults to power and ground . The DI generates test pulses through the e-stop circuit to check for cross channel shorts and short circuit faults to power and ground. NOTE: Do not replace the DI with the DIS as the pulse checking on the outputs of the DIS causes an F059 fault on the K350 safety inputs.
Ratings
The safety functions initiated by the SC300 safety sensor and the E-Stop buttons can meet the safety performance requirements of SIL CL 2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels uo to PLd per ISO13849-1:2006. This application executes a Category 0 stop.
- 26 R
Hazardous Location
T15, 800F, 897H, DIS, PowerFlex 525

+24V DC
Wiring intrinsically safe systems must be identified as such through the use of light blue jacketing or appropriate labels. Such labels are required by NEC Article 504 and ANSI/ISA RP-12.6 to be placed at no more than 25 foot intervals. When installing intrinsically safe equipment, the user should refer to all relevant national standards and those standards set forth by the authority under jurisdiction at the installation site. Hazardous Location U.S. Class I,II,III, Div 1,2 European Zone 0,1,2, EExia IIB See Entity Parameters for 897H for Groups 1492-LD4RB272 (2.7K) Non-hazardous Location Galvanic Isolator 897H-G231 15 14 11 10 DIP Switch 1 2 3 4 Settings 1 0 1 0 1492-LD4RB223 (22K) 15 21 11 22 12 14 11 10 DIP Switch 1 2 3 4 Settings 1 0 1 0 4 5 6 3 1 2 7 8 9 4 5 6 3 1 2 7 8 9 Line Fault Line Fault
Reset
L1 L2 L3
S12 S22 S11 S21 S42 S32 A1 S34 LOGIC

8 7 6 5 0 1 2 3
4 Gnd
A1
DIS 440R-D22S2 L11 L12 A2 34 44 14 24 Y32

S1 S2
UV W
Status To PLC
Trojan T15 440K-T11395

24V DC Com
The DIS Logic is set to 2: [(IN1 AND IN2) OR L12] with monitored reset. The Trojan T15 is connected to input 1 of the DIS (S12 and S22) through the Galvanic Isolator. The e-stop is connected to input 2 of the DI (S32 and S42). The gate is closed and the e-stop is released. The DIS safety outputs are off. The PowerFlex 525 drive is powered but disabled. The motor is off.
Circuit Status
The galvanic isolator limits energy to the interlock switch, which is considered a simple apparatus in the hazardous location. The DIS safety relay checks the outputs of the galvanic isolator upon power-up and each time the gate/e-stop is actuated. STARTING: Press the Reset button to turn the DIS safety outputs (14, 24, 34, 44 and L11) ON. This enables the PF525 drive. Press the Start button to turn the motor ON. STOPPING: Normal production stopping is performed by pressing the Stop button. Opening the gate or pressing the e-stop initiates a safety stop; the motor coasts to a stop.
Operating Principle
The DIP switch setting of the galvanic isolator allows for open and short circuit detection of the tongue interlock switch, as well as opening the gate. The tongue interlock switch should be wired to both inputs (terminals 7 and 8) of the galvanic isolator to drive both outputs (1/5 and 2/3) of the galvanic isolator. A single fault will not cause a loss of safety function. If one output of the galvanic isolator fails in the closed state, the DIS safety relay will detect opening of the 2nd output and turn the drive and motor off. The motor will remain off until the fault is corrected or power is cycled. The Isolator DIP switches must be set for Line Fault Detection (1) and non inverted (0) output. The 1492 resistors are requried to detect line faults. Two isolators must be used to avoid potential common cause failures.
Fault Detection
The safety function initiated by the Trojan T15 interlock meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 1 structure that can be used in systems requiring up to Performance Level PLc per ISO13849-1:2006. Although the circuit shows dual channel, the very low diagnostic coverage of the Galvanic Isolator limits structure to Cat 1. The safety function initiated by the E-stop meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring up to Performance Level PLd per ISO13849-1:2006. This circuit executes a Category 0 stop.
Ratings
- 27 R

TM TM
Hazardous Location
Safedge , MatGuard , 800F, 897H, DIS, PowerFlex 525

+24V DC
Wiring intrinsically safe systems must be identified as such through the use of light blue jacketing or appropriate labels. Such labels are required by NEC Article 504 and ANSI/ISA RP-12.6 to be placed at no more than 25 foot intervals. When installing intrinsically safe equipment, the user should refer to all relevant national standards and those standards set forth by the authority under jurisdiction at the installation site. Hazardous Location U.S. Non-hazardous Location Class I,II,III, Div 1,2 Galvanic Isolator European 897H-G231 B Zone 0,1,2, EExia IIB See Entity Parameters for 897H for Groups 4 15 5 1492-LD4RB223 (22K) 6 14 11 Safedge with cable termination e.g. 440F-EAAAA00300 or MatGuard e.g. 440F-M2030BYNN 10 DIP Switch 1 2 3 4 Settings 1 0 1 0 3 1 2 7 8 9 Line Fault
Reset
L1 L2 L3
S12 S22 S11 S21 S42 S32 A1 S34 LOGIC

8 7 6 5 0 1 2 3
4 Gnd
A1
DIS 440R-D22S2 L11 L12 A2 34 44 14 24 Y32

S1 S2
UV W
Status To PLC
1492-LD4RB272 (2.7K)
24V DC Com
The DIS Logic is set to 2: [(IN1 AND IN2) OR L12] with monitored reset. The Safedge or MatGuard is connected to input 1 of the DIS (S12 and S22) through the Galvanic Isolator. The e-stop is connected to input 2 of the DI (S32 and S42). The gate is closed and the e-stop is released. The DIS safety outputs are off. The PowerFlex 525 drive is powered but disabled. The motor is off.
Circuit Status
The galvanic isolator limits energy to the Safedge or MatGuard, which is considered a simple apparatus in the hazardous location. The DIS safety relay checks the outputs of the galvanic isolator upon power-up and each time the gate/e-stop is actuated. STARTING: Press the Reset button to turn the DIS safety outputs (14, 24, 34, 44 and L11) ON. This enables the PF525 drive. Press the Start button to turn the motor ON. STOPPING: Normal production stopping is performed by pressing the Stop button. Depressing the Safedge, stepping on the MatGuard or pressing the e-stop initiates a safety stop; the motor coasts to a stop.
Operating Principle
The DIP switch setting of the galvanic isolator allows for open and short circuit detection of the Safedge or MatGuard. The 897H-G231 has a Hardware fault tolerance of zero. A single fault can lead to the loss of the safety function. The motor will remain off until the fault is corrected or power is cycled. The Isolator DIP switches must be set for Line Fault Detection (1) and non inverted (0) output. The 1492 resistors are requried to detect line faults.
Fault Detection
The safety function initiated by the Safedge and MatGuard meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 1 structure that can be used in systems requiring up to Performance Level PLc, per ISO 13849-1:2006. The safety function initiated by the e-stop meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring up to Performance Level PLd, per ISO 13849-1:2006. This circuit executes a Category 0 stop.
Ratings
- 28 R
PowerFlex Drive - Multiple Gate Access

Trojan 5 GD2, MT-GD2, DIS, PowerFlex 70
+24V DC Guard Shown Open 11 21 33 PowerFlex 70 with DriveGuard L1 L2 L3
12 22 440K-T11341 Trojan 5 GD2
34
1 Stop 2 Start
7 DC Comm 8 Dig Comm S11 S21 S12 S22 S32 S42 S34 A1 LOGIC
8 7 6 5 0 1 2 3 4
Gate Control Power Supply 1 3 Safe Off Option
DIS 440R-D22S2 L12 L11 Y32 A2 34
44 14
24
4 2 6 Enable Gate Control Circuit Remove Jumper
11
21
33 43
Aux Signal to PLC
12 440K-MT55080 MT-GD2 Latch Release 24V DC Com
22
34 44 Motor
Circuit Status
One of the gates is open. The safety outputs of the DIS are de-energized. The PowerFlex with DriveGuard is de-energized and not enabled. The motor is off. The DIS has a Logic setting of 6: [(IN1 AND IN2) OR L12] with automatic reset.
Operating Principle
STARTING: When the last gate closes, the safety outputs of the DIS close and apply power to the Drive Enable circuit, Safe-Off option, Start and Stop buttons. Pressing the Start and Stop buttons turns the motor on and off. The motor is controlled by parameters set within the PowerFlex drive. STOPPING: Opening any of the guard doors causes the DIS safety outputs to de-energize. This removes power to the PowerFlex Enable, Safe-Off, Start, and Stop circuits. The motor performs a coast to stop.
Fault Detection
Upon power-up the PowerFlex drive and DIS perform internal checks. The DIS then looks for dual signals from the gate interlocks. With the gates closed, the DIS checks the wiring of the drive Safe-Off option. If closed, then the DIS energizes its outputs and the motor can be started. A single open circuit fault at the gate interlocks will be detected immediately, and the motor will coast to a stop. A crossfault (channel 1 to channel 2) at the gate interlocks will be detected immediately. The DIS is rated for Category 4 and will not lose the safety function due to an accumulation of faults. The PowerFlex 70 DriveGuard is rated at Category 3, as it will perform the safety function in the presence of a single internal fault.
Ratings
The safety function initiated by the gate interlocks meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO138429-1:2006. This circuit executes a Category 0 stop.
- 29 R
Multiple PowerFlex Drives

Trojan 5 GD2, DIS, PowerFlex 70 with DriveGuard
+24V DC Gate shown open 11 21 33
L1 L2 L3 PowerFlex 70 R S T with DriveGuard DeviceNet Dig. Comm
L1 L2 L3 PowerFle 70x R S T with DriveGuard DeviceNet Dig. Comm Gate Control Power Supply Safe-Off Option 1 3 4 2
12 22 Trojan5-GD2 440K-T11213
34
S11 S21 S12 S22 S32 S42 S34 A1 LOGIC

8 7 0 1 2 3 4
Gate Control Power Supply Safe-Off Option 1 3 4 2
6 5 DIS 440R-D22S2 L12 L11 Y32 A2 34
44 14
24
Enable
Gate Control Circuit
Enable U V W Motor
U V W
Remove Jumper Input 1756-IB16 1769-IQ16 1746-IB16 1734-IB4 1793-IB6 24VC DC Com PLC DeviceNet Processor 1756-DNB 1769-SDN 1747-SDN 1734-PDN 1794-ADN
Remove Jumper Motor
Circuit Status
The safety gate is open. The DIS safety outputs (14, 24, 34, and 44) are off The Enable and Safe-Off Option on both PowerFlex drives are off. Auxiliary signals from the Trojan 5 GD2 (33/34) and the DIS (Y32) inform the PLC that the safety system is OFF. The motors of both drives are off. The Logic setting of the DIS is set to 5: [(IN1 OR IN2) OR L12] with automatic reset. This circuit is intended to show that multiple drives can be connected in parallel. The number of drives that can be connected in parallel is dependent on: the load (the safe-off option plus the enable of each drive), appropriate de-rating to prevent early wearout of the DIS solid state outputs, the application requirements (e.g., zoning) and the risk assessment (e.g., some drives may require separate safety systems).
Operating Principle
STARTING: Upon closing the gate, the Trojan 5 GD2 closes the safety inputs of the DIS (S32 and S42) and opens the signal to the PLC. The safety outputs of the DIS close and enable both PowerFlex drives. The auxiliary signal of the DIS opens. The PLC compares the gate and safety relay aux signals. When both signals are open, the PLC knows that the safety system is ready. The PLC can now start and control the drives over the DeviceNet network. The PLC must ensure that the drives are not started upon the closing of the gate; a separate, intentional action must initiate the motor movement (this is not shown in the diagram). STOPPING: Normal stopping is performed by the PLC. If the gate is opened, the input signals to the DIS open. The DIS opens its safety outputs which disable all the drives connected to them via the Safe-Off option. The drives perform an immediate coast to stop.
Fault Detection
Upon power-up, the DIS performs internal checks. The DIS then looks for dual signals from the Trojan5-GD2. If only one signal is present, or a crossfault exists, the DIS assumes a fault is present and does not energize its safety outputs. With the gate closed, the DIS checks the S34 monitoring circuit. If the Safe-Off options are de-energized, the DIS assumes the drives are off and are ready to be enabled. The DIS energizes its safety outputs. If the monitoring circuit remains open, the DIS assumes a fault is present and not allow its safety outputs to energize. Single point failures related to the tongue interlock are excluded if actuator speed, alignment and mechanical stops meet installation instruction requirements, and a periodic proof test confirms proper operation.
Ratings
The safety function initiated by the Trojan 5-GD2 gate interlock meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO 13849-1:2006. This circuit executes a Category 0 stop.
- 30 R
Micro 400 Light Curtain

Micro 400, 800F, MSR41, DIS, 100S
+24V DC Micro 400 445L-P4C0300FP 445L-AC8RJ5 (2x) Transmitter Receiver E-Stop 800FM-MT44 800F-MX02S K1 K2
Reset 800FMF6MX10 Status to PLC
IN1 IN2 24V

Rcv RJ45 Trans RJ45
S11 S12 S21 S22 L12 A1 Y32 S34

LOGIC
8 0 1 2 3 4
L1L2 L3 K1 K2
MSR41 440R-P221AGS INFO1 INFO2 OSSD1 OSSD2
0V
DIS 440R-D22S2 S32 S42 A2 34 44 14 24 L11
6 5
M
K1 K2
Lockout Status to PLC Safety Output Status to PLC

K1
Start
Stop K2 100S-C43EJ14BC
24V DC Com
Circuit Status
The light curtain is clear and the e-stop is released. The MSR41 outptus are energized. The safety outputs of the DIS are OFF. The motor is off. The DIS is ready for reset. The DIS has a Logic setting of 2: [(IN1 AND IN2) OR L12] with monitored manual reset.
Operating Principle
STARTING: Press the reset button to turn the DIS safety outputs ON. Press the Start button to turn the motor ON. The Start /Stop circuit operates only K2, as a planned maintnenace feature. K1 does not switch motor current on, but it can switch the motor current off when a demand is placed on the safety stystem. STOPPING: Normal production stopping is performed by pressing the Stop button. A safety stop can be accomplished by obstructing the light curtain or by pressing the e-stop. The motor performs a coast to stop.
Fault Detection
Upon power-up, the safety devices perform internal checks. The OSSD outputs of the MSR41 are pulse tested to check for crossfaults. The e-stop signals are pulse tested to check for crossfaults. The mechanically linked contacts of the 100S ensure that the contactors are off after a demand is placed on the safety system.
Ratings
The safety function meets the safety performance requirements of SIL CL3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This circuit executes a Category 0 stop.
- 31 R
Micro 400 Light Curtain

Micro 400, SensaGuard, 800F, MSR42, DIS, DI, 100S
+24V DC Micro 400 445L-P4E0300FP 445L-AC8RJ5 (2x) Transmitter Receiver SensaGuard 440N-Z21S26H 889D-F8AB-2 Mounted on Machine to Indicate Machine Position E-Stop 800FM-MT44 800F-MX02S 2 3 7 1 4 8 5 6 Brown Green Blue White (Aux) Yellow Red Gray (OSSD1) Pink (OSSD2)
Start 800FMF3MX10
K1 K2
Stop 800FME4MX01
Reset 800FMF6MX10
To PLC
IN1 Rcv RJ45 Trans RJ45 LAMP IN2 +24V GPIO1 GPIO2 GPIO3 GPIO4
S11 S21 S12 S22 L12 A1 Y32 S34

LOGIC
8 0 1 2 3 4
S11 S12 S21 S22 A1 13 23 S34

LOGIC
8 7 6 5 0 1 2 3 4
L1L2 L3 K1 K2
MSR42 440R-P221AGS
0V
INFO1 INFO2 OSSD1 OSSD2
DIS 440R-D22S2 S32 S42 A2 34 44 14 24 L11
6 5
DI 440R-D22R2 S32 S42 L11 L12 A2 14 24 Y32
To PLC
K1 K2
100S-C43EJ14BC 24V DC Com
Circuit Status
The light curtain is clear; the SensaGuard is closed; and the e-stop is released. The MSR42 and DIS safety outptus are energized. The safety outputs of the DI are OFF. The motor is off. The DI is ready for reset. The DIS has a Logic setting of 6: [(IN1 AND IN2) OR L12] with automatic reset. When the machine is in a specified postion, as detected by the SensaGuard, the light curtain is bypassed. When the machine moves away from the specified position, the SensaGuard turns OFF and the Micro 400 light curtain becomes active. The DI has a logic setting of 3: [(IN1 OR IN2) AND L12] with monitored manual reset; this makes the E-Stop effective (and the SensaGuard or Micro 400 light curtain) at all times.
Operating Principle
STARTING: Press the reset button to turn the DI safety outputs ON. Press the Start button to turn the motor ON. The Start /Stop circuit operates only K2, as a planned maintnenace feature. K1 does not switch motor current on, but it can switch the motor current off when a demand is placed on the safety stystem. STOPPING: Normal production stopping is performed by pressing the Stop button. A safety stop can be accomplished by obstructing the light curtain when the machine postion is not detected by the SensaGuard or pressing the e-stop. The motor performs a coast to stop.
Fault Detection
Upon power-up, the safety devices perform internal checks. The OSSD outputs of the MSR42 are pulse tested to check for crossfaults. The OSSD outputs of the SensaGuard are pulse tested to check for crossfaults. The single wire safety signal (L11 to L12) tests for faults to power and ground when active. The e-stop signals are pulse tested to check for crossfaults. The mechanically linked contacts of the 100S ensure that the contactors are off after a demand is placed on the safety system.
Ratings
The safety function meets the safety performance requirements of SIL CL3 per IEC 62061:2005 and has a Category 4 structure that can be used in systems requiring Performance Levels up to PLe per ISO13849-1:2006. This circuit executes a Category 0 stop.
- 32 R
Cat 1 Stop with Guardlocking Interlock and Proximity Sensors

TLS3-GD2, 871TM, GLP, PowerFlex 70
+24 VDC
L1 L2 L3
Gate Unlock Request
Reset & Gate Lock Request
Start
PowerFlex 70 R with DriveGuard

2 Start 1 Stop
ST
Safety Gate 11 21 A1 A2 33 X14 X24 51 A1 S54 S44 Y32 L12

LOGIC 9 8 7
Stop
41 51 12 22 34 42 52
GLP 440R-GL2S2P
0 1 SLS1 1 2 9 2 3 8 3 4 4 7 6 5 6 5
0
0 SLS2 1 2 9 3 8 4 7 6 5
7 DC Comm 8 Digital In Com
S12 S22 L61 A2 AP P12 P22 L11

Brown
1 3 4 2
Gate Control Power Supply
TLS3 GD2
Black
Black
6 Enable
Gate Open 24V DC Com
Proximity Sensors 871TM-N40NP30-D4 889D-F4AC-2
Blue Blue
Remove Jumper U V W
Circuit Status
The gate is closed and locked. The motor is off. The GLP is ready for reset. The GLP has a Logic setting of 2: (Category 1 Stop with Logic IN OFF), an Safe Limited Speed (SLS) setting of 3 (3Hz) and a Maximum speed setting of 2 (20Hz). The safety outputs (S11 & S21), the single wire safety output (L11) and the auxiliary output (Y32) are OFF. NOTE: Start the GLP logic configuration from 0 to configure S11 and S21 for use as safety outputs.
Operating Principle
STARTING: Press the Reset button to lock the gate and turn the GLP safety outputs ON. Press the Start button to turn the motor ON. STOPPING: Normal production stopping is performed by pressing the Stop button. Access through the safety gate is initiated by pressing the Gate Unlock Request button. The Y32 output of the GLP turns OFF and initiates a stop command to the drive. When the speed detected by the proximity sensors drops below the safe limited speed, the gate becomes unlocked and the safety outputs turn OFF. The PowerFlex drive goes to a safe off state. If the motor has not already stopped, the motor coasts to a stop. OVERSPEED: If the proximity sensors detect a speed greater than the maximum speed (20Hz), the auxiliary output (Y32), the safety outputs (S11 & S21) and the single wire safety output (L11) turn off. The PWR/Fault indicator flashes at a 3X rate. When the speed drops below the max speed limit, press the Reset button to clear the fault and energize the safety outputs.
Fault Detection
Upon power-up, the safety devices perform internal checks. The TLS3 has dual channel signals but does not checks for crossfaults. The GLP safety outputs are pulse tested to check for faults. The proximity sensors are continuously tested by requiring that both sensors cannot be OFF at the same time. The PowerFlex 70 requires two safety signals to enable the drive.
Ratings
The safety function meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Category 1 stop.
- 33 R
Cat 1 Stop with Guardlocking Interlock and Proximity Sensors

TLSZR-GD2, 872C, GLP, PowerFlex 525
+24 VDC Gate Unlock Request Reset & Gate Lock Request
L1 L2 L3
PowerFlex R S T 525 1 Stop
Safety Gate
Brown Red Yellow Green Grey Pink White Blue
2 Start
X14 X24 51 A1 S54 S44 Y32

LOGIC 9 8 7 1 SLS1 1 2 9 2 3 3 8 4 4 7 6 5 6 5 0
4 Gnd
GLP 440R-GL2S2P
0 SLS2 1 2 9 3 8 7 6 5 4

S1 S2
S12 S22 L61 A2 AP P12 P22 L11

Brown
TLS-ZR 440G-TZS21UPRH 889D-F8AC-2
Black
Black
UV W
M
Gate Unlocked Proximity Sensors 872C-D3NP12-D4 889D-F4AC-2
Blue Blue
24V DC Com
Circuit Status
The gate is closed and locked. The motor is off. The GLP is ready for reset. The GLP has a Logic setting of 2: (Category 1 Stop with Logic IN OFF), an Safe Limited Speed (SLS1) setting of 3 (3Hz) and a Maximum (SLS2) speed setting of 2 (20Hz). The safety outputs (S11 & S21), the single wire safety output (L11) and the auxiliary output (Y32) are OFF. NOTE: Start the GLP logic configuration from 0 to configure S11 and S21 for use as safety outputs.
Operating Principle
STARTING: Press the reset button to lock the gate and turn the GLP safety outputs ON. Press the Start button to turn the motor ON. STOPPING: Normal production stopping is performed by pressing the Stop button. Access through the safety gate is initiated by pressing the Gate Unlock Request button. The Y32 output of the GLP turns OFF and initiates a stop command to the drive. When the speed detected by the proximity sensors drops below the safe limited speed, the gate becomes unlocked and the safety outputs turn OFF. The PowerFlex drive goes to a safe off state. If the motor has not already stopped, the motor coasts to a stop. OVERSPEED: If the proximity sensors detect a speed greater than the maximum speed (20Hz), the auxiliary output (Y32), the safety outputs (S11 & S21) and the single wire safety output (L11) turn off. The PWR/Fault indicator flashes at a 3X rate. When the speed drops below the max speed limit, press the Reset button to clear the fault.
Fault Detection
Upon power-up, the safety devices perform internal checks. The TLSZR has OSSD outputs and checks for crossfaults. The GLP safety outputs are pulse tested to check for faults. The proximity sensors are continuously tested by requiring that both sensors cannot be OFF at the same time. The PowerFlex 45 performs its own internal safety checks, and requires two safety signals to enable the drive.
Ratings
The safety function meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Category 1 stop.
- 34 R
Safe Limited Speed with Guardlocking Interlock and Proximity Sensors

TLSZR-GD2, 871TM, GLP, PowerFlex 70
+24 VDC
L1 L2 L3 PowerFlex 70 with DriveGuard
9 24VDC 2 Start 1 Stop 3 Speed Select 1 7 DC Comm 8 Digital In Com Brown Red Yellow Green Grey Pink White Blue
R ST
Gate Unlock Request
Reset & Gate Lock Request
Safety Gate X14 X24 51 A1 S54 S44 Y32 L12

LOGIC 9 8 7
GLP 440R-GL2S2P
0 1 SLS1 1 2 9 2 3 3 8 4 7 6 5 4 6 5
0
0 SLS2 1 2 9 3 8 7 6 5 4
Gate Control Power Supply 1 3 4 2 6 Enable Gate Control Circuit
S12 S22 L61 A2 AP P12 P22 L11

Brown
TLS-ZR 440G-TZS21UPRH 889D-F8AC-2
Black
Black
Remove Jumper U V W
M
Proximity Sensors 871TM-N40NP30-D4 889D-F4AC-2
Blue Blue
24V DC Com
Circuit Status
The gate is closed and locked. The motor is off. The GLP is ready for reset. The GLP has a Logic setting of 4: (Safe Limited Speed with Logic IN OFF), a Safe Limited Speed (SLS) setting of 5 (5Hz) and a Maximum speed setting of 8 (2000Hz). The safety outputs (S11 & S21), the single wire safety output (L11) and the auxiliary output (Y32) are OFF. NOTE: Start the GLP logic configuration from 0 to configure S11 and S21 for use as safety outputs.
Operating Principle
STARTING: Press the Reset button to turn the GLP safety outputs and single wire safety output ON. Press the Start button to turn the motor ON. STOPPING: Normal production stopping is performed by pressing the Stop button. Access through the safety gate is initiated by pressing the Gate Unlock Request button. The Y32 output of the GLP turns ON and commands the PowerFlex drive to bring the motor to a safe slow speed (less than 5Hz). When the speed detected by the proximity sensors drops below the safe limited speed (5Hz), the gate becomes unlocked. The operator can enter the machine cell, as the motor continues to run at the safe slow speed. After leaving the cell and closing the gate, press the reset button to lock the gate and return the machine to production speeds.
Fault Detection
Upon power-up, the safety devices perform internal checks. The TLSZR has OSSD outputs and checks for crossfaults. The GLP safety outputs are pulse tested to check for faults. The proximity sensors are continuously tested by requiring that both sensors cannot be OFF at the same time. The PowerFlex 70 requires two safety signals to enable the drive. If the gate is unlocked and the motor speed increases beyond the safe limited speed, the GLP turns its safety and single wire safety outputs OFF. OVERSPEED: If the proximity sensors detect a speed greater than the maximum speed (2000Hz), the safety and the single wire safety outputs turn OFF. The PWR/Fault indicator flashes at a 3X rate. When the speed drops below the max speed limit, press the Reset button to clear the fault.
Ratings
The safety function meets the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Safe Limited Speed function.
- 35 R
Overspeed Only Detection

872C, GLP, PowerFlex 525
L1 L2 L3
+24 VDC Reset
11 +24V DC X14 X24 51 A1 S44 S54 Y32 L12

LOGIC 9 8 7 1 SLS1 1 2 9 2 3 3 8 4 4 7 6 5 6 5 0
800F-POT6
GLP 440R-GL2S2P
SLS2 1 2 9 3 8 7 6 5 4
12 Analog 13 Speed 14 Control

4 Gnd
S12 S22 L61 A2 AP P12 P22 L11

Brown

S1 S2
Black
Black
U V W
Blue Blue
24V DC Com
Proximity Sensors 872C-D8NP18-D4 (2) 889D-F4AC-2
The motor is off. The GLP is ready for reset. The GLP has a Logic setting of 1: (Cat 1Stop with Logic IN OFF), a Safe Limited Speed (SLS1) setting of 0 (0.5 Hz) and a maximum (SLS2) speed setting of 5 (200 Hz). Both E-Stops are closed. NOTE: Start the GLP logic configuration from 0 to configure X14 and X24 for use as safety outputs.
Circuit Status
The GLP is only used to execute a safety stop if the speed detected by the proximity sensors exceeds 200Hz. STARTING: Press the Reset button to turn the GLP safety outputs (X14 and X24) ON. This enables the PowerFlex 525 drive. Press the Start button to turn the motor ON. Adjust the 800F-POT6 to control the speed of the motor. STOPPING: Normal production stopping is performed by manually reducing the speed of the motor by turning the 800F-POT6 or by pressing the Stop button. If the speed detected by the proximity sensors exceeds 200Hz, the GLP safety outputs turn OFF. The PowerFlex 525 drive executes a Category 0 stop and the motor coasts to a stop. OVERSPEED: When the GLP detects overspeed, X14, X24 and L11 will turn OFF and the PWR/Fault indicator wiil show green with 4 red flashes. To recover, reduce the speed below the SLS2 setting and press the Reset button to re-enable the PowerFlex 525 drive.
Operating Principle
Upon power-up, the GLP and PowerFlex 525 perform internal checks. If the checks are completed safely, the GLP will be ready for reset. At least one proximity sensors must be ON.
Fault Detection
Ratings
The safety functions meet the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13829-1:2008. This circuit executes a Category 0 stop when the spped exceeds 200Hz.
- 36 R
Category 1 Stop with Guardlocking Interlock and Proximity Sensors

TLS3-GD2, 800F, 872C, GLP, DIS, PowerFlex 70
+24 VDC Gate Unlock Request Reset & Gate Lock Request 800FM-MT44MX02V E-Stop
Stop PowerFlex 70 with DriveGuard
2 Start 1 Stop
L1 L2 L3 R ST
Start
Safety Gate 11 21 A1 A2 33 41 51 34 42 52
X14 X24 51 A1 S54 S44 Y32 L12

LOGIC 9 8 7
0 1 SLS1 1 2 9 2 3 3 8 4 4 7 6 5 6 5
S11 S21 S22 S12 S42 S32 A1 Y32

LOGIC
8 7 6 5 0 1 2 3 4
A1
Safety Status to PLC
7 DC Comm 8 Digital In Com
12 22
GLP 440R-GL2S2P
0 SLS2 1 2 9 3 8 4 7 6 5
Gate Control Power Supply 1 3 4 2 6 Enable Gate Control Circuit
DIS 440R-D22S2
S12 S22 L61 A2 AP P12 P22 L11

Brown
Reset
L11 L12 A2 34 44 14 24 S34
TLS3 GD2 440G-T27183 Gate Status to PLC 24V DC Com
Black
Black
Remove Jumper U V W
Proximity Sensors 872C-M8NP18-D4 889D-F4AC-2
Circuit Status
The gate is closed and locked. The motor is off. The GLP is ready for reset. The GLP has a Logic setting of 1: (Cat 1 Stop with Logic IN OFF), a Safe Limited Speed (SLS) setting of 9 (10 Hz) and a maximum (MAX) speed setting of 7 (1000 Hz). Both E-Stops are closed. The DI is configured to setting 4 (IN1 AND IN2 AND LOGIC IN with monitored manual reset). NOTE: Start the GLP logic configuration from 9 to configure X14 and X24 for use with safety inputs.
Operating Principle
STARTING: Press the Reset button to turn the GLP safety output (L11) ON. This enables the DI relay. Press the Reset button to turn the DI outputs ON and enable the Safe-Off Option of the PowerFlex Drive. Press the Start button to turn the motor ON. STOPPING: Normal production stopping is performed by pressing the Stop button. Access through the safety gate is initiated by pressing the Unlock Request button. The Y32 output of the GLP turns OFF and initiates a stop command to the drive. When the motor speed drops below the safe limited speed, the GLP unlocks the gate and turns its L11 safety output OFF. Subsequently the DI turns its safety outputs off, and the PowerFlex drive goes to a Safe-Off state. The motor, if not already stopped, coasts to a stop. The E-stop buttons can be used to initiate a coast-to-stop. Press the e-stop and the DI outputs turn off, which causes the PowerFlex drive to execute a Safe-Off function. The motor coasts to a stop.
Fault Detection
Upon power-up, the safety devices perform internal checks. The GLP and DI send out test pulses on X14 and X24 to check for faults on the guardlocking switch and e-stops. The GLP checks to see that the proximiity sensors are connected, by requiring that both sensors cannot be OFF at the same time. The L11/L12 connection is Single Wire Safety connection tested for shorts to power or ground when active. The DIS outputs 14 & 24 are pulse tested to check for shorts to power and ground. The DIS outputs 34 & 44, which are not pulse tested, should be used for compatibility with devices that cannot tolerate the pulse testing.
Ratings
The safety functions meet the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Category 1 stop when requesting gate access through the GLP, and a Category 0 stop when pressing the e-stops.
Blue Blue
- 37 R
Safe Limited Speed with Guardlocking Interlock and Proximity Sensors

TLS3-GD2, 800F, 872C, GLP, DI, PowerFlex 525
+24 VDC Gate Unlock Request Reset & Gate Lock Request E-Stop 800FM-MT44 800F-MX02S
Reset
L1 L2 L3
Safety Gate 11 21 A1 A2 33
5 Preset Freq (SLS) X14 X24 51 A1 S54 S44 Y32 L12

0 1 SLS1 1 2 9 2 9 3 3 8 8 4 4 7 7 6 5 GLP 6 5
LOGIC
SLS2
9 8 7 6 5
41 51 12 22 34 42 52
1 2 3 4
S11 S12 S21 S22 A1 13 23 S34 LOGIC 0

6 DI 440R-D22R2 8 7 5 1 2 3 4
4 DC Com
S1 S2
440R-GL2S2P
S12 S22 L61 A2 AP P12 P22 L11

Brown
S32 S42 L11 L12 A2 14 24 Y32
TLS3 GD2 440G-T27183 Gate Open 24V DC Com
Black
Black
UV W
Proximity Sensors 872C-D8NP18-D4 889D-F4AC-2
Blue Blue
The gate is closed and locked. The motor is off. The GLP is ready for reset. The GLP has a Logic setting of 3: (Safe limited Speed with Logic IN OFF), a Safe Limited Speed (SLS) setting of 9 (10 Hz) and a maximum (MAX) speed setting of 7 (1000 Hz). Both E-Stops are closed. The DI is configured to setting 4 (IN1 AND IN2 AND LOGIC IN with monitored manual reset). The single wire safety output (L11) and the GLP auxiliary output (Y32) are OFF. The DI safety outputs are off and the DI auxiliary output (Y32) is ON . NOTE: Start the GLP logic configuration from 9 to configure X14 and X24for use with safety inputs.
Circuit Status
STARTING: Press the Reset button to turn the GLP safety outputs (L11) ON. This enables the DI relay. Press the Reset button to turn the DI outputs ON and enable the PowerFlex Drive. Press the Start button to turn the motor ON. STOPPING: Normal production stopping is performed by pressing the Stop button. Access through the safety gate is initiated by pressing the Gate Unlock Request button. The Y32 output of the GLP turns ON and commands the PowerFlex drive to bring the motor to a safe slow speed (less than 10Hz). When the speed detected by the proximity sensors drops below the safe limited speed (10Hz), the gate becomes unlocked. The operator can enter the machine cell, as the motor continues to run at the safe slow speed. After leaving the cell and closing the gate, press the reset button to lock the gate and return the machine to production speeds. The E-stop buttons can be used to initiate a coast-to-stop. Press the e-stop and the DI outputs turn off, which commands the drive to a safe off state. The motor coasts to a stop.
Operating Principle
Upon power-up, the safety devices perform internal checks. The GLP and DI send out test pulses on S11 and S21 to check for faults on the guardlocking switch and e-stops. The GLP checks to see that the proximiity senors are connected, by requiring that both sensors cannot be OFF at the same time. The L11/L12 connection is Single Wire Safety connection tested for shorts to power or ground when active.
Fault Detection
Ratings
The safety functions meet the safety performance requirements of SIL CL2 per IEC 62061:2005 and has a Category 3 structure that can be used in systems requiring Performance Levels up to PLd per ISO13849-1:2006. This circuit executes a Safe Limited Speed function when requesting gate access through the GLP, and a Category 0 stop when pressing the e-stops.
- 38 R
E-Stops with Speed Monitored Guardlocking Interlock and Contactors

TLS-GD2, 872C, GLP, DI and Contactors
E-Stops 800FM-MT44 800F-MX02S K1 K2 Reset External StartStop Control K1 K2
24 Y32
+ 24V DC Reset & Gate Lock Request TLS3-GD2 440G-T27260

11 21 33 12 22 34 A1 A2 41 51 42 52
Gate Unlock Request SLS Request to PLC
X14 X24 51 A1 S44 S54 Y32 L12
S11 S12 S21 S22 A1 13
23 S34
LOGIC
9 8 76 5
Solenoid
GLP 440R-GL2S2P
1 2 3 4
SL1
9 8 7 6 5
1 2 3 4
SL2
9 8 7 6 5
1 2 3 4
LOGIC
6 5 DI 440R-D22R2 8 7
1 2 3 4
S12 S22 L61 A2 AP P12 P22 L11
S32 S42 L12 L11 A2 14
Gate Open
Brown Brown
Blue Blue
Black
Black
100S-C09EJ14BC
K1 K2
872C-D8NP18-E5 (2) 24V DC COM
Circuit Status
The gate is closed and locked. The motor is off. The GLP is ready for reset. The GLP has a Logic setting of 3: (Safe Limited Speed with Logic in OFF), a Safe Limited Speed (SL1) setting of 1(1 Hz) and a maximum (SL2) setting of 8 (2000Hz). The single wire safety output (L11) and the auxiliary output (Y32) are OFF. NOTE: Start the GLP configuration from 9 to configure X14 and X24 as test pulse outputs for use with the electromechanical TLS3-GD2 contacts. Both E-Stops are released. The DI is ready for reset.
Operating Principle
STARTING: Press and release the Reset button of the GLP. The gate locks, and the L11 output turns ON. Press and release the reset button of the DI. The DI safety contacts close and energize the contactor coils. The external start-stop control can now start the motor. STOPPING: Normal production start-stop is performed by an external start-stop control. When an E-Stop is pressed the DI immediately de-energizes the two contactors. The motor coasts to a stop. When the speed detected by the proximity sensors drops below the safe limited speed (1Hz) the GLP unlocks thegate. The operator can safely enter the guarded area. After leaving the area and closing the gate the operator presses and releases the GLP reset button to lock the gate. The E-Stops must be released before the DI can be reset. Press and release the DI reset to energize the contactors. The external circuit can nowstart the motor. OVERSPEED: If the GLP detects a speed greater than the maximum speed (2000Hz), the GLP single wire safety output L11 turns OFF. The DI de-energizes the two contactors and the motor coasts to a stop. The gate can not be unlocked until speed is less than 1 Hz. Should the speed increase above safe limited speed while the gate is unlocked, the GLP turns OFF its safety outputs..
Fault Detection
Upon power-up, the safety GLP and DI perform internal checks. The GLP and DI check their input devices for faults. The proximity sensors are constantly monitored by requiring that only one sensor is OFF at any time. An auxiliary NC contact from each contactor is connected in series with the DI reset contact so that should a contactor become welded closed the DI cannot be reset; the motor cannot be started.
Ratings
Emergency stop initiated by an E-Stop (2): These safety functions meet the safety performance requirements of SIL3 per IEC 62061: 2005 and have a Category 4 structure, can be used in systems requiring Performance Levels up to PLe per ISO 13849-1:2006 and execute a category 0 stops. Emergency stop initiated by an an Overspeed: This safety function meets the safety performance requirements of SIL2 per IEC 62061: 2005 and has a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1:2006 and executes a category 0 stop. Prevention of access while dangerous motion is present: This safety function meets the safety performance requirements of SIL2 per IEC 62061: 2005 and has a Category 3 structure and can be used in systems requiring Performance Levels up to PLd per ISO 13849-1:2006. Prevention of unexpected start-up (Gate Monitoring): This safety function meets the safety performance requirements of SIL2 per IEC 62061:2005 and has a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1:2006. The system can not started if stopped nor put into production speed from safe limited speed unless the gate is closed and locked.
- 39 R
Safe Limited Speed with Guardlocking, E-stops and Servo Drive

440G, 800F, 872C, GLP, DI, K300 Servo
Drive Status to PLC +24V DC Gate Unlock Request SLS Request to PLC
0
LightLatch 440G-LZS21SPRA
Reset & Gate Lock Request Green
Yellow
Red
Reset
Grey
White
Stop/Start/SLS Commands from PLC K300
Blue
Brown
Pink
X14 X24 51 A1 S44 S54 Y32 L12
S11 S12 S21 S22 A1 13
23 S34
LOGIC
9 8
GLP 440R-GL2S2P
76 54
1 2 3
SL1
9 8 7 6 5
1 2 3
SL2
9 8 7 6 5
1 2 3
LOGIC
7 DI 6 5 440R-D22R2 8
1 2 3 4
S12 S22 L61 A2 AP P12 P22 L11
S32 S42 L12 L11 A2 14
24 Y32
Safe Torque-off (STO) Connector With Wiring Header Status Safety Input 1 Safety Common Safety Input 2
Black Brown Brown 872C-D8NP18-E5 (2)
Black Blue Blue
Gate Open - Unlocked
E-Stops 800FM-MT44 800F-MX02S
Circuit Status
24V DC COM
The gate is closed and locked. The motor is off. The E-Stops are released and the DI is ready for reset.The GLP is ready for reset. The GLP has a Logic setting of 3: Safe Limited Speed with Logic in OFF, a Safe Limited Speed (SL1) setting of 0 (0.5 Hz) and a maximum (SL2) setting of 4 (100Hz). The single wire safety output (L11) and the auxiliary output (Y32) are OFF. NOTE: Start the GLP configuration from 0 to configure the GLP to accept OSSD inputs at S12 and S22.
Operating Principle
STARTING: The GLP must be started before the DI. Press and release the Reset button of the GLP. Press and release the reset button of the DI to close its safety contacts allow start of the motor by the PLC system. STOPPING: Normal production stopping is performed by the PLC control system. When an E-Stop is pressed the DI immediately opens its safety contacts controlling the Safe Torque Off of the drive. The drive removes power to the motor and the motor coasts to a stop. SAFE LIMITED SPEED (SLS): When the Unlock Request button is pressed and released the GLP Y32 output sends a SLS request to the PLC control system. The PLC system instructs the drive to go to speed less than 0.5Hz. When the GLP senses that the motion is at, or below, SLS the GLP unlocks the gate. The operator can open the gate and enter the guarded area. After leaving the guarded area the operator closes the gate and presses and releases the Reset and gate Lock button to lock the gate and end the SLS request. The Y32 signal turns off and the PLC control system is free to instruct the drive to go back to production speed. OVERSPEED: When the GLP detects a speed greater than the maximum speed (100Hz), the GLP turns OFF its L11 single wire safety signal. The DI immediately opens its safety contacts de-energizing the Safe Torque Off of the drive. The drive removes power to the motor and the motor coasts to a stop. The GLP PWR/Fault LED flashes at a 3X rate. When the speed drops below 100(Hz) pressing and releasing the Reset/Gate Lock button will reset the GLP and turn its L11 Single Wire Safety signal ON. Pressing and releasing the DI reset button closes its safety contacts energizing the Safe Torque Off and allowing the PLC control to return the drive to production speed. Should the speed increase above safe limited speed while the gate is unlocked the GLP turns OFF its single wire safety. The DI immediately opens its safety contacts controlling the Safe Torque Off of the drive. The drive removes power to the motor and the motor coasts to a stop.
Fault Detection
Upon power-up, the SI and GLP perform internal checks. The SI and GLP check their input devices for faults. The 440G checks its OSSD outputs for faults. The prox-imity sensors are constantly monitored by requiring that only one sensor is OFF at any time. The K300 monitors the status of its inputs and outputs performs internal checks.
Ratings
Emergency stop initiated by an E-Stop (2): These safety functions meet the safety performance requirements of SIL2 per IEC 62061: 2005 and have a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006 and execute a category 0 stop. Emergency stop initiated by an an Overspeed: This safety function meets the safety performance requirements of SIL2 per IEC 62061: 2005 and has a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006 and executes a category 0 stop. Prevention of access while dangerous motion is present: This safety function meets the safety performance requirements of SIL3 per IEC 62061: 2005 and has a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1 : 2006 Prevention of unexpected start-up (Gate Monitoring): This safety function meets the safety performance requirements of SIL2 per IEC 62061: 2005, has a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006. The system can not be started, if stopped, nor put into production speed from safe limited speed unless the gate is closed and locked.
- 40 -
Speed Monitoring with Guardlocking, E-Stops and Drive

TLS-ZR, GLP, DI, EMD and PF 525
+24V DC
E-Stop 800FM-MT44 800F-MX02S Reset
L1 L2 L3
Reset & Gate Lock Request Gate Unlock Request PowerFlex R S T 525 1 Stop 2 Start
B1 B2 X32 A1 17 27 37 47 Range Time
1 0 2 3 4 9 8 5 2 6 1 7 34 5 9 6 7 8 10
440GTSZ21UPRH
X14 X24 51 A1 S44 S54 Y32 L12

LOGIC
0
Brown Red
Yellow Green
TLS-ZR
GLP 7 6 5 440R-GL2S2P
9 8
1 2 3 4
SL1
9 8 7 6 5
1 2 3 4
SL2
9 8 7 6 5
1 2 3 4
S11 S12 S21 S22 A1 13 0 LOGIC 1

8
23 S34
4 Gnd
DI 440R-D22R2
6 5
2 3
S12 S22 L61 A2 AP P12 P22 L11
S32 S42 L12 L11 A2 14
24 Y32
EMD 440R-EM4R2D

S1 S2
L12 L11 A2 18 28 38 48
889D-F8AC-5 White Blue Grey Pink
Black
Black
Brown Gate Unlocked Brown
UV W
Blue Blue E-Stop 800FM-MT44 800F-MX02S
872C-D8NP18-E5 (2)
24V DC COM
Circuit Status
The gate is closed and locked.The motor is off. The GLP is ready for reset. The GLP has a Logic setting of 3: (Safe Limited Speed with Logic In OFF), a Safe Limited Speed (SL1) setting of 1(1 Hz) and a maximum speed (SL2) setting of 7 (1000Hz). The single wire safety output (L11) and the auxiliary outputs (Y32) are OFF. The E-Stops are released and the DI is ready for reset. The EMD is configured to provide a 9 second (30% of the 30s Range) OFF delay . NOTE: Start the GLP configuration from 0 to accept OSSD inputs at S12 and S22.
Operating Principle
STARTING: The GLP must be started before the DI. Press and release the Reset button of the GLP. The gate locks. The single wire safety (L11) of the GLP turns ON. Press and release the reset button of the DI. The DI closes its safety contacts enabling the PF525 Start-Stop buttons and its L11 turns ON. The EMD closes its safety contacts enabling the PF525 Safe Off. Press the Start button to start the motor. STOPPING: Normal production stopping and starting is performed using the Start-Stop buttons. When an E-Stop is pressed the DI immediately turns OFF its (L11) single wire safety signal. Simultaneously the DI safety contacts open providing a stop signal to the drive. The drive controls the motor to a stop. After the 9 second OFF delay the EMD contacts open removing 24V from the PF252 Safe Off inputs. The PF525 removes power to the motor. The motor, if still turning, coasts to a stop. When the speed detected by the proximity sensors drops below the Safe Limited Speed (1Hz), the operator can press the Unlock button and open the gate. At any time, the operator can press the Unlock button to initiate a controlled stop. After the EMD time expires, its X32 output goes to 24V to enable the resetting of the DI relay. OVERSPEED: If the GLP detects a speed greater that 1000Hz, the GLP single wire safety output (L11) turns OFF. The DI safety contacts open providing a stop command to the drive. The drive stops the motor. After 9 seconds the EMD safety contacts open and removes the signals to the safe off inputs fo the PF525. The motor then coasts to a stop if it is still running.
Fault Detection
Upon power-up, the TLSZR, GLP, DI, EMD and PF 525 perform internal checks. The GLP checks its prox, gate, reset and unlock inputs and its L11 output. The DI generates test pulses to check for faults at its inputs and also checks for shorts at the L11 output. The 440G checks its OSSD outputs for faults.The proximity sensors are constantly monitored by requiring that only one sensor is OFF at any time. The PF525 monitors the status of its inputs and outputs performs internal checks.
Ratings
Emergency stop initiated by an E-Stop (2): These safety functions meet the safety performance requirements of SIL2 per IEC 62061: 2005, have a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1 : 2006 and execute a category 1 stop. Emergency stop initiated by an an Overspeed: This safety function meets the safety performance requirements of SIL2 per IEC 62061: 2005, has a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006 and executes a category 1 stop. Prevention of access while dangerous motion is present: This safety function meets the safety performance requirements of SIL2 per IEC 62061: 2005,has a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006. Prevention of unexpected start-up (Gate Monitoring): This safety function meets the safety performance requirements of SIL2 per IEC 62061: 2005, has a Category 3 structure, can be used in systems requiring Performance Levels up to PLd per ISO 13849-1: 2006. The system cannot be started if stopped, nor put into production speed from safe limited speed, unless the gate is closed and locked.
- 41 R
Rockwell Automation, Allen-Bradley, MatGuard, GuardShield, SensaGuard, Elf, Lifeline, Trojan, Safedge, MatGuard, Kinetix, GuardMotion, PowerFlex and DriveGuard are trademarks of Rockwell Automation, Inc.
Publication SAFETY-WD001E-EN-P October 2013
Copyright 2013 Rockwell Automation, Inc. All rights reserved.

GSR Applications and Wiring Diagrams

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

GSR Applications and Wiring Diagrams

Uploaded by

Copyright:

Available Formats

Safety Applications and Wiring Diagrams

16 iring NEW W s m Diagra

Next Generation Safety Monitoring Relays

Safety Applications and Wiring Diagrams

Cat. Stop # Cat.

d 3 0 d 3 0 d 3 0 e 4 1 e 4 0 e 4 0 e 4 0 e 4 0 d 3 0 e 4 0 0 e 4 0 e 4 0 e 4 d 3 0 e 4 0 0 d 3 d 3 0 0 e 4 d 3 0 d,e 3,4 0 e 3 0 d 3 0 d 3 0 d 3 0 d 3 0 c/d 1/3 0 d 3 0 d 3 0 e 4 0 e 4 0 d 3 1 d 3 1 d 3 SLS d 3 0 d 3 1 d 3 SLS d 3 0 d 3 SLS d 3 0

Safeguarding Applications and Wiring Diagrams

Next Generation GSR Safety Monitoring Relays

General Safety Information

Safeguarding Applications and Wiring Diagrams

SI with E-stop to 525 Drive

E-Stop 800FM-MT44 800F-MX02S

S11 S21 S34

Gate control power supply Gate control circuit

S22 S12 Y32 L11 A2

Safety Applications and Wiring Diagrams

Safety Relay to Flex I/O

12 22 Trojan T15 GD2 440K-T11390 889D-F4AC-2 Blue

S12 S22 A2 L11 Y32 14 White

B 1794-TB3 & 1794-OB16 FLEX Output Module

1794-TB3 & 1794-I16 FLEX Input Module

Safeguarding Applications and Wiring Diagrams

Expansion Modules with Immediate and Delayed Outputs

S11 S21 E-Stops 800FM-MT44MX02L

EMD 440R-EM4R2D L12 L11 A2 18 28 38 48

S12 S22 Y32 L11

700SDCP310DZ24 with 199-FSMZ-1

Safety Applications and Wiring Diagrams

Safety Motion - Delayed Braking

SI 440R-S12R2 S12 S22 Y32 L11 To PLC

EMD 440R-EM4R2D L12 L11 A2 18

Resistor Braking Module COIL A1 CONSTAT41 CONSTAT42 COIL A2 T1 K1

Safeguarding Applications and Wiring Diagrams

Light Curtain with Immediate and Delayed Outputs

Reset 800FM-F6MX10 Transmitter Brown 1 2 4 Receiver 1 K1 Brown K2 K3 K4 K5 K6

Black 4 White 2 3 5 Blue Grey

POC Type 4 Safe 4 445L-P4S1200YD Patchcord: 2 x 889D-F5AC-2

S12 S22 Y32 L11

Safeguarding Applications and Wiring Diagrams

Global E-Stop, Cascaded Safety Functions

E-Stop 800FM-MT44 800F-MX02S

S11 S12 A1 RESET 0

S11 S12 S21 S22 A1 13

S11 S21 S12 S22 A1 A2 Y32 S34

AM SI MM 440R-S12R2 S21 S22 A2 L11 Y32 14

6 5 DI 440R-D22R2 S32 S42 L11 L12 A2 14

6 5 DIS 440R-D22S2 S32 S42 L11 L12 34 44 14

Aux. to PLC E-Stop 800FM-MT44 800F-MX02S

Aux. to PLC E-Stop 800FM-MT44 800F-MX02S

Safety Applications and Wiring Diagrams

Brown White Black

To PLC L1 L2 L3 S21 S11 S34 Y41 A1 Y2 S11 S12 A1 RESET AM S34 13 0 MM 24 23 K1 K2

800Z-GL3Q5 S1 889N-F5AE-6F Blue Grey

Brown White Black

MSR35H 440R-D23202 S12 S22 A2 14 24 32

S21 S22 A2 L11 Y32 14 To PLC

800Z-GL3Q5 S2 889N-F5AE-6F Blue Grey

Interlock Switch - Multiple Gate Access

Safety Applications and Wiring Diagrams

S21 S22 A2 L11 Y32 14

Safeguarding Applications and Wiring Diagrams

SI, DIS, SensaGuard, E-Stops, PF525 with Contactor

SensaGuard Integrated Latches 440N-Z21SS3PA