Safety AOIs with UDTs

[joseph_e2]

I've wired it back mainly because I haven't used a GuardLogix yet. Our safety controllers are Keyence GC-1000s that can't communicate with the drive directly. I guess I could use the CompactLogix that's talking to both to be an intermediary, but it was easier to just land a wire.
Do you need redundant load contactors? I thought I saw an example from Rockwell showing a single safety-rated load side contactor getting it to PLe.

 

[robertmee]

I've wired it back mainly because I haven't used a GuardLogix yet. Our safety controllers are Keyence GC-1000s that can't communicate with the drive directly. I guess I could use the CompactLogix that's talking to both to be an intermediary, but it was easier to just land a wire.
Do you need redundant load contactors? I thought I saw an example from Rockwell showing a single safety-rated load side contactor getting it to PLe.

I'm by no means an expert on the variances between PLe and the different categories. I think to achieve PLe Cat 4, the easiest is with redundant contactors. The STO on a PF525 'may' satisfy the requirement of one of those 'contactors', but you would have to have a safety feedback from the STO to qualify. Maybe the feedback into a Safety Input qualifies in your case, I don't know. The 525 is only rated to PLd, Sil2 using the STO, so again, I'm not positive. I just know that one of my largest customers, to achieve PLe always puts redundant contactors on PF 525's.

 

[joseph_e2]

Hmmmm....interesting. It would probably be safer to have 2 contactors. I found the manual where I saw the example from Rockwell:
https://literature.rockwellautomation.com/idc/groups/literature/documents/wd/safety-wd001_-en-p.pdf
Pages 22-23

I was wrong about one thing, though. It doesn't use any EDM feedback from the drive at all, just from the load contactor. This whole safety control thing gets complicated....

 

[robertmee]

Hmmmm....interesting. It would probably be safer to have 2 contactors. I found the manual where I saw the example from Rockwell:
https://literature.rockwellautomation.com/idc/groups/literature/documents/wd/safety-wd001_-en-p.pdf
Pages 22-23

I was wrong about one thing, though. It doesn't use any EDM feedback from the drive at all, just from the load contactor. This whole safety control thing gets complicated....

I don't agree with that figure 9. Not sure how that satisfies safe state before reset. They are using K1 to enable the reset, but nothing from the drive to indicate it's in a safe torque off mode before reset.

 

[joseph_e2]

The verbiage seems to indicate that the STO is monitored internally by the drive circuitry and that any failure would be detected that way. Personally, I'd rather have outside confirmation.

 

[robertmee]

The verbiage seems to indicate that the STO is monitored internally by the drive circuitry and that any failure would be detected that way. Personally, I'd rather have outside confirmation.

Not satisfactory....Someone or Some event could bridge the S0, S1 contacts on the drive to the safety common, and the drive would never enter STO. That actually happened on one of our installs. The contractor wired the OB8S from the PLC to the S0, S1 on the drive, but didn't remove the factory safety jumper. So the drive never went into safe off. My code caught it because I monitor the STO status in the CROUT and it has to be low to reset. The STO status is only available in the standard tag set however, and I have to pass it to the safety routine. Which brings us full circle back to my question that I asked initially