Configuring the Safety Logic Controller

SLC Communication Path

As you have created your project based on the SLC Remote Controller (M262) example, the communication path between your PC and the SLC is already configured to SLC connected through LMC. With this setting, data transmission operations (such as downloading the project, handling of debug data, uploading online values, and so on) are performed via the Logic/Motion Controller which communicates with the SLC.

Modify this setting, if a direct connection to the SLC is required, for instance for testing purposes. To edit the communication path in Machine Expert - Safety, select Online > TCPIP Communication parameters and click the radio button SLC100/SLC200/SLC300/SLC400 directly connected in the dialog box.

For details and further information, refer to Communication Settings in the EcoStruxure Machine Expert - Safety - User Guide.

Editing Safety-Related Device Parameters - General Steps

Procedure in Machine Expert - Safety:

Step	Action
1	In the tree on the left of the Devices window, double-click the module to be configured. NOTE: When selecting a module with a left click, the module type and a short description are displayed on the upper border of the window. Result: The module parameters can be edited in the grids on the right.
2	Locate and edit the parameter to be set. You can use the tabs on the bottom of the grid to display only a particular parameter category.

Step

Action

In the tree on the left of the Devices window, double-click the module to be configured.

NOTE: When selecting a module with a left click, the module type and a short description are displayed on the upper border of the window.

Result: The module parameters can be edited in the grids on the right.

Locate and edit the parameter to be set. You can use the tabs on the bottom of the grid to display only a particular parameter category.

Setting the SLC Cycle Time in the SLC

The CycleTime parameter sets the cycle time of the SLC. The value must be greater than the processing time for the safety-related application. If the value of the parameter CycleTime is less than or too close to the processing time, a cycle time error (watchdog timeout) may be detected.

The CycleTime value must be an integer multiple of the Sercos cycle time.

Best practice:

Step	Action
1	Set the maximum CycleTime value (20000) as a temporary commissioning value. Result: Due to this maximum cycle time, the safety response time of the safety-related function may be not suitable for your safety-related function during this commissioning phase.
2	Build and download the safety-related application to the SLC.
3	Select Online > SafePLC. Result: The SafePLC control dialog opens.
4	In the SafePLC control dialog, click the Info button. Result: The SafePLC Info dialog opens, displaying the current processing time.
5	Determine the SLC cycle time by rounding up the displayed processing time value to the next multiple of the Sercos cycle time. Enter this value as CycleTime in the parameter editor.
6	Rebuild the safety-related project and download it again to the SLC. Result: After the restart, the SLC should run in normal operation.

WARNING
	NON-CONFORMANCE TO SAFETY FUNCTION REQUIREMENTS Verify the impact of the increased safety response time. Make certain that appropriate procedures and measures (according to applicable sector standards) have been taken to help avoid hazardous situations during the commissioning phase. Do not enter the zone of operation while running the SLC with the maximum cycle time. Ensure that no other persons can access the zone of operation while running the SLC with the maximum cycle time. Use appropriate safety interlocks where personnel and/or equipment hazards exist. Failure to follow these instructions can result in death, serious injury, or equipment damage.

WARNING

NON-CONFORMANCE TO SAFETY FUNCTION REQUIREMENTS

Verify the impact of the increased safety response time.
Make certain that appropriate procedures and measures (according to applicable sector standards) have been taken to help avoid hazardous situations during the commissioning phase.
Do not enter the zone of operation while running the SLC with the maximum cycle time.
Ensure that no other persons can access the zone of operation while running the SLC with the maximum cycle time.
Use appropriate safety interlocks where personnel and/or equipment hazards exist.

Failure to follow these instructions can result in death, serious injury, or equipment damage.

Setting the SSDOCreation Parameter

The parameter SSDOCreation (SSDO = Safety Service Data Object, openSAFETY) defines the number of acyclic processing steps per SLC cycle.

The SLC sends SSDO telegrams mainly during the start-up of the system in order to assign and verify the SADR (Safety Address, openSAFETY) of the SNs, to verify the uniqueness of the UDIDs within the safety-related network, and for downloading parameters and DVI (Device Vendor Information) to the SNs.

The SSDOCreation parameter can be used to optimize the restart behavior of the system provided that the Sercos bus has sufficient bandwidth on its asynchronous channel. Refer to Defining the Sercos Bus Cycle Time for possibilities of increasing the bandwidth of the asynchronous Sercos channel.

The greater the number of asynchronous processing steps per SLC cycle, the faster the restart of the safety-related system is.

Details on the possible values can be found in TM5CSLCx00FS Safety Logic Controller (section Basic) of the Safety Modules - Reference Guide.

Best practice: The boot-up time of the system can be reduced when setting SSDOCreation to 5 per cycle. With this setting, the SLC transmits five SSDO telegrams per cycle. This allows the SLC to find the safety nodes in a short time.

Setting the NodeGuardingTimeout Parameter

The NodeGuardingTimeout parameter sets the period (timeout value) to put the safety-related modules in pre-operational state when the SLC is incommunicative or in case of communication interruptions detected between the safety-related module and the SLC. It also defines the delay for the SLC to detect an unavailable module.

The NodeGuardingTimeout value is not critical to functional safety. The time for deactivating actuators is determined independently using the safety response time relevant parameters.

Details on the possible values can be found in TM5CSLCx00FS Safety Logic Controller (Basic) of the Safety Modules - Reference Guide.

NOTE: After a Sercos phase-down, the next Sercos phase-up should not be executed before the duration specified via the NodeGuardingTimeout parameter has expired. Otherwise, the SNs in a large system are possibly not scanned and configured by the SLC within the set time limit which then results in a timeout.

Setting the NumberOfScans Parameter

The NumberOfScans parameter specifies the number of module scans the SLC performs before it indicates if modules are unavailable (MXCHG flashing rapidly). Scanning is continued even after the SLC has triggered the LED for unavailable modules.

Setting the RemoteControlAllowed Parameter

The RemoteControlAllowed parameter enables or disables the remote control of the Safety Logic Controller.

Set this parameter to Yes-ATTENTION as the example project is based on the SlcRemoteController example.

Take into consideration the inherent hazards involved in a remote control operation to avoid unintentional equipment operation.

WARNING
	UNINTENDED EQUIPMENT OPERATION Ensure that there is a local, competent, and qualified observer present when operating from a remote location. Failure to follow these instructions can result in death, serious injury, or equipment damage.

Configuring the Safety-Related Response Time Relevant Parameters for TM5CSLC100FS and TM5CSLC200FS

The safety response time is the time between the arrival of a signal from a sensor or input device (such as a light curtain or an emergency stop pushbutton) at the input channel of a safety-related TM5/TM7 input module and the deactivation signal at the output channel of a safety-related TM5/TM7 output module. Refer to Calculating the Safety Response Time for additional information on the safety response time and its calculation.

If the parameter SafeLogicType of the SLC is set to SLC100 or SLC200, the SLC as well as each safety-related TM5/TM7 module provide three parameters which influence the safety response time of the safety-related application.

The safety response time relevant parameters are used for timing validation purposes:

MinDataTransportTime specifies the minimum time that is required to transmit a data telegram from a safety-related producer to a consumer. If a telegram is received earlier (by the consumer) than specified by this parameter value, communication is considered as invalid.
MaxDataTransportTime specifies the maximum time that is allowed to transmit a data telegram from a producer to a consumer. If a telegram is received later (by the consumer) than specified by this parameter value, communication is considered as invalid.
CommunicationWatchdog specifies the maximum time period within which a consumer must receive a valid data telegram from a producer in order to consider the safety-related communication as valid and continue the application.

For the SLC, these parameters are combined in the group SafetyResponseTimeDefaults.

Select Project > Response Time Relevant Parameters to open the parameter calculation dialog. In the calculation dialog, open the Default tab. Proceed as described in TM5CSLCx00FS Safety Logic Controller (Group: SafetyResponseTimeDefaults) of the Safety Modules - Reference Guide to determine the correct parameter values for your application.

Best practice:

Set the Network Packet Loss parameter in the Response Time Relevant Parameters dialog to 1 (default value). This is identical to the configuration of Sercos (one data loss is allowed).
If the SNs do not reach the operational state with the calculated values (for example, in a large system, or if optional devices are configured), slightly increase the MaxDataTransportTime parameter. Maximum value: 1.5 times the amount of the calculated value.

For detailed information, also refer to Safety Response Time of the EcoStruxure Machine Expert - Safety - User Guide.

The response time relevant parameters are influenced by the value of the TM5 bus cycle time and the Sercos cycle time. After modifying the TM5 bus cycle time in the TM5NS31 bus coupler parameters, or after modifying the Sercos cycle time, you must build the standard project to transfer the modified time value to the safety-related project. Based on the modified values, you must recalculate (and adapt) the response time relevant parameters and the safety response time in EcoStruxure Machine Expert - Safety.

The TM5 bus cycle time and the Sercos cycle time can also be modified via the application code of the standard application. The calculation of the response time relevant parameters, however, is based on the CycleTime value set for the TM5NS31 bus coupler via the parameter editor.

WARNING
	INSUFFICIENT AND/OR INEFFECTIVE SAFETY-RELATED FUNCTIONS Verify that the corresponding parameters for the TM5 bus cycle time and for the Sercos cycle time are set to the correct values in the parameter editors if the TM5 bus cycle time and/or the Sercos cycle time are set via the application code of the standard application. Recalculate the response time relevant parameters each time after modifying the TM5 bus cycle time or the Sercos cycle time. Failure to follow these instructions can result in death, serious injury, or equipment damage.

WARNING

INSUFFICIENT AND/OR INEFFECTIVE SAFETY-RELATED FUNCTIONS

Verify that the corresponding parameters for the TM5 bus cycle time and for the Sercos cycle time are set to the correct values in the parameter editors if the TM5 bus cycle time and/or the Sercos cycle time are set via the application code of the standard application.
Recalculate the response time relevant parameters each time after modifying the TM5 bus cycle time or the Sercos cycle time.

Failure to follow these instructions can result in death, serious injury, or equipment damage.

Configuring the Safety-Related Response Time Relevant Parameters for TM5CSLC300FS and TM5CSLC400FS

If the parameter SafeLogicType of the SLC is set to SLC300 or SLC400, the SLC as well as each safety-related TM5/TM7 module provide two parameters which influence the safety response time of the safety-related application.

The safety response time relevant parameters are used for timing validation purposes:

SafeDataDuration specifies the maximum permissible time for data transmission from a safety-related producer to a consumer, that is, from an input module to the SLC, or from the SLC to an output module. Use the maximum total response time required for your safety-related function as a basis for your calculation. From this total response time, deduct the response times of the equipment connected to the input module and the output module. The result is the total maximum permissible time for data transmission from the input module to the output module. Since the SafeDataDuration relates to one way (from an input module to the SLC or from the SLC to an output module), divide the value you have obtained by 2 to get the value required for the parameter.

For example, if you require a SafeDataDuration value of 100 ms from input module to output module, the value you need to enter for the parameter is 500 (1000 / 2 = 500). The unit is 100 µs.
ToleratedPacketLoss specifies the maximum number of lost packets during data transmission. The number of tolerated packet losses affects the safety response time according to the following equation: ToleratedPacketLoss multiplied by SafeDataDuration.

The communication timing parameters (such as the TM5 bus cycle time and the Sercos cycle time) have an effect on whether or not the response time is reached. If it is not reached, you may try to reduce the TM5 bus cycle and the Sercos cycle time if your application allows for such a reduction.

The TM5 bus cycle time can also be modified via the application code of the standard application.

WARNING
	INSUFFICIENT AND/OR INEFFECTIVE SAFETY-RELATED FUNCTIONS For each safety-related application used in your machine/process, verify that the system operates as required with the highest TM5 bus cycle time and the highest Sercos cycle time used in your standard application if you modify the cycle times via the standard application during runtime. Failure to follow these instructions can result in death, serious injury, or equipment damage.

WARNING

INSUFFICIENT AND/OR INEFFECTIVE SAFETY-RELATED FUNCTIONS

For each safety-related application used in your machine/process, verify that the system operates as required with the highest TM5 bus cycle time and the highest Sercos cycle time used in your standard application if you modify the cycle times via the standard application during runtime.

Failure to follow these instructions can result in death, serious injury, or equipment damage.

Status of Safety-Related Project

The safety-related device parameters of the SLC are now configured and, due to the partial phase-up of Sercos to communication phase 2 you already performed (see Sercos Phase-Up), an IP address has been assigned by the Sercos master. You can now connect to the SLC.

If you compile the empty safety-related project at this stage for test purposes, the compiler reports errors. This is because your safety-related project contains unused safety-related TM5/TM7 modules. Unused means that none of the signals, which are listed under the device nodes in the Machine Expert - Safety Devices window, are used in the safety-related project. At least one signal of each module must be assigned to a global safety-related variable in Machine Expert - Safety. The same applies to the SLC exchange signals you have defined in Logic Builder (refer to Exchange Data Configuration for the Safety PLC).