Skip to main content

General Rules for Safety-Related Function Blocks

These programming rules correspond to the "General Rules for Safety-Related Function Blocks" of PLCopen. They apply to PLCopen-compliant function blocks.

FB-Specific Rules

Important

When using PLCopen function blocks, the user has to make sure that in the application the function block is called at least one time in each cycle.

Default signal

All safety-related Boolean I/O signals have the default safe value FALSE.

Signal level

The value of SAFEBOOL is only applicable as follows:

  • 0: Corresponds to safety as defined at system outputs

  • 1: Means that the safety aspects of the system are operating correctly so that, for example, normal operation is possible

This reflects the functionality of the IEC 61131 environments, such as the rules of the default value and that all outputs are set to 0 in case of an error.

Missing I/O parameters

Missing parameters are permitted. Default values apply. These default values shall under no circumstances lead to an unsafe state. Default values, including their attributes (Variable oder Constant), are specified in the relevant FB specifications.

Start behavior

Initially, the outputs are set to the default values. After the first call of the function block, the outputs are valid. There is a consistent start behavior (cold start).

Timing diagrams

Timing diagrams, as shown at the FBs, are provided for explanation only. They do not represent the exact timing behavior. The exact timing behavior depends on the implementation.

Error handling and diagnostics

All safety-related function blocks have two error-related outputs: Error and DiagCode. These are provided for diagnostic purposes on the user application level, and not for diagnostics on the system or hardware level.

The rule for safety-related environments is that the switching of a safety-related function has the highest priority. Furthermore, the following switching must have sufficient time for the diagnostics, either in the functional program or the operator interface.

General Input Parameters

Name

Data Type

Description

Activate

BOOL

Variable or constant for the activation of a FB

Initial value is FALSE

This parameter can be connected to the variable, which represents the status (active or not active) of the relevant safety device. This makes sure that no irrelevant diagnostic information is generated if a device is disabled.

FALSE: All output variables are set to the initial value.

If no device is connected, then a static TRUE signal must be assigned.

S_<safety-related input name>

SAFExxxx

Every SAFExxxx type input name begins with S_.

Only variables may be assigned.

S_StartReset

SAFEBOOL

Variable or constant

FALSE (initial value): Automatic reset deactivated; manual reset via Reset input

TRUE: Automatic reset when the safety controller is started (warm or cold)

Note the Safety Notices for S_StartReset.

S_AutoReset

SAFEBOOL

Variable or constant

FALSE (initial value): Automatic reset deactivated; manual reset via Reset input when the emergency stop switch is released.

TRUE: Automatic reset when emergency stop switch is released.

Note the Safety Notices for S_AutoReset.

Reset

BOOL

Variable. Initial value is FALSE

Depending on the function, this input can be used for different purposes.

  • Reset of the state machine, and coupled error and state messages as indicated via DiagCode, when the error cause has been removed. This reset behavior is designed as an error reset.

  • Manual reset of a restart interlock by the operator. This reset is designed as a functional reset.

  • Additional FB-specific reset functions

This function is active only on a signal change from FALSE to TRUE. A static TRUE signal does not cause any more actions, but it may be detected as an error in some functions blocks.

Note the Safety Notices for Reset.

The appropriate meaning must be described in every function block.

Safety Notices for S_StartReset

S_StartReset

This automatic start shall be activated only if it is ensured that no hazard can occur at the start of the safety controller. Therefore, the use of the "automatic start" feature of the function blocks requires implementation of other system or application measures. This must ensure that unexpected (or unintended) startup does not occur.

Caution

If the input is linked to a variable (and not to FALSE), then additional validation measures must be defined for it.

Safety Notices for S_AutoReset

Caution

The automatic restart shall be activated only if is it ensured that no restart of the machine can occur through release of the emergency stop button. Therefore, the use of the "automatic restart" feature of the function blocks requires implementation of other system or application measures. This must ensure that unexpected (or unintended) restart of the machine does not occur.

Caution

If the input is linked to a variable (and not to FALSE), then additional validation measures must be defined for it.

Safety Notices for Reset

Caution

A SAFEBOOL must be connected instead of a BOOL depending on the safety requirements. See also: Function Block: SF_ResetButton.

General Output Parameters

Name

Data Type

Description

Ready

BOOL

TRUE: Indicates that the function block is activated and the output results are valid (same as the "POWER" LED of a safety relay).

FALSE: The function block is not active and the program is not executed. Useful in debug mode or to activate/deactivate additional function blocks. Also useful for further processing in the functional program.

S_<safety-related output name>

SAFExxxx

Every SAFExxxx data type output name begins with S_.

SafetyDemand

BOOL

Output indicating that the FB is active and the primary safety function is demanded (e.g. related to the safety functionality). Other safety-related input parameters are not considered (e.g. SafetyActive and EDM). The safety loop is not closed and the safe state is demanded for the related safety output. There is no error.

TRUE: Safety demand

FALSE: No safety demand

ResetRequest

BOOL

Output which can be used to signal the operator to press the reset functionality to continue

TRUE: Operator reset requested

FALSE: Operator reset not requested

Error

BOOL

Error flag (same as "K1/K2" LED of a safety relay)

TRUE: When TRUE, Indicates that an error has occurred and the FB is in an error state. The relevant error state is mirrored at the DiagCode output.

FALSE: Indicates that there is no error and the FB is in another state. This again is mirrored by DiagCode.

Useful in debug mode as well as for further processing in the functional program.

DiagCode

WORD

Diagnostic register

All states of the FB (Active, Not Active, and Error) are represented by this register. This information is encoded in hexadecimal format in order to represent more then 16 codes. Only one consistent code is represented at the same time. In the event of multiple errors, the DiagCode output indicates the first detected error.

Useful in debug mode as well as for further processing in the functional program.

Diagnostic Codes

A transparent and uniform diagnostic concept forms the basis of all function blocks. Thus, it is ensured that, regardless of the supplier's implementation, uniform diagnostic information is available to the user in the form of DiagCode. If no error is present, then the internal state of the function block (state machine) is indicated. An error is indicated via a binary output (Error). Detailed information about internal or external function block errors can be obtained via DiagCode. The function block must be reset via the different reset inputs.

Table 4. Generic diagnostic codes

DiagCode

Description

0000_0000_0000_0000 bin

0000 hex

The FB is not activated. This code represents the Idle state. For a generic example, the I/O setting for could be:

Activate = FALSE

S_In = FALSE or TRUE

Ready = FALSE

Error = FALSE

S_Out = FALSE

SafetyDemand = FALSE

ResetRequest = FALSE

1000_0000_0000_0000 bin

8000 hex

The FB is activated without an error or any other condition that sets the safety output to FALSE. This is the default operational state where the S_Out safety output = TRUE in normal operation. For a generic example, the I/O setting for could be:

Activate = TRUE

S_In = TRUE

Ready = TRUE

Error = FALSE

S_Out = TRUE

SafetyDemand = FALSE

ResetRequest = FALSE

1000_0100_0000_0001 bin

8401 hex

An activation has been detected by the FB and the FB is now activated, but the S_Out safety output is set to FALSE. This code represents the Init state of the operational mode. For a generic example, the I/O setting for could be:

Activate = TRUE

S_In = TRUE

Ready = TRUE

Error = FALSE

S_Out = FALSE

SafetyDemand = FALSE

ResetRequest = TRUE

1000_1000_0000_0010 bin

8802 hex

The activated FB detects a safety demand, e.g. S_In = FALSE. The safety output is disabled (S_Out = FALSE). For a generic example, the I/O setting for could be:

Activate = TRUE

S_IN = FALSE

Ready = TRUE

Error = FALSE

S_Out = FALSE

SafetyDemand = TRUE

ResetRequest = FALSE

1000_0100_0000_0011 bin

8403 hex

The safety output of the activated FB has been disabled by a safety demand. The safety demand is now withdrawn, but the safety output remains FALSE until a reset condition is detected. This is an operational state where the S_Out safety output = FALSE. For a generic example, the I/O setting for could be:

Activate = TRUE

S_In = FALSE => TRUE (continuing with static TRUE)

Ready = TRUE

Error = FALSE

S_Out = FALSE

SafetyDemand = TRUE ==> FALSE

ResetRequest = FALSE ==> TRUE



Table 5. System- or device-specific codes

DiagCode

Description

0xxx_xxxx_xxxx_xxxx bin

X = System or device-specific message. This information contains the diagnostic information for the system or device, and is mapped directly to the DiagCode output.

Note: 0000 hex is reserved.



Generic state diagram

Figure 9. Generic state diagram of safety FBs
Generic state diagram of safety FBs


. Explanation of the generic state diagram:

  • A general overview of the states and transitions are displayed. Some transitions are not named here. This means that they are FB-specific and are described with the relevant FBs.

  • The diagram shows three areas:

    • At the top, the FB is not active. It is in the Safe state (safe outputs are FALSE).

    • In the middle, the FB is active. It is in the Safe state (safe outputs are FALSE).

    • At the bottom, the FB is in the normal state. The safe outputs are TRUE.

  • The first horizontal line in the state diagram shows the transition from a non-active FB to an active FB.

  • The second horizontal line shows the transition from a non-safe state to a safe state of the FB.

  • The priorities of possible parallel transitions are indicated by numbers (0 = highest priority).

  • State bubbles contain the state name and hexadecimal DiagCode.

  • Conditions OR, AND, and XOR are used as logical operators and NOT is used as negation.

  • Within the FB description, the starting state is Idle, with the transitions to operational states via the Init state.

  • The transition from any state due to Activate = FALSE changes directly to the Idle state (0 = highest priority reserved for Activate = FALSE). For greater clarity, these transitions are not shown in each state diagram. But they are mentioned as a footnote to each state diagram.

  • For reasons of clarity, the output setting is not described in the state diagram. An explicit truth table containing the states of the FB outputs is part of each FB specification. In addition, the FB-specific error and state codes are also described.

  • Note to transition from 8xx0 to 0000: Certain applications (like presses) need to finalize their cycle without the danger of any risk. In that case, the transition can be delayed.

Table 6. FB-specific error codes

DiagCode

State Name

State Description and Output Setting

Cxxx

Error

Ready = TRUE

S_Out = FALSE

SafetyDemand = FALSE

ResetRequest = FALSE

Error = TRUE



Table 7. FB-specific state codes (no error)

DiagCode

State Name

State Description and Output Setting

0000

Idle

Ready = FALSE

S_Out = FALSE

SafetyDemand = FALSE

ResetRequest = FALSE

Error = FALSE

8xxx

Init state and all states of operating modes where S_Out = FALSE

Ready = TRUE

S_Out = FALSE

SafetyDemand = Depending

ResetRequest = Depending

Error = FALSE

8000

All states of operating mode where S_Out = TRUE

Ready = TRUE

S_Out = TRUE

ResetDemand = FALSE

ResetRequest = FALSE

Error = FALSE



: