SF_Equivalent

Applicable Safety Standards

SF_Equivalent is a certified PLCopen function block. For detailed information about the applied standards , see: "PLCopen – Technical Committee 5 – Safety Software"

Important

The requirements which are listed in the standards must be met by the user.

Interface Description

This function block converts two equivalent SAFEBOOL inputs (both NO or NC) to one SAFEBOOL output with discrepancy time monitoring. This FB should not be used stand-alone since it has no restart interlock. It is required to connect the output to other safety related functionalities.

Table 8. VAR_INPUT

Name	Data Type	Initial Value	Description, Parameter Values
`Activate`	`BOOL`	`FALSE`	See General Input Parameters
`S_ChannelA`	`SAFEBOOL`	`FALSE`	Variable Input `A` for logical connection `FALSE`: Contact `A` open `TRUE`: Contact `A` closed
`S_ChannelB`	`SAFEBOOL`	`FALSE`	Variable Input `B` for logical connection `FALSE`: Contact `B` open `TRUE`: Contact `B` closed
`DiscrepancyTime`	`TIME`	`T#0ms`	Constant Maximum monitoring time for discrepancy status of both inputs The cautionary note "DiscrepancyTime" must be observed.

`DiscrepancyTime`

Applies to developers in Extended Level: The DiscrepancyTime input must be activated with a constant value. As a result, the value must not be changed for the calls.

Table 9. VAR_OUTPUT

Name	Data Type	Initial Value	Description, Parameter Values
`Ready`	`BOOL`	`FALSE`	See General Output Parameters
`S_EquivalentOut`	`SAFEBOOL`	`FALSE`	Safety-related output `FALSE`: Minimum of one input signal is `FALSE` or state change outside of monitoring time `TRUE`: Both inputs signals "active" and state change within monitoring time.
`SafetyDemand`	`BOOL`	`FALSE`	See General Output Parameters
`Error`	`BOOL`	`FALSE`	See General Output Parameters
`DiagCode`	`WORD`	`16#0000`	See Diagnostic Codes

Tip

For certain (lower) levels of safety requirements, it can be allowed to use BOOL as inputs and SAFEBOOL as output. However, this has to be evaluated via the FMEA of the application. In the library, there should be made a distinction between the SAFEBOOL and BOOL version.

Figure 10. Function block: SF_Equivalent

Functional Description

This function block converts two equivalent SAFEBOOL inputs (both NO or NC) to one SAFEBOOL output with discrepancy time monitoring. Both channels are interdependent. The function block output shows the result of the evaluation of both channels.

If the channel signal changes from TRUE to FALSE, the output immediately switches to FALSE for safety reasons.

Discrepancy time monitoring: The discrepancy time is the maximum period during which both inputs may have different states without the function block detecting an error. Discrepancy time monitoring starts when the status of an input changes. The function block detects an error when both inputs have different states once the discrepancy time has elapsed.

Both inputs must be switched symmetrically. This means that monitoring is performed for both inputs for switching from TRUE to FALSE as well as for switching from FALSE to TRUE.

Table 10. Logic table of inputs/outputs

Inputs				Outputs
`Activate`	`S_ChannelA`	`S_ChannelB`	`DiscrepancyTime`	`Ready`	`S_EquivalentOut`	`SafetyDemand`	`Error`	`DiagCode`
`FALSE`	`FALSE`	`TRUE`	Not started	`FALSE`	`FALSE`	`FALSE`	`FALSE`	`0000`
`TRUE`	`FALSE`	`FALSE`	Not started	`TRUE`	`FALSE`	`TRUE`	`FALSE`	`8801`
`TRUE`	`TRUE`	`FALSE`	Started	`TRUE`	`FALSE`	`TRUE`	`FALSE`	`8802`
`TRUE`	`TRUE`	`FALSE -> TRUE`	Started	`TRUE`	`TRUE`	`FALSE`	`FALSE`	`8000`
`TRUE`	`TRUE`	`TRUE`	Not started	`TRUE`	`TRUE`	`FALSE`	`FALSE`	`8000`
`TRUE`	`TRUE`	`TRUE -> FALSE`	Started	`TRUE`	`FALSE`	`TRUE`	`FALSE`	`8806`
`TRUE`	`TRUE -> FALSE`	`FALSE`	Started	`TRUE`	`FALSE`	`TRUE`	`FALSE`	`8801`
`TRUE`	`FALSE`	`FALSE`	Not started	`TRUE`	`FALSE`	`TRUE`	`FALSE`	`8801`
`TRUE`	`FALSE`	`FALSE -> TRUE`	Started	`TRUE`	`FALSE`	`TRUE`	`FALSE`	`8804`
`TRUE`	`FALSE -> TRUE`	`TRUE`	Started	`TRUE`	`TRUE`	`FALSE`	`FALSE`	`8000`

Tip

In the logic table, an arrow -> stands for a transition. TRUE -> FALSE means that the value of the variable has changed from TRUE to FALSE.

State diagram

Figure 11. State diagram: SF_Equivalent

Tip

The transition from any state to the Idle state due to Activate = FALSE is not shown. However these transitions have the highest priority.

Typical Timing Diagrams

Figure 12. Timing diagram 1: SF_Equivalent

Figure 13. Timing diagram 2: SF_Equivalent

Error Detection

The function block monitors the discrepancy time between channel S_ChannelA and channel S_ChannelB, when switching to TRUE as well as switching to FALSE.

Error Behavior

The output S_EquivalentOut is set to FALSE. Error is set to TRUE. DiagCode indicates the Error states. There is no Reset defined as an input coupled with the reset of an error. As soon as a Set of input values with the correct S_EquivalentOut is present, Error is FALSE again.

FB-Specific Error and State Codes

Table 11. FB-specific error codes

`DiagCode`	State Name	State Description and Output Setting
`16#C010`	`Error 1`	Discrepancy time elapsed in state `16#8802` `Ready = TRUE` `S_EquivalentOut = FALSE` `SafetyDemand = FALSE` `Error = TRUE`
`16#C020`	`Error 2`	Discrepancy time elapsed in state `16#8804` `Ready = TRUE` `S_EquivalentOut = FALSE` `SafetyDemand = FALSE` `Error = TRUE`
`16#C030`	`Error 3`	Discrepancy time elapsed in state `16#8806` `Ready = TRUE` `S_EquivalentOut = FALSE` `SafetyDemand = FALSE` `Error = TRUE`

DiagCode

State Name

State Description and Output Setting

16#C010

Error 1

Discrepancy time elapsed in state 16#8802

Ready = TRUE

S_EquivalentOut = FALSE

SafetyDemand = FALSE

Error = TRUE

16#C020

Error 2

Discrepancy time elapsed in state 16#8804

Ready = TRUE

S_EquivalentOut = FALSE

SafetyDemand = FALSE

Error = TRUE

16#C030

Error 3

Discrepancy time elapsed in state 16#8806

Ready = TRUE

S_EquivalentOut = FALSE

SafetyDemand = FALSE

Error = TRUE

Table 12. FB-specific state codes

`DiagCode`	State Name	State Description and Output Setting
`16#0000`	`Idle`	The function block is not active (initial state). `Ready = FALSE` `S_EquivalentOut =FALSE` `SafetyDemand = FALSE` `Error = FALSE`
`16#8801`	`Init`	An activation has been detected by the FB and the FB is now activated. `Ready = TRUE` `S_EquivalentOut = FALSE` `SafetyDemand = TRUE` `Error = FALSE`
`16#8000`	`Safety Output Enabled`	The inputs are switched to `TRUE` in equivalent mode. `Ready = TRUE` `S_EquivalentOut = TRUE` `SafetyDemand = FALSE` `Error = FALSE`
`16#8802`	`Wait for Channel B`	`S_ChannelA` has been switched to `TRUE` – waiting for `S_ChannelB`; discrepancy timer started. `Ready = TRUE` `S_EquivalentOut = FALSE` `SafetyDemand = TRUE` `Error = FALSE`
`16#8804`	`Wait for Channel A`	`S_ChannelB` has been switched to `TRUE` – waiting for `S_ChannelA`; discrepancy timer started. `Ready = TRUE` `S_EquivalentOut = FALSE` `SafetyDemand = TRUE` `Error = FALSE`
`16#8806`	`From Active Wait`	One channel has been switched to `FALSE`; waiting for the other channel to be switched to `FALSE`, discrepancy timer started. `Ready = TRUE` `S_EquivalentOut = FALSE` `SafetyDemand = TRUE` `Error = FALSE`