SF_Antivalent

Help version 1.1 / Issue date: 2018.03
The following description is valid for the function block SF_Antivalent_V2_0z, Version 2.0z (where z = 0 to 9).

Short Description The safety-related SF_Antivalent function block monitors the signals of two safety-related input terminals for different signal states. Typically, these signals come from two-channel sensors or switches such as an emergency-stop control device.
The S_AntivalentOut enable signal becomes SAFETRUE when the S_ChannelNC and S_ChannelNO inputs switch as follows within the time set at DiscrepancyTime:

S_ChannelNC from SAFEFALSE to SAFETRUE

S_ChannelNO from SAFETRUE to SAFEFALSE

For this to happen, the function block must be activated (Activate = TRUE) and it must not have detected any errors (Error = FALSE).

Note
Permanent signals (S_ChannelNC = SAFETRUE and S_ChannelNO = SAFEFALSE) at the inputs when the function block is activated (Activate = TRUE) or when the Safety PLC is started up switch the enable signal (S_AntivalentOut) to SAFETRUE.

Note
Always connect the two inputs differently, i.e., with a combination of one N/C contact signal and one N/O contact signal.

Block Icon

Inputs Activate

Short description Value

State-controlled input for activating the function block.
Data type: BOOL
Initial value: FALSE

FALSE: Function block inactive

TRUE: Function block activated

Refer to the topic "Activate" for details.

S_ChannelNC

Short description Value

State-controlled input for the NC channel of the connected two-channel switch or sensor.
Data type: SAFEBOOL
Initial value: SAFEFALSE

SAFEFALSE: Request to switch S_AntivalentOut to SAFEFALSE.

SAFETRUE: Request to switch S_AntivalentOut to SAFETRUE.

Refer to the topic "S_ChannelNC" for details.

S_ChannelNO

Short description Value

State-controlled input for the NO channel of the connected two-channel switch or sensor.
Data type: SAFEBOOL
Initial value: SAFEFALSE

SAFEFALSE: Request to switch S_AntivalentOut to SAFETRUE.

SAFETRUE: Request to switch S_AntivalentOut to SAFEFALSE.

Refer to the topic "S_ChannelNO" for details.

DiscrepancyTime

Short description Value

Input for specifying the maximum permissible discrepancy time in seconds.
Data type: TIME
Initial value: #0ms
If a change in state at an input results in both inputs having the same signals, the discrepancy time measurement starts. The second input must also then modify its state within the discrepancy time, so that both the S_ChannelNC and S_ChannelNO inputs have different signals again. If this does not happen, an error message will be output (Error = TRUE) and output S_AntivalentOut = SAFEFALSE. Enter a time value according to your risk analysis.
Refer to the warning below this table.

WARNING

Non-conformance to safety function requirements

Verify that the time value set at DiscrepancyTime corresponds to your risk analysis.

Be sure that your risk analysis includes an evaluation for incorrectly setting the time value applied to the DiscrepancyTime input.

Validate the overall safety-related function with regard to the set DiscrepancyTime value and thoroughly test the application.

Refer to the topic "DiscrepancyTime" for details.

Outputs Ready

Short description Value

Output for signaling "Function block activated/not activated".
Data type: BOOL

FALSE: Function block is not activated (Activate = FALSE) and all outputs of the function block are switched to FALSE/SAFEFALSE.

TRUE: Function block is activated (Activate = TRUE) and the output parameters represent the state of the safety-related function.

Refer to the topic "Ready" for details.

S_AntivalentOut

Short description Value

Output for enable signal of the function block.
Data type: SAFEBOOL
Refer to the warning below this table.

SAFEFALSE:

Input S_ChannelNC = SAFEFALSE and/or input S_ChannelNO = SAFETRUE

or the function block has detected an error

or the function block is not activated.

SAFETRUE:

The function block is activated

and input S_ChannelNC = SAFETRUE and input S_ChannelNO = SAFEFALSE

and the function block has not detected an error.

The function block supports a safety-related monitoring function but not a safety-related control function.

WARNING

Unintended machine operation

Verify that the S_AntivalentOut enable signal does not directly control the safety process.

Validate the overall safety-related function, including the start-up behavior of the process, and thoroughly test the application.

Refer to the topic "S_AntivalentOut" for details.

SafetyDemand

Short description Value

Output for signaling "safety-related function requested".
This output displays whether the safety chain is interrupted and as a result, the attention of the operator is required.
Data type: BOOL

FALSE: Safety-related function is not requested.

TRUE: The safety-related function is requested.

Refer to the topic "SafetyDemand" for details.

ResetRequest

Short description Value

Output for signaling "reset is required".
This output indicates whether a reset by the operator is required.
Data type: BOOL

FALSE: No reset required.

TRUE: A reset is required:

to remove an active start-up or restart inhibit (if available for this function block)

or to reset an error.

Refer to the topic "ResetRequest" for details.

Error

Short description Value

Output for error message.
Data type: BOOL

FALSE: No error is present.

TRUE: The function block has detected an error. The S_AntivalentOut output switches to SAFEFALSE as a result.

Note
To reset the error message, SAFEFALSE must be present at the S_ChannelNC input and SAFETRUE at input S_ChannelNO.

Refer to the topic "Error" for details.

DiagCode

Short description Value

Output for diagnostic message.
Data type: WORD Diagnostic message of the function block.
The possible values are listed and described in the topic "Diagnostic codes".

Refer to the topic "DiagCode" for details.

Detailed information Signal sequence diagram

The example below shows a typical signal curve, such as may apply to the different signals S_ChannelNC = SAFETRUE and S_ChannelNO = SAFEFALSE within the discrepancy time.

0 The function block is not yet activated (Activate = FALSE).
As a result, all outputs are FALSE or SAFEFALSE.

1 Function block activation (Activate = TRUE). In the meantime, input S_ChannelNC = SAFEFALSE and S_ChannelNO = SAFETRUE. The S_AntivalentOut output remains SAFEFALSE.

2 The S_ChannelNO input remains SAFETRUE and the S_ChannelNC input switches to SAFETRUE. When the state of an input switches, the discrepancy time measurement starts.

3 S_AntivalentOut switches to SAFETRUE, as both inputs switch during the time set at DiscrepancyTime (S_ChannelNC from SAFEFALSE to SAFETRUE and S_ChannelNO from SAFETRUE to SAFEFALSE). This results in antivalent signals at the inputs.

4 S_AntivalentOut switches to SAFEFALSE, as S_ChannelNO switches to SAFETRUE. The discrepancy time measurement starts when the state at S_ChannelNO changes.

5 S_AntivalentOut and Error remain FALSE, as input S_ChannelNC switches to SAFEFALSE during the discrepancy time.

6 S_ChannelNO switches to SAFEFALSE. This change in state causes the discrepancy time measurement to start again.

7 S_AntivalentOut switches to SAFETRUE, as S_ChannelNC switches to SAFETRUE during the discrepancy time, resulting in antivalence again.

8 S_AntivalentOut switches to SAFEFALSE, as the antivalence comes to an end (S_ChannelNC becomes SAFEFALSE). The discrepancy time measurement starts when the state at S_ChannelNC modifies.
S_AntivalentOut and Error remain FALSE, as the second input also changes its state during the discrepancy time (S_ChannelNO becomes SAFETRUE).

Note
The other signal sequence diagram can also be taken into account.

Application example

This example illustrates two-channel control of the safety-related SF_EmergencyStop function block with the help of the SF_Antivalent function block.

The emergency-stop control device is connected to the inputs 1.1 and 2.1 of the safety-related input device PSDI with an ID of 1. The N/C and N/O contacts of the emergency-stop control device are connected to the safety-related SF_Antivalent function block for evaluation purposes.
The S_AntivalentOut enable signal of the safety-related SF_Antivalent function block resulting from this is connected to the safety-related SF_EmergencyStop function block for further evaluation. The S_AntivalentOut output of the safety-related SF_Antivalent function block becomes SAFETRUE when the S_ChannelNC and S_ChannelNO inputs switch as follows within the time set at DiscrepancyTime:

S_ChannelNC from SAFEFALSE to SAFETRUE

and S_ChannelNO from SAFETRUE to SAFEFALSE.

A start-up inhibit (after the Safety PLC has been started up or after the function block has been activated) as well as a restart inhibit (after the emergency-stop control device has been deactivated) is set for the safety-related SF_EmergencyStop function block. Both inhibits are removed by pressing the reset button connected to input 1.1 of the standard input device DI with an ID of 1.

Note
The enable output S_EStopOut of the SF_EmergencyStop function block is directly connected to a global I/O variable or to an output terminal of the application via additional safety-related functions/function blocks.
Connect the S_EStopOut enable output of the SF_EmergencyStop function block to the S_OutControl input of the SF_EDM function block, for example, thus implementing a two-channel output connection.

Further Info
For more detailed information, please refer to the description of the corresponding safety-related function block.

S1 Emergency-stop

S2 Reset

See note above the illustration

Further Info
The second application example and the accompanying notes can also be taken into account.

Function block instantiation

The IEC 61131-3 standard defines function block instantiation. Instantiation means, a function block is defined once and can be used (instantiated) several times. This applies to all FBs (user-defined POUs as well as library FBs, such as IEC standard FBs, firmware FBs, user library FBs).

Why instantiation?
A function block has an internal memory where it stores its own processing data (local variables). As a consequence, the output values calculated by the FB depend on the internally stored values. The same input values applied to an FB instance do not necessarily deliver the same results in another FB instance.
Therefore, it is necessary to store the internal data of the FB to a separated memory area each time the function block is processed, i.e., for each FB instance. To uniquely identify each FB instance and to clearly separate its memory area, instance names are used.
The instance name of the function block has to be declared in the 'Variables' table of the POU where the FB is going to be used.

The following applies:

Function blocks can be instantiated in other function blocks or in program POUs. Calling FBs in function POUs is not possible.

Functions are called without instantiation because they do not have an internal memory.

Safety-related and standard (non-safety-related) code is strictly distinguished in PLCnext Engineer. If a Safety PLC is included in your project, the following applies:

Safety-related FBs can only be instantiated in safety-related POUs but not in standard (non-safety-related) POUs.

User-defined standard FBs can only be instantiated in standard POUs. They cannot be called in safety-related POUs.

Particular standard firmware FBs can be instantiated in both safety-related and standard POUs.

Note
When inserting a standard FB into a safety-related SNOLD network, the rules for implicit type conversion (safety-related to standard) apply.

Example for the instantiation of a user-defined function block

The user-defined function block 'TLC' ("Two Level Controller") is added to the 'Functions & Function Blocks' category (COMPONENTS area). It shall be called twice in the program POU 'Container' to control the filling level and the temperature of a boiler.

For both FB instances, an instance name declaration is added to the 'Variables' table of the calling program POU 'Container': TLCTemperature and TLCLevel. Thus the 'TLC' function block can be called twice in the code worksheet of the calling POU by means of these instance names.
Both FB instances have been inserted into the 'Container' code worksheet, each instance with different variables connected to its input and output formal parameters ('Level...' and 'Temperature...').

Additional information is available in the following sections:

Functional description

Additional signal sequence diagrams

Additional application examples

Fault avoidance

Implementation of safety requirements from applicable standards