SF_OutControl

Help version 1.1 / Issue date: 2018.03
The following description is valid for the function block SF_OutContrl_V2_0z, Version 2.0z (where z = 0 to 9).

Short Description The safety-related SF_OutControl function block controls the output of a safety-related device. The safety-related output is controlled depending on a signal from the standard controller (operation start/stop) and a safety-related signal (monitoring of a safety-related function, e.g., emergency-stop).
S_StartReset can be used to specify a start-up inhibit and S_AutoReset can be used to specify a restart inhibit. Both inhibits refer to the start or restart of the Safety PLC or safety-related function.
Furthermore, the StaticControl input enables the specification of an additionally required operation stop of the standard controller with requested safety-related function and before activating the function block.

Block Icon

Inputs Activate

Short description Value

State-controlled input for activating the function block.
Data type: BOOL
Initial value: FALSE

FALSE: Function block inactive

TRUE: Function block activated

Refer to the topic "Activate" for details.

S_SafeControl

Short description Value

State-controlled input for the status of the upstream safety-related function.
Data type: SAFEBOOL
Initial value: SAFEFALSE

SAFEFALSE: Upstream safety-related function triggered

SAFETRUE: Upstream safety-related function not triggered

Refer to the topic "S_SafeControl" for details.

ProcessControl

Short description Value

State-controlled input (if input StaticControl = TRUE) or edge-triggered input (if input StaticControl = FALSE) which evaluates the request of the process coming from the standard controller.
Data type: BOOL
Initial value: FALSE

FALSE: Request to switch the enable output S_OutControl to SAFEFALSE

TRUE: Request to switch the enable output S_OutControl to SAFETRUE

Edge FALSE > TRUE: A positive signal edge represents a start of operation in the standard controller

Refer to the topic "ProcessControl" for details.

StaticControl

Short description Value

Specification of an additionally required operation stop with triggered safety-related function and/or before function block activation.
Data type: BOOL
Initial value: FALSE

FALSE: Additional operation stop required

TRUE: No additional operation stop required

Refer to the topic "StaticControl" for details.

S_StartReset

Short description Value

State-controlled input for specifying the start-up inhibit after the Safety PLC has been started up or the function block has been activated.
An active start-up inhibit must be removed manually by means of a positive signal edge at the Reset input. A deactivated start-up inhibit causes the S_OutControl output to switch to SAFETRUE automatically when the function block is activated and the safety-related function is not requested.
Data type: SAFEBOOL
Initial value: SAFEFALSE

SAFEFALSE: With start-up inhibit

SAFETRUE: Without start-up inhibit

The start-up inhibit and/or restart inhibit must only be deactivated if it is certain that starting up/restarting the machine/system will not lead to a hazardous situation or that a suitable start-up/restart inhibit is in place at another location or using other means.

WARNING

Non-conformance to safety function requirements

Verify the impact of a deactivated start-up inhibit (S_StartReset = SAFETRUE) and/or restart inhibit (S_AutoReset = SAFETRUE) on your machine or process prior to implementation.

Observe the regulations given by relevant sector standards regarding the start-up/restart inhibit.

Verify that a suitable start-up inhibit is in place at another location or using other means.

Refer to the topic "S_StartReset" for details.

S_AutoReset

Short description Value

State-controlled input for specifying the restart inhibit after the SAFETRUE signal has returned at the S_SafeControl input.
An active restart inhibit must be removed manually by means of a positive signal edge at the Reset input. A deactivated restart inhibit causes the S_OutControl output to automatically switch to SAFETRUE if the function block is enabled and the safety-related function is not requested and the request from the standard controller is signaled at the ProcessControl input.
Data type: SAFEBOOL
Initial value: SAFEFALSE
Refer to the first warning below this table.

SAFEFALSE: With restart inhibit

SAFETRUE: Without restart inhibit

The start-up inhibit and/or restart inhibit must only be deactivated if it is certain that starting up/restarting the machine/system will not lead to a hazardous situation or that a suitable start-up/restart inhibit is in place at another location or using other means.

WARNING

Non-conformance to safety function requirements

Verify the impact of a deactivated start-up inhibit (S_StartReset = SAFETRUE) and/or restart inhibit (S_AutoReset = SAFETRUE) on your machine or process prior to implementation.

Observe the regulations given by relevant sector standards regarding the start-up/restart inhibit.

Verify that a suitable start-up inhibit is in place at another location or using other means.

Refer to the topic "S_AutoReset" for details.

Reset

Short description Value

Edge-triggered input for the reset signal:

Resetting error messages when the cause of the error is no longer present.

Manual resetting of an active start-up/restart inhibit (depending on which type(s) of inhibit the function block provides).

Data type: BOOL
Initial value: FALSE

FALSE: Reset is not requested

Edge FALSE > TRUE: Reset is requested

Note
Resetting does not occur with a negative (falling) edge, as specified by standard EN ISO 13849-1, but with a positive (rising) edge.
To implement the reset with a falling edge (with regard to the mandatory acceptance procedure), use the function block SF_Reset.

Resetting the function block by means of a positive signal edge at the Reset input can cause the S_OutControl output to switch to SAFETRUE immediately (depending on the status of the other inputs).

WARNING

Unintended start-up

Include in your risk analysis the impact of the reset by means of a positive signal edge at the Reset input.

Make certain that appropriate procedures and measures (according to applicable sector standards) have been established to help avoid hazardous situations when resetting.

Do not enter the zone of operation when resetting.

Ensure that no other persons can access the zone of operation when resetting.

Use appropriate safety interlocks where personnel and/or equipment hazards exist.

Refer to the topic "Reset" for details.

Outputs Ready

Short description Value

Output for signaling "Function block activated/not activated".
Data type: BOOL

FALSE: Function block is not activated (Activate = FALSE) and all outputs of the function block are switched to FALSE/SAFEFALSE.

TRUE: Function block is activated (Activate = TRUE) and the output parameters represent the state of the safety-related function.

Refer to the topic "Ready" for details.

S_OutControl

Short description Value

Output for enable signal of the function block.
Data type: SAFEBOOL

SAFEFALSE:

Function block not activated (Activate = FALSE)

or an upstream triggered safety-related function was detected by the function block (S_SafeControl = SAFEFALSE)

or a start-up/restart inhibit is active

or an operation stop is requested at ProcessControl (FALSE) from the standard controller

or an error has been detected.

SAFETRUE:

Function block is activated (Activate = TRUE)

and the function block did not detect a triggered safety-related function (S_SafeControl = SAFETRUE)

and no start-up/restart inhibit is active

and running operation is requested at ProcessControl (TRUE) from the standard controller

and no error has been detected.

Refer to the topic "S_OutControl" for details.

SafetyDemand

Short description Value

Output for signaling "safety-related function requested".
This output displays whether the safety chain is interrupted and as a result, the attention of the operator is required.
Data type: BOOL

FALSE: Safety-related function is not requested.

TRUE: The safety-related function is requested.

Refer to the topic "SafetyDemand" for details.

ResetRequest

Short description Value

Output for signaling "reset is required".
This output indicates whether a reset by the operator is required.
Data type: BOOL

FALSE: No reset required.

TRUE: A reset is required:

to remove an active start-up or restart inhibit (if available for this function block)

or to reset an error.

Refer to the topic "ResetRequest" for details.

Error

Short description Value

Output for error message.
Data type: BOOL

FALSE: No error is present.

TRUE: The function block has detected an error. The S_OutControl output switches to SAFEFALSE as a result.

Refer to the topic "Error" for details.

DiagCode

Short description Value

Output for diagnostic message.
Data type: WORD Diagnostic message of the function block.
The possible values are listed and described in the topic "Diagnostic codes".

Refer to the topic "DiagCode" for details.

Detailed information Signal sequence diagram

This diagram relates to a typical output control with specified start-up inhibit and restart inhibit. No additionally required operation stop of the standard controller is configured.

StaticControl = TRUE: No specification of an additional operation stop.

S_StartReset = SAFEFALSE: Start-up inhibit after the function block has been activated and after the Safety PLC has started up.

S_AutoReset = SAFEFALSE: Restart inhibit following a removal of the request for the safety-related function (return of the SAFETRUE signal at the S_SafeControl input).

Note
The other signal sequence diagram can be taken into account.

0 The function block is not yet activated (Activate = FALSE). As a result, all outputs are FALSE or SAFEFALSE.

1 After the function block has been activated due to Activate = TRUE, the start-up inhibit is active at first.

2 A positive signal edge at the Reset input resets the start-up inhibit.

3 Request from the standard controller at the ProcessControl function block input to switch the S_OutControl enable output to SAFETRUE. Taking the other inputs into account the following applies: If ProcessControl = TRUE, output S_OutControl = SAFETRUE.

4 ProcessControl switches to FALSE: Operation stop request from the standard controller. The S_OutControl enable output thus switches to SAFEFALSE.

5 New request at ProcessControl to switch the S_OutControl enable output to SAFETRUE (start of operation in the standard controller).
As no safety-related function is requested (S_SafeControl = SAFETRUE) and no additionally required operation stop is configured (StaticControl = TRUE), the S_OutControl output switches to SAFETRUE. This is followed by normal operation.

6 Request of the safety-related function, e.g., by pressing an emergency-stop control device (S_SafeControl = SAFEFALSE). The S_OutControl output immediately switches to SAFEFALSE.

7 After the request for the safety-related function has been removed (e.g., deactivation of the emergency-stop control device, S_SafeControl becomes SAFETRUE again), the restart inhibit is active. S_OutControl thus remains SAFEFALSE.

8 Removing the restart inhibit by means of the rising edge at the Reset input. As no additional operation stop of the standard controller is required (ProcessControl input) with StaticControl = TRUE and ProcessControl remains TRUE, S_OutControl switches to SAFETRUE.

Application example

This example shows the control of a safety-related output with the safety-related SF_OutControl function block. The TRUE constant at the StaticControl input specifies that no additional operation stop of the standard controller is required.

All function blocks involved are perpetually activated by means of TRUE constants at the Activate input.

An emergency-stop control device S1 is connected as single-channel to the input terminal 1.1 of the safety-related input device PSDI 1 and assigned to the global I/O variable S1_EStopDevice_In. This global I/O variable is connected to the S_EStopIn function block input of the SF_EmergencyStop function block. Neither a start-up inhibit nor a restart inhibit is specified for the SF_EmergencyStop function block (SAFETRUE constant at both inputs S_StartReset and S_AutoReset).

Instead, both inhibits are configured at the SF_OutControl function block: The S_StartReset = SAFEFALSE input specifies a start-up inhibit after the Safety PLC has been started up or the function block has been activated. S_AutoReset = SAFEFALSE configures a restart inhibit after the request for the safety-related function has been removed, i.e., after the SAFETRUE signal has returned at the S_SafeControl function block input. Both inhibits are only removed when there is a positive signal edge at the Reset input. To this end, the S2 reset button is connected to input 1.1 of the standard input device DI 1. Its signal is assigned to the global I/O variable S2_Reset, which is connected to the Reset input of the SF_OutControl function block.

Further connection of the SF_OutControl function block:

The S_EStopOut enable output of the SF_EmergencyStop function block signals the status of the safety-related function and is directly connected to the S_SafeControl function block input.

The ProcessControl input of the SF_OutControl function block is controlled by a signal from the standard controller. The operation start/stop is signaled by the ExchVar_OpStart exchange variable. ProcessControl signals whether or not the standard controller requests to switch the S_OutControl enable output to SAFETRUE.

A TRUE constant is applied to the StaticControl input, i.e., no additional operation stop of the standard controller is required. With this, the signal at ProcessControl may be TRUE when the request for the safety-related function is removed (S_SafeControl input) and when the function block is activated without this resulting in an error.

The S_OutControl function block output is assigned to the global I/O variable OC_Out, which in turn is connected to the 1.1 output terminal of the safety-related output device PSDO.

S1 Emergency-stop

S2 Reset

Further Info
The other application example and the accompanying notes can be taken into account.

Function block instantiation

The IEC 61131-3 standard defines function block instantiation. Instantiation means, a function block is defined once and can be used (instantiated) several times. This applies to all FBs (user-defined POUs as well as library FBs, such as IEC standard FBs, firmware FBs, user library FBs).

Why instantiation?
A function block has an internal memory where it stores its own processing data (local variables). As a consequence, the output values calculated by the FB depend on the internally stored values. The same input values applied to an FB instance do not necessarily deliver the same results in another FB instance.
Therefore, it is necessary to store the internal data of the FB to a separated memory area each time the function block is processed, i.e., for each FB instance. To uniquely identify each FB instance and to clearly separate its memory area, instance names are used.
The instance name of the function block has to be declared in the 'Variables' table of the POU where the FB is going to be used.

The following applies:

Function blocks can be instantiated in other function blocks or in program POUs. Calling FBs in function POUs is not possible.

Functions are called without instantiation because they do not have an internal memory.

Safety-related and standard (non-safety-related) code is strictly distinguished in PLCnext Engineer. If a Safety PLC is included in your project, the following applies:

Safety-related FBs can only be instantiated in safety-related POUs but not in standard (non-safety-related) POUs.

User-defined standard FBs can only be instantiated in standard POUs. They cannot be called in safety-related POUs.

Particular standard firmware FBs can be instantiated in both safety-related and standard POUs.

Note
When inserting a standard FB into a safety-related SNOLD network, the rules for implicit type conversion (safety-related to standard) apply.

Example for the instantiation of a user-defined function block

The user-defined function block 'TLC' ("Two Level Controller") is added to the 'Functions & Function Blocks' category (COMPONENTS area). It shall be called twice in the program POU 'Container' to control the filling level and the temperature of a boiler.

For both FB instances, an instance name declaration is added to the 'Variables' table of the calling program POU 'Container': TLCTemperature and TLCLevel. Thus the 'TLC' function block can be called twice in the code worksheet of the calling POU by means of these instance names.
Both FB instances have been inserted into the 'Container' code worksheet, each instance with different variables connected to its input and output formal parameters ('Level...' and 'Temperature...').

Additional information is available in the following sections:

Functional description

Additional signal sequence diagrams

Additional application example

Fault avoidance

Implementation of safety requirements from applicable standards