Safety Cockpit: Controlling the Safety Application

• Display of the essential diagnostic information on the Safety PLC including the Safety PLC state.
• Main control functions to write the safety-related project image to the Safety PLC and start/stop the Safety PLC.
• Commands for activating/terminating the monitoring mode and debug mode (see topic "Connecting vs. Monitoring Mode vs. Debug Mode").

• Writing the project to the Safety PLC and starting the safety-related application (observe the safety warning message noted at the beginning of this topic).
• Stopping the Safety PLC (only possible while debug mode is active).
• Performing a Safety PLC cold start (only possible while debug mode is active).
  During a cold start all data are initialized.

Toolbar button	Keyboard shortcut	Description
	-	Establishes/disconnects a communication connection between PLCnext Engineer and the Safety PLC. While connected to the Safety PLC, you can write and start the project. the Safety Cockpit shows diagnostic information and the Safety PLC icon in the PLANT indicates the Safety PLC state. you can activate the monitoring mode to transfer online values from the Safety PLC. you can activate the debug mode to transfer online values from and debug commands to the Safety PLC. Note If the debug mode is active when disconnecting from the Safety PLC using the button, the Safety PLC will be stopped 10 minutes after the disconnection.
	-	Activates the monitoring mode of the Safety PLC by attaching PLCnext Engineer to the running safety-related application process on the safety-related controller. This command is available, if a communication connection exists between PLCnext Engineer and the Safety PLC (see first table line). Monitoring mode allows read-only access to the Safety PLC. Therefore, monitoring mode is considered as safety-related mode as the execution of the application cannot be influenced by debug commands. While monitoring mode is active, the Safety Cockpit shows diagnostic information and the Safety PLC icon in the PLANT indicates the Safety PLC state. online values are read from the Safety PLC and displayed in online worksheets ‣ Monitoring/Debugging the Safety PLC ×‣ Monitoring Mode: Displaying Online Values × watch lists can be used for collecting online values of variables. no debug commands can be executed.
	-	Activates the debug mode of the Safety PLC by attaching PLCnext Engineer to the running safety-related application process on the safety-related controller. This command is available, if a communication connection exists between PLCnext Engineer and the Safety PLC (see first table line). Monitoring mode may be active or not. Note Debug mode allows write access to the Safety PLC (in contrast to monitoring mode). Therefore, debug mode is considered as non-safety-related mode as the execution of the application can be influenced by debug commands. Observe the hazard message below this table. When starting or terminating the debug mode, a dialog appears where you have to confirm the operation. While debug mode is active: the Safety Cockpit shows diagnostic information and the Safety PLC icon in the PLANT indicates the Safety PLC state. online values of variables are read from the Safety PLC and can be displayed in online worksheets ‣ Monitoring/Debugging the Safety PLC ×‣ Monitoring Mode: Displaying Online Values ×, and debug commands ‣ Connecting vs. Monitoring Mode vs. Debug Mode ×‣ Debugging Safety-Related Code: Forcing/Overwriting ×‣ Debugging: Single Cycle Operation of the Safety PLC × can be executed, and watch lists can be used for collecting online values of variables and for executing debug commands. While the debug mode is active, the status bar shows a red dot next to the entry 'Safety PLC: Debug Mode Active'.
	-	"All in one" command 'Write and Start'. The following is executed: Build of the machine-readable binaries (project image). If the build was successful: Connection to the Safety PLC is established. The project image (binaries) is written to the Safety PLC and stored as Boot Project in the Flash memory and in the RAM. The project image contains the application logic as machine-readable code and all relevant configuration/parameterization data of the project. Project sources are stored on the Safety PLC. Safety PLC is reset. Project execution is started automatically and the Safety PLC executes the safety-related application in Safe Run state. PLCnext Engineer automatically switches to monitoring mode (attaches to the running application process). The application is ready for monitoring ‣ Monitoring/Debugging the Safety PLC ×‣ Monitoring Mode: Displaying Online Values × and debugging ‣ Connecting vs. Monitoring Mode vs. Debug Mode ×‣ Debugging Safety-Related Code: Forcing/Overwriting ×‣ Debugging: Single Cycle Operation of the Safety PLC ×. To execute the command, it is not necessary to be connected to the Safety PLC, monitoring/debug mode is not required and the Safety PLC may run.
	-	Executes a cold start on the Safety PLC. During a cold start all data are initialized. The command is only available while the Safety PLC is running and the debug mode ‣ Connecting vs. Monitoring Mode vs. Debug Mode ×‣ Debugging Safety-Related Code: Forcing/Overwriting ×‣ Debugging: Single Cycle Operation of the Safety PLC × is active. It switches the Safety PLC from the Debug Stop to Debug Run state. This is indicated by the Safety PLC icon in the PLANT and in the Safety Cockpit.
	-	Stops the program execution on the Safety PLC. The command is only available while the Safety PLC is running and the debug mode ‣ Connecting vs. Monitoring Mode vs. Debug Mode ×‣ Debugging Safety-Related Code: Forcing/Overwriting ×‣ Debugging: Single Cycle Operation of the Safety PLC × is active. The Safety PLC enters the Debug Stop state. This is indicated by the Safety PLC icon in the PLANT and in the Safety Cockpit.
	-	Activates the halt mode of the Safety PLC. This command is available if the debug mode is active (see previous table row), i.e., the Safey PLC is one of the states Debug Run or Debug Stop. Note In the Debug Halt state and during single cycle operation, PLCnext Engineer displays a simulation in its online worksheets. No outputs are set on the Safety PLC or connected safety-related I/O devices. This means that the safety-related application does not function during single cycle operation. Observe the hazard message below this table. The program execution is halted and the single cycle operation of the Safety PLC is possible (see next table row). To exit the Debug Halt state, click the Halt mode button again. The Safety PLC switches into the state from which Debug Halt was entered before.
	-	Instructs the Safety PLC to execute exactly one single program cycle and then wait for the next command (which is either a further single cycle or exiting the Debug Halt state). This command is available if the debug mode is active and the Safety PLC is in Debug Halt state (see previous table row). Note In single cycle operation, PLCnext Engineer displays a simulation in its online worksheets. No outputs are set on the Safety PLC or connected safety-related I/O devices. This means that the safety-related application does not function during single cycle operation. Observe the hazard message below this table.
	-	The command is only available while you are logged on the Safety PLC. Opens the dialog 'Safety PLC Password Definition' where you can replace the current Safety PLC password by a new one.
	-	The command is only available while you are logged on the Safety PLC. Reads the error messages from the Safety PLC error stack and displays them in the editor page 'Safety PLC messages' of the Safety Cockpit. In case of a runtime error, the Safety PLC writes an entry to the error stack of the safety-related runtime (SafeOS). The 'Fail' LED on the 'Overview' page of the Safety Cockpit indicates that an error has occurred and that you can read the errors from the error stack and display them on the 'Safety PLC messages' editor page.
	-	The command is only available while you are logged on to the Safety PLC and the Safety PLC is in Stop state. Reads the log book of the Safety PLC and displays the messages on the page 'Safety PLC log messages' of the Safety Cockpit. In its log book, the Safety PLC records device-related events such as state changes, errors, and so on.

WARNING

Unintended machine operation Prior to forcing/overwriting variables during runtime, make certain that suitable organizational measures (according to applicable sector standards) have been taken to avoid hazardous situations if the application logic functions in an unintended or incorrect way. Verify the impact of forcing or overwriting variables. Prior to executing single cycle operations in Debug Halt state, make certain that suitable organizational measures (according to applicable sector standards) have been taken to avoid hazardous situations as the safety-related application does not function. Do not enter the zone of operation while executing single cycle operations in Debug Halt state. Ensure that no other persons can access the zone of operation while executing single cycle operations in Debug Halt state. Observe the regulations given by relevant sector standards while the machine is running in any other operating mode than "operational". Use appropriate safety interlocks where personnel and/or equipment hazards exist.