14/11/07 - Article - Bihl+Wiedemann's Safety at Work Relay Output Module BWU2045: easy to use and offering new possibilities for inexpensive networks




Bihl+Wiedemann's Safety at Work Relay Output Module BWU2045: easy to use and offering new possibilities for inexpensive networks


The Safety at Work safe actuator, the safety-rated output of an AS-Interface network, can be seen as the remote extension of the Safety Monitor: During the process, the release of an application occurs logically, as before, in the Safety Monitor, but the physical switching process no longer takes place in its relays. Instead the information is transmitted safely by the network and meeting a SIL 3 category to the safe actuator, where the switching happens locally; the safe actuator is therefore functioning as the remote extension. Hence, the actual switching process occurs in the network, in the field, via the "yellow AS-i cable".
The monitor is able to use multiple remote extensions. Depending on the configuration of network and monitor, several safe outputs can be installed and controlled as part of a single or several different release groups.
This design for a Safety at Work network has a wide range of consequences with positive side effects, providing the possibility of even more cost effective networks:
  1. The power supply for the actuators that need to be switched to the safe (i.e. off) state when a "release signal" is sent, no longer needs to be routed through the monitor (and thus through the cabinet). It can be wired directly in the field. This is where safe switching occurs.
  2. Multiple actuators may be mounted distributed in the field and can be controlled by the Safety Monitor.
  3. Several different power supply sources in a single network (for instance with different voltages) can be switched off by the same monitor.
  4. Parts of the network, that do not need to be switched off if a "release" signal (for instance "Emergency Stop") has been sent, can be supplied by the same power supply as those actuators that need to be switched off safely.
  5. Depending on the type of the monitor, several release groups can be operated by a single monitor.
  6. 2 AS-i modules in one housing:



Main function: Safe Release Switching

The safe Safety at Work actuator can – as is common for AS-Interface – be designed as a module or as an integrated slave, and thus can be, for instance, part of a motor starter1. Bihl+Wiedemann's AS-i Safety Relay Output Module BWU2045 belongs to the firstcategory. It is designed as a safety-rated actuator that gets the release information from the monitor via the AS-Interface network and then switches two parallel, galvanically isolated redundant relay sets. Hence, the safe signal is available as an on/off switch for a motor or safety contactor.
The safe switching process responding to the release request by the Safety Monitor is the main function of the device and is instantly available to the user without further configuration.



Different release groups

Operation of the safe actuator
Just like safe inputs on AS-Interface, safe actuators also utilize pre-defined safety code sequences to accomplish safe operation. However, the data source for the actuator is not the slave but the monitor. Each master call is registered by the safety monitor and the actuator. The telegram, usually sent as the 'slave response' by the slave, is now sent by the monitor and is registered by master and safe actuator. Consequently, the actuator is always only the receiver, never the sender. However, since the monitor is designed safely and sends its information in form of pre-defined code sequences, the required chain of 'Safe Data Source – Safe Data Transmission – Safe Data Sink' is guaranteed. The actuator switches into the safe state when it detects a reception or transmission error. Hence, system control is as safe as the control through the relays of the safety monitor.
If several actuators need to be switched simultaneously, these actuators are assigned – contrary to everything users are accustomed to with AS-Interface – the same address and then switch together. However, they can be installed spatially separated and are only connected via the AS-Interface network. The local auxiliary voltages can be different for each module. This way a multiplication of the safe actuators in a network and their flexible usage can be achieved without the necessity to assign additional addresses. Programming is especially simple: Only one address needs to be communicated with.
Depending on the functional capacity of the utilized safety monitor (or several monitors), multiple safe Relay Output Modules can be controlled individually: Each module with its own address can be separately released and activated. Hence, individual devices of a plant can be released or blocked selectively. This also means considerably greater flexibility for the system design.



Additional functions provided by the second slave in the housing

Besides its main function the Safe Output Module offers additional functions: Logically the Module BWU2045 consists of two slaves in a shared housing: In addition to the safe actuator described above it also includes a conventional AB-slave according to Profile S-6.A.E. with 4 inputs and 2 outputs.

a) Additional switch functions

The output bit A1 of the AB-slave is directly connected to the safe actuator: It is possible – in addition to the release by the monitor – to transfer a switch bit from the PLC to the safe actuator. This way the actuator can be switched on and off by the application, provided that the safety monitor has already granted permission to activate the output. Thus the Safety Monitor is the (safe) supervisory instance for this application and is responsible for the safe switch-off process, while the application can also operate the actuator without overwriting privileges. Prior to the availability of the safety output module a separate standard module provides this function. This is now obsolete.
This functionality can be switched off by parametrizing the AB-slave accordingly.

b) Additional inputs

Of the 4 inputs provided by the second slave, two can be freely utilized, while the other two are reserved for EDM of an external safety contactor. These signals can now be read and evaluated by the Safety Monitor resulting in the immediate transition to the safe-state whenever an error occurred. This option allows the chain of safe devices to be extended to any connected safe device (e.g. safety contactor). Because of the redundant set of relays the connected device can be controlled redundantly; the two inputs for the EDM signals enable signal monitoring and transmission to the Safety Monitor.
Configured differently trough the parameters, one of these inputs also permit transmission of the actual release state instead of the EDM signal. This simplifies programming of the control system.
The two freely available inputs are used to connect arbitrary sensors that can also be powered directly by the module (100 mA total available current).

c) Monitoring of all safe actuators

As a conventional non-safe slave the AB-slave always has its own address, occurring only once in the system. Hence, all safety output modules on a network can be separately monitored by the PLC. Even though the safe actuator cannot transmit information to the control system due to its operational principle, the application can obtain the above described data about the installed actuators and process information via the second slave.



Start-up

The start-up of the safety relay module is quite easy:
  • The safe output module is addressed as usual by an addressing device connected to the addressing jack labeled 'Prg' or directly by the master. In both cases a DIP-switch on the relay must be moved to 'Prg'. Then the address is programmed and confirmed by the slave.
  • The AB-slave is addressed as usual by an addressing device connected to the addressing jack or directly by the master. The DIP-switch on the relay must be set to 'RUN'. The slave comes preset to address'0'.
    Attention: Each of these AB-slaves needs its own unique address, even if several of their safe outputs have identical addresses.
  • Now, everything is set to utilize the main function. The default values of the parameters are set in a way that the relays only react to the release signal (and not upon the additional output bit of the control system through the AB-slave) and respond with the 'release' or 'close' information along with the Y2 value of the EDM input.
  • The additional functions of the AB-slave can be modified through parameterization via the master or the control system. Once the system is configured, these values are automatically used whenever the system is re-started.



Instructions

  • Attention: Whenever a safe module must be exchanged, addressing of the safe actuator needs to be performed as described above. This slave comes preset with the address 0. The master automatically performs the addressing of the exchanged AB-slave.
  • Attention: The safety-technological integration of the module into the application is described in the instruction manual for the monitor.



1 Bihl+Wiedemann offers engineering services necessary to integrate a corresponding circuit board in such actuators.

Article as PDF file

[back]