ABB PLUTO Safety-PLC User manual

Original instructions
English v11A 2TLC172001M0211_A
PLUTO Safety-PLC
Operating instructions
Hardware

2 2TLC172001M0211_A
Table of contents:
1General............................................................................................................................4
2Enclosure.........................................................................................................................5
3Electrical installation.........................................................................................................5
4Inputs and outputs............................................................................................................6
4.1 I.. Digital failsafe inputs..................................................................................................12
4.2 IQ.. Digital failsafe inputs / Digital outputs (non failsafe).................................................13
4.2.1 Dynamic signals.............................................................................................................13
4.2.2 Current monitoring IQ16, IQ17 (Only A20)......................................................................13
4.3 Analogue inputs..............................................................................................................14
4.3.1 Analogue inputs 0-10V / 4-20mA (Pluto D20 and D45)...................................................14
4.3.1.1 Safety in application.......................................................................................................14
4.3.1.1.1 Dual channel solutions ...................................................................................................14
4.3.1.1.2 Single channel solution...................................................................................................14
4.3.1.2 0 Volt..............................................................................................................................15
4.3.2 Possible architectures, achievable safety levels and prerequisites.................................15
4.3.2.1 Connection of analogue voltage output sensors (0-10V) ................................................16
4.3.3 Analogue inputs (0 – 27V)..............................................................................................16
4.4 Counter inputs Pluto D45 ...............................................................................................17
4.4.1 Up count.........................................................................................................................17
4.4.2 Up/Down count...............................................................................................................18
4.4.3 Sensor output types .......................................................................................................19
4.4.4 “No Filt” settings for counters..........................................................................................19
4.4.5 Speed monitoring with two sensors................................................................................19
4.4.6 Speed monitoring with one sensor..................................................................................20
4.4.7 Possible architectures, achievable safety levels and prerequisites.................................21
4.4.7.1 Application examples......................................................................................................21
4.5 Failsafe outputs..............................................................................................................22
4.5.1 Relay outputs.................................................................................................................22
4.5.2 Solid state safety outputs ...............................................................................................22
4.5.2.1 Test pulses.....................................................................................................................23
4.5.2.1.1 Disabling of test pulses...................................................................................................23
4.6 AS-Interface bus (AS-i)...................................................................................................24
4.6.1 AS-i connection..............................................................................................................24
4.6.2 Reading safety slaves ....................................................................................................25
4.6.3 Slave types.....................................................................................................................25
4.6.4 Modes of operation.........................................................................................................26
4.6.5 Exchange of Safety slaves after commissioning.............................................................26
4.6.5.1 Exchange of non-safe slaves after commissioning.........................................................26
5Connection of inputs.......................................................................................................27
5.1 Dynamic signals.............................................................................................................27
5.1.1 Connection of inputs, I....................................................................................................27
5.1.2 Connection of in-/outputs IQ...........................................................................................28
6Connection of safety devices..........................................................................................29
6.1 Dual channel systems ....................................................................................................29
6.2 Single channel systems..................................................................................................30
6.3 Emergency stop .............................................................................................................30
6.4 Monitoring of external short circuit..................................................................................31
6.5 Safety devices with transistor outputs.............................................................................32
6.6 Safety mats and safety edges ........................................................................................32
6.7 Two-hand control............................................................................................................33
6.8 Illuminated push button function.....................................................................................34
6.9 Monitoring of muting lamp (only A20).............................................................................34
7Connection of outputs.....................................................................................................35

3 2TLC172001M0211_A
7.1 Connection examples.....................................................................................................35
8Example of applications..................................................................................................38
9Pluto bus communication ...............................................................................................39
9.1 Bus cabling.....................................................................................................................39
9.1.1 Cable length...................................................................................................................40
9.1.2 Connection of bus cable shield.......................................................................................40
9.1.3 Optional protection against conducted disturbances.......................................................41
9.2 Response time over the bus...........................................................................................41
10 Identifier.........................................................................................................................42
11 Programming..................................................................................................................44
11.1 Self programming by exchange of Pluto.........................................................................44
12 Cleaning.........................................................................................................................45
13 Technical data................................................................................................................45
13.1 Connection of sensors....................................................................................................49
14 Appendix - Message and fault code list..........................................................................50

4 2TLC172001M0211_A
1 General
Pluto is a programmable safety system intended for safety applications where it is not accepted
that faults in the control system lead to loss of a safety function. To achieve this requirement
the system is designed with integral redundancy and monitoring. Unlike ordinary PLC systems,
Pluto utilizes two microprocessors, which both control and monitor each safety function for
correct operation. Each input to the system is separately connected to each processor, each
having their own memory and executing their own program. The processors continuously
compare the results with each other to ensure integrity of data.
Each safety output is connected to both processors and cannot be set unless both have
checked that the logic conditions in the application program are fulfilled.
Each Pluto unit has connections for CAN-bus and can be interconnected with other Pluto units.
The degree of safety is the same over the bus as it is within each unit.
Pluto is designed for fulfilling the demands of the EU Machinery Directive (2006/42/EC)
regarding safety of control systems, however the system can be used in other applications
such as processing industry, furnaces, railways, etc. which have similar requirements.
Pluto is designed according to the following functional safety standardsfor control systems:
- EN 954-1, Category 4
- EN 62061, SIL3
- EN 13849-1, Category 4 and Performance level e
- IEC 61508-, SIL 3
- IEC-EN 61511-, SIL 3
- EN 50156-1
For an application to fulfil any of the standards above it is necessary that the design and
installation of the complete safety related system (not only Pluto) including sensors and
actuators fulfils the requirements.

5 2TLC172001M0211_A
2 Enclosure
Pluto is constructed in an enclosure for snap mounting on
a DIN-rail in control cabinets or other suitable enclosures.
External wiring is connected via screw terminals. To make
it easy and to avoid incorrect connection when a unit is
exchanged, the connector blocks are detachable so that
individual wires do not have to be disconnected.
Note that the power shall be off during connection and
disconnection.
3 Electrical installation
The system is powered by 24V DC. The system has internal overcurrent protection but should
be protected by an external fuse. (See technical data).
In installations with several Pluto units connected together via bus, they must be installed in the
same earthing system. Proper potential equalization is necessary.
The Pluto is designed for applications which fulfil IEC-EN 60204-1 and with special attention to:
- “Transformers shall be used for supplying the control circuits”.
- “Where several transformers are used, it is recommended that the windings of those
transformers be connected in such a manner that the secondary voltages are in phase”.
(see EN 60204-1, 9.1.1)
These requirements are relevant for connection of the relay outputs.
- For electrical safety reasons and in order to be able to detect safety critical earth faults in
single channel circuits, the 0V terminal must be connected to protective bonding circuit.
(see EN 60 204-1, 9.4.3.1 Method a).
- For installation in lifts according to EN 81-1+A3 and/or EN 81-2+A3 it is required that Pluto
is installed in enclosure at least IP54.
The system is designed and tested for installationcategory II according to IEC 61010-1, (all
connected circuits are supplied via control voltage transformers).
Cables and connected devices such as sensors, pushbuttons, selector switches shall be
isolated for 250V.
K
PLUTO PLUTO
K
IQ16IQ14IQ12
IQ13 IQ15 IQ17
I4I0C L I2
C H I1 I3
Q2I6 IQ10
Q3
IQ11I7I5
I3I1CH
I2C L I0 I4
+24VID 0VIQ17IQ15IQ13
IQ12 IQ14 IQ16 Q0 Q1
Min. 5 mm space between units.
Q10-Q17
+24V
Q0-Q1 Q2-Q3
+24V
24V=
AC
0V
I0 I17
-24V
-

6 2TLC172001M0211_A
4 Inputs and outputs
In order to be as flexible as possible Pluto offers various combinations of different I/O: s.
There are also different families and types of PLUTO. Pictured below are the IO overviews for
the various Pluto types.
Inputs and outputs for the A20 family (except B22 and D20)
Terminal on Pluto In-/Output name in software I/O type Local/Global
I0…I7 I_.0…I_.7 Safe Input Global
Q0 Q_.0 Safe Output (Relay) Global
Q1 Q_.1 Safe Output (Relay) Global
Q2 Q_.2 Safe Output (Transistor) Global
Q3 Q_.3 Safe Output (Transistor) Global
IQ10…IQ17 I_.10…I_.17 Safe Input Global
Q_.10…Q_.17 Nonsafe Output Local
where “_” is the Pluto number
Inputs and outputs for Pluto B22
Terminal on Pluto In-/Output name in software I/O type Local/Global
I0…I7 I_.0…I_.7 Safe Input Global
I20…I25 I_.20…I_.25 Safe Input Local
IQ10…IQ17 I_.10…I_.17 Safe Input Global
Q_.10…Q_.17 Nonsafe Output Local
where “_” is the Pluto number
Failsafe inputs / Indication outputs (not failsafe) / Dynamic outputs
IQ10 IQ11
Power
0V +24V
Pluto bus
CL
IQ12 IQ13
input
ID
Identifier
CH
IQ15IQ14 IQ16
I0
Inputs, individual failsafe
IQ17
I1 I2 I3 I4 I6 I7
Pluto B22 SR41
AI
I5 I21I20 I22 I23 I25I24
I/O overview PLUTO B22
IQ16
Failsafe inputs / Indication outputs (not failsafe) / Dynamic outputs
Current monitored
IQ14 IQ15IQ13IQ12IQ11IQ10
2) Current monitored only on A20
1) Not S-models, S20,...
Pluto A20, B20, S20
CLCH
Pluto bus 1) Inputs, individual failsafe
I0 I2I1 I4I3 I5 I6
SR41
AI
Q1
IQ17 Q0
Identifier
individual failsafe
2)
A
B
Relay output, input
A
BID +24V0V
Power
Transistor output,
individual failsafe
I7 AQ2
B
AQ3
B
I/O overview PLUTO A20 family (except B22 and D20)

7 2TLC172001M0211_A
Inputs and outputs for Pluto D20
Terminal on Pluto In-/Output name in software I/O type Local/Global
IA0…IA3 I_.0…I_.3 Safe Input/
Safe Analogue input 4-20mA/0-10V Global
I4…I7 I_.4…I_.7 Safe Input Global
Q0 Q_.0 Safe Output (Relay) Global
Q1 Q_.1 Safe Output (Relay) Global
Q2 Q_.2 Safe Output (Transistor) Global
Q3 Q_.3 Safe Output (Transistor) Global
IQ10…IQ17 I_.10…I_.17 Safe Input Global
Q_.10…Q_.17 Nonsafe Output Local
where “_” is the Pluto number
Failsafe inputs / Indication outputs (not failsafe) / Dynamic outputs
IQ10 IQ11
Power
0V +24V
Pluto bus
CL
IQ12 IQ13
input
ID
Identifier
CH
IQ15IQ14 IQ16
IA0
BB
individual failsafe
Transistor output,
Relay output,
individual failsafe
B B
Inputs, individual failsafe
Q0
IQ17
IA1 IA2
A
IA3 I4
Q1
A
I6
Q2
A
I7
Q3
A
Pluto D20 0-24V
I5
AI
0-10V/4-20mA
DI
AI
DI
AI
DI
AI
DI
AI
DIDI DI DI
I/O overview PLUTO D20

8 2TLC172001M0211_A
Inputs and outputs for Pluto B46 and S46
Terminal on Pluto In-/Output name in software I/O type Local/Global
I0…I7 I_.0…I_.7 Safe Input Global
I30…I37 I_.30…I_.37 Safe Input Local
I40…I47 I_.40…I_.47 Safe Input Local
Q0 Q_.0 Safe Output (Relay) Global
Q1 Q_.1 Safe Output (Relay) Global
Q2 Q_.2 Safe Output (Transistor) Global
Q3 Q_.3 Safe Output (Transistor) Global
Q4 Q_.4 Safe Output (Relay) Local
Q5 Q_.5 Safe Output (Relay) Local
IQ10…IQ17 I_.10…I_.17 Safe Input Global
Q_.10…Q_.17 Nonsafe Output Local
IQ20…IQ27 I_.20…I_.27 Safe Input Local
Q_.20…Q_.27 Nonsafe Output Local
where “_” is the Pluto number
Failsafe inputs / Outputs (not failsafe) / Dynamic outputs
IQ10 IQ11
supply
Power
+24V
IQ12 IQ13
Identifier IDFIX
IQ15
IQ14 IQ16
I30
B
Inputs, individual failsafe
Q0
IQ17
I31 I32 I33 I34 I35 I36
Q2 A
I37
Pluto B46, S46
Pluto bus
I45I40 I41 I42 I43 I44 I46 I47
Inputs, individual failsafe
I0 I1 I2 I3 I6I5I4 I7
IQ21IQ20 IQ25IQ24IQ23IQ22 IQ27IQ26
BA
A
Q1 B
A
Q4 B
Q5 AB
Q3 B
A
0V
0V
ID
CH
CL 1)
1) Not S46-6
AI AI AI
SR46SR45SR41
4L
1L
0L
Safety outputs
Digital/Analogue Inputs, individual failsafe
I/O overview PLUTO B46 and S46

9 2TLC172001M0211_A
Inputs and outputs for Pluto D45
Terminal on Pluto In-/Output name in software I/O type Local/Global
IA0…IA3 I_.0…I_.3 Safe Input/
Safe Analogue input 4-20mA/0-10V/
Counter input
Global
IA4…IA7 I_.4…I_.7 Safe Input/
Safe Analogue input 4-20mA/0-10V Global
I30…I37 I_.30…I_.37 Safe Input Local
I40…I47 I_.40…I_.47 Safe Input Local
Q0 Q_.0 Safe Output (Relay) Global
Q1 Q_.1 Safe Output (Relay) Global
Q2 Q_.2 Safe Output (Transistor) Global
Q3 Q_.3 Safe Output (Transistor) Global
Q4 Q_.4 Safe Output (Relay) Local
Q5 Q_.5 Safe Output (Relay) Local
IQ10…IQ17 I_.10…I_.17 Safe Input Global
Q_.10…Q_.17 Nonsafe Output Local
IQ20…IQ26 I_.20…I_.26 Safe Input Local
Q_.20…Q_.26 Nonsafe Output Local
where “_” is the Pluto number
Failsafe inputs / Outputs (not failsafe) / Dynamic outputs
IQ10 IQ11
supply
Power
+24V
IQ12 IQ13
Identifier IDFIX
IQ15
IQ14 IQ16
I30
B
Inputs, individual failsafe
Q0
IQ17
I31 I32 I33 I34 I35 I36
Q2 A
I37
Pluto D45
Pluto bus
I45I40 I41 I42 I43 I44 I46
Digital inputs, individual failsafe
IQ21IQ20 IQ25IQ24IQ23IQ22 IQ26
B
A
A
Q1 B
A
Q4 B
Q5 A B
Q3 B
A
0V
0V
ID
CH
CL
AI
4L
1L
0L
Safety outputs
Analogue inputs 0-10V/4-20mA Inputs, individual failsafe
DI
IA7
DI AI
IA6
DI AI
IA5
DI AI
IA4
DI AI
IA2
DI AI
IA1
DI AI
IA0 AIDI IA3
CS (Shield)
Fast counter
I47
I/O overview PLUTO D45

10 2TLC172001M0211_A
Inputs and outputs for Pluto B42 AS-i
Terminal on Pluto In-/Output name in software I/O type Local/Global
I0…I3 I_.0…I_.3 Safe Input Global
I30…I37 I_.30…I_.37 Safe Input Local
I40…I47 I_.40…I_.47 Safe Input Local
Q0 Q_.0 Safe Output (Relay) Local
Q1 Q_.1 Safe Output (Relay) Local
Q2 Q_.2 Safe Output (Transistor) Local
Q3 Q_.3 Safe Output (Transistor) Local
Q4 Q_.4 Safe Output (Relay) Local
Q5 Q_.5 Safe Output (Relay) Local
IQ10…IQ17 I_.10…I_.17 Safe Input Local
Q_.10…Q_.17 Nonsafe Output Local
IQ20…IQ27 I_.20…I_.27 Safe Input Local
Q_.20…Q_.27 Nonsafe Output Local
ASi+ - AS-i bus -
ASi-
where “_” is the Pluto number
IQ25IQ24IQ23IQ22 IQ27IQ26
B
A
A
Q1 B
A
Q4 B
Q5 A B
Q3 B
A
0V
0V
ID
CH
CL
AI AI AI
SR46SR45SR41
4L
1L
0L
Failsafe inputs / Outputs (not failsafe) / Dynamic outputs
Power
Identifier IDFIX
Inputs, individual failsafe
Pluto bus
Inputs, individual failsafe
Safety outputs
Digital/Analogue Inputs, individual failsafe
supply
CS
AS-Interface
(Shield)
I35 I36
Q2 A
I37
Pluto B42 AS-i
I45I40 I41 I42 I43 I44 I46 I47ASi+ ASi- I2I1I0 I3
IQ21IQ20IQ10 IQ11
+24V
IQ12 IQ13 IQ15IQ14 IQ16
I30
B
Q0
IQ17
I31 I32 I33 I34
I/O overview PLUTO B42 AS-i

11 2TLC172001M0211_A
Inputs and outputs for Pluto AS-i
Terminal on Pluto In-/Output name in software I/O type Local/Global
I0 I_.0 Safe Input Global
I1…I3 I_.1…I_.3 Safe Input Local
Q0 Q_.0 Safe Output (Relay) Global
Q1 Q_.1 Safe Output (Relay) Global
Q2 Q_.2 Safe Output (Transistor) Global
Q3 Q_.3 Safe Output (Transistor) Global
IQ10…IQ13 I_.10…I_.13 Safe Input Local
Q_.10…Q_.13 Nonsafe Output Local
ASi+ - AS-i bus -
ASi-
where “_” is the Pluto number
Pluto AS-i can also read inputs and set outputs in AS-i slaves connected to the AS-i bus. The
different slave types are explained further in chapter 4.5.2 Slave types, and the corresponding
Pluto configurations for these are explained in the Pluto Programming Manual.
ASI-
IQ11 IQ12 IQ13IQ10
Outputs (not failsafe) / Dynamic outputs
DI
Failsafe inputs / Analogue inputs
AI
AI DI DI AI DI AI
Power
supply
+24V CH
CAN-bus
input
0V ID
Identifier
Pluto AS-i
CL ASI+
AS-Interface
Q3Q2
Q1Q0
Safety outputs
0L
A
B1L
A
BB
A
B
A
I2
Inputs, individual failsafe
I0 I1 I3
I/O overview PLUTO AS-i

12 2TLC172001M0211_A
Inputs and outputs for Pluto O2
Terminal on Pluto In-/Output name in software I/O type Local/Global
I0, I1 I_.0, I_.1 Safe Input (for monitoring) Global
Q0.13…Q0.34 Q_.0 Safe Output (Relay) Global
Q1.13…Q0.34 Q_.1 Safe Output (Relay) Global
IQ10, IQ11 I_.10, I_.11 Safe Input Global
Q_.10, Q_.11 Nonsafe Output Local
where “_” is the Pluto number
Pluto O2 is a safety output module with two relay output groups with three contacts each. Pluto
O2 is also equipped with two safe inputs for monitoring and two combined safe in-/non-safe
outputs (IQ).
4.1 I.. Digital failsafe inputs
Each input is separately
connected to both processors
which, facilitating both single
channel and dual channel safety
devices.
The inputs can be supplied by
+24V or by the dynamic signal
outputs A, B or C.
CL I0 CH
ID
Pluto O2
IQ10
Q1
B
IQ11
33
A
13 14
+24V 0V
CSh
23 2434
B33 34 13 14 23 24
A
Q0
I1
250VAC, 5A24V, 1.5A
24V, 1.5A 250VAC, 5A
Power supply
Safety Output Module
Safe inputs
Non-safe outp
Dynamic outp
Safe inputs
Non-safe outp
Dynamic outp
I
/
O overview PLUTO
O2

13 2TLC172001M0211_A
4.2 IQ.. Digital failsafe inputs / Digital outputs (non failsafe)
This type of IO-terminals provides 4 different functions. Each terminal is connected to both
processors and may therefore be used as a failsafe input.
Each terminal is also equipped with an output transistor giving the user the possibility to
configure it as either a failsafe input or non failsafe output. The outputs are intended for
functions that do not require redundancy. E.g. indicators and status signals.
4.2.1 Dynamic signals
The IQ-terminals can be configured as dynamic outputs A, B or C for supplying inputs. When
an output is configured as dynamic, a unique pulse train is generated. A safety input can then
be configured just to accept this specific pulse train as input condition and the system will
detect external short circuit conditions. (See separate description).
4.2.2 Current monitoring IQ16, IQ17 (Only A20)
See 6.9
Failsafe inputs, Outputs (non failsafe), Dynamic outputs
IQ10
BA
CPU
Current monitored (only A20)
IQ15 IQ16 IQ17
AB AB AB

14 2TLC172001M0211_A
4.3 Analogue inputs
4.3.1 Analogue inputs 0-10V / 4-20mA (Pluto D20 and D45)
Pluto D20 is equipped with 4, and Pluto D45 with 8, safe 4-20mA/0-10V analogue inputs.
These (D20: IA0 – IA3, D45: IA0 – IA7) can be configured as either “ordinary” failsafe inputs,
as analogue inputs 0-10V or as analogue inputs 4-20mA. (For D45 IA0 – IA3 can also be
configured as counter inputs, see below.) For an application to reach SIL 3/PL e it is required
that two sensors in parallel with one input each are being used. See Pluto Programming
Manual.
4.3.1.1 Safety in application
Each input is connected to both processors in order to be able to use them as standalone
safety inputs. There are however some faults which can give failure in the measurement such
as interruption in the connector block, or interruption in the cabling between sensor and Pluto
which leads to that Pluto reads a value close to 0.
To achieve higher degree of safety or redundancy for a complete application there are some
requirements and suggested solutions.
4.3.1.1.1 Dual channel solutions
A complete dual channel application with two
sensors using two inputs, one for each sensor and
the sensor values are compared with each other, the
application can achieve category 4/PL e and SIL 3.
In general the physical values must be dynamic and
must not be static. In case that the physical values
are almost static, then for category 4 a test must be
performed daily. If not, the solution can only be
regarded as category 3/PL d.
In the application there is normally some trip out function when a limit value is passed, such as
over temp, overpressure etc. Since there in process industry are applications which do not trip
out under normal operation a test procedure should be implemented, especially for test of the
sensors. Such test can be a manual test once a year.
4.3.1.1.2 Single channel solution
A safetyfunction with a single sensor using a single input gives category 2, PL b..c,
SIL 2. Factors which have influence on the safety level are:
- If there is a dynamic behaviour in the application that is predictable.
- If wire break or other interruptions of the signal is detected. Input values close to 0V and
0mA can be used as fault condition by using for example 4..20mA as correct values.
- If the sensor value can be compared with another value from another source. (This can
however be seen as a dual channel solution.)
- If automatic test procedure can be implemented.
- Protected cables. The cables can be protected against mechanical damage and separated
from other cabling.
-FS-type approved sensor.
A maximum of Category 2, PL d, SIL2 is achievable with approved sensors.
Sensor B IAx
+24V
0V µB
µA
Pluto
0V
+24V
IAx
µB
µA
=
4..20mA / 0..10V
4..20mA / 0..10V
=
Sensor A
Dual channel application

15 2TLC172001M0211_A
4.3.1.2 0 Volt
In general 0 or close to 0 volt/mA cannot be trusted as a true signal except when there is a
dynamic behaviour in the application which makes it possible to evaluate the correctness.
There are two reasons for this:
- 0 can be a consequence of an internal fault in Pluto. Variables in the PLC code are then
often set to 0.
- An analogue value close to 0, 0..0.5V/ 0..0.5mA can be caused by wire break or other
interruption of the connected sensor.
The use of 4-20mA or 2-10V range is therefore recommended.
Note: If 0-signals are used the evaluation of the correctness must be performed by the
application program.
4.3.2 Possible architectures, achievable safety levels and prerequisites
This table is an overview of safety levelsfor different applications.
The achievable SIL / PL depend on the sensor which is used in the application.
Structure
Achievable
SIL / PL
Prerequisites,
necessary diagnostic to be realized in the application
program
1 standard sensor SIL 1 / PL c Measurement values < 3.0mA resp. < 1.5V have to be handled as
failure conditions
(DC ≥60%)
1 FS certified sensor
(SIL 2 / PL d) SIL 2 / PL d Measurement values < 3.0mA resp. < 1.5V have to be handled as failure conditions.
Eventual additional diagnostic measures mentioned in the safety
manual of the sensor
1 FS certified sensor
(SIL 3 / PL e) SIL 2 / PL d Measurement values < 3.0mA resp. < 1.5V have to be handled as failure conditions.
Eventual additional diagnostic measures mentioned in the safety
manual of the sensor
2 standard sensors
(homogeneous
redundant)
SIL 2..3 / PL d Measurement values < 3.0mA resp. < 1.5V have to be handled as
failure conditions.
Monitoring, if the measured values of both channels match
together
(DC ≥60%)
2 standard sensors
(diverse redundant) SIL 3 / PL e Measurement values < 3.0mA resp. < 1.5V have to be handled as failure conditions.
Monitoring, if the measured values of both channels match
together
(DC ≥90%)

16 2TLC172001M0211_A
4.3.2.1 Connection of analogue voltage output sensors (0-10V)
It is important that the 0V wire from the analogue sensor is connected directly to the terminal
”0V” on Pluto, and not to 0V somewhere else. Otherwise current in the 0V conductor may affect
the measured analogue value.
When using long cablesfrom the analogue sensor, a current output sensor is to be preferred
over a voltage output sensor since long cables may cause a voltage drop. A current loop (4-20
mA) is not affected by this.
4.3.3 Analogue inputs (0 – 27V)
Depending on type there are one or more analogue inputs. These inputs are connected to
terminals for digital inputs (example A20 – I5, B46 – I5, I6, I7). These analogue inputs are read
by both processors and can therefore be used for safety applications.
In the PLC program the value can be read in system registers. See Pluto Programming
Manual.
0V +24V
IA0
+24V
IA1 IA2..........
Pluto D20/D45
Sensor
Output
0V Signal 0V
+24V
0V
0..10V
0..10V
Sensor with 0-10V output. 0V supply to the sensor should be directly connected to Pluto 0V.

17 2TLC172001M0211_A
4.4 Counter inputs Pluto D45
For Pluto D45 the inputs IA0 – IA3 can be configured as counter inputs (pulse counting) which
work for frequencies up to 14000 Hz. As counter inputs IA0 – IA3 can be used in two ways, Up
counting or Up/Down counting.
4.4.1 Up count
When the input is configured for Up count Pluto counts the pulses on the input. Via a function
block the user gets the pulse rate which for example can represent a speed. The sensor is
typically a proximity switch or photocell. For description of the use of Function blocks see Pluto
Programming Manual.
IA0 µA
µB
+24V Pluto
IA4
µB
µB
µA
IA1
IA3 µA
µA
µB
0V
+24V
0V
T
R
Example of sensor solution for speed monitoring. The sensors can for example be proximity switches or
photocells.
Any of the inputs IA0..IA3 can be used.
Configuration of counter input

18 2TLC172001M0211_A
4.4.2 Up/Down count
In order to determine the direction of a movement input IA0 and IA2 can be configured as
Up/Down counters. When this is done the next input (IA1 or IA3) is automatically reserved for
Up/Down counting. This means that for Up/Down counting IA0-IA1 are a pair and IA2-IA3 are
another pair.
In order to make up/down counting it requires that the sensors can produce A/B-pulses. A/B-
pulses are two square wave signals that are 90° phase shifted to each other. The sensor is
typically a incremental encoder 24V, HTL. For description of the use of Function blocks see
Pluto Programming Manual.
Typical devices are rotary incremental encoders, 24V (HTL).
A
B
Illustration of A and B pulses.
A and B are 90° phase shifted
0V
+24V
IA0
µB
µA
IA1 µA
µB
A
B
A
B
µB
IA3
IA2
+24V
0V µA
µB
µA
Pluto
Example of speed monitoring with incremental encoders leaving A and B pulses to two inputs, IA0-IA1
or IA2-IA3. The direction is then possible to measure.
Two encoders with two inputs each are used in this example to achieve redundancy.
For overspeed monitoring (safe low speed, SLS) category 4 and PL e is normally reached.
For stand still monitoring Category 3 and PL d can be reached depending on application.

19 2TLC172001M0211_A
4.4.3 Sensor output types
Incremental encoders with HTL output and other with push-pull output can be used at
frequencies up to around 14 kHz. For sensors with “open collector”, “PNP” output, or other
output not of “push-pull” type the maximum frequency might typically be 1 – 4 kHz, but the limit
is dependent on the output resistance, the cable length etc.
The reason for this is that the signal will not have time to return to zero at higher frequencies.
This will be interpreted by Pluto and the function block as Speed=0.
4.4.4 “No Filt” settings for counters
For incremental encoders with HTL output and frequencies over 4 kHz the setting “No Filt” shall
be selected.
For lower frequencies and use of for example standard proximity switches the option “No Filt”
shall not be selected since the filter will give protection against disturbances.
4.4.5 Speed monitoring with two sensors
Overspeed, Safe low speed etc.
With a two-channel solution where 2 sensors monitor that the speed are within certain limits the
application can reach Category 3/PL d or 4/PL e if diverse types of sensors are used.
As long as there is a speed the two sensors can be compared with each other and if one fails it
is detected since they need to be equal.
Stand still monitoring, dual channel
For stand still monitoring with two sensors Category 3/PL d can be achieved. This requires
however that motion is detected regularly so that the application is tested. A typical solution is
every time a motion in a machine is started the PLC program requires a corresponding reaction
from the sensors / speed sources.
Note that in machines vibrations can cause indication of small speed values.
10V
0
1 1
0
10V
0V
+24V
Output
Sensor output Signal at low frequency Signal at too high frequency
(Pluto reads 0 speed.)
Signal behaviour for sensor outputs with no active pull to 0V.
0V
+24V +24V
0V
Push-pull / HTL sensor output. Open collector / PNP sensor output
Typical for incremental encoders Typical for proximity sensors and photocells

20 2TLC172001M0211_A
Interruption in the cabling to a sensor will lead to that Pluto read 0-speed from that sensor.
Such fault must therefore be detected in the application by using two independent sensors that
are automatically cyclically checked with regard to that there is motion in the machine at least a
couple of times per day.
Note: By use of two encoders which are compared with each other, faults in one sensor are
monitored. The encoder can normally be of same type since the same fault in the two sensors
in the same time is unlikely. But to get even higher degree of safety two of different type can be
used in order to achieve diversity. This diversity minimises the risk of common cause failures.
4.4.6 Speed monitoring with one sensor
Overspeed, Safe low speed etc.
With a single sensor normally Category 2/PL c is reached.
However, by monitoring of dynamic behaviour in the application it is possible to reach
Category 3/PL d.
Such monitoring for safe low speed monitoring (SLS) can be:
1) When the motion in the machine is stopped Pluto checks that the sensor also indicates a
stop. Then when the motion is started the program checks that the sensor value changes
from indicating stop to the expected speed.
2) Another solution is to compare the sensor value with for example a feed back from another
system such as frequency converter. The independent source of the speed information
must be proven.
Stand still monitoring, single channel
For stand still monitoring with one sensor Category 2/PL c can be achieved under the
requirement that the sensor application is automatically cyclically tested. The interval is
typically several times a day.
One solution for testing is to read the speed value at every cycle start and stop of the machine
cycle. Every time a motion in a machine is started the PLC program requires a corresponding
reaction from the sensor. At start the program can check that the sensor value changes from
stand still to an expected speed within a certain time. At stop command the program can check
that the speed value decreases down to stand still.
NOTE: Interruption in the cabling to a sensor will lead to that Pluto reads 0-speed. At stand still
monitoring this is loss of safety function if it happens during a stop.
(This is however according to the definition of category 2.)