Allen-Bradley 1756-L61S ControlLogix 5561S User manual

GuardLogix Controller Systems
Catalog Numbers 1756-L61S, 1756-L62S, 1756-L63S, 1768-L43S,1768-L45S, RSLogix 5000 Version 20 and earlier
Safety Reference Manual
Original Instructions

Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to
familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,
and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are
required to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may
be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from
the use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous
environment, which may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property
damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous
voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may
reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to
potential Arc Flash. Arc Flash will cause severe injury or death.Wear proper Personal Protective Equipment (PPE). Follow ALL
Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 3
Table of Contents
Preface
Summary of Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Understanding Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Chapter 1
Safety Integrity Level (SIL) Concept
SIL 3 Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Functional Verification Tests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
GuardLogix Architecture for SIL 3 Applications . . . . . . . . . . . . . . . . . . . . 13
GuardLogix System Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
GuardLogix Certifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
GuardLogix PFD and PFH Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Safety Integrity Level (SIL) Compliance Distribution and Weight. . . . 17
System Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Safety Task Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Safety Task Period and Safety Task Watchdog . . . . . . . . . . . . . . . . . . 19
Contact Information if Device Failure Occurs . . . . . . . . . . . . . . . . . . . . . . 19
Chapter 2
GuardLogix Controller System
1756 GuardLogix Controller Hardware. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Primary Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Safety Partner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Chassis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Power Supplies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
1768 Compact GuardLogix Controller Hardware . . . . . . . . . . . . . . . . . . 23
CIP Safety Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Safety I/O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Communication Bridges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Programming Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Chapter 3
CIP Safety I/O for the GuardLogix
Control System
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Typical Safety Functions of CIP Safety I/O Modules. . . . . . . . . . . . . . . . 27
Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Status Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Status Indicators. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
On- or Off-delay Function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Safety Considerations for CIP Safety I/O Modules. . . . . . . . . . . . . . . . . . 29
Ownership. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Safety I/O Configuration Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
I/O Module Replacement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

4Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Table of Contents
Chapter 4
CIP Safety and the Safety Network
Number
Routable CIP Safety Control System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Unique Node Reference. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Safety Network Number . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Considerations for Assigning the Safety Network Number (SNN) . . . 35
Safety Network Number (SNN) for Safety Consumed Tags. . . . . . 35
Safety Network Number (SNN) for Out-of-box Modules. . . . . . . . 36
Safety Network Number (SNN) for Safety Module with a Different
Configuration Owner. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Safety Network Number (SNN) When Copying a Safety Project . 36
Chapter 5
Characteristics of Safety Tags, the
Safety Task, and Safety Programs
Differentiate Between Standard and Safety . . . . . . . . . . . . . . . . . . . . . . . . . 37
SIL 2 Safety Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
SIL 2 Safety Control in the Safety Task. . . . . . . . . . . . . . . . . . . . . . . . . 38
SIL 2 Safety Control in Standard Tasks (1756 GuardLogix controllers
only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
SIL 3 Safety–the Safety Task . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Safety Task Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Safety Task Execution Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Use of Human-to-machine Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Accessing Safety-related Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Safety Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Safety Routines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Safety Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Standard Tags in Safety Routines (tag mapping). . . . . . . . . . . . . . . . . 48
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Chapter 6
Safety Application Development
Safety Concept Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Basics of Application Development and Testing . . . . . . . . . . . . . . . . . . . . 52
Commissioning Life Cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Specification of the Control Function . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Create the Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Test the Application Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Generate the Safety Task Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Project Verification Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Confirm the Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Safety Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Lock the GuardLogix Controller. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Downloading the Safety Application Program . . . . . . . . . . . . . . . . . . . . . . 59
Uploading the Safety Application Program . . . . . . . . . . . . . . . . . . . . . . . . . 59
Online Editing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Storing and Loading a Project from Nonvolatile Memory. . . . . . . . . . . . 60
Force Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 5
Table of Contents
Inhibit a Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Editing Your Safety Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Performing Offline Edits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Performing Online Edits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Modification Impact Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Chapter 7
Monitor Status and Handle Faults
Monitoring System Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
CONNECTION_STATUS Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Input and Output Diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
I/O Module Connection Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
De-energize to Trip System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Get System Value (GSV) and Set System Value (SSV) Instructions 67
GuardLogix System Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Nonrecoverable Controller Faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Nonrecoverable Safety Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Recoverable Faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Appendix A
Safety Instructions
Safety Application Instructions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Metal Form Safety Application Instructions . . . . . . . . . . . . . . . . . . . . . . . . 72
Safety Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Appendix B
Safety Add-On Instructions
Creating and Using a Safety Add-On Instruction . . . . . . . . . . . . . . . . . . . 75
Create Add-On Instruction Test Project . . . . . . . . . . . . . . . . . . . . . . . 77
Create a Safety Add-On Instruction. . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Generate Instruction Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Download and Generate Safety Instruction Signature . . . . . . . . . . . 78
SIL 3 Add-On Instruction Qualification Test. . . . . . . . . . . . . . . . . . . 78
Confirm the Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Safety Validate Add-On Instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Create Signature History Entry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Export and Import the Safety Add-On Instruction . . . . . . . . . . . . . . 79
Verify Safety Add-On Instruction Signatures . . . . . . . . . . . . . . . . . . . 79
Test the Application Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Project Verification Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Safety Validate Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

6Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Table of Contents
Appendix C
Reaction Times
System Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Logix System Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Simple Input-logic-output Chain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Logic Chain Using Produced/Consumed Safety Tags. . . . . . . . . . . . 83
Factors Affecting Logix Reaction-time Components . . . . . . . . . . . . . . . . 84
Accessing Input Module Delay Time Settings . . . . . . . . . . . . . . . . . . . 84
Accessing Input and Output Safety Connection Reaction Time
Limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Configuring the Safety Task Period and Watchdog. . . . . . . . . . . . . . 86
Accessing Produced/Consumed Tag Data . . . . . . . . . . . . . . . . . . . . . . 87
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Appendix D
Checklists for GuardLogix Safety
Applications
Checklist for GuardLogix Controller System . . . . . . . . . . . . . . . . . . . . . . . 89
Checklist for Safety Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Checklist for Safety Outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Checklist for Developing a Safety Application Program. . . . . . . . . . . . . . 93
Appendix E
GuardLogix Systems Safety Data
PFD Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
PFH Values. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
Appendix F
RSLogix 5000 Software, Version 14
and Later, Safety Application
Instructions
De-energize to Trip System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Use Connection Status Data to Initiate a Fault Programmatically . . . . 97
Appendix G
Using 1794 FLEX™ I/O Modules and
1756 SIL 2 Inputs and Outputs with
1756 GuardLogix Controllers to
Comply with EN 50156
SIL 2 Dual-channel Inputs (standard side of 1756 GuardLogix
controllers) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
SIL 2 Outputs Using SIL 3 Guard I/O Output Modules . . . . . . . . . . . 105
SIL 2 Outputs Using 1756 or 1794 SIL 2 Output Modules . . . . . . . . . 105
Safety Functions within the 1756 GuardLogix Safety Task. . . . . . . . . . 106
Glossary
Index

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 7
Preface
Summary of Changes This publication contains new and updated information as indicated in the
following table.
This manual is intended to describe the GuardLogix® controller system, which is
type-approved and certified for use in safety applications up to and including SIL
CL 3 according to IEC 61508 and IEC 62061, safety applications up to and
including Performance Level PLe (Category 4) according to ISO 13849-1.
This publication covers both 1756 and 1768 GuardLogix controller systems.
When ‘GuardLogix controllers’ is used alone in this publication, it refers to both
1756 and 1768 GuardLogix controllers. Information specific to one controller
type will include the bulletin number, 1756 or 1768.
Use this manual if you are responsible for the development, operation, or
maintenance of a GuardLogix controller-based safety system. You must read and
understand the safety concepts and requirements presented in this manual prior
to operating a GuardLogix controller-based safety system.
Understanding Terminology The following table defines terms used in this manual.
Topic Page
Summary of Changes 7
UnderstandingTerminology 7
Additional Resources 8
Topic Page
Updated the definition of Safety Partner. 22
Removed 5570 controllers, which are covered by the GuardLogix 5570 and Compact
GuardLogix 5370 Controller Systems Safety Reference Manual, publication
1756-RM099.
Throughout
Table 1 - Terms and Definitions
Abbreviation Full Term Definition
1oo2 One out ofTwo Identifies the programmable electronic controller architecture.
CIP Common Industrial Protocol An industrial communication protocol used by Logix 5000™ based automation systemson Ethernet/IP™,
ControlNet™, and DeviceNet™ communication networks.
CIP Safety Common Industrial Protocol – Safety
Certified SIL 3 -rated version of CIP.
CL Claim Limit The maximum SILlevel that can be achieved.
DC Diagnostic Coverage The ratio of the detected failure rate to the total failure rate.
EN European Norm. The official European Standard.

8Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Preface
Additional Resources These documents contain additional information concerning related products
from Rockwell Automation.
GSV Get SystemValue A ladder logic instruction that retrieves specified controller status information and places it in a destination
tag.
PC Personal Computer Computer used to interface with, and control, a Logix-based system via RSLogix 5000® programming
software.
PFD Probability of Failure on Demand The average probability of a system to fail to perform its design function on demand.
PFH Probability of Failure per Hour The probability of a system to have a dangerous failure occur per hour.
PL Performance Level ISO 13849-1 safety rating.
SNN Safety Network Number A unique number that identifies a section of a safety network.
SSV Set SystemValue A ladder logic instruction that sets controller system data.
-- Standard Any object, task, tag, program, or component in your project that is not a safety-related item (that is,
standard controller refers generically to a ControlLogix® or CompactLogix™ controller).
Table 1 - Terms and Definitions (continued)
Abbreviation Full Term Definition
Resource Description
GuardLogix Controllers User Manual, publication 1756-UM020 Provides information on installing, configuring, and programming the GuardLogix system
CompactLogix Controllers Installation Instructions, publication 1768-IN004 Provides information on installing Compact GuardLogix controllers
1768 Compact GuardLogix Controllers User Manual, publication
1768-UM002 Details how to configure, program, and operate a 1768 CompactLogix system, and provides technical specifications
GuardLogix Safety Application Instruction Set Reference Manual,
publication 1756-RM095 Provides information on the GuardLogix Safety Application instruction set
Guard I/O DeviceNet Safety Modules User Manual, publication
1791DS-UM001 Provides information on using Guard I/O™ DeviceNet Safety modules
Guard I/O EtherNet/IP Safety Modules User Manual, publication
1791ES-UM001 Provides information on using Guard I/O EtherNet/IP Safety modules
POINT Guard I/O Safety Modules User Manual, publication 1734-UM013 Provides information on installing and operating POINT Guard I/O™ modules
Using ControlLogix in SIL 2 Applications Safety Reference Manual,
publication 1756-RM001 Describes requirements for using ControlLogix controllers, and GuardLogix standard task, in SIL 2 safety
control applications
Logix5000General Instruction Set Reference Manual, publication
1756-RM003 Provides information on the Logix5000™ Instruction Set
Logix Common Procedures Programming Manual, publication
1756-PM001 Provides information on programming Logix5000 controllers,including managing project files,
organizing tags, programming and testing routines, and handling faults
Logix5000 Controllers Add-On Instructions Programming Manual,
publication 1756-PM010 Provides information on using creating and using standard and safety Add-On Instructions in Logix
applications
ControlLogix System User Manual, publication 1756-UM001 Provides information on using ControlLogix controllers in non-safety applications
DeviceNet Modules in Logix5000 Control Systems User Manual, publication
DNET-UM004 Provides information on using the 1756-DNB module in a Logix5000 control system
EtherNet/IP Modules in Logix5000 Control Systems User Manual,
publication ENET-UM001 Provides information on using the 1756-ENBT module in a Logix5000 control system
ControlNet Modules in Logix5000 Control Systems User Manual,
publication CNET-UM001 Provides information on using the 1756-CNB module in Logix5000 control systems
Logix5000 Controllers ExecutionTime and Memory Use Reference Manual,
publication 1756-RM087 Provides information on estimating the execution time and memory use for instructions

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 9
Preface
You can view or download publications at
http://www.rockwellautomation.com/literature/. To order paper copies of
technical documentation, contact your local Allen-Bradley distributor or
Rockwell Automation sales representative.
Logix Import Export Reference Manual, publication 1756-RM084 Provides information on using the RSLogix 5000 Import/Export utility
Industrial AutomationWiring and Grounding Guidelines, publication
1770-4.1 Provides general guidelines for installing a Rockwell Automation industrial system.
Product Certifications website, http://www.rockwellautomation.com/
global/certification/overview.page Provides declarations of conformity, certificates, and other certification details
Resource Description

10 Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Preface
Notes:

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 11
Chapter 1
Safety Integrity Level (SIL) Concept
SIL 3 Certification 1756 and 1768 GuardLogix® controller systems are type-approved and certified
for use in safety applications up to and including SIL CL3 according to
IEC 61508 and IEC 62061, safety applications up to and including Performance
Level PLe (Category 4) according to ISO 13849-1. SIL requirements are based
on the standards current at the time of certification.
In addition, the standard tasks within 1756 GuardLogix controllers can be used
either for standard applications or SIL 2 safety applications as described in the
Using ControlLogix® in SIL 2 Applications Reference Manual, publication
1756-RM001. In either case, do not use SIL 2 or standard tasks and variables to
build up safety loops of a higher level. The safety task is the only task certified for
SIL 3 applications.
The standard task in 1768 Compact GuardLogix controllers may not be used for
SIL 2 safety applications.
RSLogix 5000® programming software is required to create programs for 1756
and 1768 GuardLogix controllers.
Topic Page
SIL 3 Certification 11
FunctionalVerificationTests 12
GuardLogix Architecture for SIL 3 Applications 13
GuardLogix System Components 14
GuardLogix Certifications 16
GuardLogix PFD and PFH Specifications 16
Safety Integrity Level (SIL) Compliance Distribution andWeight 17
System Reaction Time 18
Safety Task Period and SafetyTaskWatchdog 19
Contact Information if Device Failure Occurs 19

12 Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Chapter 1 Safety Integrity Level (SIL) Concept
The TÜV Rheinland has approved GuardLogix controller systems for use in
safety-related applications up to SIL CL 3, in which the de-energized state is
considered to be the safe state. All of the examples related to I/O included in this
manual are based on achieving de-energization as the safe state for typical
Machine Safety and Emergency Shutdown (ESD) Systems.
When applying Functional Safety, restrict access to qualified, authorized
personnel who are trained and experienced.
Functional Verification Tests IEC 61508 requires the user to perform various functional verification tests of
the equipment used in the system. Functional verification tests are performed at
user-defined times. For example, functional verification test intervals can be once
a year, once every 15 years, or whatever time frame is appropriate.
GuardLogix controllers have a functional verification test interval of up to
20 years. Other components of the system, such as safety I/O modules, sensors,
and actuators may have shorter functional verification test intervals. The
controller should be included in the functional verification testing of the other
components in the safety system.
For more information on the requirements of a functional verification test, see
Project Verification Test on pages 56 and 56.
IMPORTANT
The system user is responsible for:
•the setup, SIL rating, and validation of any sensors or actuators connected
to the GuardLogix system.
•project management and functional testing.
•access control to the safety system, including password handling.
•programming the application software and the device configurations in
accordance with the information in this safety reference manual and the
GuardLogix Controllers User Manual, publication
1756-UM020, or the 1768 Compact GuardLogix Controllers User Manual
publication 1768-UM002.
IMPORTANT
Your specific applications determine the time frame for the functional
verification test interval. However, this is mainly related to safety I/O
modules and field instrumentation.

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 13
Safety Integrity Level (SIL) Concept Chapter 1
GuardLogix Architecture for
SIL 3 Applications
The following illustration shows a typical SIL function, including:
•the overall safety function.
•the GuardLogix portion of the overall safety function.
•how other devices (for example, HMI) are connected, while operating
outside the function.
Figure 1 - Typical SIL Function
1756-DNB
To Plant-wide Ethernet Network
SIL 3 GuardLogix System
Programming Software HMI
Read-only Access to Safety Tags
Overall Safety Function
1756-L6xS 1756-LSP 1756-ENBT
Switch
Actuator
DeviceNet Safety Network
Sensor
CIP Safety™
I/O Module
CIP Safety
I/O Module
CIP Safety I/O Module on
Ethernet Network
CIP Safety
Actuator
Sensor
Actuator
Sensor
SIL 3 Compact GuardLogix System
CIP Safety I/O Module on Ethernet
Network
Compact GuardLogix Controller with 1768-ENBT Module

14 Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Chapter 1 Safety Integrity Level (SIL) Concept
GuardLogix System
Components
The tables in this section list SIL 3-certified GuardLogix components for both
1756 and 1768 systems as well as non-SIL 3-certified components that may be
used with SIL 3 GuardLogix systems.
For the most current list of GuardLogix controller and CIP Safety™ I/O modules
certified series and firmware revisions, see http://www.rockwellautomation.com/
products/certification/safety/. Firmware revisions are available at http://
support.rockwellautomation.com/ControlFLASH™/.
Table 2 - SIL 3-certified GuardLogix Components
Device Type Cat. No. Description
Related Documentation(1)
Installation
Instructions User Manual
1756 GuardLogix
primary controller
(ControlLogix556xS)
1756-L61S Controller with 2 MB standard, 1 MB safety memory
N/A(2) 1756-UM020
1756-L62S Controller with 4 MB standard, 1 MB safety memory
1756-L63S Controller with 8 MB standard, 3.75 MB safety memory
1756 GuardLogix
safety partner
(ControlLogix55SP)
1756-LSP Safety partner (for L6xS)
1768 Compact GuardLogix
Controller
(CompactLogix4xS)
1768-L43S Controller with support for two 1768 modules 1768-IN004 1768-UM002
1768-L45S Controller with support for four 1768 modules
CIP Safety I/O modules on
DeviceNet networks
For the most current list of certified series and firmware revisions, see the safety certificate at http:/
/www.rockwellautomation.com/products/certification/safety/
1791DS-IN001
1791DS-IN002
1732DS-IN001 1791DS-UM001
CIP Safety I/O modules on
EtherNet/IP networks 1791ES-IN001 1791ES-UM001
POINT Guard I/O modules N/A(2) 1734-UM013
(1) These publications are available from Rockwell Automation by visiting http://www.rockwellautomation.com/literature.
(2) See user manual for installation instructions.
Table 3 - Components Suitable for Use with 1756 GuardLogix Controller Safety Systems
Device Type Cat. No. Description
Related Documentation(4)
Series(1) Revision(1) Installation
Instructions User Manual
Chassis
1756-A4
1756-A7
1756-A10
1756-A13
1756-A17
4-slot chassis
7-slot chassis
10-slot chassis
13-slot chassis
17-slot chassis
BN/A
1756-IN005
N/A
Power supply
1756-PA72 Power supply, AC C
N/A N/A
1756-PB72 Power supply, DC C
1756-PA75 Power supply, AC B
1756-PB75 Power supply, DC B
Communication
modules
1756-ENBT
1756-EN2T
1756-EN2F
1756-EN2TR
1756-EN3TR
EtherNet/IP bridge module A
A
A
C
C
3.6
2.005
2.005
5.007 ENET-IN002 ENET-UM001
1734-AENT POINT I/O™ Ethernet Adapter A 3.001 1734-IN590 1734-UM011
1756-DNB DeviceNet bridge module A 6.2 DNET-IN001 DNET-UM004
1756-CN2 ControlNet bridge module A 12.1
CNET-IN005 CNET-UM0011756-CN2R ControlNet bridge module, redundant media A 12.1
1756-CN2RXT XT ControlNet bridge module, redundant media B 20.020

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 15
Safety Integrity Level (SIL) Concept Chapter 1
Slots of a SIL 3 system chassis not used by the 1756 SIL 3 system may be
populated with other ControlLogix (1756) modules that are certified to the Low
Voltage and EMC Directives.
To find the certificates for the ‘Programmable Control – ControlLogix Product
Family’ refer to http://www.rockwellautomation.com/products/certification/
ce/.
Programming
software 9324-xxxx RSLogix 5000 software for 1756-L6xS controllers N/A 14(2)
N/A Consult online
help.
RSLogix 5000 software for 1756-L7xS and 1756-L73SXT controllers 20(3)
Memory cards 1784-CF128 128MB CompactFlash Card for 1756-L6xS controllers
N/A N/A N/A N/A1784-SD1 1 GB Secure Digital (SD) Card for 1756-L7xS controllers
1784-SD2 2 GB Secure Digital (SD) Card for 1756-L7xS controllers
(1) This version or later.
(2) RSLogix 5000 software, version 15, does not support GuardLogix safety controllers (for 14, 16, 17, 18, 19, and 20).
(3) V20 only.
(4) These publications are available from Rockwell Automation by visiting http://www.rockwellautomation.com/literature.
Table 3 - Components Suitable for Use with 1756 GuardLogix Controller Safety Systems (continued)
Device Type Cat. No. Description
Related Documentation(4)
Series(1) Revision(1) Installation Instructions User Manual
IMPORTANT
ControlLogix-XT™ system components are rated for extreme environmental
conditions only when used properly with other Logix-XT system components.
The use of ControlLogix-XT components with traditional ControlLogix or
GuardLogix system components nullifies extreme environment ratings.

16 Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Chapter 1 Safety Integrity Level (SIL) Concept
Expansion slots of a SIL 3 system bus that are not used by the 1768 SIL 3 system
may be populated with other CompactLogix™ (1768) modules that are certified
to the Low Voltage and EMC Directives. To find the certificates for the
‘Programmable Control – CompactLogix Product Family’, refer to
http://www.rockwellautomation.com/products/certification/ce/.
GuardLogix Certifications The ControlLogix Controllers Technical Data, publication 1756-TD001 lists
the product specifications and the agency certifications for which the products
are approved. If a product has achieved agency certification, it is marked as such
on the product labeling. See the Product Certification link at http://
www.rockwellautomation.com/products/certification/ for Declarations of
Conformity, Certificates, and other certification details.
GuardLogix PFD and PFH
Specifications
Safety-related systems can be classified as operating in either a Low Demand
mode, or in a High Demand/Continuous mode. IEC 61508 quantifies this
classification by stating that the frequency of demands for operation of the safety
system is no greater than once per year in the Low Demand mode, or greater than
once per year in High Demand/Continuous mode.
The Safety Integrity Level (SIL) value for a Low Demand safety-related system is
directly related to order-of-magnitude ranges of its average probability of failure
to satisfactorily perform its safety function on demand or, simply, probability of
failure on demand (PFD). The SIL value for a High Demand/Continuous mode
safety-related system is directly related to the probability of a dangerous failure
occurring per hour (PFH).
Table 4 - Components Suitable for Use With 1768 Compact GuardLogix Controller Safety Systems
Device Type Cat. No. Description
Related Documentation(2)
Series(1) Revision(1) Installation Instructions User Manual
Power supply 1768-PA3 Power supply, AC N/A N/A 1768-IN001 N/A
1768-PB3 Power supply, DC N/A N/A
Communication
modules
1768-ENBT EtherNet/IP bridge module A 3.1.1 ENET-IN002 ENET-UM001
1734-AENT POINT I/O™Ethernet Adapter A 3.001 1734-IN590 1734-UM011
1734-AENTR POINT I/O Ethernet Adapter A 3.001 1734-IN040 N/A
1768-CNB ControlNet bridge module A 2.1.1 CNET-IN005 CNET-UM001
Programming
software 9324-xxxx RSLogix 5000 software N/A 18 N/A Consult online help.
Memory Cards 1784-CF128 128 MB CompactFlash Card N/A N/A N/A N/A
(1) This revision or version or later.
(2) These publications are available from Rockwell Automation by visiting http://www.rockwellautomation.com/literature.

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 17
Safety Integrity Level (SIL) Concept Chapter 1
PFD and PFH values are associated with each of the three primary elements
making up a safety-related system (the sensors, the logic element, and the
actuators). Within the logic element you also have input, processor, and output
elements.
Figure 2 - PFH Example
To determine the logic element PFH for each safety loop in the simple example
system shown in the PFH Example, sum the PFH values for each component in
the loop. The PFH Equations by Safety Loop table provides a simplified example
of PFH value calculations for each safety loop shown in the PFH Example
illustration.
When calculating PFH values, you must take into account the specific
requirements of your application, including proof test and diagnostic test
intervals.
Safety Integrity Level (SIL)
Compliance Distribution and
Weight
The GuardLogix controller and I/O system may conservatively be assumed to
contribute 10% of the reliability burden. A SIL 3 system may need to incorporate
multiple inputs for critical sensors and input devices, as well as dual outputs
connected in series to dual actuators dependent on SIL assessments for the safety
related system.
DeviceNet EtherNet
Logix5562S Logix55LSP
Sensor
Sensor
Sensor
1791DS-IB12
GuardLogix Controller
1791DS-IB8XOB8
1791DS-IB4XOX4
Actuator
Actuator
LOOP 1
LOOP 2
Table 5 - PFH Equations by Safety Loop
For this loop Sum the PFH values of these components
Total PFH for loop 1 = 1791DS-IB12 + GuardLogix controller + 1791DS-IB4XOX4
Total PFH for loop 2 = 1791DS-IB8XOB8 + GuardLogix controller + 1791DS-IB4XOX4

18 Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Chapter 1 Safety Integrity Level (SIL) Concept
Figure 3 - Reliability Burden
System Reaction Time The system reaction time is the amount of time from a safety-related event as an
input to the system until the system sets corresponding outputs to their safe state.
Faults within the system can also have an effect upon the reaction time of the
system. The system reaction time is the sum of the following reaction times.
Each of the times listed above is variably dependent on factors such as the type of
I/O module and instructions used in the program.
Safety Task Reaction Time
The safety task reaction time is the worst-case delay from any input change
presented to the controller until the processed output is set by the output
producer. It is less than or equal to the sum of the safety task period and the safety
task watchdog.
Actuator
Controller Output
Module
+V
Sensor
Sensor
40%ofthe
PFD
10% of the PFD
50% of the PFD
Input
Module
Actuator
++++
Sensor
Reaction
Time
Input
Reaction
Time
SafetyTask
Reaction
Time
Output
Reaction
Time
Actuator
Reaction
Time

Rockwell Automation Publication 1756-RM093J-EN-P - April 2018 19
Safety Integrity Level (SIL) Concept Chapter 1
Safety Task Period and Safety Task Watchdog
The safety task period is the interval at which the safety task executes.
The safety task watchdog time is the maximum permissible time for safety task
processing. If safety task processing time exceeds the safety task watchdog time, a
non-recoverable safety fault occurs in the controller and outputs transition to the
safe state (off) automatically.
You define the safety task watchdog time, which must be less than or equal to the
safety task period.
The safety task watchdog time is set in the task properties window of
RSLogix 5000 software. This value can be modified online, regardless of
controller mode, but it cannot be changed when the controller is safety-locked or
once a safety task signature is created.
Contact Information if Device
Failure Occurs
If you experience a failure with any SIL 3-certified device, contact your local
Rockwell Automation distributor to initiate the following actions:
•You can return the device to Rockwell Automation so the failure is
appropriately logged for the catalog number affected and a record is made
of the failure.
•You can request a failure analysis (if necessary) to try to determine the
cause of the failure.

20 Rockwell Automation Publication 1756-RM093J-EN-P - April 2018
Chapter 1 Safety Integrity Level (SIL) Concept
Notes: