Allen-Bradley GuardPLC 1753 User manual

GuardPLC™
Controller Systems
Bulletin 1753, 1754, and 1755
Safety Reference Manual
AB Parts

Important User Information
Solid state equipment has operational characteristics differing from those of
electromechanical equipment. Safety Guidelines for the Application,
Installation and Maintenance of Solid State Controls (Publication SGI-1.1
available from your local Rockwell Automation sales office or online at
http://www.ab.com/manuals/gi) describes some important differences
between solid state equipment and hard-wired electromechanical devices.
Because of this difference, and also because of the wide variety of uses for
solid state equipment, all persons responsible for applying this equipment
must satisfy themselves that each intended application of this equipment is
acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for
indirect or consequential damages resulting from the use or application of
this equipment.
The examples and diagrams in this manual are included solely for illustrative
purposes. Because of the many variables and requirements associated with
any particular installation, Rockwell Automation, Inc. cannot assume
responsibility or liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to
use of information, circuits, equipment, or software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without
written permission of Rockwell Automation, Inc. is prohibited.
Throughout this manual we use notes to make you aware of safety
considerations.
Allen-Bradley, GuardPLC, and RSLogix Guard PLUS are trademarks of Rockwell Automation.
WindowsNT and Windows 2000 are registered trademarks of Microsoft Corporation.
WARNING Identifies information about practices or circumstances
that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property
damage, or economic loss.
IMPORTANT Identifies information that is critical for successful
application and understanding of the product.
ATTENTION Identifies information about practices or circumstances
that can lead to personal injury or death, property
damage, or economic loss. Attentions help you:
•identify a hazard
•avoid a hazard
•recognize the consequence

iii Publication 1755-RM001B-EN-P - March 2004
Summary of Changes
The information below summarizes the changes to this manual since
the last publication.
To help you find new and updated information in this release of the
manual, we have included change bars as shown to the right of this
paragraph.
Information regarding GuardPLC 1600 and GuardPLC 1800 controllers,
GuardPLC Distributed I/O, and RSLogix Guard PLUS programming
software has been added throughout the manual. The table below
summarizes other changes since the last publication.
For information about See
List of catalog numbers covered by this safety reference
manual
page 1-1
Certification page 1-2
PFD and PFH calculations page 1-3
Safety requirements page 1-3
Programming requirements page 1-4
Communication requirements page 1-5
Maintenance override page 1-5
Updated power supply requirements page 2-1
Updated table of GuardPLC input capabilities page 3-1
Preventing surge impulses on digital inputs page 3-4
Configurable digital inputs page 3-4
Line control for inputs page 3-4
Analog input values for GuardPLC 1800 page 3-6
Revised checklist for safety-related inputs page 3-10
Updated table of GuardPLC output capabilities page 4-1
Line control for outputs page 4-3
Revised checklist for safety-related outputs page 4-6
Revised checklist for creation of the application program page 5-8
Configuring communications Chapter 7
Use in central fire alarm systems Appendix B
AB Parts

Publication 1755-RM001B-EN-P - March 2004
Summary of Changes iv

vPublication 1755-RM001B-EN-P - March 2004
Table of Contents
Chapter 1
Safety Concept
Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
Introduction to Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2
PFD and PFH Calculations . . . . . . . . . . . . . . . . . . . . . . 1-3
Safety Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-3
Hardware Configuration. . . . . . . . . . . . . . . . . . . . . . . . 1-3
Programming Requirements . . . . . . . . . . . . . . . . . . . . . 1-4
Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Maintenance Override . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Safety Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-5
Fault Tolerance Time (FTT) . . . . . . . . . . . . . . . . . . . . . 1-6
Safety Time (of the PES). . . . . . . . . . . . . . . . . . . . . . . . 1-6
Multiple Error Occurrence Time (MOT) . . . . . . . . . . . . 1-6
Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-6
Watchdog Time of the CPU (in the PES) . . . . . . . . . . . . 1-7
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7
Chapter 2
Central Functions
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
Power Supply Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-1
Functional Description of the Central Processing Unit. . . . . 2-2
Self-Test Routines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
Microprocessor-Test . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
Test Memory Sectors . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
Fixed Memory Sectors . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
RAM-Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
Watchdog-Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-3
Test of the I/O Bus Within the System . . . . . . . . . . . . . 2-4
Reactions to Detected Errors in the CPU . . . . . . . . . . . . 2-4
Error Diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4
Chapter 3
Input Channels
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-1
General Information on Safety-Related Input Modules . . . . 3-2
Safety of Sensors, Encoders, and Transmitters. . . . . . . . . . . 3-2
Safety-Related Digital Inputs and Input Modules. . . . . . . . . 3-2
General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-2
Test Routines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
Reaction To Error. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3
Surge on Digital Inputs . . . . . . . . . . . . . . . . . . . . . . . . 3-4
Configurable Digital Inputs. . . . . . . . . . . . . . . . . . . . . . 3-4
Line Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4
AB Parts

Publication 1755-RM001B-EN-P - March 2004
Table of Contents vi
Analog Inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-6
General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-6
Test Routines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-7
Reaction In Case of Fault . . . . . . . . . . . . . . . . . . . . . . . 3-8
Counter Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-8
General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9
Test Routines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-9
Reaction In Fault Condition . . . . . . . . . . . . . . . . . . . . . 3-9
Checklist for Safety-Related Inputs . . . . . . . . . . . . . . . . . . . 3-10
Chapter 4
Output Channels
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1
Overview of GuardPLC Output Modules . . . . . . . . . . . . . . 4-1
General Safety Information On Safety-Related
Output Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1
Digital Outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2
Test Routines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2
Reaction To Error. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-3
Line Control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-3
Analog Outputs in the 1755-OF8 (AB-AO) . . . . . . . . . . . . . 4-4
General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4
Test Routines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4
Reaction To Error. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5
Checklist for Safety-Related Outputs. . . . . . . . . . . . . . . . . . 4-6
Chapter 5
GuardPLC Controller Operating
System
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-1
Software for GuardPLC Safety-Related Systems . . . . . . . . . . 5-1
Technical Safety for the Operating System . . . . . . . . . . . . . 5-2
Operation Mode and Functions of the Operating System . . 5-2
Technical Safety
for Programming. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-3
Safety Concept of RSLogix Guard PLUS. . . . . . . . . . . . . 5-3
Check the Application Program . . . . . . . . . . . . . . . . . . 5-3
Creation of a Backup Program . . . . . . . . . . . . . . . . . . . 5-4
Program Identification . . . . . . . . . . . . . . . . . . . . . . . . . 5-5
Parameters of the Automation System . . . . . . . . . . . . . . . . 5-5
Forcing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-6
Protection Against Manipulation . . . . . . . . . . . . . . . . . . . . 5-7
Checklist for the Creation of an Application Program . . . . . 5-8

Publication 1755-RM001B-EN-P - March 2004
Table of Contents vii
Chapter 6
Technical Safety for the
Application Program
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-1
General Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2
Basis of Programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2
Combinatory Logic. . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-2
Sequential Controls (Step Controls). . . . . . . . . . . . . . . . 6-3
Sensors (Digital or Analog). . . . . . . . . . . . . . . . . . . . . . 6-3
Actuators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-3
Variable Declaration and
I/O Naming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-3
Assignment of I/O Names to Variable Names . . . . . . . . 6-4
Types of Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-4
Functions of the Application Program . . . . . . . . . . . . . . . . 6-5
Safety-Related Inputs and Outputs . . . . . . . . . . . . . . . . 6-5
Parameters of the Application Program . . . . . . . . . . . . . 6-6
Procedure for “Disabling” the PES . . . . . . . . . . . . . . . . 6-6
Procedure for “Enabling” the PES . . . . . . . . . . . . . . . . . 6-7
Code Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6-8
Loading and Starting the Application Program. . . . . . . . 6-8
Forcing Inputs and Outputs . . . . . . . . . . . . . . . . . . . . . 6-8
Program Documentation for Safety-Related Applications . . . 6-9
Chapter 7
Configuring Communications
Non-Safety-Related Communication . . . . . . . . . . . . . . . . . . 7-1
Safety-Related (Peer-to-Peer) Communication. . . . . . . . . . . 7-1
Calculating Worst-Case Reaction Time . . . . . . . . . . . . . 7-2
Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-3
Appendix A
Specifications
Chapter Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1
Climatic Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
Mechanical Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2
EMC Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-3
Power Supply Conditions . . . . . . . . . . . . . . . . . . . . . . . . . A-4
Appendix B
Use in Central Fire Alarm Systems
AB Parts

Publication 1755-RM001B-EN-P - March 2004
Table of Contents viii

1Publication 1755-RM001B-EN-P - March 2004
Chapter 1
Safety Concept
This chapter introduces you to the safety concept for the following
GuardPLC products:
Catalog Number Description
1753-L28BBB-M GuardPLC 1600 controller with Modbus Communications
1753-L28BBB-P GuardPLC 1600 controller with Profibus-DP Communications
1753-L32BBBM-8A GuardPLC 1800 controller with Modbus Communications
1753-L32BBBP-8A GuardPLC 1800 controller with Profibus-DP Communications
1753-IB16 GuardPLC 16-point Input Module
(for GuardPLC 1600 or 1800 controllers)
1753-IB20XOB8 GuardPLC I/O Module
(for GuardPLC 1600 or 1800 Controllers)
1753-OB16 GuardPLC 16-point Output Module
(for GuardPLC 1600 or 1800 Controllers)
1754-L28BBB GuardPLC 1200 Controller
1755-L1 GuardPLC 2000 Controller
1755-A6 GuardPLC 2000 I/O Chassis
1755-IB24XOB16 GuardPLC 2000 Digital I/O Module
1755-IF8 GuardPLC 2000 Analog Input Module
1755-HSC GuardPLC 2000 High Speed Counter Module
1755-OF8 GuardPLC 2000 Analog Output Module
1755-PB720 GuardPLC 2000 Power Supply Module
For information about: See page:
certification 1-2
introduction to safety 1-2
safety requirements 1-3
safety times 1-5
terminology used in this manual 1-7
AB Parts

Publication 1755-RM001B-EN-P - March 2004
1-2 Safety Concept
Certification
Certificate No. 968/EZ164.00/04
TÜV Rheinland/Berlin-Brandenburg
TÜV Anlagentechnik GmbH
Automation, Software, and Informatinstechnologie
Safety restrictions can be found in this manual. See Safety
Requirements on page 1-3.
Introduction to Safety
The Programmable Electronic System (PES) for the Allen-Bradley
GuardPLC system is safety-related, based on the 1oo2 microprocessor
structure for one central module. These controllers are safety-related
up to safety requirement class 6 according to DIN V 19250, SIL 3
according to IEC 61508 and category 3,4 according to EN 954-1.
Safety tests are based on the safety standards current at the time of
certification. These safety tests consist of test routines that are run
during the entire operating phase. The routines are guaranteed to the
highest degree of safe function for existing systems, making the PES
suitable for the Safety Machinery Market.
For support in the creation of safety-related programs, use the
programming software RSLogix Guard PLUS, according to IEC
61131-3. (Programming software is defined in IEC 61131-1.)
The PES has been designed to the closed-circuit current principle,
which requires that systems be designed so that the “normally closed”
or “on” state of external sensors and actuators is the normal run
condition. The “off” or “normally open” state is the safe state. This
means that in the event of a fault or safety trip, all inputs and outputs
revert to the “off” (current-free/voltage free) state.

Publication 1755-RM001B-EN-P - March 2004
Safety Concept 1-3
PFD and PFH Calculations
The average probability of a system to fail to satisfactorily perform its
safety function on demand is called Probability of Failure on Demand
(PFD). The probability of a system to have a dangerous failure occur
per hour is called Probability of Failure per Hour (PFH).
PFD and PFH calculations have been carried out for the GuardPLC
system in accordance with IEC 61508. For SIL 3, IEC 61508-1 sets the
following PFD and PFH values:
The Proof Test interval is set at 10 years.
The safety functions, consisting of a safety-related loop (input,
processor, output, and communications between GuardPLC systems),
fulfill the above requirements in any combination. These requirements
are also met by the distributed I/O modules.
Safety Requirements
The following safety requirements must be followed when using the
safety-related PES of the GuardPLC system.
Hardware Configuration
Product Independent
•To ensure safety-related operation, use only GuardPLC
hardware (see the GuardPLC Version List available at
www.ab.com/certification/safety/) and RSLogix Guard PLUS
software.
•The specified operating conditions listed in Appendix A must be
followed.
•Hardware modules and software components which are not
fail-safe, but do not cause any adverse reactions, can be used to
process non-safety-related signals. However, they cannot be
used to carry out safety-related tasks.
•The closed-circuit current principle should be used in all
external safety circuits connected to the system.
Type SIL3 value per IEC61508-1:
PFD 10-4 to 10-3
PFH 10-8 to 10-7 per hour
AB Parts

Publication 1755-RM001B-EN-P - March 2004
1-4 Safety Concept
Product Dependent
Only equipment that can be safely isolated from the main power
should be connected to the system.
The safe electrical isolation of the power supply must take place in
the 24V dc power supply. Only PELV- and SELV-compliant power
supplies may be used. See Appendix A or page 2-1 for details on
power supply requirements.
Programming Requirements
Product Independent
For safety-relevant applications, ensure that the safety-relevant system
variables are correctly configured. Pay particular attention to the
maximum cycle time and the safety time.
Product Dependent
•You must use RSLogix Guard PLUS to program the system.
•After creating the application, check that it was compiled
correctly by manually compiling and comparing the CRCs.
•The correct conversion of the application specification should
be validated using a complete test of the logic for verification.
•Each time a modification is made, the application must be
re-checked as described above.
•When a fault occurs in the fail-safe input and output modules,
the error response of the system must be determined by the user
program according to site-specific safety criteria.

Publication 1755-RM001B-EN-P - March 2004
Safety Concept 1-5
Communication
•When safety-related communication occurs between different
devices, the total response time of the system must not exceed
the fault tolerance time. See Calculating Worst-Case Reaction
Time on page 7-2.
•Safety-related data cannot be transferred over public networks
(e.g. the Internet).
•If the data will be transferred across company/factory networks,
ensure that sufficient protection is provided against
manipulation. For example, use a firewall to separate the
safety-relevant portion of the network from standard use
portions.
•Serial interfaces should be used only for non-safety-relevant
purposes.
•Equipment connected to communication devices should feature
safe electrical isolation.
Maintenance Override
When using “Maintenance Override”, follow the requirements of the
most recent version of the Maintenance Override document from TÜV
Product Service. The document is available from the TÜV website:
www.tuv-fs.com (TÜV Süddeutschland).
If necessary, the operator must consult the acceptance department
responsible for the application to determine the administrative
requirements to provide access protection for the system.
Safety Times
Individual errors that may lead to a dangerous operating condition are
detected by the self-tests and trigger defined error reactions which
transfer the faulty modules into the safe condition within the safety
time of the PES. The following section describes self-test safety times.
AB Parts

Publication 1755-RM001B-EN-P - March 2004
1-6 Safety Concept
Fault Tolerance Time (FTT)
(See DIN VDE 0801 Appendix A1 2.5.3)
The fault tolerance time is an attribute of the process and describes
the time span in which faulty signals can be tolerated in the process
without a dangerous condition occurring. If the fault condition lasts
longer than the FTT, the faulty signals can create a dangerous
condition.
Safety Time (of the PES)
The safety time is the time within which the PES (while in RUN mode)
must react after an internal error has occurred.
Seen from the process side, the safety time is the maximum amount of
time in which the safety system must react (reaction time) to a change
in the input signals.
Multiple Error Occurrence Time (MOT)
The occurrence time for multiple faults is the period of time in which
the probability for the occurrence of multiple faults, which in
combination are critical to safety, is sufficiently low.
The multiple fault occurrence time is defined at 24 hours in the
operating system.
Reaction Time
The maximum reaction time of cyclically working GuardPLC systems
is twice the cycle time of the system. The cycle time of a system
consists of the following parts:
•Reading inputs
•Processing the application program
•Writing outputs
•Testing routines
In addition, when considering the worst case for the entire system, the
switching times of the inputs and outputs are taken into account.

Publication 1755-RM001B-EN-P - March 2004
Safety Concept 1-7
Watchdog Time of the CPU (in the PES)
The watchdog time of the CPU is dependent upon system capabilities.
The watchdog time of the CPU is the maximum permissible time
allowed for a RUN cycle (cycle time). If the cycle time exceeds the
default watchdog time of the CPU, the CPU goes into FAILURE STOP
mode. The watchdog time of the CPU must be a value between 2 ms
and half the safety time of the PES. The maximum permitted value is
5000 ms. The default setting for controllers is 50 ms. The default for
distributed I/O modules is 10 ms.
Terminology
The following table defines the acronyms and terms used in this
manual.
Term Definition
EN EuroNorm. The official European Standard
IEC International Electrotechnical Commission
Non-Interacting Does not interfere or affect functions of the safety system
NSP Non-Safe Protocol
PES Programmable Electronic System
PFD Probability of Failure on Demand
PFH Probability of Failure per Hour
POU Program Organization Unit
PS Programming System
SIL Safety Integrity Level
SRS System, Rack, Slot (This number is used as the System ID)
TÜV Technischer Überwachungs-Verein (Technical Inspection
Association)
WD Watchdog Time
AB Parts

Publication 1755-RM001B-EN-P - March 2004
1-8 Safety Concept

1Publication 1755-RM001B-EN-P - March 2004
Chapter 2
Central Functions
Chapter Introduction
This chapter discusses the power supply, the CPU, and self-test
routines for GuardPLC controllers.
GuardPLC 1200 is a compact system which includes a CPU, 20 digital
inputs, 8 digital outputs, 2 counters and communication ports in a
single package. An external 24V dc power supply is required.
GuardPLC 1600 and GuardPLC 1800 systems include an integrated
CPU and on-board I/O, as well as optional distributed I/O. An
external 24V dc power supply is required.
GuardPLC 2000 is a modular system, in which a power supply
module, a CPU module, and up to 6 local I/O modules comprise the
system.
Power Supply Module
The power supply transforms the system supply voltage from 24V to
3.3V dc/5V dc (used for internal I/O Bus).
The power supply used with the GuardPLC 1200, 1600 or GuardPLC
1800 controllers must feature galvanic isolation since inputs and
outputs are not electrically isolated from the processor. In addition, it
must fulfill the requirements of IEC 61131-2 and SELV (Safety Extra
Low Voltage) or PELV (Protective Extra Low Voltage).
For information about: See page:
the power supply 2-1
functional description of the central module 2-2
self-test routines 2-3
error diagnostics 2-4
AB Parts

Publication 1755-RM001B-EN-P - March 2004
2-2 Central Functions
Functional Description of
the Central Processing Unit
The central processing unit of the GuardPLC controllers consists of the
following function blocks:
Figure 2.1 Display of the Function Blocks (Using GuardPLC 2000):
Features of the central module are listed below.
•two cycle synchronous microprocessors (µP1 and µP2)
•each microprocessor has its own memory (RAM 1 and RAM 2)
•testable hardware comparator for all external access of both
microprocessors
•in case of an error, the watchdog (WD) is set in the safe
condition
•Flash EPROMs of the program memory for the operating system
and user program - suitable for a minimum of 100,000
programming cycles
•data memory in SRAM (Static RAM)
•multiplexer for the connection of I/O bus, Dual Port RAM (DPR)
•buffering for SRAMs via batteries
•interface for data exchange between the GuardPLC controllers
and programming software (PC) based on Ethernet
•additional interface(s) for data exchange by field bus
•system condition indicated by LEDs
•I/O-Bus-Logic for the connection with I/O modules
•safe watchdog (WD)
•power supply module monitor, testable (3.3V dc/5V dc system
voltage)
42917
COM COM
RAM
COM CLK
CLK
DPR
ROM
I/O
Module
Buffered
SRAM WD
RAM 1 µP1 RAM 2
µP2
SYNC
=
ADDRESS
CONTROL
DATA
FB1
FB2Ethernet

Publication 1755-RM001B-EN-P - March 2004
Central Functions 2-3
Self-Test Routines
The most important self-test routines for the safety-related GuardPLC
controller’s central processing unit and the interface to the I/O level
are described in the following sections.
Microprocessor-Test
The following items are checked:
•all used commands and addressing modes
•write condition of the flags and the commands controlled by
flags
•write condition and the cross-linking of the registers
Test Memory Sectors
The operating system, the user program, the constants and
parameters, and the variable data are stored in every central
processing unit in both processor sectors and are tested by a hardware
comparator.
Fixed Memory Sectors
The operating system, user program, and parameter sector are each
filed in one memory. They are secured by write-protection and a CRC
test.
RAM-Test
The RAM sectors, particularly stuck-at and cross-coupling, are tested
with a Write/Read test.
Watchdog-Test
If it is not triggered by the two CPUs within a defined time window,
the watchdog is switched off. The same applies if the test of the
hardware comparators fails. A separate test determines whether the
watchdog signal is able to switch off.
AB Parts

Publication 1755-RM001B-EN-P - March 2004
2-4 Central Functions
Test of the I/O Bus Within the System
The connection between the CPU and the related I/O points or I/O
modules is checked.
Reactions to Detected Errors in the CPU
A hardware comparator within the central area constantly compares
whether the data of microprocessor system 1 are identical to the data
of microprocessor system 2. If this is not the case, or if the test
routines in the central area are negative, the system automatically goes
into FAILURE_STOP mode and the watchdog signal is switched off.
Input signals are no longer processed, and outputs go to the
de-energized, switched-off condition.
Error Diagnostics
Because the GuardPLC 1200, 1600, and 1800 controllers are compact
systems, error diagnostics are summarized in a collective error LED.
Each GuardPLC distributed I/O module has its own LED to display
errors in case of module failures or faults in the external wiring,
providing a quick error diagnosis in case of module failure.
The evaluation of system variables that contain the status value of the
I/O or the CPU can also be monitored in the application program.
An error signal is only transmitted if the error does not impede
communication with the CPU, that is, an evaluation via the CPU is still
possible.
An extensive diagnostic record of system performance and faults is
stored in the diagnostic memory of the CPU and the COM. This record
can be viewed in the programming software, even after a system fault.