Allen-Bradley GuardLogix 5570 User manual

Application Technique
Original Instructions
Enabling Switch with an Integrated Safety Controller and a POINT
Guard I/O Safety Module Safety Function
Products: GuardLogix 5570 or Compact GuardLogix 5370 Controller, POINT Guard I/O Safety Module, 440J Enabling Switch,
440K Interlock Switch
Safety Rating: Cat. 3, PLd to ISO 13849-1: 2015
Topic Page
Important User Information 2
Summary of Changes 3
General Safety Information 3
Introduction 4
Safety Function Realization: Risk Assessment 5
Enabling Switch Safety Function 5
Safety Function Requirements 5
Functional Safety Description 5
Bill of Material 6
Setup and Wiring 7
Configuration 10
Programming 11
Calculation of the Performance Level 13
Verification and Validation Plan 15
Additional Resources 16

2Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and operation of this
equipment before you install, configure, operate, or maintain this product. Users are required to familiarize themselves with installation and
wiring instructions in addition to requirements of all applicable codes, laws, and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to be carried
out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application
of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements
associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the
examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in
this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property
damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous
voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may
reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to
potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL
Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022 3
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Summary of Changes
This publication contains new and updated information as indicated in the following table.
General Safety Information
Contact Rockwell Automation to learn more about our safety risk assessment services.
Safety Distance Calculations
Non-separating safeguards provide no physical barrier to prevent access to a hazard. Publications that offer guidance for calculating
compliant safety distances for safety systems that use non-separating safeguards, such as light curtains, scanners, two-hand controls, or
safety mats, include the following:
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of parts of the human body)
EN ISO 13857:2008 (Safety of Machinery – Safety distances to prevent hazardous zones being reached by upper and lower limbs)
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
Separating safeguards monitor a movable, physical barrier that guards access to a hazard. Publications that offer guidance for calculating
compliant access times for safety systems that use separating safeguards, such as gates with limit switches or interlocks (including
SensaGuard™ switches), include the following:
EN ISO 14119:2013 (Safety of Machinery – Interlocking devices associated with guards - Principles for design and selection)
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of parts of the human body)
EN ISO 13857:2008 (Safety of Machinery – Safety distances to prevent hazardous zones being reached by upper and lower limbs)
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
In addition, consult relevant national or local safety standards to assure compliance.
Topic Page
Updated the Bill of Material. 6
Replaced the Electrical Schematic diagram. 9
Added a graphic that depicts the I/O configuration. 10
Replaced the SISTEMA screen shots. 13…14
IMPORTANT This application example is for advanced users and assumes that you are trained and experienced in safety
system requirements.
ATTENTION: Perform a risk assessment to make sure that all task and hazard combinations have been identified and
addressed. The risk assessment can require additional circuitry to reduce the risk to a tolerable level. Safety circuits must
consider safety distance calculations, which are not part of the scope of this document.
ATTENTION: While safety distance or access time calculations are beyond the scope of this document, compliant safety
circuits must often consider a safety distance or access time calculation.

4Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Introduction
This safety function application technique explains how to wire, configure, and program a Compact GuardLogix® controller and POINT Guard
I/O™ module to monitor an enabling switch. The operator squeezes the enabling switch to the middle position to bypass the primary, safety-
door interlock. This action allows the Compact GuardLogix controller to energize the final control device, in this case, a redundant pair of
100S contactors. The actual safety function that uses an enabling switch is beyond the scope of this document. The safety function may
require speed monitoring, direction monitoring, force monitoring, or additional monitoring to reduce hazard to a tolerable level while using
the enabling switch.
This example is applicable to any GuardLogix controller. This example uses a 440J interlock switch with an integrated jog button, but is
applicable to solutions that use enabling switch technology in combination with a manual button.
The Safety Integrity Software Tool for the Evaluation of Machine Applications (SISTEMA) calculations that are shown later in this document
would have to be recalculated using the actual products.
Use Sample Project Files
Sample project files (AutoCAD, EPLAN, ACD, SISTEMA, and Verification and Validation checklist) are attached to this document to help you
implement this safety function.
To access these files, follow these steps.
1. If you are viewing the PDF file in a browser and do not see the Attachments link , download the PDF file and open it in the Adobe
Acrobat Reader application.
2. Click the Attachments link .
3. Right-click and save the desired file.
4. Open the file in the appropriate application.

Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022 5
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Safety Function Realization: Risk Assessment
The Performance Level required (PLr) is the result of a risk assessment and refers to the amount of the risk reduction to be conducted by the
safety-related parts of the control system. Part of the risk reduction process is to determine the safety functions of the machine. In this
application, the Performance Level that is required by the risk assessment is category 3, Performance Level d (cat. 3, PLd), for each safety
function. A safety system that achieves cat. 3, PLd, or higher, can be considered control reliable. Each safety product has its own rating and
can be combined to create a safety function that meets or exceeds the PLr.
Enabling Switch Safety Function
This application technique includes one safety function: removal of power from the hazard when the safety system detects that the operator
does not have the enabling switch in the middle position, or the door switch is open.
Safety Function Requirements
Functional safety requires the continuous actuation of a three-position enabling switch to enable power to the motor. The handheld device
provides power to the motor when squeezed to the middle position. When the operator releases or fully squeezes the switch, power to the
motor is removed. Faults at the enabling switch, wiring terminals, or safety controller are detected before the next safety demand. The
safety function in this example is capable of connecting and interrupting power to motors rated up to 9 A, 600V AC.
The safety function in this application technique meets or exceeds the requirements for Category 3, Performance Level d (Cat. 3, PLd), per
ISO 13849-1 and control reliable operation per ANSI B11.19.
Functional Safety Description
In this example, power to the motor is enabled if the safety door is closed, or if the operator opens the door and squeezes an enabling switch
to the middle position. Both the door switch and enabling switch are wired to a pair of safety inputs on a safety input module (SI1).The safety
contactors (K1 and K2) are connected to a pair of safety outputs of a safety output module (SO1). The I/O module is connected via CIP Safety™
technology over an EtherNet/IP™ network to the safety controller (SC1). The safety code in SC1 monitors the status of the door and enabling
switch by using pre-certified safety instructions. Dual Channel Input Stop (DCS) is used for the door and Dual Channel Input Start (DCSRT) is
used for the enabling switch, as this device is a safety device that starts a safety output. When all safety input interlocks are satisfied and no
faults are detected, a certified function block called Configurable Redundant Output (CROUT) controls and monitors feedback for a pair of
100S redundant contactors.
From: Risk Assessment (ISO 12100)
1. Identification of safety functions
2. Specification of characteristics of each function
3. Determination of required PL (PLr) for each safety function
To: Realization and PL Evaluation

6Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Bill of Material
This application technique uses these products.
Choose one of the following safety-controller hardware groups.
Cat. No. Description Quantity
440J-N21TNPM-NP Enabling switch with button 1
440K-T11090 Trojan™ 5 standard safety interlock switch 1
800FM-G611MX10 800F Reset push button - metal, guarded, blue, R, metal latch mount, one normally open contact, standard 2
100S-C09EJ23C Bulletin 100S-C - safety contactors 2
1734-AENT 24V DC Ethernet adapter 1
1734-TB Module base with removable IEC screw terminals 4
1734-IB8S POINT Guard I/O safety input module 1
1734-OB8S POINT Guard I/O safety output module 1
Controller Cat. No. Description Quantity
GuardLogix 5570
1756-L71S GuardLogix processor, 2.0 MB standard memory, 1.0 MB safety memory
11756-L72S GuardLogix processor, 4.0 MB standard memory, 2.0 MB safety memory
1756-L73S GuardLogix processor, 8.0 MB standard memory, 4.0 MB safety memory
1756-L7SP GuardLogix Safety Partner 1
1756-EN2TR ControlLogix® EtherNet/IP bridge, 10/100 Mbps, 2-port, twisted-pair media 1
1756-PA72 Power supply, 120/240V AC input, 3.5 A @ 24V DC 1
1756-A7 Seven-slot ControlLogix chassis 1
Compact GuardLogix 5370
1769-L30ERMS Compact GuardLogix processor, 1.0 MB standard memory, 0.5 MB safety memory
1
1769-L33ERMS Compact GuardLogix processor, 2.0 MB standard memory, 1.0 MB safety memory
1769-L36ERMS Compact GuardLogix processor, 3.0 MB standard memory, 1.5 MB safety memory
1769-L37ERMS Compact GuardLogix processor, 4.0 MB standard memory, 1.5 MB safety memory
1769-L38ERMS Compact GuardLogix processor, 5.0 MB standard memory, 1.5 MB safety memory
1769-PA4 Power supply, 120V/240V AC input, 2.0 A @ 24V DC 1
1769-ECR Right-end cap and terminator 1
GuardLogix 5580(1)
1756-L81ES GuardLogix Processor, 3 MB standard memory, 1.5 MB safety memory
1
1756-L82ES GuardLogix Processor, 5 MB standard memory, 2.5 MB safety memory
1756-L83ES GuardLogix Processor, 10 MB standard memory, 5 MB safety memory
1756-L84ES GuardLogix Processor, 20 MB standard memory, 6 MB safety memory
1756-PA72 Power supply, 120/240V AC input, 3.5 A @ 24V DC 1
1756-A7 Seven-slot ControlLogix chassis 1

Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022 7
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Setup and Wiring
For detailed information on how to install and wire the products in this application technique, refer to the publications that are listed in
Additional Resources.
System Overview
The POINT Guard I/O safety input module monitors the contacts of both the enabling switch and the door interlock switch.
The input module can source the 24V DC for all channels to dynamically test the signal wiring for shorts to 24V DC and channel-to-channel
shorts. If a fault occurs, either or all channels are set low (0), and the controller reacts by dropping out the safety contactors. Only after the
fault is cleared and the faulted input device is cycled, does the function block reset.
Compact GuardLogix 5380–
SIL 2
5069-L306ERS2 Compact GuardLogix processor, 0.6 MB standard memory, 0.3 MB safety memory
1
5069-L306ERMS2
5069-L310ERMS Compact GuardLogix processor, 1.0 MB standard memory, 0.5 MB safety memory
5069-L310ERMS2
5069-L320ERS2 Compact GuardLogix processor, 2.0 MB standard memory, 1.0 MB safety memory
5069-L320ERMS2
5069-L330ERS2 Compact GuardLogix processor, 3.0 MB standard memory, 1.5 MB safety memory
5069-L330ERMS2
5069-L340ERS2 Compact GuardLogix processor, 4.0 MB standard memory, 2.0 MB safety memory
5069-L340ERMS2
5069-L350ERS2 Compact GuardLogix processor, 5.0 MB standard memory, 2.5 MB safety memory
5069-L350ERMS2
5069-L380ERS2 Compact GuardLogix processor, 8.0 MB standard memory, 4.0 MB safety memory
5069-L380ERMS2
5069-L3100ERS2 Compact GuardLogix processor, 10.0 MB standard memory, 5.0 MB safety memory
5069-L3100ERMS2
1606-XLP72E Compact power supply, 24…28V DC, 72 W, 120/240V AC input 1
Compact GuardLogix 5380 -
SIL 3
5069-L306ERMS3 Compact GuardLogix processor, 0.6 MB standard memory, 0.3 MB safety memory
1
5069-L310ERMS3 Compact GuardLogix processor, 1.0 MB standard memory, 0.5 MB safety memory
5069-L320ERMS3 Compact GuardLogix processor, 2.0 MB standard memory, 1.0 MB safety memory
5069-L330ERMS3 Compact GuardLogix processor, 3.0 MB standard memory, 1.5 MB safety memory
5069-L340ERMS3 Compact GuardLogix processor, 4.0 MB standard memory, 2.0 MB safety memory
5069-L350ERMS3 Compact GuardLogix processor, 5.0 MB standard memory, 2.5 MB safety memory
5069-L380ERMS3 Compact GuardLogix processor, 8.0 MB standard memory, 4.0 MB safety memory
5069-L3100ERMS3 Compact GuardLogix processor, 10.0 MB standard memory, 5.0 MB safety memory
1606-XLP72E Compact power supply, 24…28V DC, 72 W, 120/240V AC input 1
(1) If your PLr is SIL 3/PLe, use a GuardLogix 5580 controller with a safety partner, cat. no. 1756-L8SP.
Controller Cat. No. Description Quantity

8Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Shorts to 0V DC (and wire off) are seen as an open circuit by the safety input module, and the controller reacts by dropping out the safety
contactors. If the inputs remain discrepant for longer than the discrepancy time, then the function block (DCS or DCSRT) in the controller
declares a fault. Only after the fault is cleared and the faulted input device is cycled, does the function block reset.
The final control device in this case is a pair of 100S safety contactors, K1 and K2. The contactors are controlled by a POINT Guard I/O safety
output module. The contactors are wired in a redundant-series configuration. A feedback circuit is wired through the normally closed
contacts and back to an input on the safety output module to monitor the contactors for proper operation. The contactors cannot restart if
the feedback circuit is not in the correct state.
The system has a reset button for resetting faults. There is a jog button on the enabling switch that the control system uses to start motion.
The reset button, the jog button, and the contactor feedback circuit are all wired to the safety input module in this example. This
configuration is not required for functional safety. These inputs could be wired to a standard input module.

Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022 9
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Electrical Schematic
For an electrical schematic in AutoCAD or EPLAN format, see the attached files. For instructions on how to access the attachments, see Use
Sample Project Files on page 4.
Safety Reset
Fault Reset
Jog Switch
Safety
Interlock
Switch
DC COM
24V DC - Class 2

10 Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Configuration
The safety controller is configured by using the Studio 5000 Logix Designer® application. You must create a project and add the POINT Guard
I/O modules. A detailed description of each step is beyond the scope of this document. Knowledge of the Logix Designer application is
assumed.
For a Studio 5000 Logix Designer project file that you can import into your own project, see the attached ACD file. The attached ACD file
includes a GuardLogix 5570 controller, but if you choose a Compact GuardLogix 5370 controller, you can change the controller in the Logix
Designer program. Make sure that the controller that is used in your safety function is the same controller used in your SISTEMA PL
calculation.
Create a Project with a GuardLogix Controller
If you are not using the attached ACD file, follow these steps to create a project.
1. In the Logix Designer application, create a project with a GuardLogix controller that includes the following:
• A connection to an Ethernet network
GuardLogix 5570 controllers require the use of an Ethernet communication module, but
Compact GuardLogix 5370 controllers have Ethernet ports.
• Time Synchronization enabled on the controller and any Ethernet communication modules, if used
2. Set the IP Address for the controller or any Ethernet communication modules, if used.
3. Add a POINT I/O™ Ethernet adapter module to your project.
4. Add POINT Guard I/O modules to your project.
5. Configure the modules properly for your application.
See Additional Resources for more information regarding I/O modules.
Minimum Logix Designer Application Version Product
20 GuardLogix 5570 controller
28 Compact GuardLogix 5370 controller (1769-L30ERMS, 1769-L33ERMS, 1769-L36ERMS)
31 Compact GuardLogix 5370 controller (1769-L37ERMS, 1769-L38ERMS)
I/O Configuration from the Controller Organizer
in the Logix Designer application

Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022 11
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Programming
The Dual Channel Input Stop (DCS) instruction monitors dual-input safety devices whose main function is to stop a machine safely, for
example, a safety gate. If the Door OK tag is sealed in around the falling edge of the Safety Reset button, then the contactors are energized.
The Dual Channel Start (DCSRT) instruction energizes its output (O1) if the enable input is high (1), and both input channels are in the active (1)
state. In this example, the Slow_Machine_Mode enable input indicates that the machine is in a mode where use of the enabling switch is
allowed. You are responsible for driving this input, which you must base on your application and risk assessment. If use of an enabling
switch is allowed, and the operator squeezes the enabling switch to the idle position, then the contactors energize.
The DCS and DCSRT instructions monitor dual-input channels for consistency (Equivalent- Active High) and detect and trap faults when the
inconsistency is detected for longer than the configured Discrepancy Time (ms).
The automatic restart type allows the DCS output (O1) to reset automatically after a demand. The manual action that is typically required for
safety is provided in rungs 2 and 3 to reset the safety outputs.
Input Status typically represents the channel status of the dual-input channels. In this example, the Combined Input Status bit goes low (0) if
any of the eight input channels on the 1734-IB8S module have a fault. The Energize_K1K2 tag drives the Actuate input on the Configurable
Redundant Output (CROUT) instruction. Either a closed door or the enabling switch can set this tag to high (1).
The CROUT instruction controls and monitors redundant outputs. Essentially, this instruction verifies that feedback follows the safety
outputs appropriately. For the negative feedback used in this example, if the outputs are high (1), the feedback is low (0) and vice versa. In
this example, the feedback has 500 ms to change to the proper state. Because only one feedback circuit is used, the feedback tag is used
for both Feedback 1 and 2.
The two output tags from the CROUT instruction are used to drive the contactor outputs on the 1734-OB8S module.

12 Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
For controller logic that you can download to your controller, see the attached ACD file.
Falling Edge Reset
ISO 13849-1 stipulates that instruction reset functions must occur on falling edge signals. To comply with this requirement, a One Shot Falling
(OSF) instruction is used on the reset rung. Then, the OSF instruction Output Bit tag is used as the reset bit for the STO output rung.
0
O1
FP
Dual Channel Input Stop
DCS Zone1_Door
Safety Function SAFETY GATE
Input Type EQUIVALENT - ACTIVE HIGH
Discrepancy Time (Msec) 500
Restart Type AUTOMATIC
Cold Start Type AUTOMATIC
Channel A AENT:1:I.Pt00Data
0
Channel B AENT:1:I.Pt01Data
0
Input Status
AENT:1:I.CombinedInputStatus
0
Reset AENT:1:I.Pt05Data
0
DCS
1
O1
FP
Dual Channel Input Start
DCSRT Zone1_Enable_Pendant
Safety Function ENABLE PENDANT
Input Type EQUIVALENT - ACTIVE HIGH
Discrepancy Time (Msec) 250
Enable Slow_Machine_Mode
0
Channel A AENT:1:I.Pt02Data
0
Channel B AENT:1:I.Pt03Data
0
Input Status
AENT:1:I.CombinedInputStatus
0
Reset AENT:1:I.Pt05Data
0
DCSRT
2
AENT:1:I.Pt04Data
SB
OB
One Shot Falling
Storage Bit Wrk_Zone1_OSF
Output Bit Wrk_Zone1_FallingEdge
OSF
3
Wrk_Zone1_FallingEdge
Door_OK
Zone1_Door.O1
/
Zone1_K1K2.FP Door_OK
4
Door_OK
Zone1_Enable_Pendant.O1
Energize_K1K2
5
O1
O2
FP
Configurable Redundant Output
CROUT Zone1_K1K2
Feedback Type NEGATIVE
Feedback Reaction Time (Msec) 500
Actuate
Energize_K1K2
0
Feedback 1 AENT:1:I.Pt07Data
0
Feedback 2 AENT:1:I.Pt07Data
0
Input Status AENT:1:I.CombinedInputStatus
0
Output Status
AENT:2:I.CombinedOutputStatus
0
Reset AENT:1:I.Pt05Data
0
CROUT
6
Zone1_K1K2.O1 Zone1_K1K2.O2 AENT:2:O.Pt00Data
AENT:2:O.Pt01Data

Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022 13
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Calculation of the Performance Level
When properly implemented, these safety functions can achieve a safety rating of category 3, Performance Level d (cat. 3, PLd), according to
ISO 13849-1: 2015, as calculated by using the Safety Integrity Software Tool for the Evaluation of Machine Applications (SISTEMA).
The SISTEMA file that is referenced in this safety function application technique is attached to this document.
The average frequency of a dangerous failure per hour (PFH) for electromechanical systems may be calculated differently based on the
version of ISO 13849 supported by SISTEMA. ISO 13849-1:2015, which changed the maximum MTTFd from 100…2500 years, is supported
starting in version 2.0.3 of SISTEMA. As a result, the same SISTEMA data file that is opened in two different versions of SISTEMA can yield
different calculated results.
The functional safety specifications of the project call for a Performance Level of PLd (minimum) and a structure of
Cat. 3 (minimum). A PFHd of less than 1.0 E-06 for the overall safety function is required for PLd.
The GuardLogix 5570 controller subsystem uses 1.2% of PLe bandwidth. The Compact GuardLogix 5370 controller subsystem uses 1.5% of
PLe bandwidth.
Complete Safety Function PL Calculation Example
Assuming the use of a Compact GuardLogix 5370 controller, here are all of the subsystems shown together. If you choose a different
controller, you need different calculations.
IMPORTANT To calculate the PL of your entire safety function, you must include the specific subsystems that you chose.
Depending on the devices you choose, the overall safety rating of your system will be different. An example
that describes how to calculate the safety rating for a complete safety function appears in the section titled
Complete Safety Function PL Calculation Example.

14 Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
The Enabling Switch Safety Function can be modeled as shown.
Functional Safety Data Required for Determining the Performance Level of Electromechanical Devices
Because these devices are electromechanical devices, the functional safety data that are required for Performance Level calculation include
the following:
• Mean Time to Failure, dangerous (MTTFd)
• Diagnostic Coverage (DCavg)
• Common Cause Failure (CCF)
The functional safety evaluations of the electromechanical devices include the following:
• How frequently they are operated
• Whether they are effectively monitored for faults
• Whether they are properly specified and installed
SISTEMA calculates the MTTFd by using B10d data that are provided for the contactors along with the estimated frequency of use, entered
during the creation of the SISTEMA project.
The DCavg (99%) for the contactors is selected from the Output Device table of ISO 13849-1 Annex E, Direct Monitoring.
The CCF value is generated by using the scoring process that is outlined in Annex F of ISO 13849-1. The complete CCF scoring process must
be performed when actually implementing an application. A minimum score of 65 must be achieved.
The enabling switch has one mechanical actuator. To account for this single point of failure, Subsystem 2 (fault exclusion) is included in the
SISTEMA calculation. Note that a fault exclusion is allowed in safety functions up to and including PLd, per annex D.8 of ISO 13849-2 2012
When an application includes two-channel, single-actuator mechanical safeguarding devices such as interlocks or mechanical emergency
stop devices such as E-stops or cable pull switches, fault exclusion for single- actuator failure must be taken into account and, when
required, applied when determining the Performance Level.
Exclusion of the possible fault of the single actuator failing to switch the two channels properly is not allowed. Therefore, single types of
electromechanical devices are limited to a maximum Performance Level of d. The Performance Level required (PLr) in safety function
application techniques is PLd. Redundancy of safeguarding switches is required to achieve Performance Level e.
Subsystem 1 Subsystem 2 Subsystem 3 Subsystem 4 Subsystem 5 Subsystem 6
Input Logic Output
Enabling
Switch
Channel A
Enabling
Switch
Channel B
Fault
Exclusion 1734-IB8S 1734-OB8S
GuardLogix
Safety
Controller
100S-C
K1
100S-C
K2

Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022 15
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
A message has been added about the mission time of enabling switch elements (EL). An estimated annual number of 8760 cycles, one per
hour, 24 hours a day, 365 days a year, was used to calculate the MTTFd. The note indicates that at that rate of use, the enabling switch must
be replaced after 11.42 years of use.
Verification and Validation Plan
Verification and validation play important roles in the avoidance of faults throughout the safety system design and development process. ISO
13849-2 sets the requirements for verification and validation. The standard calls for a documented plan to confirm that all safety functional
requirements have been met.
Verification is an analysis of the resulting safety control system. The Performance Level (PL) of the safety control system is calculated to
confirm that the system meets the required Performance Level (PLr) specified. The SISTEMA software is typically used to perform the
calculations and assist with satisfying the requirements of ISO 13849-1.
Validation is a functional test of the safety control system to demonstrate that the system meets the specified requirements of the safety
function. The safety control system is tested to confirm that all safety-related outputs respond appropriately to their corresponding safety-
related inputs. The functional test includes normal operating conditions and potential fault injection of failure modes. A checklist is typically
used to document the validation of the safety control system.
Before validating the GuardLogix Safety System, confirm that the safety system and safety application program have been designed in
accordance with the controller safety reference manuals that are listed in Additional Resources, and the GuardLogix Safety Application
Instruction Set Reference Manual, publication 1756-RM095.
For a validation checklist, see the attached spreadsheet.

16 Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Additional Resources
These documents contain more information about related products from Rockwell Automation.
You can view or download publications at rok.auto/literature.
Resource Description
GuardLogix 5570 and Compact GuardLogix 5370 Controller Systems Safety
Reference Manual, publication 1756-RM099
Describes the GuardLogix 5570 controller and Compact GuardLogix 5370
controller system. Provides instructions on how to develop, operate, or maintain
a controller-based safety system that uses the Studio 5000 Logix Designer
application.
GuardLogix 5570 Controllers User Manual, publication 1756-UM022 Provides information on how to install, configure, and program the GuardLogix
5570 controllers in the Logix Designer application.
Compact GuardLogix 5370 Controllers User Manual, publication 1769-UM022 Provides information on how to install, configure, and program the Compact
GuardLogix 5370 controllers in the Logix Designer application.
GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety
Reference Manual, publication 1756-RM012
Describes the GuardLogix 5580 and Compact GuardLogix 5380 controller
system. Provides instructions on how to develop, operate, or maintain a
controller-based safety system that uses the Studio 5000 Logix Designer
application.
ControlLogix and GuardLogix 5580 Controllers User Manual, publication
1756-UM543 Provides information on how to install, configure, and program the GuardLogix
5580 controllers in the Logix Designer application.
CompactLogix™ and Compact GuardLogix Controllers User Manual, publication
5069-UM001 Provides information on how to install, configure, and program the Compact GuardLogix 5380 controllers in the Logix Designer application.
GuardLogix Safety Application Instruction Set Reference Manual,
publication 1756-RM095
Describes the Rockwell Automation® GuardLogix Safety Application Instruction
Set. Provides instructions on how to design, program, or troubleshoot safety
applications that use GuardLogix controllers.
POINT Guard I/O Safety Modules User Manual, publication 1734-UM013 Provides information on how to install, configure, and operate POINT Guard I/O
modules.
440J-N Enabling Switch Installation Instructions, publication 440J-IN001 Provides instructions on how to install and maintain the 440J-N enabling
switch.
Trojan 5 and 6 Installation Instructions, publication 440K-IN002 Provides instructions on how to install and maintain the 440K Trojan 5 and 6
interlock switch.
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines for installing a Rockwell Automation industrial
system.
Product Certifications website, rok.auto/certifications. Provides declarations of conformity, certificates, and other certification details.
Safety Automation Builder and SISTEMA Library website, rok.auto/sistema
Download the Safety Automation Builder® software to help simplify machine
safety design and validation, and reduce time and costs. Integration with our
risk assessment software provides you with consistent, reliable, and
documented management of the Functional Safety Lifecycle.
The SISTEMA tool, also available for download from the Safety Automation
Builder page, automates calculation of the attained Performance Level from the
safety-related parts of a machine’s control system to (EN) ISO 13849-1.

Rockwell Automation Publication SAFETY-AT125C-EN-P - February 2022 17
Enabling Switch with an Integrated Safety Controller and a POINT Guard I/O Safety Module Safety Function Application Technique
Notes:

Publication SAFETY-AT125C-EN-P - February 2022
Supersedes Publication SAFETY-AT125B-EN-P - November 2018 Copyright © 2022 Rockwell Automation, Inc. All rights reserved. Printed in the U.S.A.
Rockwell Automation Support
Use these resources to access support information.
Documentation Feedback
Your comments help us serve your documentation needs better. If you have any suggestions on how to improve our content, complete the
form at rok.auto/docfeedback.
Technical Support Center Find help with how-to videos, FAQs, chat, user forums, and product notification updates. rok.auto/support
Knowledgebase Access Knowledgebase articles. rok.auto/knowledgebase
Local Technical Support Phone Numbers Locate the telephone number for your country. rok.auto/phonesupport
Literature Library Find installation instructions, manuals, brochures, and technical data publications. rok.auto/literature
Product Compatibility and Download Center
(PCDC)
Get help determining how products interact, check features and capabilities, and find
associated firmware. rok.auto/pcdc
Rockwell Automation maintains current product environmental information on its website at rok.auto/pec.
Allen-Bradley, CompactLogix, ControlLogix, expanding human possibility, GuardLogix, POINT Guard I/O, POINT I/O, Rockwell Automation, Safety Automation Builder, SensaGuard,
Studio 5000 Logix Designer, and Trojan are trademarks of Rockwell Automation, Inc.
CIP Safety and EtherNet/IP are trademarks of ODVA, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
Rockwell Otomasyon Ticaret A.Ş. Kar Plaza İş Merkezi E Blok Kat:6 34752, İçerenkÖy, İstanbul, Tel: [phone] EEE YÖnetmeliğine Uygundur
Safety Function Capabilities
Visit rok.auto/safety for more information on our Safety System Development Tools, including Safety Functions.