Beckhoff EJ6910 User manual

Operating Instructions | EN
EJ6910
TwinSAFE Logic Module
2023-03-10 | Version: 2.0.0

Table of contents
EJ6910 3Version: 2.0.0
Table of contents
1 Notes on the documentation....................................................................................................................5
1.1 Disclaimer..........................................................................................................................................5
1.1.1 Trademarks........................................................................................................................5
1.1.2 Patents...............................................................................................................................5
1.1.3 Limitation of liability............................................................................................................6
1.1.4 Copyright............................................................................................................................6
1.2 Documentation issue status ..............................................................................................................7
1.3 Staff qualification...............................................................................................................................8
1.4 Safety and instruction........................................................................................................................9
1.4.1 Explanation of symbols ......................................................................................................9
1.5 Beckhoff Support and Service.........................................................................................................10
2 For your safety ........................................................................................................................................11
2.1 Duty of care.....................................................................................................................................11
2.2 Safety image signs..........................................................................................................................12
2.3 General safety instructions..............................................................................................................13
2.3.1 Before operation...............................................................................................................13
2.3.2 In operation ......................................................................................................................13
2.3.3 After operation..................................................................................................................14
3 TwinSAFE System Description..............................................................................................................15
3.1 Extension of the Beckhoff I/O system with safety functions............................................................15
3.2 Safety concept ................................................................................................................................15
3.3 EtherCAT plug-in module system (EJ)............................................................................................16
4 Product description ................................................................................................................................17
4.1 EJ6910 - TwinSAFE logic module...................................................................................................17
4.2 Intended use ...................................................................................................................................18
4.3 Technical data.................................................................................................................................19
4.4 Safety parameters...........................................................................................................................20
4.5 Dimensions .....................................................................................................................................21
5 Operation .................................................................................................................................................22
5.1 Environmental conditions ................................................................................................................22
5.2 Installation .......................................................................................................................................22
5.2.1 Safety instructions............................................................................................................22
5.2.2 Transport / storage...........................................................................................................22
5.2.3 Mechanical installation.....................................................................................................22
5.2.4 Electrical installation.........................................................................................................25
5.3 Configuration of the EJ6910 in TwinCAT ........................................................................................26
5.3.1 Configuration requirements..............................................................................................26
5.3.2 Adding an EJ6910............................................................................................................27
5.3.3 Address setting on the TwinSAFE EJ modules with 1023 possible addresses ............... 28
5.3.4 Creating a safety project in TwinCAT3............................................................................29
5.3.5 Downloading the safety application..................................................................................55
5.3.6 Online Mode.....................................................................................................................58
5.3.7 New features in TC3.1 Build 4022 ...................................................................................62

Table of contents
EJ69104 Version: 2.0.0
5.4 Info Data..........................................................................................................................................81
5.4.1 Info data for the connection .............................................................................................81
5.4.2 Info data for function blocks .............................................................................................82
5.4.3 Info data for the TwinSAFE group....................................................................................83
5.4.4 Info data for the device.....................................................................................................84
5.5 Version history ................................................................................................................................85
5.6 User Administration.........................................................................................................................86
5.7 Backup/Restore...............................................................................................................................88
5.8 Export/import of the safety project ..................................................................................................92
5.9 Diag History tab...............................................................................................................................94
5.10 TwinSAFE SC - configuration .........................................................................................................95
5.11 Customizing / disabling TwinSAFE groups .....................................................................................99
5.12 Saving the analog group inputs persistently .................................................................................102
5.13 Project design limits of EL6910/EJ6910........................................................................................103
5.14 Sync-Manager Configuration ........................................................................................................103
5.15 TwinSAFE reaction times..............................................................................................................106
5.15.1 Typical reaction time ......................................................................................................106
5.15.2 Worst-case reaction time ...............................................................................................107
5.16 Diagnostics....................................................................................................................................108
5.16.1 Diagnostic LEDs.............................................................................................................108
5.16.2 Status LEDs ...................................................................................................................110
5.16.3 Diagnostic objects..........................................................................................................110
5.16.4 Cycle time of the safety project......................................................................................112
6 Service life .............................................................................................................................................113
7 Maintenance and cleaning ...................................................................................................................114
8 Decommissioning .................................................................................................................................115
8.1 Disposal ........................................................................................................................................115
8.1.1 Returning to the vendor..................................................................................................115
9 Appendix................................................................................................................................................116
9.1 Volatility.........................................................................................................................................116
9.2 Focus of certificates ......................................................................................................................117
9.3 Certificate ......................................................................................................................................118

Notes on the documentation
EJ6910 5Version: 2.0.0
1 Notes on the documentation
1.1 Disclaimer
Beckhoff products are subject to continuous further development. We reserve the right to revise the
operating instructions at any time and without prior announcement. No claims for the modification of products
that have already been supplied may be made on the basis of the data, diagrams and descriptions in these
operating instructions.
In these operating instructions we define all permissible use cases whose properties and operating
conditions we can guarantee. The use cases we define are fully tested and certified. Use cases beyond this,
which are not described in these operating instructions, require the approval of Beckhoff Automation GmbH
& Co KG.
1.1.1 Trademarks
Beckhoff®, TwinCAT®, EtherCAT®, EtherCAT G®, EtherCAT G10®, EtherCAT P®, Safety over EtherCAT®,
TwinSAFE®, XFC®, XTS® and XPlanar® are registered and licensed trademarks of Beckhoff Automation
GmbH.
The use of other brand names or designations by third parties may lead to an infringement of the rights of
the owners of the corresponding designations.
1.1.2 Patents
The EtherCAT technology is protected by patent rights through the following registrations and patents with
corresponding applications and registrations in various other countries:
• EP1590927
• EP1789857
• EP1456722
• EP2137893
• DE102015105702
EtherCAT® is a registered trademark and patented technology,
licensed by Beckhoff Automation GmbH.
Safety over EtherCAT® is a registered trademark and patented
technology, licensed by Beckhoff Automation GmbH.

Notes on the documentation
EJ69106 Version: 2.0.0
1.1.3 Limitation of liability
All components in this product as described in the operating instructions are delivered in a specific
configuration of hardware and software, depending on the application regulations. Modifications and
changes to the hardware and/or software configuration that go beyond the documented options are
prohibited and nullify the liability of Beckhoff Automation GmbH & Co. KG.
The following is excluded from the liability:
• Failure to observe these operating instructions
• Improper use
• Use of untrained personnel
• Use of unauthorized spare parts
1.1.4 Copyright
© Beckhoff Automation GmbH & Co. KG, Germany.
The distribution and reproduction of this document as well as the use and communication of its contents
without express authorization are prohibited.
Offenders will be held liable for the payment of damages. All rights reserved in the event of the grant of a
patent, utility model or design.

Notes on the documentation
EJ6910 7Version: 2.0.0
1.2 Documentation issue status
Version Comment
2.0.0 • Foreword changed to Notes on the documentation [}5] and For your safety [}11]
• In chapter Technical data [}19] link to download page of certificates added
• In chapter TwinSAFE reaction times [}106] chapter structure revised
•Service life [}113] moved
•Maintenance and cleaning [}114] and Decommissioning [}115] adjusted
• Appendix adjusted and expanded
1.8.1 • Version 1.8.0 added to this table
1.8.0 • Maximum permissible operating temperature changed
• In chapter Technical data [}19] Warning notice added
• New layout
1.7.0 • Project design limits updated
• Description of new features in TwinCAT 3.1 Build 4022 added
• Description temperature measurement updated
• Intended use added
1.6.0 • Hint and flowchart to Backup/Restore added
• Note to the input and output process image added
• Description for Sync Manager configuration added
• TwinSAFE SC description updated
1.5.1 • Screenshots User Administration updated
• State and Diag of TwinSAFE group updated
• Technical data permissible air pressure expanded
1.5.0 • Screenshots updated
• Certificate updated
1.4.0 • Reference to standards updated
• Safety parameters updated
1.3.0 • Description of diagnosis object 0xFEA0 extended
1.2.0 • Description Backup/Restore expanded
• Description TwinSAFE SC expanded
1.1.0 • Chapters External connections, FB port properties, Parameterization of the alias device,
Variable mapping and Customizing updated
1.0.0 • Migration
0.6.0 • Preliminary (internal only)
Currentness
Please check whether you are using the current and valid version of this document. The current version can
be downloaded from the Beckhoff homepage at http://www.beckhoff.de/twinsafe. In case of doubt, please
contact Technical Support (see Beckhoff Support and Service [}10]).
Origin of the document
The original documentation is written in German. All other languages are derived from the German original.
Product features
Only the product properties specified in the current operating instructions are valid. Further information given
on the product pages of the Beckhoff homepage, in emails or in other publications is not authoritative.

Notes on the documentation
EJ69108 Version: 2.0.0
1.3 Staff qualification
These operating instructions are intended exclusively for trained specialists in control technology and
automation with the relevant knowledge.
The trained specialist personnel must ensure that the applications and use of the described product meet all
safety requirements. This includes all applicable and valid laws, regulations, provisions and standards.
Trained specialists
Trained specialists have extensive technical knowledge from studies, apprenticeships or technical training.
Understanding of control technology and automation is available. Trained specialists can:
• Independently identify, avoid and eliminate sources of hazard.
• Apply relevant standards and directives.
• Implement specifications from accident prevention regulations.
• Evaluate, prepare and set up the workplaces.
• Evaluate, optimize and execute work independently.

Notes on the documentation
EJ6910 9Version: 2.0.0
1.4 Safety and instruction
Read the contents that refer to the activities you have to perform with the product. Always read the chapter
For your safety [}11] in the operating instructions.
Observe the warnings in the chapters so that you can handle and work with the product as intended and
safely.
1.4.1 Explanation of symbols
Various symbols are used for a clear arrangement:
1. The numbering indicates an action that should be taken.
• The bullet point indicates an enumeration.
[…] The square brackets indicate cross-references to other text passages in the document.
[1] The number in square brackets indicates the numbering of a referenced document.
1.4.1.1 Pictograms
In order to make it easier for you to find text passages, pictograms and signal words are used in warning
notices:
DANGER
Failure to observe will result in serious or fatal injuries.
WARNING
Failure to observe may result in serious or fatal injuries.
CAUTION
Failure to observe may result in minor or moderate injuries.
NOTE
Notes
Notes are used for important information on the product. The possible consequences of failure to observe
these include:
• Malfunctions of the product
• Damage to the product
• Damage to the environment
Information
This sign indicates information, tips and notes for dealing with the product or the software.

Notes on the documentation
EJ691010 Version: 2.0.0
1.5 Beckhoff Support and Service
Support
Beckhoff Support offers technical advice on the use of individual Beckhoff products and system planning.
The employees support you in the programming and commissioning of sophisticated automation systems.
Hotline: [phone]
E-mail: [email protected]
Web: www.beckhoff.com/support
Training
Training in Germany takes place in our training center at the Beckhoff headquarters in Verl, at subsidiaries
or, by arrangement, at the customer's premises.
Hotline: [phone]
E-mail: [email protected]
Web: www.beckhoff.com/training
Service
The Beckhoff Service Center supports you with after-sales services such as on-site service, repair service or
spare parts service.
Hotline: [phone]
E-mail: [email protected]
Web: www.beckhoff.com/service
Download area
In the download area you can obtain product information, software updates, the TwinCAT automation
software, documentation and much more.
Web: www.beckhoff.com/download
Headquarters
Beckhoff Automation GmbH & Co. KG
Hülshorstweg 20
33415 Verl
Germany
Phone: [phone]
E-mail: [email protected]
Web: www.beckhoff.com
For the addresses of our worldwide locations, please visit our website at Global Presence.

For your safety
EJ6910 11Version: 2.0.0
2 For your safety
Read this chapter containing general safety information. In addition, always observe the safety instructions
and warnings in these operating instructions for your own safety, the safety of other persons and the safety
of the product.
When working with control and automation products, many dangers can result from careless or incorrect use.
Work particularly thoroughly, not under time pressure and responsibly towards other people.
2.1 Duty of care
Read entire documentation for TwinSAFE component
• TwinSAFE application manual
• EL6910 TwinSAFE logic terminal operating manual
• TwinSAFE Logic FB documentation manual
The operator must comply with all the requirements and notes specified in these operating instructions in
order to fulfill his duty of care. This includes in particular that you
• comply with the provisions defined in the chapter Limitation of liability [}6].
• only operate the TwinSAFE component when it is in perfect working order.
• provide the operating instructions in a legible condition and complete at the place of use of the
TwinSAFE component.
• do not remove the safety markings attached to the TwinSAFE component and maintain their legibility.
No disposal in domestic waste
Products marked with a crossed-out waste bin must not be disposed of with domestic
waste. The device is considered waste electrical and electronic equipment when it is
disposed of. Observe the national regulations for the disposal of waste electrical and
electronic equipment.

For your safety
EJ691012 Version: 2.0.0
2.2 Safety image signs
On Beckhoff products you will find attached or lasered safety pictograms, which vary depending on the
product. They serve to serve to ensure safety for people and to prevent damage to the products. Safety
pictograms must not be removed and must be legible for the user.
Read and observe the operating instructions
Commissioning is only permitted if the operating instructions have been read and understood
beforehand. This applies in particular to the safety instructions and warnings.
Electrostatic sensitive components
Work with and on the TwinSAFE component is only permitted in protected workplaces.

For your safety
EJ6910 13Version: 2.0.0
2.3 General safety instructions
2.3.1 Before operation
Use in machines according to the Machinery Directive
Only use the TwinSAFE component in machines that comply with the Machinery Directive. This is how you
ensure safe operation.
Ensure traceability
Ensure the traceability of the TwinSAFE component via the serial number.
Use SELV/PELV power supply
Use a SELV/PELV power supply unit with an output-side voltage limit of Umax = 36VDC to supply the
TwinSAFE component with 24VDC.
Failure to observe this will endanger the safety function of the product. Depending on the machine, death
and danger to life, serious physical injury and damage to the machine may result.
Carry out commissioning test
Before commissioning, wiring faults to the sensors must be excluded. Before commissioning, carry out a
commissioning test. After a successful commissioning test, you can use the TwinSAFE component for the
intended safety-related task.
In case of wiring errors, the safety function of the product is at risk. Depending on the machine, death and
danger to life, serious bodily injury and damage to the machine may result.
Use permissible engineering tools and procedures
The TÜV SÜD certificate applies to the TwinSAFE component, the function blocks available in it, the
documentation and the engineering tool. Approved engineering tools are TwinCAT 3.1, the TwinSAFE
Loader and CODESYS Safety for EtherCAT Safety Module.
Procedures or engineering tools that deviate from this are not covered by the certificate. This is especially
true for externally generated xml files for the TwinSAFE import or externally generated automatic project
creation procedures.
2.3.2 In operation
Interference due to emitted interference
Do not operate the following devices in the vicinity of the TwinSAFE component: for example, radio
telephones, radios, transmitters or high-frequency systems.
TwinSAFE components comply with the requirements of the applicable electromagnetic compatibility
standards with regard to interference emission and immunity. If you exceed the limits for emitted interference
specified in the standards, the function of the TwinSAFE component may be impaired.

For your safety
EJ691014 Version: 2.0.0
2.3.3 After operation
De-energize and switch off components before working on them
Check all safety-relevant equipment for functionality before working on the TwinSAFE component. Secure
the working environment. Secure the machine or plant against being inadvertently started up. Observe the
chapter Decommissioning [}115].

TwinSAFE System Description
EJ6910 15Version: 2.0.0
3 TwinSAFE System Description
3.1 Extension of the Beckhoff I/O system with safety
functions
The TwinSAFE products from Beckhoff enable convenient expansion of the Beckhoff I/O system with safety
components, and integration of all the cabling for the safety circuit within the existing fieldbus cable. Safe
signals can be mixed with standard signals as required. The transfer of safety-related TwinSAFE telegrams
is handled by the standard controller. Maintenance is simplified significantly thanks to faster diagnosis and
simple replacement of components.
The following basic functionalities are included in the TwinSAFE components:
digital inputs (e.g. EL19xx, EP1908), digital outputs (e.g. EL29xx), drive components (e.g. AX5805) and logic
units (e.g. EL6900, EL6910). For a large number of applications, the complete safety sensor and actuator
technology can be wired on these components. The required logical link of the inputs and the outputs is
handled by the EL69xx. In addition to Boolean operations, the EL6910 now also enables analog operations.
3.2 Safety concept
TwinSAFE: Safety and I/O technology in one system
• Extension of the familiar Beckhoff I/O system with TwinSAFE components
• Safe and non-safe components can be combined as required
• Logical link of the I/Os in the EL69xx TwinSAFE logic terminal
• Suitable for applications up to SIL3 according to EN61508:2010 and Cat4, PLe according to
DINENISO13849-1:2016-06
• Safety-relevant networking of machines via bus systems
• In the event of an error, all TwinSAFE components always switch to the wattless and therefore safe
state
• No safety requirements for the higher-level standard TwinCAT system
Safety over EtherCAT protocol (FSoE)
• Transfer of safety-relevant data via any media (“genuine black channel”)
• TwinSAFE communication via fieldbus systems such as EtherCAT, Lightbus, PROFIBUS, PROFINET
or Ethernet
• IEC 61508:2010 SIL 3 compliant
• FSoE is IEC standard (IEC 61784-3-12) and ETG standard (ETG.5100)
Fail-safe principle (fail stop)
The basic rule for a safety system such as TwinSAFE is that failure of a part, a system component or the
overall system must never lead to a dangerous condition. The safe state is always the switched off and
wattless state.
CAUTION
Safe state
For all TwinSAFE components the safe state is always the switched-off, wattless state.

TwinSAFE System Description
EJ691016 Version: 2.0.0
3.3 EtherCAT plug-in module system (EJ)
Similar to the EtherCAT terminal system, a module strand consists of a Bus Coupler and any desired I/O
modules. In contrast to the EtherCAT Terminals, however, the EtherCAT plug-in modules have no spring-
loaded contacts, since the wiring level is outsourced: communication, signal distribution and the supply of
power to the modules takes place via plug connectors on the back side of the modules and the conductive
tracks of the signal distribution board.
The EtherCAT plug-in modules and the plug level for sensors and actuators can be placed flexibly on the
signal distribution board. Signal distribution boards can be user-developed or provided as custom solutions
by Beckhoff Automation GmbH & Co. KG.
Fig.1: EtherCAT plug-in module system (EJ)

Product description
EJ6910 17Version: 2.0.0
4 Product description
4.1 EJ6910 - TwinSAFE logic module
The TwinSAFE logic EJ module is the link unit between the TwinSAFE input and output modules.
The EJ6910 module meets the requirements of IEC61508:2010 SIL3 and DINENISO13849-1:2016-06
(Cat4, PLe).
Fig.2: EJ6910 - TwinSAFE logic module

Product description
EJ691018 Version: 2.0.0
4.2 Intended use
WARNING
Caution - Risk of injury!
TwinSAFE EJ modules may only be used for the purposes described below!
The TwinSAFE EJ modules expand the application range of the Beckhoff EtherCAT system by functions that
enable it to be used in the field of machine safety as well. The TwinSAFE EJ modules are designed for
machine safety functions and directly associated to industrial automation tasks. It is therefore approved only
for applications with a defined fail-safe state. This safe state is the wattless state.
The TwinSAFE EJ modules are suitable for operation on an EJ distribution board.
WARNING
System limits
The TÜV-SÜD certificate applies to the TwinSAFE EJ modules, the function blocks available in it, the
documentation and the engineering tool. Approved engineering tools are TwinCAT 3.1, TwinSAFE Loader
and CODESYS Safety for EtherCAT Safety Module. Any deviations from these procedures or tools,
particularly externally generated xml files for TwinSAFE import or externally generated automatic project
creation procedures, are not covered by the certificate.
WARNING
Power supply
An SELV/PELV power supply unit with a voltage limit of Umax= 36VDC on the output side must be used to
supply power for the TwinSAFE EJ modules with 24VDC. Failure to observe this can result in a loss of
safety.
WARNING
Commissioning test
Before the TwinSAFE EJ modules can be used for the safety task, the user must carry out a commissioning
test so that sensor and actuator wiring errors can be ruled out.
CAUTION
Note the Machinery Directive
The TwinSAFE EJ modules may only be used in machines according to the machinery directive.
CAUTION
Ensure traceability
The buyer has to ensure the traceability of the device via the serial number.

Product description
EJ6910 19Version: 2.0.0
4.3 Technical data
WARNING
Keep distance to the maximum values
The EJ modules are assemblies that are integrated into an overall system by the user. Due to the
complexity and variability, exact technical limit values for the ambient conditions are not generally valid. In
addition, there are many influencing factors that cannot be fully derived in this documentation.
Therefore, keep as large a distance as possible from the maximum values.
Non-observance can endanger safety.
The current certificates of all TwinSAFE products with the underlying standards and directives can be found
at https://www.beckhoff.com/en-en/support/download-finder/certificates-approvals/.
Product designation EJ6910
Number of inputs 0
Number of outputs 0
Status display 4 diagnostic LEDs
Minimum/maximum cycle time approx. 1 ms / according the project size
Error reaction time ≤ watchdog times
Watchdog time Min. 2ms, max. 60000ms
Input process image Dynamic, according to the TwinSAFE configuration in TwinCAT3
Output process image Dynamic, according to the TwinSAFE configuration in TwinCAT3
Supply voltage (SELV/PELV) 24VDC (–15%/+20%)
Current consumption approx. 222 mA
Power dissipation of the terminal typically 1 W
Dimensions (W x H x D) 12mm x 66mm x 55mm
Weight approx. 27 g
Permissible ambient temperature (operation) -25°C to +45°C
Permissible ambient temperature (transport/storage) -40°C to +70°C
Permissible air humidity 5% to 95%, non-condensing
Permissible air pressure (operation/storage/transport) 750hPa to 1100hPa
(this corresponds to a height of approx. -690m to 2450m over
sea level assuming an international standard atmosphere)
Climate category according to EN 60721-3-3 3K3
(the deviation from 3K3 is possible only with optimal
environmental conditions and also applies only to the technical
data which are specified differently in this documentation)
Permissible level of contamination according to EN60664-1 level of contamination 2 (comply with the chapter Maintenance)
Impermissible operating conditions TwinSAFE EJ modules must not be used under the following
conditions:
• under the influence of ionizing radiation (that exceeds the
level of the natural environmental radiation)
• in corrosive environments
• in an environment that leads to unacceptable soiling of the
Bus Terminal
Vibration/shock resistance conforms to EN 60068-2-6 / EN 60068-2-27
EMC immunity/emission conforms to EN 61000-6-2 / EN 61000-6-4
Shocks 15 g with pulse duration 11 ms in all three axes
Protection class IP20
Permitted operating environment control cabinet or terminal box with minimum protection class
IP54 according to IEC 60529
Permissible installation position see chapter Installation position and minimum distances [}24]
Approvals CE, TÜV SÜD

Product description
EJ691020 Version: 2.0.0
4.4 Safety parameters
Key figures EJ6910
Lifetime [a] 20
Prooftest Interval [a] not required 1)
PFHD1.81E-09
%SIL3 of PFHD1.81%
PFDavg 2.56E-05
%SIL3 of PFDavg 2.56%
MTTFdhigh
DC high
Performance level PL e
Category 4
HFT 1
Element classification 2) Type B
1. Special proof tests over the whole service life of the EtherCAT EJ6910 module are not required.
2. Classification according to IEC 61508-2:2010 (see chapters 7.4.4.1.2 and 7.4.4.1.3)
The EtherCAT EJ6910 module can be used for safety-related applications as defined in
IEC61508:2010 up to SIL3 and DINENISO13849-1:2016-06 up to Cat4, PLe.
For the calculation or estimation of the MTTFd value from the PFHD value, further information can be found in
the TwinSAFE application manual or in DINENISO13849-1:2016-06 Table K.1.