Beckhoff TwinSAFE EL2912 User manual

Operating Instructions | EN
EL2912 and EL2912-2200
TwinSAFE Terminal with 2 digital fail-safe outputs
2023-03-08 | Version: 2.0.0

Table of contents
EL2912 and EL2912-2200 3Version: 2.0.0
Table of contents
1 Notes on the documentation....................................................................................................................5
1.1 Disclaimer..........................................................................................................................................5
1.1.1 Trademarks........................................................................................................................5
1.1.2 Patents...............................................................................................................................5
1.1.3 Limitation of liability............................................................................................................6
1.1.4 Copyright............................................................................................................................6
1.2 Documentation issue status ..............................................................................................................7
1.3 Version history of the TwinSAFE product .........................................................................................7
1.4 Staff qualification...............................................................................................................................7
1.5 Safety and instruction........................................................................................................................9
1.5.1 Explanation of symbols ......................................................................................................9
1.6 Beckhoff Support and Service.........................................................................................................10
2 For your safety ........................................................................................................................................11
2.1 Duty of care.....................................................................................................................................11
2.2 Safety image signs..........................................................................................................................12
2.3 General safety instructions..............................................................................................................13
2.3.1 Before operation...............................................................................................................13
2.3.2 In operation ......................................................................................................................13
2.3.3 After operation..................................................................................................................13
3 System description .................................................................................................................................14
3.1 The Beckhoff EtherCAT Terminal system.......................................................................................14
3.1.1 EtherCAT Bus Coupler.....................................................................................................15
3.1.2 EtherCAT Terminals.........................................................................................................16
3.1.3 E-bus................................................................................................................................17
3.1.4 Power contacts.................................................................................................................17
3.2 TwinSAFE .......................................................................................................................................17
3.2.1 The I/O construction kit is extended safely ......................................................................17
3.2.2 Safety concept .................................................................................................................17
3.2.3 The fail-safe principle (Fail Stop) .....................................................................................18
4 Product description ................................................................................................................................19
4.1 EL2912 and EL2912-2200 ..............................................................................................................19
4.2 Intended use ...................................................................................................................................20
4.3 Technical data.................................................................................................................................22
4.4 Safety parameters...........................................................................................................................24
4.5 Safe output......................................................................................................................................25
4.6 Fuse ................................................................................................................................................25
4.7 Dimensions .....................................................................................................................................25
4.8 EL2912: using the integrated TwinSAFE Logic functions ...............................................................26
4.8.1 Project design limits for the EL2912.................................................................................26
5 Operation .................................................................................................................................................28
5.1 Environmental conditions ................................................................................................................28
5.2 Installation .......................................................................................................................................28
5.2.1 Safety instructions............................................................................................................28

Table of contents
EL2912 and EL2912-22004 Version: 2.0.0
5.2.2 Transport / storage...........................................................................................................28
5.2.3 Mechanical installation.....................................................................................................28
5.2.4 Electrical installation.........................................................................................................34
5.3 Configuration of the terminal in TwinCAT .......................................................................................39
5.3.1 Inserting a Bus Coupler....................................................................................................39
5.3.2 Inserting a Bus Terminal ..................................................................................................39
5.3.3 Adding an EL2912............................................................................................................39
5.3.4 Address settings on TwinSAFE terminals with 1023 possible addresses........................40
5.3.5 Alias devices ....................................................................................................................41
5.3.6 EL2912 parameters in TwinCAT......................................................................................42
5.3.7 EL2912 process image ....................................................................................................44
5.4 TwinSAFE reaction times................................................................................................................44
5.5 Diagnostics......................................................................................................................................46
5.5.1 Status LEDs .....................................................................................................................46
5.5.2 Diagnostic LEDs...............................................................................................................46
5.5.3 Flash code display ...........................................................................................................47
5.5.4 Diagnostic objects............................................................................................................47
5.5.5 Cycle time of the safety project........................................................................................49
5.5.6 Diagnosis History .............................................................................................................49
5.5.7 Diag History tab................................................................................................................52
6 Service life ...............................................................................................................................................54
7 Maintenance and cleaning .....................................................................................................................55
8 Decommissioning ...................................................................................................................................56
8.1 Disposal ..........................................................................................................................................56
8.1.1 Returning to the vendor....................................................................................................56
9 Appendix..................................................................................................................................................57
9.1 Volatility...........................................................................................................................................57
9.2 Focus of certificates ........................................................................................................................58
9.3 Certificate ........................................................................................................................................59

Notes on the documentation
EL2912 and EL2912-2200 5Version: 2.0.0
1 Notes on the documentation
1.1 Disclaimer
Beckhoff products are subject to continuous further development. We reserve the right to revise the
operating instructions at any time and without prior announcement. No claims for the modification of products
that have already been supplied may be made on the basis of the data, diagrams and descriptions in these
operating instructions.
In these operating instructions we define all permissible use cases whose properties and operating
conditions we can guarantee. The use cases we define are fully tested and certified. Use cases beyond this,
which are not described in these operating instructions, require the approval of Beckhoff Automation GmbH
& Co KG.
1.1.1 Trademarks
Beckhoff®, TwinCAT®, EtherCAT®, EtherCAT G®, EtherCAT G10®, EtherCAT P®, Safety over EtherCAT®,
TwinSAFE®, XFC®, XTS® and XPlanar® are registered and licensed trademarks of Beckhoff Automation
GmbH.
The use of other brand names or designations by third parties may lead to an infringement of the rights of
the owners of the corresponding designations.
1.1.2 Patents
The EtherCAT technology is protected by patent rights through the following registrations and patents with
corresponding applications and registrations in various other countries:
• EP1590927
• EP1789857
• EP1456722
• EP2137893
• DE102015105702
EtherCAT® is a registered trademark and patented technology,
licensed by Beckhoff Automation GmbH.
Safety over EtherCAT® is a registered trademark and patented
technology, licensed by Beckhoff Automation GmbH.

Notes on the documentation
EL2912 and EL2912-22006 Version: 2.0.0
1.1.3 Limitation of liability
All components in this product as described in the operating instructions are delivered in a specific
configuration of hardware and software, depending on the application regulations. Modifications and
changes to the hardware and/or software configuration that go beyond the documented options are
prohibited and nullify the liability of Beckhoff Automation GmbH & Co. KG.
The following is excluded from the liability:
• Failure to observe these operating instructions
• Improper use
• Use of untrained personnel
• Use of unauthorized spare parts
1.1.4 Copyright
© Beckhoff Automation GmbH & Co. KG, Germany.
The distribution and reproduction of this document as well as the use and communication of its contents
without express authorization are prohibited.
Offenders will be held liable for the payment of damages. All rights reserved in the event of the grant of a
patent, utility model or design.

Notes on the documentation
EL2912 and EL2912-2200 7Version: 2.0.0
1.2 Documentation issue status
Version Comment
2.0.0 • Foreword changed to Notes on the documentation [}5] and For your safety [}11]
•Service life [}54] moved
•Maintenance and cleaning [}55] and Decommissioning [}56] adapted
• Appendix adapted and expanded
1.1.1 • Typo in Technical data [}22] corrected
1.1.0 • In chapter Technical data [}22] link to download page of certificates added
• Chapter "Firmware update of TwinSAFE products" removed
• I/O component EL2912-2200 added as variant of EL2912
• Chapter Connection [}36] renamed
• Chapter Project design limits for the EL2912 [}26] moved
• Figure labels edited
1.0.0 • First release of the documentation
Currentness
Please check whether you are using the current and valid version of this document. The current version can
be downloaded from the Beckhoff homepage at http://www.beckhoff.de/twinsafe. In case of doubt, please
contact Technical Support (see Beckhoff Support and Service [}10]).
Origin of the document
The original documentation is written in German. All other languages are derived from the German original.
Product features
Only the product properties specified in the current operating instructions are valid. Further information given
on the product pages of the Beckhoff homepage, in emails or in other publications is not authoritative.
1.3 Version history of the TwinSAFE product
This version history lists the software and hardware version numbers. A description of the changes
compared to the previous version is also given.
Updated hardware and software
TwinSAFE products are subject to a cyclical revision. We reserve the right to revise and change the
TwinSAFE products at any time and without prior notice.
No claims for changes to products already delivered can be asserted from these hardware and/or
software changes.
Date Software ver-
sion
Hardware
version
Modifications
First release of the EL2912-2200
24/07/2019 01(V01.04) 00 First release of the EL2912
1.4 Staff qualification
These operating instructions are intended exclusively for trained specialists in control technology and
automation with the relevant knowledge.

Notes on the documentation
EL2912 and EL2912-22008 Version: 2.0.0
The trained specialist personnel must ensure that the applications and use of the described product meet all
safety requirements. This includes all applicable and valid laws, regulations, provisions and standards.
Trained specialists
Trained specialists have extensive technical knowledge from studies, apprenticeships or technical training.
Understanding of control technology and automation is available. Trained specialists can:
• Independently identify, avoid and eliminate sources of hazard.
• Apply relevant standards and directives.
• Implement specifications from accident prevention regulations.
• Evaluate, prepare and set up the workplaces.
• Evaluate, optimize and execute work independently.

Notes on the documentation
EL2912 and EL2912-2200 9Version: 2.0.0
1.5 Safety and instruction
Read the contents that refer to the activities you have to perform with the product. Always read the chapter
For your safety [}11] in the operating instructions.
Observe the warnings in the chapters so that you can handle and work with the product as intended and
safely.
1.5.1 Explanation of symbols
Various symbols are used for a clear arrangement:
1. The numbering indicates an action that should be taken.
• The bullet point indicates an enumeration.
[…] The square brackets indicate cross-references to other text passages in the document.
[1] The number in square brackets indicates the numbering of a referenced document.
1.5.1.1 Pictograms
In order to make it easier for you to find text passages, pictograms and signal words are used in warning
notices:
DANGER
Failure to observe will result in serious or fatal injuries.
WARNING
Failure to observe may result in serious or fatal injuries.
CAUTION
Failure to observe may result in minor or moderate injuries.
NOTE
Notes
Notes are used for important information on the product. The possible consequences of failure to observe
these include:
• Malfunctions of the product
• Damage to the product
• Damage to the environment
Information
This sign indicates information, tips and notes for dealing with the product or the software.

Notes on the documentation
EL2912 and EL2912-220010 Version: 2.0.0
1.6 Beckhoff Support and Service
Support
Beckhoff Support offers technical advice on the use of individual Beckhoff products and system planning.
The employees support you in the programming and commissioning of sophisticated automation systems.
Hotline: [phone]
E-mail: [email protected]
Web: www.beckhoff.com/support
Training
Training in Germany takes place in our training center at the Beckhoff headquarters in Verl, at subsidiaries
or, by arrangement, at the customer's premises.
Hotline: [phone]
E-mail: [email protected]
Web: www.beckhoff.com/training
Service
The Beckhoff Service Center supports you with after-sales services such as on-site service, repair service or
spare parts service.
Hotline: [phone]
E-mail: [email protected]
Web: www.beckhoff.com/service
Download area
In the download area you can obtain product information, software updates, the TwinCAT automation
software, documentation and much more.
Web: www.beckhoff.com/download
Headquarters
Beckhoff Automation GmbH & Co. KG
Hülshorstweg 20
33415 Verl
Germany
Phone: [phone]
E-mail: [email protected]
Web: www.beckhoff.com
For the addresses of our worldwide locations, please visit our website at Global Presence.

For your safety
EL2912 and EL2912-2200 11Version: 2.0.0
2 For your safety
Read this chapter containing general safety information. In addition, always observe the safety instructions
and warnings in these operating instructions for your own safety, the safety of other persons and the safety
of the product.
When working with control and automation products, many dangers can result from careless or incorrect use.
Work particularly thoroughly, not under time pressure and responsibly towards other people.
2.1 Duty of care
Read entire documentation for TwinSAFE component
• TwinSAFE application manual
• EL6910 TwinSAFE logic terminal operating manual
• TwinSAFE Logic FB documentation manual
The operator must comply with all the requirements and notes specified in these operating instructions in
order to fulfill his duty of care. This includes in particular that you
• comply with the provisions defined in the chapter Limitation of liability [}6].
• only operate the TwinSAFE component when it is in perfect working order.
• provide the operating instructions in a legible condition and complete at the place of use of the
TwinSAFE component.
• do not remove the safety markings attached to the TwinSAFE component and maintain their legibility.
No disposal in domestic waste
Products marked with a crossed-out waste bin must not be disposed of with domestic
waste. The device is considered waste electrical and electronic equipment when it is
disposed of. Observe the national regulations for the disposal of waste electrical and
electronic equipment.

For your safety
EL2912 and EL2912-220012 Version: 2.0.0
2.2 Safety image signs
On Beckhoff products you will find attached or lasered safety pictograms, which vary depending on the
product. They serve to serve to ensure safety for people and to prevent damage to the products. Safety
pictograms must not be removed and must be legible for the user.
Read and observe the operating instructions
Commissioning is only permitted if the operating instructions have been read and understood
beforehand. This applies in particular to the safety instructions and warnings.
Electrostatic sensitive components
Work with and on the TwinSAFE component is only permitted in protected workplaces.

For your safety
EL2912 and EL2912-2200 13Version: 2.0.0
2.3 General safety instructions
2.3.1 Before operation
Use in machines according to the Machinery Directive
Only use the TwinSAFE component in machines that comply with the Machinery Directive. This is how you
ensure safe operation.
Ensure traceability
Ensure the traceability of the TwinSAFE component via the serial number.
Use SELV/PELV power supply
Use a SELV/PELV power supply unit with an output-side voltage limit of Umax = 36VDC to supply the
TwinSAFE component with 24VDC.
Failure to observe this will endanger the safety function of the product. Depending on the machine, death
and danger to life, serious physical injury and damage to the machine may result.
Carry out commissioning test
Before commissioning, wiring faults to the sensors must be excluded. Before commissioning, carry out a
commissioning test. After a successful commissioning test, you can use the TwinSAFE component for the
intended safety-related task.
In case of wiring errors, the safety function of the product is at risk. Depending on the machine, death and
danger to life, serious bodily injury and damage to the machine may result.
Use permitted engineering tools and procedures
The TÜV SÜD certificate applies to the TwinSAFE component, the function blocks available in it, the
documentation and the engineering tool. TwinCAT 3.1 and the TwinSAFE Loader are permitted as
engineering tools.
Procedures or engineering tools deviating from this are not covered by the certificate. This applies in
particular to externally generated xml files for the TwinSAFE import.
2.3.2 In operation
Interference due to emitted interference
Do not operate the following devices in the vicinity of the TwinSAFE component: for example, radio
telephones, radios, transmitters or high-frequency systems.
TwinSAFE components comply with the requirements of the applicable electromagnetic compatibility
standards with regard to interference emission and immunity. If you exceed the limits for emitted interference
specified in the standards, the function of the TwinSAFE component may be impaired.
2.3.3 After operation
De-energize and switch off components before working on them
Check all safety-relevant equipment for functionality before working on the TwinSAFE component. Secure
the working environment. Secure the machine or plant against being inadvertently started up. Observe the
chapter Decommissioning [}56].

System description
EL2912 and EL2912-220014 Version: 2.0.0
3 System description
3.1 The Beckhoff EtherCAT Terminal system
The Beckhoff EtherCAT Terminal system is used for decentralized connection of sensors and actuators to a
controller. The components of the Beckhoff EtherCAT Terminal system are mainly used in industrial
automation and building management systems. As a minimum, a bus station consists of an EtherCAT
Coupler and connected EtherCAT Terminals. The EtherCAT Coupler forms the communication interface to
the higher-level controller, while the EtherCAT Terminals form the interface to the sensors and actuators.
The whole bus station is clipped onto a 35mm DIN mounting rail (EN 60715). The mechanical link of the bus
station is established with a slot and key system on EtherCAT Couplers and EtherCAT Terminals.
The sensors and actuators are connected with the terminals via the screwless (spring-loaded) connection
system.
Fig.1: Slot and key system and screwless (spring-loaded) connection system

System description
EL2912 and EL2912-2200 15Version: 2.0.0
3.1.1 EtherCAT Bus Coupler
Mechanical data Bus Coupler
Material polycarbonate, polyamide (PA6.6).
Dimensions (W x H x D) 44mm x 100mm x 68mm
Mounting on 35 mm mounting rail (EN60715) with locking
Attachable by double slot and key connection
Fig.2: Bus Coupler (EtherCAT)
Connection technology Bus Coupler
Wiring Spring-loaded system
Connection cross-section 0.08mm² ... 2.5mm², stranded wire, solid wire
Fieldbus connection EtherCAT
Power contacts 3 spring contacts
Current load 10A
Nominal voltage 24VDC

System description
EL2912 and EL2912-220016 Version: 2.0.0
3.1.2 EtherCAT Terminals
Mechanical data Bus Terminal
Material polycarbonate, polyamide (PA6.6).
Dimensions (W x H x D) 12mm x 100mm x 68mm or 24mm x 100mm x 68mm
Mounting on 35 mm mounting rail (EN60715) with locking
Attachable by double slot and key connection
Fig.3: Overview of EtherCAT Terminals
Connection technology Bus Terminal
Wiring Spring-loaded system
Connection cross-section typically 0.08mm² – 2.5mm², stranded wire, solid wire
Communication E-bus
Power contacts Up to 3 blade/spring contacts
Current load 10A
Nominal voltage Depending on terminal type (typically 24 VDC)

System description
EL2912 and EL2912-2200 17Version: 2.0.0
3.1.3 E-bus
The E-bus is the data path within a terminal strip. The E-bus is led through from the Bus Coupler through all
the terminals via six contacts on the terminals' side walls.
3.1.4 Power contacts
The operating voltage is passed on to following terminals via three power contacts. Terminal strip can be
split into galvanically isolated groups by means of potential supply terminals as required. The supply
terminals play no part in the control of the terminals, and can be inserted at any locations within the terminal
strip.
3.2 TwinSAFE
3.2.1 The I/O construction kit is extended safely
The integrated TwinSAFE safety solution is the logical continuation of the open, PC-based Beckhoff control
philosophy. Due to their modularity and versatility, the TwinSAFE components fit seamlessly into the
Beckhoff control system. The I/O components are available in the formats Bus Terminal, EtherCAT Terminal,
EtherCAT plug-in module and EtherCAT Box.
Thanks to the fieldbus-neutral safety protocol (TwinSAFE/Safety-over-EtherCAT), TwinSAFE devices can be
integrated into any fieldbus system. They are integrated into existing networks with K-bus or EtherCAT and
can be used directly in the machine as IP67 modules. These safety I/Os form the interfaces to the safety-
relevant sensors and actuators.
The possibility to transmit the safety-relevant signals over a standard bus system gives rise to substantial
advantages in terms of planning, installation, operation, maintenance, diagnostics and costs.
The safety application is configured or programmed respectively in the TwinCAT software. This application is
then transferred via the bus to a TwinSAFE logic component. These form the heart of the TwinSAFE system.
All safety devices in the system communicate with this logic component. Due to the enormous flexibility of
the system, several TwinSAFE logic components can also be operated simultaneously in a network.
3.2.2 Safety concept
TwinSAFE: Safety and I/O technology in one system
• Extension of the familiar Beckhoff I/O system with TwinSAFE Terminals
• Freely selectable mix of safe and standard signals
• Logic link of the I/Os in the TwinSAFE logic component, e.g. EL6910
• Safety-relevant networking of machines via bus systems
TwinSAFE protocol (FSoE / Safety-over-EtherCAT)
• Transfer of safety-relevant data via any media (“genuine black channel”)
• TwinSAFE communication via fieldbus systems such as EtherCAT, Lightbus, PROFIBUS or Ethernet
• IEC 61508:2010 SIL 3 compliant
TwinCAT software and TwinSAFE editor
• Safety application is configured or programmed in the TwinCAT software
• Certified function blocks such as emergency stop, operation mode, etc.
• simple handling
• Transfer of the application via the bus to the TwinSAFE logic component

System description
EL2912 and EL2912-220018 Version: 2.0.0
TwinSAFE logic component, e.g. EL6910
• Processing of the safety-related application and communication with the TwinSAFE terminals
• No safety requirements for higher-level control system
• TwinSAFE enables a network with up to 65,535 TwinSAFE components.
• TwinSAFE logic component can establish up to 512 connections (TwinSAFE connections).
• Several TwinSAFE logic components can be operated in a network
• Suitable for applications up to SIL 3 according to IEC 61508:2010 and category 4 / PL e according to
ENISO13849-1:2015.
TwinSAFE I/O components
• The TwinSAFE I/O components are available in the formats Bus Terminal, EtherCAT Terminal,
EtherCAT plug-in module, EtherCAT Box and TwinSAFE Drive option card
• All common safety sensors and actuators can be connected
• Operation with a TwinSAFE logic component
• Typically meet the requirements of IEC 61508:2010 up to SIL 3 and ENISO13849-1:2015 up to
Category 4, PLe. More detailed information can be found in the respective user documentation
3.2.3 The fail-safe principle (Fail Stop)
The basic rule for a safety system such as TwinSAFE is that failure of a part, a system component or the
overall system must never lead to a dangerous condition.
CAUTION
Safe state!
The safe state of the TwinSAFE system is always the switched-off and de-energized state.

Product description
EL2912 and EL2912-2200 19Version: 2.0.0
4 Product description
4.1 EL2912 and EL2912-2200
The EL2912 is a safe output terminal with two fail-safe outputs, each with 2A (24VDC).
The EL2912 meets the requirements of the following standards:
• EN61508:2010(SIL 3)
• EN62061:2005/A2:2015(SILCL3)
• ENISO13849-1:2015(Cat.4,PLe).
The TwinSAFE terminal has the typical design of a 12mm EtherCAT Terminal. The outputs use the voltage
of the power contacts. In addition, the voltage of the power contacts is applied to terminal points 2/6 and 3/7.
The terminal points GND1, GND2 and GND UP (terminal points 3/7) are directly connected internally.
Fig.4: EL2912 - TwinSAFE terminal with two fail-safe outputs
EL2912 variants
The EL2912 has an integrated safety control that can be used for user-specific applications directly
on the component. The variant EL2912-2200 does not have this functionality and represents a pure
I/O component.

Product description
EL2912 and EL2912-220020 Version: 2.0.0
4.2 Intended use
WARNING
Caution - Risk of injury!
TwinSAFE components may only be used for the purposes described below!
The TwinSAFE Terminals expand the application area of Beckhoff Bus Terminal system with functions that
enable them to be used for machine safety applications. The TwinSAFE Terminals are designed for machine
safety functions and directly associated industrial automation tasks. They are therefore only approved for
applications with a defined fail-safe state. This safe state is the switched-off and de-energized state. Fail-
safety according to the relevant standards is required.
The TwinSAFE I/O components allow the connection of:
• 24VDC sensors such as
emergency stop push-buttons, rope pull switches, position switches, two-hand switches, safety
switching mats, light curtains, light barriers, laser scanners, etc.
• 24VDC actuators such as
contactors, protective door switches with tumbler, signal lamps, servo drives, etc.
Test pulses
When selecting actuators please ensure that the test pulses of the TwinSAFE component do not
lead to switching of the actuator or a diagnostic message of the TwinSAFE component.
The following TwinSAFE components were developed for these tasks:
• The EL1904 is an EtherCAT Terminal with 4 digital fail-safe inputs
• The EL2904 is an EtherCAT Terminal with 4 digital fail-safe outputs
• The EL6910 is an EtherCAT Terminal with integrated TwinSAFE logic
These TwinSAFE components are suitable for operation on the
• Beckhoff EKxxxx series Bus Couplers
• Beckhoff CXxxxx series Embedded PCs with E-bus connection
WARNING
System limits
The TÜV SÜD certificate applies to this TwinSAFE component, the function blocks available in it, the
documentation and the engineering tool. TwinCAT 3.1 and the TwinSAFE Loader are permitted as
engineering tools. Any deviations from these procedures or tools, particularly externally generated xml files
for TwinSAFE import or externally generated automatic project creation procedures, are not covered by the
certificate.
WARNING
Power supply from SELV/PELV power supply unit!
The TwinSAFE components must be supplied with 24VDC by an SELV/PELV power supply unit with an
output voltage limit Umax of 36VDC. Failure to observe this can result in a loss of safety.
WARNING
Commissioning test
Before the EL2912 can be used for safety-related tasks, a commissioning test must be carried out by the
user so that faulty sensor wiring can be ruled out.