Beckhoff EP7211-0034 User guide

Application Example
EP7211-0034 - STO Function
1.0.0
2019-11-11
Version:
Date:

Table of contents
EP7211-0034 - STO Function 3Version: 1.0.0
Table of contents
1 Foreword ....................................................................................................................................................5
1.1 Notes on the documentation..............................................................................................................5
1.2 Documentation issue status ..............................................................................................................6
1.3 Purpose and area of application........................................................................................................6
1.4 Explanation of terms..........................................................................................................................7
1.5 Operator's obligation to exercise diligence ........................................................................................7
2 Safety instructions ....................................................................................................................................8
2.1 Delivery state.....................................................................................................................................8
2.2 Operator's obligation to exercise diligence ........................................................................................8
2.3 Description of instructions .................................................................................................................9
3 STO function with EP7211-0034 (category3,PLd)..............................................................................10
3.1 Parameters of the safe input and output terminals..........................................................................11
3.2 Block formation and safety loops.....................................................................................................11
3.2.1 Safety function 1 .............................................................................................................. 11
3.3 Calculation.......................................................................................................................................12
3.3.1 PFHD / MTTFD / B10D – values ..................................................................................... 12
3.3.2 Diagnostic Coverage DC ................................................................................................. 12
3.3.3 Calculation of safety function 1........................................................................................ 12
4 Appendix ..................................................................................................................................................16
4.1 Support and Service ........................................................................................................................16

Table of contents
EP7211-0034 - STO Function4 Version: 1.0.0

Foreword
EP7211-0034 - STO Function 5Version: 1.0.0
1 Foreword
1.1 Notes on the documentation
Intended audience
This description is only intended for the use of trained specialists in control and automation engineering who
are familiar with the applicable national standards.
It is essential that the following notes and explanations are followed when installing and commissioning
these components.
The responsible staff must ensure that the application or use of the products described satisfy all the
requirements for safety, including all the relevant laws, regulations, guidelines and standards.
Origin of the document
This original documentation is written in German. All other languages are derived from the German original.
Currentness
Please check whether you are using the current and valid version of this document. The current version can
be downloaded from the Beckhoff homepage at http://www.beckhoff.com/english/download/twinsafe.htm.
In case of doubt, please contact Technical Support [}16].
Product features
Only the product features specified in the current user documentation are valid. Further information given on
the product pages of the Beckhoff homepage, in emails or in other publications is not authoritative.
Disclaimer
The documentation has been prepared with care. The products described are subject to cyclical revision. For
that reason the documentation is not in every case checked for consistency with performance data,
standards or other characteristics. We reserve the right to revise and change the documentation at any time
and without prior announcement. No claims for the modification of products that have already been supplied
may be made on the basis of the data, diagrams and descriptions in this documentation.
Trademarks
Beckhoff®, TwinCAT®, EtherCAT®, EtherCATG®, EtherCATG10®, EtherCATP®, SafetyoverEtherCAT®,
TwinSAFE®, XFC®, XTS® and XPlanar® are registered trademarks of and licensed by Beckhoff Automation
GmbH. Other designations used in this publication may be trademarks whose use by third parties for their
own purposes could violate the rights of the owners.
Patent Pending
The EtherCAT Technology is covered, including but not limited to the following patent applications and
patents: EP1590927, EP1789857, EP1456722, EP2137893, DE102015105702 with corresponding
applications or registrations in various other countries.

Foreword
EP7211-0034 - STO Function6 Version: 1.0.0
EtherCAT® and Safety over EtherCAT® are registered trademarks and patented technologies, licensed by
Beckhoff Automation GmbH, Germany.
Copyright
© Beckhoff Automation GmbH & Co. KG, Germany.
The reproduction, distribution and utilization of this document as well as the communication of its contents to
others without express authorization are prohibited.
Offenders will be held liable for the payment of damages. All rights reserved in the event of the grant of a
patent, utility model or design.
Delivery conditions
In addition, the general delivery conditions of the company Beckhoff Automation GmbH & Co. KG apply.
1.2 Documentation issue status
Version Comment
1.0.0 • First release version
1.3 Purpose and area of application
The Application Guide provides the user with examples for the calculation of safety parameters for safety
functions according to the standards DINENISO13849-1 and EN62061 or EN61508:2010 (if applicable),
such as are typically used on machines.
In the examples an EL1904 is taken as an example for a safe input or an EL2904 for a safe output. This is to
be considered an example; of course other safe inputs or outputs can be used, such as an EP1908 or an
EL2912. The appropriate parameters, which can be taken from the respective product documentation, must
then be used in the calculation.
NOTE
Application samples
These samples provide the user with example calculations. They do not release him from his duty to carry
out a risk and hazard analysis and to apply the directives, standards and laws that need to be considered
for the application.

Foreword
EP7211-0034 - STO Function 7Version: 1.0.0
1.4 Explanation of terms
Name Explanation
B10DMean number of cycles after 10% of the components have dangerously failed
CCF Failures with a common cause
dop Mean operating time in days per year
DCavg Average diagnostic coverage
hop Mean operating time in hours per day
MTTFDMean time to dangerous failure
nop Mean number of annual actuations
PFHDProbability of a dangerous failure per hour
PL Performance level
PLrRequired Performance Level
Tcycle Mean time between two successive cycles of the system (given in minutes in the following
examples, but can also be given in seconds)
T1 Lifetime of the device (typically 20 years for TwinSAFE devices)
λDDangerous failure rate given in FIT (failure rate in 109 component hours)
T10D Operating time - maximum operating time for electromechanical components, for example
TwinSAFE SC The TwinSAFE SC technology (SC - Single Channel) enables a signal from a standard
terminal to be packaged in a FSoE telegram and transmitted via the standard fieldbus to the
TwinSAFE Logic. As a result, falsifications on the transmission path can be excluded. Within
the TwinSAFE Logic, this signal is checked with a further independent signal. This
comparison result typically yields an analog value corresponding to a category3 and PLd.
This technology does not support digital input signals and cannot be used in a single-
channel structure (only one TwinSAFE SC channel).
1.5 Operator's obligation to exercise diligence
The operator must ensure that
• the TwinSAFE products are only used as intended (see chapter Product description);
• the TwinSAFE products are only operated in sound condition and in working order.
• the TwinSAFE products are operated only by suitably qualified and authorized personnel.
• the personnel is instructed regularly about relevant occupational safety and environmental protection
aspects, and is familiar with the operating instructions and in particular the safety instructions contained
herein.
• the operating instructions are in good condition and complete, and always available for reference at the
location where the TwinSAFE products are used.
• none of the safety and warning notes attached to the TwinSAFE products are removed, and all notes
remain legible.
NOTE
Qualified personnel
For the use of the TwinSAFE components, the personnel must be qualified and take part regularly in train-
ing courses.
Training courses on functional safety can be taken at the corresponding certifying bodies such as the TÜV
or at the responsible employer's liability insurance associations.
Product training courses for the TwinSAFE components can be booked with the Beckhoff Training Depart-
ment.

Safety instructions
EP7211-0034 - STO Function8 Version: 1.0.0
2 Safety instructions
2.1 Delivery state
All the components are supplied in particular hardware and software configurations appropriate for the
application. Modifications to hardware or software configurations other than those described in the
documentation are not permitted, and nullify the liability of Beckhoff Automation GmbH & Co. KG.
2.2 Operator's obligation to exercise diligence
The operator must ensure that
• the TwinSAFE products are only used as intended (see chapter Product description);
• the TwinSAFE products are only operated in sound condition and in working order.
• the TwinSAFE products are operated only by suitably qualified and authorized personnel.
• the personnel is instructed regularly about relevant occupational safety and environmental protection
aspects, and is familiar with the operating instructions and in particular the safety instructions contained
herein.
• the operating instructions are in good condition and complete, and always available for reference at the
location where the TwinSAFE products are used.
• none of the safety and warning notes attached to the TwinSAFE products are removed, and all notes
remain legible.

Safety instructions
EP7211-0034 - STO Function 9Version: 1.0.0
2.3 Description of instructions
In these operating instructions the following instructions are used.
These instructions must be read carefully and followed without fail!
DANGER
Serious risk of injury!
Failure to follow this safety instruction directly endangers the life and health of persons.
WARNING
Risk of injury!
Failure to follow this safety instruction endangers the life and health of persons.
CAUTION
Personal injuries!
Failure to follow this safety instruction can lead to injuries to persons.
NOTE
Damage to the environment/equipment or data loss
Failure to follow this instruction can lead to environmental damage, equipment damage or data loss.
Tip or pointer
This symbol indicates information that contributes to better understanding.

STO function with EP7211-0034 (category3,PLd)
EP7211-0034 - STO Function10 Version: 1.0.0
3 STO function with EP7211-0034
(category3,PLd)
The following application example shows how the EP7211-0034 can be wired together with an EL2904 in
order to implement an STO function according to EN61800-5-2.
A protective door (S1 and S2) and a restart signal (S3) are logically linked on an ESTOP function block. The
EStopOut signal is transferred to the NC controller, which can be used within the functional application. The
STO input of the EP7211-0034 is operated via the delayed output EStopDelOut. Forwarding this signal to
further EP7211-0034 via the second connection is allowed. The EP7211-0034 supplies the information that
the STO function is active via the standard controller. This information is transferred to the EDM input of the
ESTOP function block and additionally to the EDM function block in order to generate an expectation for this
signal.
CAUTION
Implement a restart lock in the machine!
The restart lock is NOT part of the safety chain and must be implemented in the machine!
If the risk analysis returns the result that a restart is to be realized in the safety controller, then the restart
must also be placed on a safe input.