Mitsubishi Electric MELSEC iQ-R Series Installation and operating manual

MELSEC iQ-R
Safety Application Guide

1
SAFETY PRECAUTIONS
(Read these precautions before using this product.)
Before using MELSEC iQ-R series programmable controllers, please read the manuals for the product and the relevant
manuals introduced in those manuals carefully, and pay full attention to safety to handle the product correctly.
In this manual, the safety precautions are classified into two levels: " WARNING" and " CAUTION".
Under some circumstances, failure to observe the precautions given under " CAUTION" may lead to serious
consequences.
Observe the precautions of both levels because they are important for personal and system safety.
Make sure that the end users read this manual and then keep the manual in a safe place for future reference.
[Design Precautions]
WARNING
●When the safety programmable controller detects a fault in the external power supply or itself, it turns
off all outputs in the safety system. Configure an external circuit to ensure that the power source of a
hazard is shut off by turning off the outputs. Failure to do so may result in an accident.
●Configure short current protection circuits for safety relays and protection circuits, such as a fuse and
breaker, external to the safety programmable controller.
●When a load current exceeding the rated current or an overcurrent caused by a load short-circuit
flows, the safety remote I/O module detects an error and turns off all outputs. Note that if the
overcurrent state continues for a long time, it may cause smoke and fire. To prevent this, configure an
external safety circuit, such as a fuse.
●When changing data and operating status, and modifying program of the running safety
programmable controller from an external device such as a personal computer connected to the
Safety CPU, configure an interlock circuit in the program or external to the safety programmable
controller to ensure that the entire system always operates safely. In addition, before performing
online operations, determine corrective actions to be taken between the external device and Safety
CPU in case of a communication failure due to poor contact of cables.
●Do not use any "use prohibited" signals as a remote I/O signal since they are used by the system. Do
not write any data to the "use prohibited" areas in the remote register. For the "use prohibited" signals,
refer to the MELSEC iQ-R CC-Link IE Field Network User's Manual (Application). Do not turn on or off
these signals on a program since normal operations cannot be guaranteed. Doing so may cause
malfunction of the programmable controller system.
●When the CC-Link IE Field Network remote I/O module (with safety functions) detects a CC-Link IE
Field Network error, it turns off outputs. However, the program does not automatically turn off outputs.
Create a program that turns off outputs when a CC-Link IE Field Network error is detected. If CC-Link
IE Field Network is restored with outputs on, connected machines may suddenly operate, resulting in
an accident.
●Create an interlock circuit which uses reset buttons so that the system does not restart automatically
after executing safety functions and turning off outputs.
WARNING Indicates that incorrect handling may cause hazardous conditions, resulting in
death or severe injury.
CAUTION Indicates that incorrect handling may cause hazardous conditions, resulting in
minor or moderate injury or property damage.

2
[Design Precautions]
[Design Precautions]
[Installation Precautions]
WARNING
●In the case of a communication failure in the network, the status of the error station will be as follows:
(1) All inputs from remote I/O stations are turned off.
(2) All outputs from remote I/O stations are turned off.
Check the communication status information and configure an interlock circuit in the program to
ensure that the entire system will operate safely. Failure to do so may result in an accident due to an
incorrect output or malfunction.
●Outputs may remain on or off due to a failure of the CC-Link IE Field Network remote I/O module (with
safety functions). Configure an external circuit for monitoring output signals that could cause a serious
accident.
CAUTION
●Do not install the wiring for external devices or communication cables together with the main circuit
lines or power cables. Keep a distance of 100mm or more between them. Failure to do so may result
in malfunction due to noise.
●When selecting external devices to be connected to the CC-Link IE Field Network remote I/O module
(with safety functions), consider the maximum inrush current described in the CC-Link IE Field
Network Remote I/O Module (With Safety Functions) User's Manual.
WARNING
●Shut off the external power supply (all phases) used in the system before mounting or removing a
safety programmable controller. Failure to do so may result in electric shock or cause the module to
fail or malfunction.

3
[Installation Precautions]
CAUTION
●Use each module mounted on a base unit with a safety programmable controller in an environment
that meets the general specifications in the MELSEC iQ-R Module Configuration Manual. Use the
safety remote I/O module and standard remote I/O module in an environment that meets the general
specifications in the corresponding manuals (CC-Link IE Field Network Remote I/O Module (With
Safety Functions) User's Manual and CC-Link IE Field Network Remote I/O Module User's Manual).
Failure to do so may result in electric shock, fire, malfunction, or damage to or deterioration of the
product.
●Fix the module and base unit with a screw. Tighten the screws within the specified torque range.
Undertightening can cause drop of the screw, short circuit, or malfunction. Overtightening can
damage the screw and/or module, resulting in drop, short circuit, or malfunction.
●Securely fix the safety remote I/O module and standard remote I/O module with a DIN rail or module
fixing screws. Tighten the screws within the specified torque range. Undertightening can cause drop
of the screw, short circuit, or malfunction. Overtightening can damage the screw and/or module,
resulting in drop, short circuit, or malfunction.
●Do not directly touch any conductive parts and electronic components of the module. Doing so can
cause malfunction or failure of the module.
●Connect the connector of each cable to the installing part securely. Poor contact may cause
malfunction.

4
[Wiring Precautions]
[Wiring Precautions]
WARNING
●Shut off the external power supply (all phases) used in the system before wiring.
Failure to do so may result in electric shock or cause the module to fail or malfunction.
●After installation and wiring, attach the included terminal cover to the module before turning it on for
operation. Failure to do so may result in electric shock.
CAUTION
●Individually ground the FG and LG terminals of the programmable controller with a ground resistance
of 100 ohms or less. Failure to do so may result in electric shock or malfunction.
●For terminal block wiring, use solderless terminals with an insulation sleeve. Do not connect more
than two solderless terminals to a terminal.
●Use applicable solderless terminals and tighten them within the specified torque range. If any spade
solderless terminal is used, it may be disconnected when the terminal screw comes loose, resulting in
failure.
●Check the rated voltage and terminal layout before wiring to the module, and connect the cables
correctly. Connecting a power supply with a different voltage rating or incorrect wiring may cause a fire
or failure.
●Tighten a terminal block mounting screw, terminal screw, and module fixing screw within the specified
torque range. If the terminal block mounting screw or terminal screw is too loose, it may cause a short
circuit, fire, or malfunctions. If too tight, it may damage the screw and/or the module, resulting in a
drop of the screw or module, a short circuit or malfunctions. If the module fixing screw is too loose, it
may cause a drop of the screw or module. Overtightening the screw may cause a drop due to the
damage of the screw or module.
●For the wire strip length, meet the specifications in a manual. The wire strip length is too long, it may
cause the electric shock and short circuit between terminals due to spreading out the conductive part
to the front of terminal block. The wire strip length is too short, it may cause the poor contact for the
spring clamp terminal block.
●Observe the following precautions when the spring clamp terminal block tool is used. Failure to do so
may cause the damage of the spring clamp terminal block or terminal block resin part.
(1) Use the dedicated spring clamp terminal block tool.
(2) Insert the spring clamp terminal block tool to the tool insertion opening vertically.
●Prevent foreign matter such as dust or wire chips from entering the module. Such foreign matter can
cause a fire, failure, or malfunction.
●A protective film is attached to the top of the module to prevent foreign matter, such as wire chips,
from entering the module during wiring. Do not remove the film during wiring. Remove it for heat
dissipation before system operation.
●Place the cables in a duct or clamp them. If not, dangling cable may swing or inadvertently be pulled,
resulting in damage to the module or cables or malfunction due to poor contact.
●When disconnecting the cable from the module, do not pull the cable by the cable part. For the cable
connected to the terminal block, loosen the terminal screw. Pulling the cable connected to the module
may result in malfunction or damage to the module or cable.

5
[Wiring Precautions]
[Startup and Maintenance Precautions]
CAUTION
●Do not install the control lines or communication cables together with the main circuit lines or power
cables. Failure to do so may result in malfunction due to noise.
●When an overcurrent caused by a failure of an external device or a module flows for a long time, it
may cause smoke and fire. To prevent this, configure an external safety circuit, such as a fuse.
●Programmable controllers must be installed in control panels. Connect the main power supply to the
power supply module in the control panel through a relay terminal block. Wiring and replacement of a
power supply module must be performed by qualified maintenance personnel with knowledge of
protection against electric shock. For wiring, refer to the MELSEC iQ-R Module Configuration Manual.
●For Ethernet cables to be used in the system, select the ones that meet the specifications in the
MELSEC iQ-R Ethernet/CC-Link IE User's Manual (Startup). If not, normal data transmission is not
guaranteed.
WARNING
●Do not touch any terminal while power is on. Doing so may lead to the electric shock.
●Correctly connect the battery connector. Do not charge, disassemble, heat, short-circuit, solder, or
throw the battery into the fire. Also, do not expose it to liquid or strong shock. Doing so will cause the
battery to produce heat, explode, ignite, or leak, resulting in injury and fire.
●Shut off the external power supply (all phases) used in the system before cleaning the module or
retightening the terminal block mounting screws, terminal screws, or module fixing screws. Failure to
do so may result in electric shock. Tighten the terminal block screws or connector screws within the
specified torque range. If the terminal block mounting screw or terminal screw is too loose, it may
cause a short circuit, fire, or malfunctions. If too tight, it may damage the screw and/or the module,
resulting in a drop of the screw or module, a short circuit or malfunctions. If the module fixing screw is
too loose, it may cause a drop of the screw or module. Overtightening the screw may cause a drop
due to the damage of the screw or module.

6
[Startup and Maintenance Precautions]
[Disposal Precautions]
[Transportation Precautions]
CAUTION
●The online operations performed from a PC to a running safety programmable controller (Program
change when a safety CPU module is RUN, device test, and operating status change such as
RUNSTOP switching) have to be executed after the manual has been carefully read and the safety
has been ensured. Following the operating procedure predetermined at designing, the operation has
to be performed by an instructed person. When changing a program while a safety CPU module is
RUN (Write during RUN), it may cause a program breakdown in some operating conditions. Fully
understand the precautions described in the GX Works3 Operating Manual before use.
●Do not disassemble or modify the module. Doing so may cause failure, malfunction, injury, or a fire.
●Use any radio communication device such as a cellular phone or PHS (Personal Handy-phone
System) more than 25cm away in all directions from the module. Failure to do so may cause
malfunction.
●Shut off the external power supply (all phases) used with the safety programmable controller before
mounting or removing the module. Failure to do so may cause the module to fail or malfunction.
●Restrict the mounting/removal of a module, base unit, and terminal block up to 50 times (IEC 61131-2
compliant), after the first use of the product. Exceeding the limit may cause malfunction.
●Do not drop or apply shock to the battery to be installed in the module. Doing so may damage the
battery, causing the battery fluid to leak inside the battery. If the battery is dropped or any shock is
applied to it, dispose of it without using.
●Before handling the module, touch a conducting object such as a grounded metal to discharge the
static electricity from the human body. Failure to do so may cause the module to fail or malfunction.
●Since the module case is made of resin, do not drop or apply any strong impact to the module. Doing
so may damage the module.
●Shut off the external power supply (all phases) used in the system before mounting or removing a
module. Failure to do so may cause the module to fail or malfunction.
CAUTION
●When disposing of this product, treat it as industrial waste.
●When disposing of batteries, separate them from other wastes according to the local regulations. For
details on battery regulations in EU member states, refer to the MELSEC iQ-R Module Configuration
Manual.
CAUTION
●When transporting lithium batteries, follow the transportation regulations. For details on the regulated
models, refer to the MELSEC iQ-R Module Configuration Manual.
●The halogens (such as fluorine, chlorine, bromine, and iodine), which are contained in a fumigant
used for disinfection and pest control of wood packaging materials, may cause failure of the product.
Prevent the entry of fumigant residues into the product or consider other methods (such as heat
treatment) instead of fumigation. The disinfection and pest control measures must be applied to
unprocessed raw wood.

7
CONDITIONS OF USE FOR THE PRODUCT
INTRODUCTION
Thank you for purchasing the Mitsubishi Electric MELSEC iQ-R series programmable controllers.
This manual describes the points to be concerned when configuring safety application that meets the safety standards using
the safety programmable controller.
Before using this product, please read this manual and the relevant manuals carefully and develop familiarity with the
functions and performance of the MELSEC iQ-R series programmable controller to handle the product correctly.
When applying the program and circuit examples provided in this manual to an actual system, ensure the applicability and
confirm that it will not cause system control problems.
Please make sure that the end users read this manual.
(1) Although MELCO has obtained the certification for Product's compliance to the international safety standards
IEC61508, EN954-1/ISO13849-1 from TUV Rheinland, this fact does not guarantee that Product will be free from any
malfunction or failure. The user of this Product shall comply with any and all applicable safety standard, regulation or
law and take appropriate safety measures for the system in which the Product is installed or used and shall take the
second or third safety measures other than the Product. MELCO is not liable for damages that could have been
prevented by compliance with any applicable safety standard, regulation or law.
(2) MELCO prohibits the use of Products with or in any application involving, and MELCO shall not be liable for a default, a
liability for defect warranty, a quality assurance, negligence or other tort and a product liability in these applications.
(a) power plants,
(b) trains, railway systems, airplanes, airline operations, other transportation systems,
(c) hospitals, medical care, dialysis and life support facilities or equipment,
(d) amusement equipments,
(e) incineration and fuel devices,
(f) handling of nuclear or hazardous materials or chemicals,
(g) mining and drilling,
(h) and other applications where the level of risk to human life, health or property are elevated.

8
CONTENTS
SAFETY PRECAUTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1
CONDITIONS OF USE FOR THE PRODUCT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
INTRODUCTION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
RELEVANT MANUALS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
TERMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
HOW TO USE THIS MANUAL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .12
CHAPTER 1 OVERVIEW 13
CHAPTER 2 APPLICATION EXAMPLE 15
CHAPTER 3 RISK ASSESSMENT AND SAFETY LEVEL 18
3.1 Risk Assessment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Risk reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.2 SIL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.3 PL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
CHAPTER 4 PRECAUTIONS FOR USE OF SAFETY PROGRAMMABLE
CONTROLLER 26
4.1 Precautions for Designing Safety Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
4.2 Precautions for Programming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.3 Precautions for Startup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
4.4 Precautions for Safety Functions Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
CHAPTER 5 SAFETY APPLICATION CONFIGURATION EXAMPLES 51
5.1 System Configured by a Safety CPU. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
System configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Network-related switch settings of module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Parameter setting of the Safety CPU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Parameter settings of CC-Link IE Field Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Relationship between devices in the Safety CPU and remote inputs/outputs. . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Setting standard inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Case examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
5.2 System to Which Multiple Safety CPUs are Connected. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
System configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Network-related switch settings of module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
Parameter setting of the Safety CPU . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Parameter settings of CC-Link IE Field Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
Relationship between devices in the Safety CPU and remote inputs/outputs. . . . . . . . . . . . . . . . . . . . . . . . . . 170
Setting standard inputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
Case examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
APPENDICES 234
Appendix 1 Calculating Safety Response Time for System Configured with a Safety CPU. . . . . . . . . . . . . . . . 234
Method for calculating safety response time of CC-Link IE Field Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
Calculation example for response time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240
Appendix 2 Calculating Safety Response Time for System Connected to Multiple Safety CPUs . . . . . . . . . . . 242
Method for calculating safety data transmission time of the CC-Link IE Field Network . . . . . . . . . . . . . . . . . . 243

9
CONTENTS
Calculation example for response time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Appendix 3 Checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
INDEX 249
REVISIONS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .251
WARRANTY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .252
TRADEMARKS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .254

10
RELEVANT MANUALS
e-Manual refers to the Mitsubishi Electric FA electronic book manuals that can be browsed using a dedicated
tool.
e-Manual has the following features:
• Required information can be cross-searched in multiple manuals.
• Other manuals can be accessed from the links in the manual.
• The hardware specifications of each part can be found from the product figures.
• Pages that users often browse can be bookmarked.
• Sample programs can be copied to an engineering tool.
Manual name [manual number] Description Available form
MELSEC iQ-R Safety Application Guide
[SH-081538ENG] (this manual)
Overview of safety systems, how to configure safety systems,
examples of installation and wiring, and application programs.
e-Manual
PDF
MELSEC iQ-R CPU Module User's Manual (Startup)
[SH-081263ENG]
Performance specifications, procedures before operation, and
troubleshooting of the CPU module
Print book
e-Manual
PDF
MELSEC iQ-R CPU Module User's Manual (Application)
[SH-081264ENG]
Memory, functions, devices, and parameters of the CPU
module
Print book
e-Manual
PDF
MELSEC iQ-R Ethernet/CC-Link IE User's Manual
(Startup)
[SH-081256ENG]
Specifications, procedures before operation, system
configuration, wiring, and communication examples of Ethernet,
CC-Link IE Controller Network, and the CC-Link IE Field
Network
Print book
e-Manual
PDF
MELSEC iQ-R CC-Link IE Field Network User's Manual
(Application)
[SH-081259ENG]
Functions, parameter settings, programming, troubleshooting, I/
O signals, and buffer memory of the CC-Link IE Field Network
Print book
e-Manual
PDF
CC-Link IE Field Network Remote I/O Module (With Safety
Functions) User's Manual
[SH-081449ENG]
Procedures required to use safety I/O modules, system
configuration, parameter setting, functions, and
troubleshooting.
Print book
e-Manual
PDF
CC-Link IE Field Network Remote I/O Module User's
Manual
[SH-081114ENG]
Procedures required to use I/O modules, system configuration,
parameter setting, functions, and troubleshooting.
Print book
e-Manual
PDF

11
TERMS
Unless otherwise specified, this manual uses the following terms.
Term Description
CC-Link IE Field Network master/local module The abbreviation for the RJ71GF11-T2 the CC-Link IE Field Network master/local module
Dark test A function that diagnoses contacts including external devices by outputting an off pulse from the test
pulse terminal when the input or output is on
Engineering tool Another term for the software package for the MELSEC programmable controllers
Local station on the CC-Link IE Field Network A station that performs cyclic transmission and transient transmission with the master station and
other local stations on the CC-Link IE Field Network
Master station on the CC-Link IE Field Network A station that controls the entire the CC-Link IE Field Network.
Only one master station can be used in a network.
This station can perform cyclic transmission and transient transmission with all stations on the CC-
Link IE Field Network.
NC A contact that is closed or in a conductive state, and opened by operation of the switch
NO A contact that is open or in a non-conductive state, and closed by operation of the switch
Normally closed contact Refer to the description of NC.
Normally open contact Refer to the description of NO.
PL (performance level) A safety level specified in ISO13849-1: 2006 (The safety level is classified into five levels, a to e.)
Remote device station (safety station) on the CC-Link IE
Field Network
A station that exchanges I/O signals (bit data) with the master station by safety communications.
This station can be used in a safety system.
Remote device station on the CC-Link IE Field Network A station that exchanges I/O signals (bit data) and I/O data (word data) with another station by
transient transmission. This station responds to a transient transmission request from another
station. This station cannot be used in a safety system.
Remote I/O station on the CC-Link IE Field Network A station that exchanges I/O signals (bit data) with the master station by cyclic transmission. This
station cannot be used in a safety system.
Risk The combination of the possibility and severity of harm (injury or illness) that may occur when
exposed to a hazard
Risk assessment Overall process comprising identification of the hazards of machines and risk evaluation
RWr Remote register (read area for the CC-Link IE Field Network)
RWw Remote register (write area for the CC-Link IE Field Network)
RX Remote input (for the CC-Link IE Field Network)
RY Remote output (for the CC-Link IE Field Network)
Safety application A generic term for the applications that are controlled by the safety programmable controller for
realizing the safety function
Safety communications Communication service that performs send/receive processing in the safety layer of the safety
communication protocol
Safety component A component such as a fail-safe sensor and actuator
Safety control Machine control by safety programs and safety data communications. When an error occurs, the
machine in operation is securely stopped.
Safety CPU A generic term for the R08SFCPU, R16SFCPU, R32SFCPU, and R120SFCPU.
This module is used with a safety function module as a pair, and performs both standard control and
safety control.
Safety cycle time This is a time inserted to activate safety input and output, as well as the safety program.
Safety function A function provided to protect a person from the hazards of machines
Safety function module Another term for the R6SFM.
This module is used with the Safety CPU as a pair and performs safety control. The module can
only be paired with the Safety CPU.
Safety input A generic term for the signals that are input to the safety programmable controller for realizing the
safety function
Safety measures Measures for reducing risk
Safety output A generic term for the signals that are output from the safety programmable controller for realizing
the safety function
Safety programmable controller A generic term for the MELSEC iQ-R series modules that perform safety control (such as a Safety
CPU, safety function module, or the CC-Link IE Field Network remote I/O module (with safety
functions))
Safety remote I/O module The abbreviation for the NZ2GFSS2-32D and NZ2EXSS2-8TE CC-Link IE Field Network remote I/O
module (with safety functions)

12
HOW TO USE THIS MANUAL
This manual describes the points to be concerned when configuring a safety application that meets the safety standards using
the safety programmable controller.
Safety application configuration examples are provided in chapter 5 of this manual, but they have not obtained safety
approvals. It is user's responsibility to obtain a safety approval for the entire safety system.
This manual consists of five chapters.
Chapter 1: Overview of the safety programmable controller
Chapter 2: Safety application that is configured using the safety programmable controller
Chapter 3: Risk assessment, SIL, and PL
Chapter 4: Precautions for using the safety programmable controller
Chapter 5: Safety application configuration examples
For detailed specifications and functions of each module, refer to the relevant manuals.
Safety station on the CC-Link IE Field Network A generic term for stations on the CC-Link IE Field Network, which perform safety communications
and standard communications
Safety system A system that execute the required safety function
SB Link special relay. Bit data that indicates the operating status and data link status of a module on the
CC-Link IE Field Network.
SIL A safety level specified in IEC61508: 2010 (The safety level is classified into four levels, SIL1 to
SIL4.)
Slave station on the CC-Link IE Field Network A generic term for stations other than the master station on the CC-Link IE Field Network, such as a
local station, remote I/O station, remote device station, intelligent device station, or intelligent device
station (safety station)
Standard communications Communications other than safety communications, such as cyclic transmission and transient
transmission of the CC-Link IE Field Network
Standard control Machine control by standard programs and standard data communications. Programmable
controllers other than the safety programmable controller perform only standard control. (This term
is used to distinguish from safety control.)
Standard CPU A generic term for MELSEC iQ-R series CPU modules (other than Safety CPU) that perform
standard control (This term is used to distinguish from the Safety CPU.)
Standard programmable controller A generic term for MELSEC iQ-R series, MELSEC-Q series, MELSEC-L series, MELSEC-QnA
series, MELSEC-A series, and MELSEC-FX series modules that perform standard control (This
term is used to distinguish from a safety programmable controller.)
Standard remote I/O module The abbreviation for a remote I/O module on the CC-Link IE Field Network where only standard
inputs and outputs (not safety inputs and outputs) are connected (This term is used to distinguish
from a safety remote I/O module.)
SW Link special register. Word data that indicates the operating status and data link status of a module
on the CC-Link IE Field Network.
Target failure measure A target value of reliability specified in IEC61508: 2010 for each SIL level. There are two target
failure measures depending on the operation frequency of the safety function, PFDavg and PFH.
Term Description

1 OVERVIEW
13
1
1OVERVIEW
Our safety programmable controllers obtained safety approval at the highest safety level that the programmable controller can
obtain (ISO13849-1: 2006 Category 4 and PLe, IEC62061: 2012 SIL3, and IEC61508: 2010 SIL3).
The customer can use safety programmable controllers for configuring safety station with ISO13849-1: 2006 Category 4 and
PLe, IEC62061: 2012 SIL3, and IEC61508: 2010 SIL3.
Safety control and standard control programs can be simultaneously executed under a safety CPU. Similarly, both safety and
standard communications can be executed under a network.
System configuration for safety programmable controllers is shown below:
• Mount power supply module, safety CPU, safety function module, CC-Link IE Field Network master/local module on the
main base unit.
• Connect CC-Link IE Field Network master/local module and safety remote I/O module by network.
• Connect personal computer installed engineering tools to safety CPU, when setting programs and parameters.
GX Works3
Safety programmable controller (1)
Standard
control
Safety
control
Safety programmable
controller (2)
Standard controlSafety control
Safety programmable
controller (3)
Standard controlSafety control
CC-Link IE
Field Network
Emergency
stop switch
Light
curtain
Safety
relay
Inverter Robot Emergency
stop switch
Light
curtain
Safety
relay
Inverter Robot
Emergency
stop switch
Light
curtain
Safety
relay
Inverter Robot

14 1 OVERVIEW
MEMO

2 APPLICATION EXAMPLE
15
2
2APPLICATION EXAMPLE
Safety control for the entire line using a single safety programmable controller
The following shows an application image for the car welding line as an application example of the safety programmable
controller. The safety programmable controller processes safety control of the entire line as a safety application, and
processes line integrated control, which integrates processes as a standard application.
Configure the safety application operated by the safety programmable controller for the following purposes:
• When safe state signal is checked, supply power to the robots.
• When the safe state signal cannot be checked, cut off the power.
• The safe state signal can be checked using an emergency stop switch or a light curtain.
The safety application operated by the safety programmable controller operates as follows:
• Connect a safe state signal to the safety remote I/O module.
• The safety remote I/O module sends the safe state signal to the Safety CPU. The Safety CPU processes safe state signal
received with the safety program and sends safety output to the safety remote I/O module.
• The safety output cuts off the power to the robots.
The standard application operated by the safety programmable controller operates as follows:
• Perform communications between the standard programmable controller and standard CPU. Then, process integrated
control on the lines.
• Connect the restart switch and warming light to a standard remote I/O module.
• Deliver the input of connected restart switch to the safety application.
• Receive a safe state signal from the safety application, and then control the warning lights.
• To perform integrated line control of the lines, communicate the input of the standard programmable controller and restart
switch, the safe state signal, the operating status of standard control, and the like through communications between
standard CPUs

16 2 APPLICATION EXAMPLE
*1 This is a network including the CC-Link IE Controller Network and Ethernet.
*2 This communicates with the CC-Link IE Field Network (standard communications + safety communications).
*3 This communicates with the CC-Link IE Field Network (standard communications).
Integrated control panel First process Second process nth process
Warning
light
Light
curtain Robot
Emergency
stop switch
Restart
switch
Integrated
line control*
2
CC-Link IE Field Network
(standard communications
+ safety communications)
Line control*3 Line control*3Line control*3
Body welding line
Safety input Safety input
Safety
output
Standard
output
Standard
input
Network*
1
(Communications between
standard CPU modules)

2 APPLICATION EXAMPLE
17
2
Safety control for the entire line using multiple safety programmable controllers
The following shows an application image for the safety control linked between multiple manufacturing processes, as an
application example of the safety programmable controller. The safety programmable controller processes controls linked
between safety control and standard control at each process, and control processes. All processes should share safe state
information from each process when connecting multiple manufacturing processes without physical separation. Share safe
state information between safety programmable controllers allocated in each process, using safety communication functions
between Safety CPUs.
Configure the safety application operated by the safety programmable controller for the following purposes:
• When the safe state signal is checked, supply power to the robots.
• When safe state signal cannot be checked, cut off the power.
• The safe state signal can be checked using an emergency stop switch or a light curtain.
• Configure the safety control linked with consecutive processes or the entire process using safety communications between
Safety CPUs on the CC-Link IE Field Network.
The safety application operated by the safety programmable controller operates as follows:
• Connect a safe state signal to the safety remote I/O module.
• Connect the Safety CPUs at each process with the CC-Link IE Field Network.
• The safety remote I/O module sends the safe state signal to the Safety CPU.
• To perform emergency stop for consecutive processes or the entire line, send an emergency stop request to the Safety
CPUs installed in the consecutive processes or the entire line through safety communications between Safety CPUs in CC-
Link IE Field Network using the program.
• The Safety CPU processes the safe state signal received from the safety remote I/O module and an emergency stop
request received by safety communications of the CC-Link IE Field Network using the safety program. Then it sends a
safety output to the safety remote I/O module.
• The safety output cuts off the power to the robots.
The standard application operated by the safety programmable controller operates as follows:
• Connect restart switch, inverter, and robot to standard remote I/O module.
• Deliver input of connected restart switch to safety application.
• Perform communications to check operation status and operation instruction with inverter and robot.
• When a link is required for standard control of multiple or the same processes, send standard data through standard
communications of the CC-Link IE Field Network.
First process Second process nth process
CC-Link IE Field Network (standard communications + safety communications)
Standard control
Safety control Standard control Safety control
Standard control
Safety control
Emergency
stop switch
Light
curtain
InverterRestart
switch
Robot
Inverter Robot
Emergency
stop switch
Light
curtain
InverterRestart
switch
RobotEmergency
stop switch
Light
curtain
InverterRestart
switch
Robot

18 3 RISK ASSESSMENT AND SAFETY LEVEL
3.1 Risk Assessment
3RISK ASSESSMENT AND SAFETY LEVEL
When using safety programmable controller, perform risk assessment on target equipment while observing ISO12100: 2010,
and select appropriate SIL and PL, as well as reduce the risk conforming to ISO13849-1: 2006, IEC61508: 2010, and
IEC62061: 2012.
This chapter describes the risk assessment, risk reduction, and overview of SIL and PL.
3.1 Risk Assessment
The risk assessment is to clarify potential hazards in a machine and assess the degree of the hazards.
The following shows a risk assessment and risk reduction procedures. These procedures are standardized in ISO12100:
2010 Safety of machinery -- General principles for design -- Risk assessment and risk reduction.