Pilz PSS 4000 User manual

Application Note – 1006505-EN-01
PSSu Key
-in-Pocket Extended
Product
Type:
FS_KeyInPocket_SignInOut, FS_KeyInPocket_Manager, FS_KeyInPocket_BlindSpotCheck
Name:
PSS 4000, PITreader, PITgatebox, PSENmlock
Manufacturer:
Pilz GmbH & Co. KG, Safe Automation
Document
Release Number:
01
Release Date:
16 May 2023

Document Revision History
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 2/
43
Document Revision History
Release
Date
Changes
Chapter
01
2023-05-16
Creation
all
Validity of Application Note
This present Application Note is valid until a new version of the document is published.
This and other Application Notes can be downloaded in the latest version and for free from
www.pilz.com. For a simple search, use our content document (1002400) or the direct search
function in the download area.
The Pilz newsletter is free of charge and keeps you up-to-date on all the latest issues and trends in
safe automation.
Exclusion of Liability
We have taken great care in compiling our application note. It contains information about our
company and our products. All statements are made in accordance with the current status of
technology and to the best of our knowledge and belief.
While every effort has been made to ensure the information provided is accurate, we cannot accept
liability for the accuracy and entirety of the information provided, except in the case of gross
negligence. In particular, all information on applicable standards, safety-related classifications and
time characteristics should be viewed as provisional. In particular it should be noted that statements
do not have the legal quality of assurances or assured properties.
We are grateful for any feedback on the contents.
May 2023
All rights to this publication are reserved by Pilz GmbH & Co. KG.
We reserve the right to amend specifications without prior notice. Copies may be made for the user’s
internal purposes.
The names of products, goods and technologies used in this manual are trademarks of the
respective companies. Please note the current information about the products, their licenses and
registered trademarks in the documents listed in Chapter 2 Useful documentation [󰱭7].
Industrial Security
To secure plants, systems, machines and networks against cyberthreats it is necessary to implement
(and continuously maintain) an overall Industrial Security concept that is state of the art.
Perform a risk assessment in accordance with VDI/VDE 2182 or IEC 62443-3-2 and plan the security
measures with care. If necessary, seek advice from Pilz Customer Support.

Abbreviations
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 3/
43
Abbreviations
Abbreviation / term
Description
Source
AN
Application Note
www.pilz.com > AN content (1002400)
PNOZ
Pilz E-STOP positive-guided
(DE: Pilz NOT-AUS-Zwangsgeführt)
www.pilz.com > PNOZ
PSS
Programmable control system
(DE: Programmierbares Steuerungssystem)
www.pilz.com > PSS
PSS u2
PSSuniversal, 2nd generation
www.pilz.com > PSS u2
POU
Program Organisation Unit
NC
Normally Closed
NO
Normally Open
STO
Safe Torque Off
Definition of Symbols
Information that is particularly important is identified as follows:
CAUTION!
This refers to a hazard that can lead to a less serious or minor injury plus material
damage, and also provides information on preventive measures that can be taken.
NOTICE
This describes a situation in which the product or devices could be damaged and also
provides information on preventive measures that can be taken.
It also highlights areas within the text that are of particular importance.
INFORMATION
This gives advice on applications and provides information on special features.

Contents
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 4/
43
Contents
1Preface.....................................................................................................................................6
2Useful documentation ...........................................................................................................7
2.1 Documentation from Pilz GmbH & Co. KG..................................................................................................................... 7
2.2 Documentation from other sources of information .................................................................................................... 7
3Used hardware and software................................................................................................8
3.1 Pilz products................................................................................................................................................................................ 8
3.2 Structure of the application (schematic) .......................................................................................................................... 9
4Application description .......................................................................................................10
4.1 Introduction...............................................................................................................................................................................10
4.2 Key-in-Pocket............................................................................................................................................................................12
4.3 Monitoring of safety gate and guard locking..............................................................................................................13
4.4 Drive..............................................................................................................................................................................................13
4.5 Safety assessments .................................................................................................................................................................14
4.5.1 Key-in-pocket system ............................................................................................................................................................14
4.5.2 Safety gate system..................................................................................................................................................................14
4.5.3 Drive system ..............................................................................................................................................................................15
4.6 Functional safety......................................................................................................................................................................15
4.6.1 Introduction...............................................................................................................................................................................15
4.6.2 Safety-related characteristic data in accordance with EN ISO 13849-1 ............................................................15
4.6.3 Safety-related characteristic data in accordance with EN 62061 .........................................................................16
5Hardware configuration ......................................................................................................17
5.1 PITgatebox with PITreader...................................................................................................................................................17
5.2 PSSu PLC .....................................................................................................................................................................................17
5.2.1 Overview .....................................................................................................................................................................................17
5.2.2 IP connections ..........................................................................................................................................................................18
6Software configuration .......................................................................................................19
6.1 Multi programming ................................................................................................................................................................19
6.1.1 Key-in-Pocket............................................................................................................................................................................19
6.1.2 Activation and monitoring of the safety gate with guard locking.......................................................................22
6.1.3 Activating the machine .........................................................................................................................................................24
6.2 IEC 61131 programming (programming language STL: Structured Text) ........................................................24
6.2.1 Declaration part .......................................................................................................................................................................24
6.2.2 Instruction part.........................................................................................................................................................................26
6.3 Resource assignment.............................................................................................................................................................29
6.4 I/O mapping ..............................................................................................................................................................................30
7Application conditions ........................................................................................................32
8Appendix...............................................................................................................................34
8.1 Wiring diagram.........................................................................................................................................................................34
8.1.1 Wiring diagram 1/8 ................................................................................................................................................................34
8.1.2 Wiring diagram 2/8 ................................................................................................................................................................35
8.1.3 Wiring diagram 3/8 ................................................................................................................................................................36
8.1.4 Wiring diagram 4/8 ................................................................................................................................................................37
8.1.5 Wiring diagram 5/8 ................................................................................................................................................................38

Contents
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 5/
43
8.1.6 Wiring diagram 6/8 ................................................................................................................................................................39
8.1.7 Wiring diagram 7/8 ................................................................................................................................................................40
8.1.8 Wiring diagram 8/8 ................................................................................................................................................................41
9Table of figures ....................................................................................................................42

Preface
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 6/
43
1Preface
This Application Note provides a basic description of the commissioning of the key-in-pocket system
from Pilz, using as an example a manufacturing cell with two access points and two blind spots.
With the help of the access permission system PITreader and a Pilz safety controller, the key-in-
pocket system from Pilz guarantees that a plant cannot (re-)start until the last person has left the
danger zone. A PSSu PLC from the automation system PSS 4000 is used as the safety controller.
The general procedure for a successful basic configuration is shown.
NOTICE
A detailed explanation of the safety functions employed in the failsafe application and
their evaluation in terms of functional safety are not part of this document.

Useful documentation
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 7/
43
2Useful documentation
Reading the documentation listed below is necessary for understanding this Application Note.
The availability of the software used and its safe handling are also presupposed for the user.
2.1 Documentation from Pilz GmbH & Co. KG
No.
Description
Item No. /Download
1
Pilz international homepage, download section
www.pilz.com
2
System description Key-in-Pocket
1006613-EN-xx
3
System description PSS 4000
1001467-EN-xx
4
Safety manual PSS 4000
1001468-EN-xx
5
Operating manual PSSu H PLC2 FS SN SD
1005195-EN-xx
6
Operating manual PSSu E F 4DI
21310-EN-xx
7
Operating manual PSSu E F 4DO 0.5
21316-EN-xx
8
Operating manual PITreader
1004806-EN-xx
9
Operating manual PIT gb RLLE y ETH
1005249-EN-xx
10
Operating manual PSEN ml b 1.1/2.1/2.2 / PSEN ml DHM
1005444-EN-xx
11
PAS4000 Online help
-
2.2 Documentation from other sources of information
No.
Description
Item No. / Download
1
EN ISO 13849-1:2015
Safety of machinery – Safety-related parts of control systems – Part 1: General
principles for design
European standard
2
3
4

Used hardware and software
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 8/
43
3Used hardware and software
3.1 Pilz products
No.
Descriptions
Order number
Version
Number
1
PSSu H PLC2 FS SN SD
312077
FW 1.25
1
2
PSSu E F 4DI
312200
-
6
3
PSSu E F 4DO 0.5
312210
-
4
4
PSSu BP 1/8C
312601
-
10
5
PSSu A Con 2/8 C
(connector set, spring-loaded connection)
313111 - 1
6
PIT gb RLLE y up ETH
(PITgatebox – pushbutton unit)
G1000020 - 2
7
PITreader S base unit
402256
-
4
8
PITreader key Adapter h
402308
-
4
9
PITreader key ye g
(Transponder key, authorisations freely configurable)
402260 - 1 (min.)
10
PSEN ml b 2.1 switch
(Safety gate system with mechanical guard locking, basic version
with power reset, fully coded)
570403 - 2
11
PSEN ml DHM down l 2.1
(Door handle module for fully coded PSENmlock switches, left-
hand gate end stop)
6O000006 - 2
12
Software platform PAS4000
-
V 1.25
1
The Pilz product portfolio also includes servo amplifiers and drives. However, they are not described
in detail here, as they are not central to this Application Note.

Used hardware and software
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 9/
43
3.2 Structure of the application (schematic)
Figure 1: Application – Structure of the hardware (schematic)
1. Failsafe controller PSSu PLC
2. Transponder key
3. PITgatebox – pushbutton unit with PITreader (Safety gate 1 outside)
4. Door handle module for PSENmlock (Safety gate 1 outside)
5. Safety gate system PSENmlock (Safety gate 1 outside)
6. PITreader and pushbutton (Safety gate 1 inside)
7. PITgatebox – pushbutton unit with PITreader (Safety gate 2 outside)
8. Door handle module for PSENmlock (Safety gate 2 outside)
9. Safety gate system PSENmlock (Safety gate 2 outside)
10. PITreader and pushbutton (Safety gate 2 inside)
11. PITreader and pushbutton (Blind spot check 1)
12. PITreader and pushbutton (Blind spot check 2)
13. Servo amplifier
14. Drive
15. Ethernet switch

Application description
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 10/
43
4Application description
4.1 Introduction
On a plant in which the danger zone is accessible via safety gates, "key-in-pocket" is a system that
guarantees that the plant cannot (re-)start until the last person has left the danger zone. Each person
who accesses the danger zone has to sign in to the key-in-pocket system’s internal sign in list. When
leaving the danger zone, each person must sign out of the internal sign in list. Transponders from
the authentication system PITreader from Pilz are used to sign in and out.
The example shows the application of the key-in-pocket system on a machine that executes
hazardous movements within a protective enclosure (protective grille and safety gate).
Figure 2: Danger zone
It is possible to enter or leave the danger zone via two access points, which are physically separate.
Within the danger zone there are two blind spots, which cannot be seen from the outside. On the
inside (within the danger zone), the gates also have devices to activate/deactivate guard locking, so
that it is possible to enter the danger via one of the gates and leave via the other. In this example,
the blind spots must be checked in a defined sequence.

Application description
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 11/
43
Figure 3: Access to the danger zone
It is only possible to enter the danger zone if:
‒A person has used their personal transponder to sign in to the key-in-pocket system’s sign in
list via the PITreader integrated within the PITgatebox
‒All hazardous machine movements are stopped
‒The guard locking on a safety gate has been deactivated.
Additional persons wishing to enter the danger zone must use their transponder to sign in to the
key-in-pocket system’s sign in list.
All persons carry their transponders with them while they are in the danger zone.
It is only possible to restart the machine if:
‒All except one person have left the danger zone and signed out of the sign in list
‒The last remaining person checks and confirms that there is nobody in the blind spots
‒Both safety gates are closed and the guard locking devices are activated
‒The last remaining person has used their transponder to sign out of the key-in-pocket system’s
sign in list.
To operate the key-in-pocket system, each gate uses a PITgatebox, which has two illuminated
pushbuttons in addition to an E-STOP and the PITreader.
Figure 4: PITgatebox with pushbutton assignment
Lock/Unlock
Sign-In/Sign-Out

Application description
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 12/
43
Activation (lock) and deactivation (unlock) of guard locking are assigned to the upper pushbutton.
The status of guard locking (activated/deactivated) is displayed via the integrated indicator lamp.
The lower pushbutton is used to sign a transponder in to the sign in list and to sign a transponder
out of the sign in list. The status of a transponder (signed in/signed out) is displayed via the
integrated indicator lamp.
In each case, a PITreader and an illuminated pushbutton are provided inside the danger zone for
operating the guard locking devices and checking the blind spots.
Two further pushbuttons are required to start and stop the machine.
A PSEN ml b 2.1 (PSENmlock) is used in conjunction with a handle module PSEN ml DHM down l 2.1
for safety gate monitoring and guard locking.
4.2 Key-in-Pocket
The basic function of the key-in-pocket system in this application is described below, based on the
machine in operation.
The operator wishes to enter the danger zone. To do this, on a gate he positions his transponder in
the PITreader, presses the lower pushbutton (sign in/sign out) and then releases it (0.5 … 5 seconds).
The operator ensures that the indicator lamp on the lower pushbutton switches to a continuous
light; i.e. the transponder is signed in to the sign in list.
By signing in to the sign in list, a machine stop is requested automatically. Also, signing in to the sign
in list activates the display for the status of guard locking. The indicator lamp on the upper
pushbutton (lock/unlock) switches to continuous light, so indicating that guard locking is activated.
When the machine is at standstill, the operator can deactivate guard locking by pressing the upper
pushbutton (lock/unlock). The indicator lamp goes out, so indicating that the gate can be opened.
The operator removes his transponder (the indicator lamp (sign in/sign out) goes out), opens the
gate and enters the danger zone.
Additional persons can sign in to the sign in list and enter the danger zone, including via the second
gate if necessary.
Once their work is complete, people gradually leave the danger zone and sign out of the sign in list.
As soon as there is only transponder signed in to the sign in list, the blind spots must be checked
before the last remaining transponder can be signed out. This is displayed by a continuous light on
the indicator lamp at the first blind spot (ReadyForCheck).
First, the person with the last remaining transponder closes one of the gates and activates its guard
locking by pressing the pushbutton after the transponder is positioned at the relevant control point
(inside or outside). The status of guard locking is displayed via the indicator lamp that is integrated
within the pushbutton.
Then the person checks both blind spots consecutively and confirms each check by positioning the
transponder at the PITreader installed there and pressing the pushbutton (0.5 … 5 seconds). The
indicator lamp that is integrated within the pushbutton (ReadyForCheck) goes out.
Finally, the person leaves the danger zone, closes the gate and positions their transponder in the
PITreader (outside). The indicator lamp in the lower pushbutton (sign in/sign out) switches to a
continuous light.

Application description
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 13/
43
Pressing the upper pushbutton (lock/unlock) activates guard locking. The activated status is
displayed via the indicator lamp staying continuously lit.
The operator presses the lower pushbutton (sign in/sign out) and then releases it (0.5 … 5 seconds).
The indicator lamp goes out, so indicating that the transponder has been signed out of the sign in
list. The operator removes his transponder from the PITreader.
If nobody else has signed in to the sign in list in the meantime, then the enable to start the machine
is now present (separate Start button). Signing out the last transponder from the sign in list resets
the restart interlock.
Any person who enters the danger zone must use their transponder to sign in to the sign in list and
then sign out again after leaving the danger zone. A maximum of 21 people can sign in to the sign in
list.
The following blocks are used for the key-in-pocket system: “FS_KeyInPocket_SignInOut”,
“FS_KeyInPocket_Manager” and “FS_KeyInPocket_BlindSpotCheck”.
Where people have signed in to the sign in list before entering the danger zone but have not signed
out of the sign in list after leaving the danger zone and are also no longer available, the block
“FS_KeyInPocket_Manager” has the option to delete the list using a transponder with a higher
permission and a separate pushbutton (“Delete”). The data on the signed in transponder (security ID
and serial number) can be read on the block "FS_KeyInPocket_Manager".
4.3 Monitoring of safety gate and guard locking
The safety gate system PSENmlock signals the status of the safety gate and guard locking via 2
OSSD outputs.
A block with automatic reset, “FS_SafetyGate”, is used to evaluate the OSSD outputs.
Guard locking can only be activated/de-activated when the transponder is positioned and signed in.
Guard locking can only be deactivated once the hazardous movement has ended (safe standstill
monitoring).
The functional state of guard locking (locked/unlocked) remains active even after the supply voltage
is removed.
4.4 Drive
With the request to stop the machine (sign in to the sign in list, stop button), the motor is stopped
and shut down via the servo amplifier, via a preset ramp.
To ensure that the operator does not access the danger zone until the danger has passed, a delay
device is started when the machine is stopped. This ensures that any movement has come to a
standstill before guard locking on the safety gate can be opened (delay time > maximum stopping
time of the motor).
Once the set delay time has elapsed, two safe outputs are shut down, whereby the servo amplifier’s
pulse inhibitor safely removes the power to the motor (STO).
The safe standstill monitoring implemented here in the form of a delay time is only one example and
should be defined and implemented by the user to suit the specific application.
This example does not describe the design and functionality of the servo amplifier in any detail. The
user must select an appropriate drive to suit their application and the safety level it requires.

Application description
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 14/
43
4.5 Safety assessments
4.5.1 Key-in-pocket system
The system provides protection against an unintended and unauthorised restart. The restart interlock
is set (“Enable” = FALSE on the block “FS_KeyInPocket_Manager”), as soon as one person uses their
transponder to sign in to the sign in list, and reset (“Enable” = TRUE), when a person has signed out
the list’s last remaining transponder from the list.
The safety concept is based on each action (signing in/signing out of the sign in list) requiring
operator action on two logically, technologically and physically independent components:
PITreader with transponders and transfer via network protocol
Pushbutton on a safe hardware input
Both function elements are considered as independent channels.
Measures to detect and manage single errors are implemented in both channels.
The following measures are used in the channel with the PITreader:
Data transfer is monitored through data dynamisation
Data is secured via CRC
Data on a positioned transponder is valid for a limited time
Limited to one action while a transponder is positioned
Data connection is monitored
The following measures are used in the channel with pushbutton:
A rising and falling edge must be detected to trigger an action.
An operation is classed as valid if the falling edge occurs between 500 ms and 5 s after the rising
edge.
When deleting the list via the block “FS_KeyInPocket_Manager”, the transponder used for deletion
remains in the sign in list, so that the delete operation does not reset the restart interlock.
The sign in list is empty when the safety controller starts up (no non-volatile memory). In order to set
the enable for the restart, a transponder must be signed in once to the sign in list and then signed
out again.
For safe application of the key-in-pocket system, please note the guidelines stated in chapter 7
Application conditions [󰱭32].
4.5.2 Safety gate system
The safety gate system PSENmlock meets the following safety requirements:
Safe guard locking for swing gates and sliding gates
(the safety switch may only be used with the corresponding actuator.)
Errors on the OSSD signals (no synchronous switching, OSSD failing to switch from TRUE to FALSE
when guard locking is deactivated) are detected by the block “FS_SafetyGate”. A short or cross-
short between the OSSDs is detected by the PSENmlock and leads to the OSSDs being shut down.
(The safety outputs (OSSDs) must not be connected to 24V.)
Errors on the 2-channel operation of the guard locking device or servo amplifier (stuck-at-high,
cross-short) are detected by the safety controller (on and off test). In the event of an error, guard
locking is still guaranteed.

Application description
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 15/
43
After the drive has stopped or when the safety gate is opened, the energy supply to the motor is
forcibly removed (activation of STO). As a result, the drive can no longer generate a rotational
torque and therefore no braking torque either.
Additional hazards may therefore arise, which must be taken into consideration. For example:
‒Increased time to standstill (overrun)
‒Uncontrolled falling (e.g. on vertical axes)
‒Positional change due to mass, pressure or voltage
Please comply with the safety guidelines and installation and wiring instructions in the PSENmlock
operating manual.
4.5.3 Drive system
Please comply with the safety guidelines stated in the operating manual for the relevant servo
amplifier.
4.6 Functional safety
4.6.1 Introduction
The restart interlock implemented through the key-in-pocket system is treated as a separate safety
function. The safety function depends equally on both input functions (pushbutton und PITreader).
PITreader and pushbutton can therefore be regarded as channels of the “Input” subsystem. The key-
in-pocket system can be used for applications up to Category 3 PL d of EN ISO 13849-1 or up to
SIL 2 of EN 62061.
The safety gate system PSENmlock achieves classification to PL e of EN ISO 13849-1 and SIL 3 of EN
62061, both for safety gate monitoring and mechanical guard locking.
Fault exclusion is assumed for the single-channel mechanical actuator (Fmax = 2x FZH).
All the units used within a safety function must be considered when calculating the safety
characteristic data.
4.6.2 Safety-related characteristic data in accordance with EN ISO 13849-1
No.
Safety function
Performance
level
Safety-related parts of the control
system
1
Restart is prevented as long as one person is
signed in to the sign in list with their
transponder.
(KEY-IN-POCKET).
PL d
Sensor (Pushbutton/PITreader PITgatebox)
Input (PSSu E F 4DI)
Logic (PSSu H PLC2 FS SN SD)
Output (PSSu E F 4DO 0.5)
Actuator (Servo amplifier)
2
Hazardous movements are shut down when
the safety gate is opened; a restart is
prevented while the safety gate is open.
(SAFETY GATE)
PL e
Sensor (PSENmlock (OSSD))
Input (PSSu E F 4DI)
Logic (PSSu H PLC2 FS SN SD)
Output (PSSu E F 4DO 0.5)
Actuator (Servo amplifier)
3
Restart is prevented if guard locking is not
activated.
(GUARD LOCKING – start-up)
PL e
Sensor (PSENmlock (OSSD))
Input (PSSu E F 4DI)
Logic (PSSu H PLC2 FS SN SD)
Output (PSSu E F 4DO 0.5)
Actuator (Servo amplifier)
4
Guard locking cannot be deactivated until a
safe state is achieved.
(GUARD LOCKING – standstill)
PL e
Logic (PSSu H PLC2 FS SN SD)
Output (PSSu E F 4DO 0.5)
Actuator (PSENmlock (Guard locking))

Application description
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 16/
43
Requirements:
No.
Description
Identification
1
Common cause failure (CCF)
Requirements are considered to be met
(must be checked when implemented)
2
Mission time
20 years
3
Operation interval (electromechanical
components)
(according to application-related assumption
from this example)
Sensor
4 operations per hour
4
Characteristic data of servo amplifier - STO
(assuming):
Actuator
PFHD= 5E-09
PL e
Please note the further requirements of EN ISO 13849-1, e.g. requirements for avoiding systematic
failures.
4.6.3 Safety-related characteristic data in accordance with EN 62061
No.
Safety-related control function (SRCF)
Safety Integrity
Level
Subsystems
1
Restart is prevented as long as one person is
signed in to the sign in list with their
transponder.
(KEY-IN-POCKET).
SIL 2
Sensor (Pushbutton/PITreader PITgatebox)
Input (PSSu E F 4DI)
Logic (PSSu H PLC2 FS SN SD)
Output (PSSu E F 4DO 0.5)
Actuator (Servo amplifier)
2
Hazardous movements are shut down when
the safety gate is opened; a restart is
prevented while the safety gate is open.
(SAFETY GATE)
SIL 3
Sensor (PSENmlock (OSSD))
Input (PSSu E F 4DI)
Logic (PSSu H PLC2 FS SN SD)
Output (PSSu E F 4DO 0.5)
Actuator (Servo amplifier)
3
Restart is prevented if guard locking is not
activated.
(GUARD LOCKING – start-up)
SIL 3
Sensor (PSENmlock (OSSD))
Input (PSSu E F 4DI)
Logic (PSSu H PLC2 FS SN SD)
Output (PSSu E F 4DO 0.5)
Actuator (Servo amplifier)
4
Guard locking cannot be deactivated until a
safe state is achieved.
(GUARD LOCKING – standstill)
SIL 3
Logic (PSSu H PLC2 FS SN SD)
Output (PSSu E F 4DO 0.5)
Actuator (PSENmlock (Guard locking))
Requirements:
No.
Description
Identification
1
Common cause failure (CCF)
ß = 2 % (must be checked when
implemented)
2
Proof test interval
20 years
3
Operation interval (electromechanical
components)
(according to application-related assumption
from this example)
Sensor
4 operations per hour
4
Characteristic data of servo amplifier - STO
(assuming):
Actuator
PFHD= 5E-09
SIL 3
Please note the further requirements of EN 62061, e.g. requirements for systematic safety integrity.

Hardware configuration
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 17/
43
5Hardware configuration
5.1 PITgatebox with PITreader
The PITreader is configured via a web application, which is called up via a standard browser. Settings
on the PITreader as well as changes to transponders can generally be made via the web application.
A detailed description can be found in the operating manual PITreader.
When delivered, the PITreader in the PITgatebox has the IP address 192.168.0.12.
This example uses transponders that are freely configurable. Before use, they must be assigned a
permission via the web application.
5.2 PSSu PLC
5.2.1 Overview
Figure 5: PSS 4000 hardware configuration
The PSSu PLC is assigned the IP address 192.168.0.11.
With the E-modules PSSu E F 4DO 0.5, the off tests must be activated (default setting). The on tests
for the outputs that activate guard locking and the servo amplifier must also be activated.
All inputs are configured for a 24 V supply, with the exception of the emergency stop inputs, which
are supplied via pulse signals.

Hardware configuration
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 18/
43
5.2.2 IP connections
Figure 6: Modbus/TCP client connections
The 6 PITreader units supply data to the PSSu PLC via the IP connections configured above.

Software configuration
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 19/
43
6Software configuration
The software development is shown in the alternative programming types “Multi programming” and
“IEC 61131 programming”.
6.1 Multi programming
The program can be divided into 3 functional areas:
Key-in-pocket system
Activation and monitoring of the safety gate with guard locking
Activation of the machine
To keep the illustration understandable, some internal signals have been assigned to PI points and
have been connected via PI-PI mapping. These connections can also be created directly without PI
points, of course, via lines.
The blue elements are simple component blocks for converting connection points into PI points and
vice-versa. The “Button” type elements also supply the valid information from the input signal.
Note: For reasons of clarity, the emergency stop function is not represented here.
6.1.1 Key-in-Pocket
Figure 7: Multi program part “Key-in-Pocket”
The following blocks are used for the key-in-pocket system: “FS_KeyInPocket_SignInOut” (6
instances), “FS_KeyInPocket_Manager” (1 instance) and “FS_KeyInPocket_BlindSpotCheck” (2
instances).

Software configuration
Application Note PSSu Key-in-Pocket Extended
1006505-EN-01
│ 20/
43
“KiPSignInOut_Door1_Outside” and “KiPSignInOut_Door2_Outside” process the data from the
PITreader and the commands from the pushbuttons “SignInOut1” and “SignInOut2” from the
gateboxes installed outside beside the gates. The parameter settings are used to activate sign in/sign
out and to specify a minimum permission for the transponders:
Figure 8: Parameter settings “FS_KeyInPocket_SignInOut” for signing in and out of the sign in list
“KiPSignInOut_Door1_Inside” and “KiPSignInOut_Door2_Inside” process the data from the PITreaders
installed in the inside area next to the gates. The parameter settings are used to deactivate sign
in/sign out:
Figure 9: Parameter settings “FS_KeyInPocket_SignInOut” for use without signing in and out of the sign
in list
“KiP_Manager” manages the sign in list. The block controls the upstream multiplexer block “MulPlex”,
receives the data from the “FS_KeyInPocket_SignInOut” instances and signs this in to or out of the
internal sign in list. Using a signed-in transponder with a higher permission, the internal list can be
deleted apart from one entry, via the “Delete” button. The parameter settings are used to select the
blind spot check and to specify the number of channels to be processed, along with the channel and
the permission to delete:
Figure 10: Parameter settings “FS_KeyInPocket_Manager”