Rockwell Automation Allen-Bradley Compact GuardLogix 5370... User guide

Application Technique
Door Locking and Monitoring with a 442G Access Box and an
Integrated Safety Controller Safety Function
Products: GuardLogix 5570 or Compact GuardLogix 5370 Controller, 442G Multifunctional Access Box, POINT Guard I/O Safety Modules
Safety Rating: Cat. 4, PLe to ISO 13849-1: 2015
Topic Page
Important User Information 2
Summary of Changes 3
General Safety Information 3
Introduction 4
Safety Function Realization: Risk Assessment 5
Guard Locking and Monitoring Safety Function 5
Safety Function Requirements 5
Functional Safety Description 6
Bill of Material 7
Setup and Wiring 7
Configuration 10
Programming 11
Calculation of the Performance Level 20
Verification and Validation Plan 22
Additional Resources 23

2Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to
familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,
and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are
required to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may
be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from
the use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
Labels may also be on or inside the equipment to provide specific precautions.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal
injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss.
Attentions help you identifya hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.
BURN HAZARD: Labelsmaybe onorinside theequipment,for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash will
cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and for
Personal Protective Equipment (PPE).

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 3
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Summary of Changes
This publication contains new and updated information as indicated in the following table.
General Safety Information
Contact Rockwell Automation to learn more about our safety risk assessment services.
SafetyDistanceCalculations
Non-separating safeguards provide no physical barrier to prevent access to a hazard. Publications that offer guidance for
calculating compliant safety distances for safety systems that use non-separating safeguards, such as light curtains,
scanners, two-hand controls, or safety mats, include the following:
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of
parts of the human body)
EN ISO 13857:2008 (Safety of Machinery – Safety distances to prevent hazardous zones being reached by upper
and lower limbs)
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
Topic Pages
Added section on accessing components of the safety function. 4
Updated available controller groups in the Bill of Material. 7
Attached the wiring schematic to this document. 9
Shortened the Configuration section because the Logix Designer project ACD is now attached to this document. 10
Added the SISTEMA file to this document. 20
The Verification and Validation Checklist is now attached tothis document as a spreadsheet. 22
IMPORTANT This application example is for advanced users and assumes that you are trained and experienced in safety system requirements.
ATTENTION: Perform a risk assessment to make sure that all task and hazard combinations have been identified and addressed. The risk assessment can require
additional circuitry to reduce the risk to a tolerable level. Safety circuits must consider safety distance calculations, which are not part of the scope of this
document.
ATTENTION: While safety distance or access time calculations are beyond the scope of this document, compliant safety circuits must often consider a safety
distance or access time calculation.

4Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Separating safeguards monitor a movable, physical barrier that guards access to a hazard. Publications that offer guidance
for calculating compliant access times for safety systems that use separating safeguards, such as gates with limit switches
or interlocks (including SensaGuard™ switches), include the following:
EN ISO 14119:2013 (Safety of Machinery – Interlocking devices associated with guards - Principles for design
and selection)
EN ISO 13855:2010 (Safety of Machinery – Positioning of safeguards with respect to the approach speeds of
parts of the human body)
EN ISO 13857:2008 (Safety of Machinery – Safety distances to prevent hazardous zones being reached by upper
and lower limbs)
ANSI B11:19 2010 (Machines – Performance Criteria for Safeguarding)
In addition, consult relevant national or local safety standards to assure compliance.
Introduction
This safety function application technique explains how to wire, configure, and program a GuardLogix® controller and
POINT Guard I/O™ module to lock and monitor a 442G Multifunctional Access Box (MAB) mounted on a power-to-
release door. If the door is opened or unlocked, or a fault is detected in the safety function, the GuardLogix controller
de-energizes the final control device, which in this safety function is a redundant pair of 100S contactors.
This example uses a 1756-L73S GuardLogix controller, but is applicable to any GuardLogix controller.
The Safety Integrity Software Tool for the Evaluation of Machine Applications (SISTEMA) calculations that are shown
later in this document would have to be recalculated by using the actual products.
Access Componentsof the Safety Function
The component files (AutoCAD, EPLAN, ACD, SISTEMA, and Verification and Validation checklist) that are
attached to this document help you implement this safety function. To access these components, click the Attachments
link and right-click and save the component that you want to use. If the PDF file opens in a browser and you don't see
the Attachments link , download the PDF file and then reopen the file with the Adobe Acrobat Reader application.

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 5
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
SafetyFunctionRealization: Risk Assessment
The Performance Level required (PLr) is the result of a risk assessment and refers to the amount of the risk reduction to
be conducted by the safety-related parts of the control system. Part of the risk reduction process is to determine the safety
functions of the machine. In this application, the Performance Level required by the risk assessment is category 3,
Performance Level d (cat. 3, PLd), for each safety function. A safety system that achieves cat. 3, PLd, or higher, can be
considered control reliable. Each safety product has its own rating and can be combined to create a safety function that
meets or exceeds the PLr.
Guard Locking and Monitoring Safety Function
This application technique includes one safety function: guard locking and monitoring.
Safety Function Requirements
This safety function makes sure that the hazard has stopped, and that safety output power has been removed, before the
gate is unlocked upon request. It also monitors the lock and door, and it drops output power if they unexpectedly change
state. If any fault occurs, such as loss of communications, output power to the safety actuators is dropped. While the door
is open, itsstatus is monitored to prevent unexpected startup while the door is open. When the door isclosed and locked,
hazardous motion and power to the motor do not resume until a secondary action (Reset button depressed) occurs.
The safety function in this application technique meets or exceeds the requirements for Category 3, Performance Level d
(Cat. 3, PLd), per ISO 13849-1 and control reliable operation per ANSI B11.19.
From: Risk Assessment (ISO 12100)
1. Identification of safety functions
2. Specification of characteristics of each function
3. Determination of required PL (PLr) for each safety function
To: Realization and PL Evaluation

6Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Considerations for Safety Distance and Stopping Performance
Safety distance calculations are typically not required for safety functions that use a Power-to-release locking-gate switch.
The risk assessment determines if a safety distance calculation is required for your safety function that uses the
Multifunctional Access Box.
Based on the selection of a sensor subsystem, the risk assessment determines if a safety distance calculation is required.
Typically, a safety distance calculation is required if a non-separating sensor subsystem (such as a light curtain) is selected
for the safety function. If a safety distance calculation is required for this safety function, the following documents can be
referenced:
•GuardLogix 5570 and Compact GuardLogix 5370 Controller Systems Safety Reference Manual,
publication1756-RM099
•SafeBook 5– Safety related control systems for machinery, publication SAFEBK-RM002
•Safety Function: Light Curtain Products: Light Curtain GuardLogix Controller, publication SAFETY-AT056
Functional Safety Description
In this example, an unlock is requested by pressing an Unlock Request button on the MAB. The unlock request is sent
over a CIP Safety™ connection to the GuardLogix safety controller. The GuardLogix controller drops out the redundant
contactors, and the hazard coasts to a stop. The safety contactors (K1 and K2) are connected to a pair of safety outputs
on a safety output module (1734-OB8S). The I/O module is connected via CIP Safety over an EtherNet/IP™ network to
the safety controller. After the hazard stops (you must determine how to monitor for the hazard stopping in your
application), the GuardLogix commands the MAB to unlock the door, which allows entry to the hazard. Once the
operator has completed the routine and repetitive maintenance, the operator closes the door and extends the bolt via the
handle. If the door is closed and the bolt is extended, a Lock button on the MAB can be used to send a signal to the
GuardLogix controller to lock the door by de-energizing the lock solenoid. In this example, the lock is Power-to-release.
The GuardLogix safety code monitors the status of the door by using the pre-certified safety instruction, Dual Channel
Input Stop with Test and Lock (DCSTL). The MAB provides a status bit that indicates that the door is closed, the bolt is
extended, and the bolt is locked. These status interlocks are monitored by the GuardLogix DCSTL.
When all safety input interlocks (the DCSTL is one of these interlocks) are satisfied, no faults are detected, and a safety
restart button on the MAB is pressed, a second GuardLogix certified function block called Configurable Redundant
Output (CROUT) controls and monitors feedback for a pair of 100S redundant contactors. The CROUT energizes
and de-energizes the contactors and monitors electromechanical feedback to make sure that both contactors operate
properly.
If a demand is placed on any other safety interlock, in this example it is the MAB E-stop, the redundant contactors are
dropped out. The Unlock Request button can then be used to request access to the hazard. The DCSTL safety
instruction makes sure that the hazard is stopped before the door is unlocked.

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 7
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Bill of Material
This application technique uses these products.
Choose either the GuardLogix 5570 hardware list or the Compact GuardLogix 5370 hardware list.
Setup and Wiring
For detailed information on how to install and wire, refer to the publications that are listed in the Additional Resources.
Cat. No. Description Quantity
442G-MABH-R Handle for right-hand guard door 1
442G-MABRB-UR-E0JP4679 Lock/Bus module with E-stop, four buttons,and connector for enabling switch, power-to-release, right-hand1
100S-C09ZL23C Bulletin 100S-C safety contactors 2
1734-IB8S POINT Guard safety input module 1
1734-OB8S POINT Guard safety output module 1
1734-AENT 24V DC Ethernet adapter 1
1734-TB Module base with removable IEC screw terminals 4
Controller Cat. No. Description Quantity
GuardLogix 5570
1756-L71S
1756-L72S
1756-L73S
GuardLogix processor, 2.0 MB standard memory, 1.0 MB safety memory, or
GuardLogix processor, 4.0 MB standard memory, 2.0 MB safety memory, or
GuardLogix processor, 8.0 MB standard memory, 4.0 MB safety memory
1
1756-L7SP GuardLogix Safety Partner 1
1756-EN2TR ControlLogix® EtherNet/IP Module 1
1756-PA72 Power supply, 120/240V AC input, 3.5 A @24V DC 1
1756-AA Four-slot chassis 1
Compact GuardLogix 5370
1769-L30ERMS
1769-L33ERMS
1769-L36ERMS
1769-L37ERMS
1769-L38ERMS
Compact GuardLogix processor, 1.0 MB standard memory, 0.5 MB safety memory, or
Compact GuardLogix processor, 2.0 MB standard memory,1.0 MB safety memory, or
Compact GuardLogix processor, 3.0 MB standard memory, 1.5 MB safety memory, or
Compact GuardLogix processor, 4.0 MB standard memory, 1.5 MB safety memory, or
Compact GuardLogix processor, 5.0 MB standard memory, 1.5 MB safety memory
1
1769-PA2 CompactLogix® Power Supply, 120V/240V AC 1
1769-ECR Right-end cap and terminator 1

8Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
System Overview
The MAB and GuardLogix safety controller are connected over a CIP Safety connection.
The following status information is communicated from the MAB to the controller:
•Door/handle position, RFID technology (safety-rated status)
•Bolt position (safety-rated status)
•Lock status (safety-rated status)
•E-stop position (safety-rated status)
•Four push buttons (used for Unlock request/Lock request/resets in this safety function)
•RUN Mode
•MAB Faults
The following control information is communicated from the controller to the MAB:
•Fault resets
•Lock solenoid control (safety-rated control data)
•Four lights
•E-stop light
The final control device in this case is a pair of 100S safety contactors, K1 and K2. The contactors are controlled by a
1734-OB8S safety output module. The contactors are wired in a redundant-series configuration. A feedback circuit is
wired through the K1 and K2 normally open contacts and back to an input on the 1734-IB8S module to monitor the
contactors for proper operation. The contactors cannot restart if the feedback circuit is not in the correct state.
The contactor feedback circuit is wired to the 1734-IB8S safety input module in this example. Feedback wiring to a
safety module is not required for functional safety. The feedback circuit could be wired to a standard input module.
The system has individual reset buttons for resetting faults and resetting safety outputs.

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 9
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Electrical Schematic
For an electrical schematic in AutoCAD or EPLAN format, see the attached files.
'UDZLQJQXPEHU
&XVWRPHUQXPEHU
 (3/$1
6$)(7<$7
&RPPLVVLRQ
7RWDO3DJH
5HSODFHPHQWIRU
2I
5%DUJLU
(3/$1
'DWH 1DPH
3ODQWGHVLJQDWLRQ

5HSODFHGE\

3DJH
0RGLILFDWLRQ 1DPH
6)$7V)2565:,5,1*',$*
2ULJLQDO
7RWDOQRRISDJHV
'DWH
$SSU 
(GE\
3UHYLRXVSDJH

',
,%6
9'&&/$66
'&&20
'2
2%6
(6723
*0$%5%85(2-3 *0$%+5
(7+(51(7,3
,)86,1*')8&;
81/2&.
5(48(67
5(6(7
6$)(7<
5(6(7
/2&.
5(48(67
;
, , , ,
, , , ,
&20 &20 &20 &20
7 70 7 70
9

9


7%'&

&20 &20 &20 &20
&20 &20 &20 &20
2 2 2 2
2 2 2 2
8 9 :
3(
0 a
0


.






.




3(


.


.
$ $
6&=/&
.
$ $
6&=/&
.
  
  
  




7%'&







%/8

%51

9 
9 
/ / /

10 Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Network Architecture
The controller, EtherNet/IP connection, and MAB are shown in the controller organizer in the Logix Designer
application.
Configuration
The GuardLogix controller is configured by using the Studio 5000 Logix Designer® application. You must create a
project and add the POINT Guard I/O modules and the multifunctional access box. A detailed description of each step
is beyond the scope of this document. Knowledge of the Logix Designer application is assumed.
For a Studio 5000 Logix Designer project file that you can import into your own project, see the attached ACD file. The
attached ACD file includes a GuardLogix 5570 controller, but if you choose a Compact GuardLogix 5370 controller,
you can change the controller in the Logix Designer program. Make sure that the controller used in your safety function
is the same controller used in your SISTEMA PL calculation.
Createa Project with a GuardLogix Controller
If you are not using the attached ACD file, follow these steps to create a project.
1. In the Logix Designer application, create a project with a GuardLogix controller that includes the following:
•A connection to an Ethernet network
GuardLogix 5570 controllers require the use of an Ethernet communication module, but
Compact GuardLogix 5370 controllers have Ethernet ports.
•Time Synchronization enabled on the controller and any Ethernet communication modules, if used
2. Set the IP Address for the controller or any Ethernet communication modules, if used.
3. Add a POINT I/O™ Ethernet adapter module to your project.
4. Add POINT Guard I/O modules to your project.
Minimum Logix Designer Application Version Product
20 GuardLogix 5570 controller
28 Compact GuardLogix 5370 controller (1769-L30ERMS, 1769-L33ERMS, 1769-L36ERMS)
31 Compact GuardLogix 5370 controller (1769-L37ERMS, 1769-L38ERMS)
GuardLogix 5570 Controller Organizer Compact GuardLogix 5370 Controller Organizer

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 11
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
5. Configure the modules properly for your application.
See Additional Resources for more information regarding I/O modules.
6. Add a multifunctional access box (MAB) to your project.
7. Configure the MAB properly for your application.
See Additional Resources for more information regarding your product.
Programming
Rung 0
This rung sets the input status in the emergency stop DCS instruction. If the MAB connection is valid, and there are no
MAB emergency stop faults, then set the DCS MAB emergency stop input status to high (1).
Rung 1
The DCS instruction monitors the E-stop button on the MAB. The E-stop button is not part of the door-lock safety
function. Both the emergency stop interlock and door interlock drop out the safety output enable in rung 7. The MAB is
a safety device residing on the CIP Safety network, so there is no safety issue with using only one tag for the MAB
emergency stop state. That one tag is placed into both channel A and channel B. There is never a DCS discrepancy fault,
because the same tag is used for both channels, but the DCS instruction provides the reset/restart functionality without
having to write additional code.
Rung 2
This rung sets the input status in the MAB DCSTL instruction. If the MAB connection is valid, then set the DCSTL
MAB door lock input status to high (1). The MAB Lock status cannot be used to influence the DCSTL input status.
Many MAB faults require the door to be opened and closed to recover, and if the DCSTL input status goes to low (0),
the DCSTL unlock command cannot be changed unless the input status recovers. That creates a problem– the MAB
status cannot be reset until the DCSTL input status is repaired, which requires the MAB status to be repaired.
Rung 3
The DCSTL instruction monitors the door and lock on the MAB.
Every time the door unlocks, the DCSTL instruction requires that the door be opened and then closed. A fault occurs if
the gate is unlocked and then locked without the door opening and closing. The branches above the DCSTL instruction
provide a software-driven demand on the door. If the door unlocks, then the channels are set to low (0) for one scan only.
Other than that single scan, the channels are driven by the MAB status, which indicates whether the door is closed and
the bolt is extended. The software-driven demand does not operate when the DCSTL instruction sees a request to test
the door, which occurs when the Test Request input is toggled to low (0).
The basic operation of the DCSTL instruction is as follows: To set the DCSTL output O1 (door interlock) to high (1),
channel A and channel B must be set to high (1), the test request must be set to high (1), the unlock request must be set
to low (0), the lock feedback (FB) must be set to high (1), the hazard stopped parameter must be set to high (1), which
indicates that the hazard is stopped, and the input status must be set to high (1). A reset can then turn output O1 on. The
Hazard_Stopped parameter would typically then go to low (0) because the door interlock allows the hazard to move.

12 Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
To unlock the gate, the assumption is that the hazard is moving and that the Hazard_Stopped parameter is low (0). An
unlock request is made by pressing the Unlock Request (upper left buttonon the MAB), which sets the unlock request of
the DCSTL instruction to high (1). When the hazard stops, the unlock command (ULC) is set to high (1) by the
DCSTL instruction. The high (1) unlock command unlocks the door, which sets the lock feedback to low (0). The
operator can enter the hazardous area. Upon leaving the hazardous area, the operator closes the door and turns the handle
to extend the bolt. To lock the door, press the Lock Request button (top right button on the MAB). The DCSTL
instruction responds by setting the unlock command (ULC) to low (0). The low (0) unlock command locks the door,
which sets the lock feedback to high (1).
The DCSTL output O1 is used as a door interlock to drop out the safety actuators in rung 7.
Rung 4
This rung controls the unlock request input to the DCSTL instruction. If the gate is locked, and there is an unlock
request (top left button on the MAB), then seal in the command until there is a lock request (top right button on the
MAB).
Rung 5
This rung controls the lock solenoid of the Power-to-release MAB. It is driven by the DCSTL unlock command.
Rung 6
This rung generates a reset command on the trailing edge of the safety reset (bottom right button on the MAB). ISO
13849-1 stipulates that instruction reset functions must occur on falling edge signals. To comply with this requirement, a
One Shot Falling (OSF) instruction is used on the safety reset rung. Then, the OSF instruction Output Bit tag is used to
seal-in the safety output enable on the next rung.
Rung 7
This rung is a seal-in for the safety-output enable interlock. The enable is used as the actuate input in the CROUT
instruction in rung 8. It seals in around the reset button. The seal-in is broken if either the emergency stop or door
interlock is dropped out due to either a demand or a fault. Faults in the output circuit that are monitored by the
CROUT instruction also break the seal-in. If there is an unlock request or a stop command, the seal-in is broken. If the
seal-in is broken, the CROUT instruction output is dropped out and the hazard coasts to a stop. Typically, a stop
command is generated by a normally-closed red push button. But in this sample code, the stop interlock is manually
toggled. The only time it is required to be used is to stop the hazard so that the user can test the door.
Rung 8
The CROUT instruction controls the redundant safety contactors and monitors the feedback circuit to make sure that
both contactors are operating properly. The actuate is driven by the output enable seal-in in rung 7. The channel status of
the 1734-IB8S safety input 7 is used as the input status of the CROUT instruction. If the channel status is not valid, then
the CROUT outputs drop out.
Rung 9
The outputs of the CROUT instruction drive the redundant safety contactors, K1 and K2. In this example, the bottom
right light on the MAB is energized in rung 27 when the contactors are energized.

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 13
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Rung 10
The channel status of the two1734-OB8S outputs that control the contactors are used to generate a tag that is used as the
output status for the CROUT instruction. If either of those status bits is not valid, then the CROUT outputs drop out.
Rung 11
The DCSTL instruction supports a test function. If Test_Request transitions from high (1) to low (0), then the operator
must open and close the gate to satisfy the test requirement. The DCSTL instruction drops out output (O1) during the
test, so the hazard must be stopped before the test request is made. To stop the hazard, use the STOP command on
rung 7. In this example, you can simply toggle ToggleLO_for_Test_Request to low (0) to initiate a test. After the test is
completed, toggle it back to high (1).
Rung 12
In this safety function, you must generate a tag for the DCSTL instruction that indicates the hazard is stopped, and that
it is safe for the DCSTL instruction to unlock the door. This tag will replace the placeholder tag
[Hazard_has_Stopped_Interlock].
Rung 13
This rung blinks a light (bottom left) on the MAB, if the door monitor (DCSTL instruction), the MAB emergency stop
monitor (DCS instruction), the contactors (CROUT instruction), or the MAB hardware has a fault for which a fault
reset is required to recover. The blink is driven by code in a standard task, and the Blink_SafetyTask tag is generated in
the mapping tool.
Rung 14
This rung energizes the top-right light on the MAB, if the door is locked. The light blinks if the door is closed and
unlocked, waiting to be locked.
Rungs 15 through 17
If the MAB has an internal Lock Sequence Fault, then the reset button (bottom left on the MAB) can be used to unlatch
the fault. The MAB requires that the reset pulse width to be 10 ms…10000 ms in length, which is the purpose for the
2000 ms timer.
Rungs 18 through 20
If the MAB has an internal General Fault, then the reset button (bottom left on the MAB) can be used to unlatch the
fault. The MAB requires that the reset pulse width to be 10 ms…10000 ms in length, which is the purpose for the
2000 ms timer.
Rung 21
This rung indicates when the MAB lock solenoid has reached 1,000,000 cycles. One million cycles is the maximum
number of switching cycles allowed in the lifetime of the MAB.

14 Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Rung 22
This indicator can be used to inform maintenance that the MAB has a fault that requires a power cycle to recover.
Rung 23
This indicator can be used to inform maintenance that the MAB has a fault that requires the emergency stop (E-stop) on
the MAB to be cycled, followed by a reset, to recover.
Rung 24
This indicator can be used to inform maintenance that the MAB has a fault that requires the door on the MAB to be
cycled, followed by a reset, to recover. In this example, the top left light on the MAB is flashed to indicate that an unlock
is required before the door can be cycled. This light also flashes if the DCSTL instruction is in a state that requires a door
cycle.
Rung 25
This indicator can be used to inform maintenance that the MAB has a fault that requires the door on the MAB to be
opened, followed by a reset, to recover.
Rung 26
This indicator can be used to inform maintenance that the MAB has a fault that requires the lock on the MAB to be
cycled, followed by a reset, to recover.
Rung 27
The bottom right light on the MAB is energized when the contactors are energized, and the light blinks if the safety
interlocks are satisfied and all that remains to energize the contactors is a safety reset (bottom right button on the MAB).

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 15
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
For controller logic that you can download to your controller, see the attached ACD file.

16 Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 17
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function

18 Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function

Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018 19
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Falling Edge Reset
ISO 13849-1 stipulates that instruction reset functions must occur on falling edge signals. To comply with this
requirement, a One Shot Falling (OSF) instruction is used on the reset rung6. Then, the OSF instruction Output Bit tag
is used as the reset bit for the output enable on rung 7.

20 Rockwell Automation Publication SAFETY-AT129B-EN-P - November 2018
Door Locking and Monitoring with a 442G Access Box and an Integrated Safety Controller Safety Function
Calculation of the Performance Level
When properly implemented, this safety function can achieve a safety rating of Category 4, Performance Level e (Cat. 4,
PLe), according to ISO 13849-1: 2015, as calculated by using the Safety Integrity Software Tool for the Evaluation of
Machine Applications (SISTEMA).
The SISTEMA file that is referenced in this safety function application technique is attached to this document.
The average frequency of a dangerous failure per hour (PFH) for electromechanical systems may be calculated differently
based on the version of ISO 13849 supported by SISTEMA. ISO 13849-1:2015, which changed the maximum MTTFd
from 100…2500 years, is supported starting in version 2.0.3 of SISTEMA. As a result, the same SISTEMA data file that
is opened in two different versions of SISTEMA can yield different calculated results.
The (logic) GuardLogix 5570 controller subsystem uses 1.2% of PLe bandwidth. The (logic) Compact GuardLogix
5370 controller subsystem uses 1.5% of PLe bandwidth.
Complete Safety Function PL Calculation Example
Assuming the use of the following subsystem choices, the overall performance level that is achieved is shown in the
graphic. If you choose the GuardLogix 5570 controller, you need different calculations.
The overall safety system can be modeled as follows:
IMPORTANT To calculate the PL of your entire safety function, you must include the specific subsystems that you chose. Depending on the devices you choose, the
overall safety rating of your system will be different. An example that describes how to calculate the safety rating for a completesafetyfunctionappears in
the section titled Complete Safety Function PL Calculation Example.
Input Logic Output
442G MAB
DoorLock 1756-L73S 1734-OB8S
k1
100S
k2
100S
Subsystem 1 Subsystem 2 Subsystem 3 Subsystem 4