Safety PLCs

GuardPLC System Overview . . . . . . . . . . . . . . . . . . . 8-2

GuardPLC 1200 Packaged Safety Controller . . . . . . . 8-6

GuardPLC 2000 Safety System. . . . . . . . . . . . . . . . . . . 8-7

Safety PLCs
GuardPLC Safety Control Systems
System Overview

CPU processes input values to control outputs.

GuardPLC 2000
1755 Chassis Safety System

Slot Filler

Power Supply

I/O Module converts input-circuit signals to back plane

levels and converts back plane signals to output circuit
levels. The total number of safety I/O modules must not
exceed six (any combination of digital, analog and counter).

8-2
 Safety PLCs
GuardPLC Safety Control Systems
System Overview
Advantages
Depending on your application needs, Rockwell Automation offers
two state-of-the-art GuardPLC Safety Control Systems. The
GuardPLC 1200 Packaged Safety Controller is designed for small
GuardPLC 1200 Packaged control applications that require functional safety and that can be
Safety Controller is a fully-
equipped and compact unit serviced with a fixed number of I/O points.
with built-in CPU, power
supply, and I/O (digital I/O
and counter/encoder
In contrast, the GuardPLC 2000 Safety System is designed to
module). control large applications. This system can have a maximum of 144
digital inputs, 96 digital outputs, or 48 analog inputs, or 48 analog
outputs. You can have any combination of six safety-related I/O
modules as long as you don’t exceed the maximum current of 30A
for the 24V DC power supply.

During the 1960s and throughout the 1970s, the machine control • Programming is simple. RSLogix Guard Software, designed to
industry made the transformation from relay-based logic to operate with Microsoft Windows NT v4.0 or Windows 2000,
programmable logic controllers, commonly referred to as PLC provides a drag-and-drop palette of function blocks to create
controllers. This transformation let the control engineer create safety logic; while, other screens help developers enter tag names,
systems with extremely high productivity, flexibility and reliability, populate chassis, set up communication, and associate tags with
and revolutionized the machine control market. The continual specific I/O.
evolution and consolidation of safety standards among Europe, • Affordable solution. The GuardPLC Safety Control System is
North America and Asia has brought about new practices in the built with redundant CPUs in one controller, has outputs with
application of safety on the factory floor. New classes of products built-in monitoring, is designed to comply with the latest global
such as safety relays and safety switches have become familiar safety standards, and uses graphical programming software.
fixtures in the automation industry. Now, just as the PLC controller Therefore, the cost of a GuardPLC safety control system is
changed the way standard machine control logic was accomplished, affordable compared to the cost of using standard redundant
the Safety PLC System is changing the face of functional safety for PLC processors, excessive I/O hardware, custom software, and
machine control. additional engineering time to create a safety system wherein all
the components meet global safety standards.
Rockwell Automation is no stranger to meeting manufacturers’ • Reliability. GuardPLC Safety Controllers and modules are
safety needs. Some of the company’s earliest safety products designed specifically for very high MTBF (Mean Time Between
included emergency stop buttons in the early 1900s and the Allen- Failure) and very low PFD (Probability of Failure on Demand).
Bradley 700P control relay with interlocked contacts in the 1940s. In • Modularity. The GuardPLC 2000 system provides a
the 1960s, the Bulletin 1040 was created for clutch/brake control for configurable and expandable system including digital I/O, analog
mechanical stamping presses. Throughout the 1970s and 1980s, I/O, timers, and high-speed counters.
Allen-Bradley, now part of Rockwell Automation, manufactured • Compact size. The GuardPLC 1200 Packaged Safety Controller
programmable controllers that featured unalterable core memory for mounts on a DIN rail and fits into limited panel space.
unprecedented safety. Today, safe start-up and shutdown of igniters • Flexibility. The programmable nature of the GuardPLC
is provided by the Rockwell Automation advanced burner controllers make them ideal as solutions for several types of
management control systems. GuardPLC 1200 and 2000 Safety safety applications and provides for functionality that may be
controllers take Rockwell Automation into their next generation of difficult or impossible to implement with a hard-wired safety
safety systems. solution.
• High productivity. The flexible programming of the GuardPLC
As industrial automation broadens to accommodate a more global controllers helps the control engineer create maintenance modes
marketplace, equipment manufacturers and users are applying of operation with “limited shutdown” capability, which allows for
international standards to their installations—in no area is this more quick restarting of the process and reduced downtime. The
true than in machine safety. Historically, safety and productivity have extensive diagnostics aid in the troubleshooting and repair of the
worked against each other on the plant floor. With the latest safety system as well as reduce downtime and increase
developments in machine safety products, this is no longer the case. productivity of the manufacturing process.
In the past, machine safety was thought of as merely an expense; that
notion has evolved into the acceptance of safety as an investment
Safety System Features
that may actually increase productivity. With Rockwell Automation
• Designed for application in systems up to Safety Integrity Level 3
Safety Systems, all maintenance programs are run in the same
(SIL 3) according to IEC 61508 without restrictions; certified by
controller so that specific portions of a manufacturing cell can
TÜV Product Services; and meets Machinery Directive EN 954–
operate while other portions are stopped for safety reasons.
1, Category 4.

8-3
Safety PLCs
GuardPLC Safety Control Systems
System Overview (continued)
• Eliminates the need for dual standard PLC processors and Safety Concept
excessive I/O in safety-related applications The GuardPLC 1200 and GuardPLC 2000 systems each have a fail-
• Eliminates writing, testing, and certifying software whose only safe CPU. Faults that individually have a direct impact on the safety
purpose is to monitor the safety control system system are detected within a Safety Time specified by the user. Faults
• Creates run time and maintenance programs using easy-to- that do not directly affect the safety function of the system unless
program function blocks they occur in combination with another fault are detected within the
Multiple Error Occurrence Time, which is preset in the operating
A GuardPLC product is the intelligent combination of safety-related system to 24 hours. This results in the following behaviours:
programmable controllers and easy-to-learn programming. As
shown below, there are two types of controllers available to fit • The user specifies the Safety Time and the Watchdog Time for
customer needs—one that’s compact and one that’s modular. the safety system. The Multiple Error Occurrence Time is preset
in the operating system (24 hours).
Communication • The controller continues to provide safety-related functions even
A proprietary Ethernet safety link is used for programming and upon the detection of an error.
configuration between the safety controller and the Programming • Faulty input signals (e.g. incorrectly transmitted input values) do
and Debugging Tool with RSLogix Guard software installed. not affect the safety function of the CPU. Faulted input signals
have a “0” value.
• The failure of the CPU does not affect the safety function of the
other safety-related modules (digital inputs, digital outputs, etc.).

GuardPLC 1200 Packaged GuardPLC 2000

Safety Controller is a fully- Safety System is a
equipped and compact unit. modular system.

8-4
 Safety PLCs
GuardPLC Safety Control Systems
System Overview (continued)
Functional Design A simple system for small control applications can consist of a single
Each of the logic circuits within the Safety PLC that supports digital compact GuardPLC 1200 unit and a Programming and Debugging
and analog inputs, outputs, and counters contains several test points Tool, which is a personal computer running Windows NT v4.0 or
as shown in the following figure. A typical digital output logic circuit Windows 2000 operating system and has RSLogix Guard 1200 or
contains a test point near each of the two safety switches located RSLogix Guard 2000 installed. On-board I/O includes a maximum
behind the output driver as well as a third test point near the second of 20 digital inputs, 8 digital outputs, and 2 counters.
output driver. Each of the two safety switches is controlled by a
different microprocessor. If a failure is monitored at either of the
Programming and
two safety switches due to switch or microprocessor failure or at the Debugging Tool
test point near the output driver, the operating system of the Safety
PLC automatically acknowledges system failure. Then, on its own,
the Safety PLC defaults to a known state facilitating an orderly
equipment shutdown.
Proprietary Ethernet Safety Link

Safety Safety Output

Switch 1 Switch 2 Driver
To Actuator

GuardPLC 1200 OUTPUTS

Local I/O on-board the
Test Test Test Packaged PLC
1200 GuardPLC 1200
Points Points Points Controller GuardPLC 1200 Back Plane Packaged
Output Microprocessor Controller, 8 digital
INPUTS

Driver outputs, 20 digital inputs,

and 2 counters.

Test For large applications, a module safety controller system

Points communicates over a proprietary Ethernet safety link to a
To Secondary Programming and Debugging Tool with RSLogix Guard 2000
(Redundant) Actuator
installed. You can have a maximum of 144 digital inputs, 96 digital
outputs, or 48 analog inputs or 48 analog outputs.
Mechanical Design
The GuardPLC 1200 Packaged Safety Controller contains the safety Programming and
controller, power supply, and associated safety-related I/O packaged Debugging Tool
in a rugged plastic housing. It’s a compact system that’s ideal for
small spaces.

The GuardPLC 2000 Safety System chassis, which is a modular Proprietary Ethernet Safety Link
system, can house one safety controller, one power supply, and up to
six safety-related I/O modules.

GuardPLC 2000 Local I/O on-board the

Safety GuardPLC 2000
GuardPLC 2000 Back Plane Controller:
Microprocessor
You can have any combination
of 6 I/O modules including:
a digital combination module
with 24 inputs and 16 outputs,
an 8-point analog input module, an 8-point
analog output module and a high-speed
counter module that provides 2 counters.

8-5
Safety PLCs
GuardPLC 1200 Packaged Safety Controller
1754–L28BBB
Specifications
Number of safety-related 20 (not electrically isolated)
digital inputs
Nominal Input Voltage 24V DC
On-State Voltage 10-30V DC
On-State Current 2mA @ 10V DC, 13mA @ 30V DC
Off-State Voltage 5V DC (maximum)
Off-State Current 1.5mA per channel (maximum)
4mA per channel (minimum)
Number of safety-related 8 (not electrically isolated)
digital outputs
Output Voltage Range 18.4 to 26.8 V DC
Output Current Channels 1 through 6: 0.5A per channel
Channels 7 & 8: 2A per channel
The GuardPLC 1200 is a safety-related compact Programmable Number of safety-related 2
counters
Electronic System (PES), which is designed in accordance with IEC
Inputs per counter 3 (Input A, Direction, Gate/Reset)
61131. Despite its small size, it complies with the requirements for a
Counter Resolution 24 Bit
control system with the safety integrity level (SIL 3) according
Input Frequency 100 kHz (maximum) in counter modes
IEC 61508.
Power Supply Voltage 24V DC(20 / -15%), ≤ 15% ripple
The GuardPLC 1200 is designed for smaller applications that Power Rating 8A (maximum)
require functional safety and that can be serviced with a fixed Ambient Temperature 0°C to 60°C (32°F to 140°F)
number of I/O points. The compact size of the GuardPLC 1200 (Operating)
combined with DIN rail mounting allows deployment even under Storage Temperature -40°C to 85°C (-40°F to 185°F)
cramped space conditions. Operating Humidity 5 to 95% (without condensation)
Shock Operating: 30g non operating: 50g
The GuardPLC 1200 includes a power supply, CPU, Watchdog, 20 Vibration Operating: 2g @ 10 to 500Hz
digital inputs, 8 digital outputs plus 2 counters and communication Dimensions (WxHxD) 90 x 160 x 87mm
(3.54 x 6.29 x 3.42in)
ports, all incorporated in a rugged plastic housing.
Weight 0.68 kg

Typical Applications
• Perimeter guarding for Robot/weld cells
• Perimeter guarding for Packaging Machines
• Entertainment industry (ride control and ski lift control)
• Burner Management
• Press Controls

Features
• Rugged plastic housing
• DIN rail mounting
• I/O self test
• 30 I/O points
• 24V digital I/O
• Multiple I/O test points
• Certified by TÜV for use in applications to SIL 3 according to
IEC 61508; EN 954–1, Category 4
• Programmed with RSLogix Guard Software
• RS–232 port for ASCII communication (read only)
• Ethernet port for programming, configuration and Peer-to-Peer

8-6
 Safety PLCs
GuardPLC 2000 Safety System
1755–L1
Specifications
User Memory 500 KB application code memory
500 KB application data memory
Operating Voltages 3.3V DC
5V DC
Current Consumption 3.3V @ 1.5A5V @ 0.1A
Operating Temperature 0°C to 60°C (32°F to 140°F)
Storage Temperature -40°C to 85°C (-40°F to 185°F)
Operating Humidity 5 to 95% (without condensation)
Shock Operating: 30g non operating: 50g
Vibration Operating: 2g @ 10 to 500Hz
Weight 6.3 kg (fully equipped)
Dimensions (WxHxD) 255 x 285 x 210mm
(10 x 11.22 x 8.26in)
The GuardPLC2000 CPU has one 10/100BaseT Ethernet port for
programming and configuration and two interface ports (9-pin
D-shell) for serial connections. The CPU controls all functions of
the GuardPLC 2000 system as well as communication to other
systems. LEDs display the operating modes: Run and Error for the
I/O modules; Run, Error, Stop, Programming and Forcing for the
CPU.

Typical Applications
• Perimeter guarding for Robot/weld cells
• Perimeter guarding for Packaging Machines
• Entertainment industry (ride control and ski lift control)
• Semi-conductor industry
• Press Control
• Burner Management
• Shipping (rudder controls)

Features
• Metal chassis
• I/O self test
• 24V DC digital I/O
• Expandable number of I/O
• Multiple I/O test points
• Certified by TÜV for use in applications up to SIL 3 according to
IEC 61508; EN 954–1, Category 4
• Programmed with RSLogix Guard Software
• RS–232 port for ASCII communication (read only)
• Ethernet port for programming, configuration and Peer-to-Peer

8-7
Safety PLCs
GuardPLC 2000 Safety System
Chassis 1755–A6 Power Supply 1755–PB720

The GuardPLC chassis houses the GuardPLC 2000 controller, The power supply module transforms the system supply voltage
power supply, and up to six safety I/O modules. A filler module is from 24V to 3.3V DC/5V DC (used for internal I/O bus). It
also available for unused slots (catalogue number 1755–N2). occupies the left-most slot of the GuardPLC 2000 chassis. The
power supply comes with a lithium battery, which has a four-year life
Specifications span, that is used for back-up. Four LEDs indicate the power supply,
battery voltage, and faults.
Description Expansion chassis for adding safety I/O
modules
Number of Slots 6
Dimensions (WxHxD) 255 x 285 x 210mm (10 x 11.2 x 8.3in)
Weight 3.3kg (7.2lbs)
Mounting Back-panel mounting
Catalogue Number 1755-A6

8-8
 Safety PLCs
GuardPLC Safety Control Systems

Overview • The analog output module, which is available in the GuardPLC

Safety-related input modules are automatically subjected to a high- 2000 system only, has eight analog outputs with a 12-bit
grade, cyclical self-test in both the GuardPLC 1200 and GuardPLC resolution. They are electrically isolated in groups of two outputs
2000 systems during operation. These test routines are TÜV with a common ground. The output ranges of the module can be
approved and help ensure the safe function of the respective switched to 0 to 21 mA, 0 to 10.25V DC or -10.25 to +10.25V
module. When an error is detected, the application is provided with DC. For each channel, the module has a switch placed on the
an “0” signal, and a detailed error message is generated optionally. If printed circuit board to switch the different output ranges. In
there are minor failures in the module (no effect on the safety case of module error, the outputs are switched to the de-
function), no user diagnostic information is generated. energized state.
• The counter module has two operating modes: counter mode and
• The GuardPLC 2000 digital I/O module has 24 inputs and 16 decoder mode. The module has 24-bit counters with two outputs
outputs for signals, and the inputs and outputs are electrically each. The counters can operate in both directions (up and down)
isolated in groups of eight. The GuardPLC 1200 digital I/O and have a separate reset input. The input signals of 5V can be in
module has 20 inputs and 8 outputs. In case of module error, the a frequency range of 0 to 1 MHz in a GuardPLC 2000 system.
outputs are switched to the de-energized state. Use a PC to configure the input voltage, which can be 5V or in a
• The analog output module, which is available in the GuardPLC range of 10 to 26.4V. In case of module error, the outputs are
2000 system only, the eight channels on the analog input module switched to the de-energized state. The counter can count pulses
can be used as eight single-ended or four differential analog with direction and reset inputs up to 1 MHz in the GuardPLC
inputs for 0 to 20 mA. No mixing is allowed. The incoming 2000 system and up to 100 KHz in the GuardPLC 1200 system.
signals are converted into an integer value with a 12-bit
resolution. This value then can be used in the user program. In The counter module can also be used as an 8-bit gray code
case of module error, the logic outputs of the modules are encoder in the GuardPLC 2000 system or a 6-bit gray code
switched to the de-energized state. encoder in the GuardPLC 1200 system.

I/O Hardware
Safety Digital I/O Combination Module
Max
Maximum Operating Continuous Number Catalogue
Operating Signal Delay Off-State On-State Number Voltage/ Signal Delay Current of Number
Voltage (max) Current Current of Inputs Type (max) per Output Outputs Applications 1755–
GuardPLC GuardPLC
2000 2000
on = 70µs on = 70 µs Safety
off = 70 µs 2mA @ 10V off = 15 µs 2A (8A applications
10-30V 1.5mA @
13mA @ 24 18.4-
total per 16 requiring 24V
DC 5V DC 26.8V DC DC inputs and –IB24XOB16
GuardPLC 30V GuardPLC module) 24V DC
1200 1200 outputs
on = 120 µs on = 15 µs
off = 200 µs off = 90 µs

Safety Analog I/O Modules

Catalogue
Number of Inputs/ Back Plane Channel Update/ Number
Outputs Data Format Voltage Range Current Range Current Load Resolution 1755–
4 differential or 8 12-bit signed
single–ended inputs Integer (natural ±10V 0-20.5mA 150 mA/3.3V DC 12 bits (0-1000) IF8
0-10V DC (with shunt) 400 mA/24V DC
— selectable binary)
12-bit signed
±10V 150 mA/3.3V DC
8 outputs Integer (natural 0-20mA 12 bits (0-1000) OF8
0-10V DC 400 mA / 24V DC
binary)

Safety Counter Module

Maximum Input
Inputs Frequency Outputs Location Back Plane Current Load Catalogue Number
0.1A / 24V DC without load
2 1 MHz 4 Any unused slot 0.8A (3.3V DC), 0.1A (5V 1755-HSC
DC)

8-9
Safety PLCs
GuardPLC Safety Control Systems

Weights Features
• Save programming and configuration time using software that’s
Catalogue Number and Weight in kg (lb)
already certified for use in applications up to SIL 3
• 1754–L28BBB 0.68 (1.5) • Program your safety control system using pre-defined graphical
• 1755–A6 3.3 (7.3) elements and a “drag and drop” palette
• 1755–HSC 0.26 (0.57) • Tag-based system
• 1755–IB24XOB16 0.26 (0.57)
• 1755–IF8 0.24 (0.53)
System Requirements
• 1755–L1 0.28 (0.62)
• 1755–OF8 0.28 (0.62) To install RSLogix Guard Programming Software on a personal
• 1755–PB720 0.82 (1.8) computer, you need to meet the following minimum requirements.

Programming Software CPU Processor Pentium II, 400 MHz

RAM 128M bytes
RSLogix Guard Software
Graphic Adaptor Resolution: 1024 x 768 pixels (XGA)
The safety aspects of the GuardPLC Safety Control System extend
beyond the physical control platforms. Like the controllers, Hard Disk Space 30M bytes (minimum) for RSLogix
Guard plus space for user defined
programming software must also be certified to support Safety programs
Integrity Level 3 (SIL 3) applications and is a critical component of Operating System Windows NT v4.0 or Windows 2000
the total safety system. The programming and configuration tool for
GuardPLC 2000 and GuardPLC 1200 safety controls is RSLogix Ordering Information
Guard software, designed to operate with Microsoft Windows NT You can install RSLogix Guard Programming Software on a local
v4.0 or Windows 2000 operating system. drive only (not a network).

Since the RSLogix Guard software is a function block-based

Description Catalogue Number
programming tool, there is no need for programmers to learn a
RSLogix Guard 1200 for GuardPLC 1200
cryptic programming language. Using such pre-defined elements as Packaged Safety Controller
AND and OR gates, numerical functions, counters, and timers, • 200 variables per POU (Program Organization 1754–PCS
programmers select and “drag” the appropriate functions onto their Unit)
workstation screen. These functions, like the controllers, have been RSLogix Guard 2000 for GuardPLC 1200 and
GuardPLC 2000 Safety Controllers
certified for use in applications up to SIL 3. Subsequent • 650 variables per POU (Program Organization 1755–PCS
programming is as easy as drawing lines to “wire” inputs and Unit)
outputs to the logical elements and making connections to hardware • User-defined function blocks
by way of user-defined variables or tags.

The RSLogix Guard software is also used for system diagnosis and
debugging. It can provide the status of controller CPU and I/O and
can be used to obtain information about the application program.

8-10