SF_Override

This is the web edition of the original ‎⮫ AC500-S safety user manual, version 1.4.0. This web edition is provided for quick reference only. The original safety user manual must be used to meet functional safety application requirements.

Standards	Requirements
EN IEC 62046:2008	5.5.4 Mute dependent override A manually operated, mute dependent override function can be necessary to allow blockages to be removed from the detection zone of the protective equipment. When a mute dependent override function is active, access to the hazardous zone can be possible without actuating the trip function. Mute dependent override shall permit operation of the hazardous elements only in reduced risk conditions. For details of reduced risk conditions see ISO 12100-2, 4.11.9. When a product or transport unit is stopped in the detection zone of the ESPE or of the muting sensors, the muting function shall be cancelled and all dangerous action once safe operation conditions have been re-established. The override function shall be enabled only when the output of the ESPE is in the OFF-state and/or at least one muting sensor is actuated. From a lockout condition (when a dangerous fault is detected) it shall not be possible to actuate the override function. The mute dependent override function shall: be activated either: by the use of a spring return hold-to-run device located so that is not possible to enter the hazardous zone whilst maintaining the action on the hold-to-run device, and so that the hazardous zone is visible while actuating the device; or by the use of a key operated switch or equally secure momentary action pushbutton when: - the override function is automatically terminated after a correct muting signal sequence is identified, and - no access to the hazardous zone is possible during tho override sequence; - an emergency stop can be initiated from the same position. only be activated when at least one of the muting sensors is actuated; automatically terminate when all the muting sensors are de-actuated; automatically terminate after a pre-determined time limit has expired; only enable those movements that are necessary to permit blockages to be removed from the detection zone of the protective equipment. Measures shall be provided to prevent activation of the mute dependent override function due to a fault or inadvertent operation of the initiating device.
ISO 13849-1:2015	5.2.2 Manual reset function Note: A positive edge evaluation has the same quality as a negative edge evaluation.

Standards

Requirements

EN IEC 62046:2008

5.5.4 Mute dependent override

A manually operated, mute dependent override function can be necessary to allow blockages to be removed from the detection zone of the protective equipment. When a mute dependent override function is active, access to the hazardous zone can be possible without actuating the trip function. Mute dependent override shall permit operation of the hazardous elements only in reduced risk conditions. For details of reduced risk conditions see ISO 12100-2, 4.11.9.

When a product or transport unit is stopped in the detection zone of the ESPE or of the muting sensors, the muting function shall be cancelled and all dangerous action once safe operation conditions have been re-established.

The override function shall be enabled only when the output of the ESPE is in the OFF-state and/or at least one muting sensor is actuated. From a lockout condition (when a dangerous fault is detected) it shall not be possible to actuate the override function.

The mute dependent override function shall:

be activated either:
- by the use of a spring return hold-to-run device located so that is not possible to enter the hazardous zone whilst maintaining the action on the hold-to-run device, and so that the hazardous zone is visible while actuating the device;
- or by the use of a key operated switch or equally secure momentary action pushbutton when:
  
  - the override function is automatically terminated after a correct muting signal sequence is identified, and
  
  - no access to the hazardous zone is possible during tho override sequence;
  
  - an emergency stop can be initiated from the same position.
only be activated when at least one of the muting sensors is actuated;
automatically terminate when all the muting sensors are de-actuated;
automatically terminate after a pre-determined time limit has expired;
only enable those movements that are necessary to permit blockages to be removed from the detection zone of the protective equipment.

Measures shall be provided to prevent activation of the mute dependent override function due to a fault or inadvertent operation of the initiating device.

ISO 13849-1:2015

5.2.2 Manual reset function

Note: A positive edge evaluation has the same quality as a negative edge evaluation.

Standards	Requirements
ISO 12100:2010	6.2.11.9 Control mode for setting, teaching, process changeover, fault-finding, cleaning or maintenance Where, for setting, teaching, process changeover, fault-finding, cleaning or maintenance of machinery, a guard has to be displaced or removed and/or a protective device has to be disabled, and where it is necessary for the purpose of these operations for the machinery or part of the machinery to be put into operation, the safety of the operator shall be achieved using a specific control mode which simultaneously disables all other control modes, permits operation of the hazardous elements only by continuous actuation of an enabling device, a two-hand control device or a hold-to-run control device, permits operation of the hazardous elements only in reduced risk conditions (for example, reduced speed, reduced power/force, step-by-step, for example, with a limited movement control device), and prevents any operation of hazardous functions by voluntary or involuntary action on the machine's sensors. Note: For some special machinery other protective measures can be appropriate. This control mode shall be associated with one or more of the following measures: restriction of access to the danger zone as far as possible; emergency stop control within immediate reach of the operator; portable control unit (teach pendant) and/or local controls (allowing sight of the controlled elements). See IEC 60204-1.

Standards

Requirements

ISO 12100:2010

6.2.11.9

Control mode for setting, teaching, process changeover, fault-finding, cleaning or maintenance

Where, for setting, teaching, process changeover, fault-finding, cleaning or maintenance of machinery, a guard has to be displaced or removed and/or a protective device has to be disabled, and where it is necessary for the purpose of these operations for the machinery or part of the machinery to be put into operation, the safety of the operator shall be achieved using a specific control mode which simultaneously

disables all other control modes,
permits operation of the hazardous elements only by continuous actuation of an enabling device, a two-hand control device or a hold-to-run control device,
permits operation of the hazardous elements only in reduced risk conditions (for example, reduced speed, reduced power/force, step-by-step, for example, with a limited movement control device), and
prevents any operation of hazardous functions by voluntary or involuntary action on the machine's sensors.

Note: For some special machinery other protective measures can be appropriate.

This control mode shall be associated with one or more of the following measures:

restriction of access to the danger zone as far as possible;
emergency stop control within immediate reach of the operator;
portable control unit (teach pendant) and/or local controls (allowing sight of the controlled elements).

See IEC 60204-1.

This FB makes it possible to move a product in the production line even when the muting functionality was aborted due to an error. This FB is only applicable in combination with a muting FB.

A manual operated override function can be required to remove blockades in the safety area which resulted during the muting process. If override is active a stop request of the safety equipment is not effective.

This FB SF_Override is only to be used in combination with a muting FB.

In the application program itself, first the muting FB must be processed and then the override FB.

Note: The outputs Error and DiagCode of the preconnected muting are not transmitted to the outputs Error and DiagCode of the FB SF_Override.

Table 1090: FB name: SF_Override
Name	Data type	Initial value	Description, parameter values
VAR_INPUT
Activate	BOOL	FALSE	⮫ Table 1031 “General input parameters”
S_AOPD_In	BOOL	FALSE	Variable. OSSD signal from AOPD. FALSE: Protection field interrupted. TRUE: Protection field not interrupted.
S_Muting_AOPD_OUT	BOOL	FALSE	Variable. S_AOPD_OUT signal from the previous muting function block. FALSE/ TRUE: The status of the safety related output S_AOPD_OUT from the previous muting function block.
MutingError	BOOL	FALSE	Error output of the previous connected muting FB. FALSE: No error. TRUE: Error in muting process.
MutingSwitch11	BOOL	FALSE	Variable. Status of the muting sensor signal which is connected at the input MutingSwitch11 of the previous muting function block. FALSE: Muting sensor 11 not actuated. TRUE: Workpiece actuates muting sensor 11.
MutingSwitch12	BOOL	FALSE	Variable. Status of the muting sensor signal which is connected at the input MutingSwitch12 of the previous muting function block. FALSE: Muting sensor 12 not actuated. TRUE: Workpiece actuates muting sensor 12.
MutingSwitch21	BOOL	FALSE	Variable. Status of the muting sensor signal which is connected at the input MutingSwitch21 of the previous muting function block. FALSE: Muting sensor 21 not actuated. TRUE: Workpiece actuates muting sensor 21. Note that this parameter is not connected if the previous muting function is the SF_MutingPar_2Sensor.
MutingSwitch22	BOOL	FALSE	Variable. Status of the muting sensor signal which is connected at the input MutingSwitch22 of the previous muting function block. FALSE: Muting sensor 22 not actuated. TRUE: Workpiece actuates muting sensor 22. Note that this parameter is not connected if the previous muting function is the SF_MutingPar_2Sensor.
S_StartStopOverride	BOOL	FALSE	Signal for the start and stop of override functionality. A rising edge is needed to start the override functionality. TRUE: If all override conditions are fulfilled, the override process starts. At this moment also the timer for the MaxOverrideTime starts. FALSE: The override process stops. The timer for the MaxOverrideTime continues till the muting process is finished (transition from 8832 to 8002).
Reset	BOOL	FALSE	⮫ Table 1031 “General input parameters”
MaxOverrideTime	TIME	T#0s	Constant 0..10 min; Maximum time for the overall override process. The time is started when the start conditions for the override process are available. The timer is stopped when all the muting sensors are not muted anymore.
VAR_OUTPUT
Ready	BOOL	FALSE	⮫ Table 1032 “General output parameters”
S_AOPD_OUT	BOOL	FALSE	Safety related output, indicates status of the muted guard or override signal. FALSE: AOPD protection field interrupted and muting not active or override is not active. TRUE: AOPD protection field not interrupted or muting active or override is active.
OverridePossible	BOOL	FALSE	Status signaling that override is possible. FALSE: Override not possible TRUE: Override possible
OverrideActive	BOOL	FALSE	Indicates the status of override process. FALSE: Override not active. TRUE: Override active.
SafetyDemand	BOOL	FALSE	Optional. ⮫ Table 1032 “General output parameters”
ResetRequest	BOOL	FALSE	Optional. ⮫ Table 1032 “General output parameters”
Error	BOOL	FALSE	⮫ Table 1032 “General output parameters”
DiagCode	WORD	16#0000	⮫ Table 1032 “General output parameters”

SF_MutingPar_example_1 — Fig. 533: Example combination of SF_MutingPar with 4 sensors and SF_Override

SF_MutingPar_example_2 — Fig. 534: Example combination of SF_MutingPar_2Sensor and SF_Override

The override signal (S_AOPD_Out of the SF_Override FB) is set by the FB if:

the pre-connected muting FB shows an error,
an applicable S_StartStopOverride signal has a rising edge and a static TRUE,
the safeguard (e.g., light curtain) is interrupted and/or
at least one muting sensor is blocked.

The override signal (S_AOPD_Out of the SF_Override FB) is reset by the FB if:

all muting sensors are not active and the safeguard (e.g., light curtain) is not interrupted,
the applicable maximum override time is expired,
the S_StartStopOverride signal is FALSE.

Typical timing diagram

SF_Override_TimingDiagram — Fig. 535: Typical timing diagram for SF_Override

Error detection

Static signals are detected at Reset and after MaxOverrideTime elapsed.

Error behavior

In the event of an error the Error output is set to TRUE, the OverridePossible is deactivated, the OverrideActive is deactivated, and the DiagCode output indicates the relevant error code.

An error must be acknowledged by a rising trigger at the Reset input.

Function block-specific error and status codes

Table 1091: FB-specific error codes
DiagCode	State name	State description and output setting
C011	Reset Error	Static Reset condition detected after FB activation. Ready = TRUE S_AOPD_Out = FALSE OverridePossible = FALSE OverrideActive = FALSE SafetyDemand = FALSE ResetRequest = FALSE Error = TRUE
C410	Override Error	MaxOverrideTime elapsed. Ready = TRUE S_AOPD_Out = FALSE OverridePossible = FALSE OverrideActive = FALSE SafetyDemand = FALSE ResetRequest = TRUE Error = TRUE

Table 1092: FB-specific status codes (no error):
DiagCode	State name	State description and output setting
0000	Idle	The function block is not active (initial state). Ready = FALSE S_AOPD_Out = FALSE OverridePossible = FALSE OverrideActive = FALSE SafetyDemand = FALSE ResetRequest = FALSE Error = FALSE
8002	Safety Demand AOPD	Protection field interrupted and muting not active or override is not active and the timer for the MaxOverrideTime will be reset. Ready = TRUE S_AOPD_Out = FALSE OverridePossible = FALSE OverrideActive = FALSE SafetyDemand = FALSE ResetRequest = FALSE Error = FALSE
8012	Muting Error but Override not possible	The pre-connected muting FB shows an error but the safeguard (e.g., light curtain) is not interrupted and no muting sensor is blocked. Ready = TRUE S_AOPD_Out = FALSE OverridePossible = FALSE OverrideActive = FALSE SafetyDemand = FALSE ResetRequest = FALSE Error = FALSE
8022	Override Possible	The pre-connected muting FB shows an error and the safeguard (e.g., light curtain) is interrupted and/or at least one muting sensor is blocked. Ready = TRUE S_AOPD_Out = FALSE OverridePossible = TRUE OverrideActive = FALSE SafetyDemand = FALSE ResetRequest = FALSE Error = FALSE
8832	Override Interrupt	The override start signal is set to FALSE during override process. The time for the MaxOverrideTime is still running. Ready = TRUE S_AOPD_Out = FALSE OverridePossible = TRUE OverrideActive = FALSE SafetyDemand = TRUE ResetRequest = FALSE Error = FALSE
8000	Override Active	Override is active and the timer for the MaxOverrideTime is starting to run. Ready = TRUE S_AOPD_Out = TRUE OverridePossible = TRUE OverrideActive = TRUE SafetyDemand = FALSE ResetRequest = FALSE Error = FALSE
8100	AOPD Free	S_AOPD_Out from the pre-connected function block is TRUE Ready = TRUE S_AOPD_Out = TRUE OverridePossible = FALSE OverrideActive = FALSE SafetyDemand = FALSE ResetRequest = FALSE Error = FALSE