User Manual — Original Language

Guardmaster® 440C-CR30 Configurable Safety Relay

Catalog Number 440C-CR30-22BBB
Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and
operation of this equipment before you install, configure, operate, or maintain this product. Users are required to
familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,
and standards.

Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required
to be carried out by suitably trained personnel in accordance with applicable code of practice.

If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be
impaired.

In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the
use or application of this equipment.

The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and
requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or
liability for actual use based on the examples and diagrams.

No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or
software described in this manual.

Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,
Inc., is prohibited.

Throughout this manual, when necessary, we use notes to make you aware of safety considerations.

WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,
which may lead to personal injury or death, property damage, or economic loss.

ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property
damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.

IMPORTANT Identifies information that is critical for successful application and understanding of the product.

Labels may also be on or inside the equipment to provide specific precautions.

SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous
voltage may be present.

BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may
reach dangerous temperatures.

ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to
potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL
Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Allen­Bradley, Connected Components Workbench, ControlFLASH, Guardmaster, GuardShield, Micro800, Micro830, PanelView, PowerFlex, Rockwell Software, SafeZone, SensaGuard, and Zero-Force Touch Buttons are
trademarks of Rockwell Automation, Inc.

Trademarks not belonging to Rockwell Automation are property of their respective companies.
 Preface

Read this preface to familiarize yourself with the rest of the manual. It provides
information concerning:
• who should use this manual
• the purpose of this manual
• related documentation
• conventions used in this manual

Who Should Use this Manual Use this manual if you are responsible for designing, installing, configuring, or
troubleshooting control systems that use the CR30 safety relay.

You should have a basic understanding of electrical circuitry and familiarity with
safety related control systems. If you do not, obtain the proper training before
using this product.

Purpose of this Manual This manual is a reference guide for the CR30 safety relay, plug-in modules and
accessories. It describes the procedures you use to install, wire, and troubleshoot
your relay. This manual:
• explains how to install and wire your relay
• gives an overview of the CR30 safety relay system

Refer to the Online Help provided with Connected Components Workbench™

software for more information on configuring your CR30 safety relay.

Additional Resources These documents contain additional information concerning related products
from Rockwell Automation.
Resource Description
2711C-UM001_-EN-P PanelView™ Component HMI Terminal User Manual
440C-QS001_-EN-P Guardmaster® 440C-CR30 Software Configurable Safety
Relay Quick Start Guide
Industrial Automation Wiring and Grounding Guidelines, Provides general guidelines for installing a Rockwell
publication 1770-4.1 Automation industrial system.
Product Certifications website, http://www.ab.com Provides declarations of conformity, certificates, and
other certification details.
Allen-Bradley Industrial Automation Glossary, AG-7.1 A glossary of industrial automation terms and
abbreviations.

You can view or download publications at

http:/www.rockwellautomation.com/literature/. To order paper copies of
technical documentation, contact your local Allen-Bradley distributor or
Rockwell Automation sales representative.

You can download the latest version of Connected Components Workbench for
your CR30 at
http://compatibility.rockwellautomation.com/Pages/
MultiProductDownload.aspx?Keyword=Free&crumb=112

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 3

Preface

Definitions Publication AG-7.1 contains a glossary of terms and abbreviations used by

Rockwell Automation to describe industrial automation systems. Below is a list of
specific terms and abbreviations used in this manual.
• CCW – The Connected Components Workbench. This is a software
package that allows the user to configure a CR30, program a Micro800®
controller and configure a PanelView™ HMI.
• CR30 – Is the Cat. No. 440R-CR30-22BBB software configurable safety
relay, described in this user manual.
• HI – Logic state of being ON.
• LO – Logic state of being OFF.
• Logic Block – On the CCW grid, a logic block resides in any of the four
columns. A logic block is either: 1) a Safety Monitoring Function, 2) Logic
Level A, 3) Logic Level B, or 4) Safety Output Function.
• Logic Level A (LLA) – This column is used to perform logic processes on
a number of inputs to create a desired output state.
• Logic Level B (LLB) - This column is used to perform logic processes on a
number of inputs to create a desired output state.
• N.C. (Normally Closed) – An electrical contact whose normal state (i.e.,
no pressure or electrical potential applied) is in the closed position.
• N.O. (Normally Open) – An electrical contact whose normal state (i.e.,
no pressure or electrical potential applied) is in the open position.
• OSSD (Output Signal Switching Device) – This is typically a pair of
solid state signals that are pulled up to the DC source supply. The signals
are usually tested for short circuits to the DC power supply, short circuits
to the DC common and shorts circuits between the two signals.
• Reaction Time - Describes the time between the true states of one input
to the ON state of the output.
• Recovery Time - Describes the time required for the input to be in the LO
state before returning to the HI state.
• Response Time - Describes the time between the trigger of one input to
the OFF state of the output.
• Safety Function – This describes the complete sensing of the action (e.g.
open a safety gate) to execution the final output device (e.g. turning off a
pair of contactors).
• Safety Monitoring Function (SMF) – This is the input block on the
Connected Components Workbench for the CR30.
• Safety Output Function (SOF) – This is the output block on the
Connected Components Workbench for the CR30.
• Single Wire Safety (SWS) – This is a unique, safety rated signal sent over
one wire to indicate a safety status. The SWS can be used in Category 4,
Performance Level e, per ISO 13849-1 and Safety Integrity Level (SIL) 3,
per IEC 62061 and IEC 61508.

4 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Table of Contents

Important User Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Preface Who Should Use this Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Purpose of this Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Chapter 1
Overview Intended Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Hardware Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
CR30 Hardware Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Max Number of Inputs and Outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Software. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Obtain Connected Components Workbench. . . . . . . . . . . . . . . . . . . 13
USB Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Serial Port Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Chapter 2
Installation Mounting Dimensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
DIN Rail Mounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Panel Mounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Enclosure Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Preventing Excessive Heat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Chapter 3
Power, Ground, and Wiring Wiring Requirements and Recommendation . . . . . . . . . . . . . . . . . . . . . . . 19
Wire Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Terminal Assignments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Grounding the Configurable Safety Relay . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Connecting a Power Supply . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Wire Input Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Input Devices with Mechanical Contacts . . . . . . . . . . . . . . . . . . . . . . . 22
Input Devices with OSSD Outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Wire Output Devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Use Surge Suppressors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Embedded Serial Port Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Power Cycling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 5

Table of Contents

Chapter 4
Configuring the CR30 Begin Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
The Workspace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Download the Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Validation and Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Validation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Viewing the Verification ID without CCW. . . . . . . . . . . . . . . . . . . . . 32
Multiple Block Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Chapter 5
Pulse Testing Normally Open Input Pulse Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Normally Closed Input Pulse Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Output Pulse Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

Chapter 6
Input Filter Input Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Chapter 7
Discrepancy Time Discrepancy Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Chapter 8
Safety Block Renaming General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Naming Error Indication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Chapter 9
Safety Monitoring Functions Emergency Stop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Enabling Switch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Feedback Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Gate Switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Light Curtain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Muting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
2-Sensor T-Type Muting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
2-Sensor L-Type Muting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
4-Sensor Muting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Muting Override . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Muting Lamp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Safety Mat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
SensaGuard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Single Wire Safety Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Two-Hand Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Type IIIA Two-hand Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Type IIIC Two-Hand Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

6 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Table of Contents

Alternate Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Single Channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Dual Channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Dual Channel OSSD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Dual Channel N.C./N.O. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Three Channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Chapter 10
Logic Levels A and B Pass Through . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
AND . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
OR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
XOR. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
NAND. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
NOR. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
NOT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
AND with Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
OR with Restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Chapter 11
Safety Outputs Input Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Timing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Output Connections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Immediate OFF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
ON Delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
OFF Delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Jog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Muting Lamp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

Chapter 12
Plug-in Modules Insert Module into Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
2080-IQ4OB4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
2080-IQ4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
2080-OB4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
2080-OW4I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Chapter 13
LEDs Input and Output LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Controller Status LEDs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Chapter 14
Modbus Communication Modbus Mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
Example Architectures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Reading CR30 Status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Sending Reset to CR30 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 7

Table of Contents

Chapter 15
Troubleshooting Recoverable Faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
LEDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Nonrecoverable Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Troubleshooting with the CCW. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Troubleshooting with Modbus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106
Example Fault Analysis – Crossfault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Chapter 16
Security and Password Exclusive Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Password Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Work with a Locked Safety Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Upload from a Password-Protected Safety Relay . . . . . . . . . . . . . . . . 110
Connect to a Password-Protected Safety Relay . . . . . . . . . . . . . . . . . 110
Download to a Password-Protected Safety Relay. . . . . . . . . . . . . . . . 110
Configure Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Set Safety Relay Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Change Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
Clear Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Lost Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Chapter 17
Using the Memory Module Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Project Backup and Restore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Back-up Project. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Restore Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

Chapter 18
Reports Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

8 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Table of Contents

Appendix A
Specifications SIL Rating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Performance Level/Category . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Environmental. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Inputs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Reaction Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
Recovery Times . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Response Times. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
System Response Time Calculation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Response Time - Demand of the Safety Function. . . . . . . . . . . . . . . 125
Monitoring Time - Occurrence of Recoverable Faults and Failures. . .
127
Test Pulse Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Multi-Channel Signal Evaluation and Discrepancy Monitoring . 130
Sequence and Timing Faults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Integral Test Pulses of Safety Outputs . . . . . . . . . . . . . . . . . . . . . . . . . 130
Response Time - Occurrence of Nonrecoverable Faults and Failures .
132
Reaction Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

Appendix B
Regulatory Approvals Agency Certifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
Compliance to European Union Directives. . . . . . . . . . . . . . . . . . . . . . . . 137
Machine Safety Directive. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
EMC Directive. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

Appendix C
Configuration Reference Document Important User Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

Appendix D
ControlFLASH Firmware Upgrade Upgrade the Firmware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
Unrecognized Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 9

Table of Contents

Notes:

10 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 1

Overview

Intended Use The Cat. No. 440C-CR30-22BBB (CR30) relay is a software-configurable safety
relay. This device is intended to be part of the safety-related control system of a
machine. The CR30 must be configured using a personal computer (PC)
running the Allen-Bradley Connected Components Workbench™ (CCW). The
CR30 accommodates up to 24 safety monitoring functions. Examples of safety
monitoring functions are single channel input, dual channel input, two hand
control, reset, and feedback.

It is based on the Micro800 platform. The housing is red to signify it as a safety

device and to distinguish it from the grey-colored standard controllers.

Hardware Features Figure 1 - CR30 Relay

The CR30 has 22 embedded safety rated inputs and outputs and accepts up to
two plug-in modules, each of which has four standard inputs and four standard
outputs.

The CR30 can be configured to accept two single-wire safety inputs and to
provide two single-wire safety outputs. This feature allows the CR30 to be an
integral part of an extensive machine safeguarding system.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 11

Chapter 1 Overview

CR30 Hardware Details

Figure 2 - Hardware Details
1 2 3 4 5 6 7 Status Indicators
12
13
14
15
16
17
18

8 9 10 5 11 6

Description Description
1 Status indicators 10 Verification button
2 Plug-in latch 11 Din Rail mounting latch
3 Plug-in screw hole 12 Input status
4 40-pin high-speed plug-in connector 13 Power status
5 I/O and Power terminal blocks 14 Run status
6 Mounting screw hole/mounting foot 15 Fault status
7 Right-side cover 16 Lock status
8 RS-232 non-isolated serial port 17 Serial communications status
9 Type B connector USB 18 Output status

Max Number of Inputs and Outputs

Many of the inputs and outputs can be configured for different roles. The
following table shows the maximum number of terminals for a specific function.
Assigning a configurable terminal to one role reduces the risks of its use as
another role and reduce the allowed maximum number of terminals for other
functions.

Function Max Allowed Function Max Allowed

Safety inputs, normally closed up to 18 Pulse test outputs up to 6
Safety inputs, normally open up to 6 OSSD safety outputs up to 10
Single-wire safety input up to 2 Non-pulsed (standard) outputs up to 6
Single-wire safety output up to 2

12 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Overview Chapter 1

Software The CR30 is software configurable using the Rockwell Automation Connected
Components Workbench (CCW). Connected Components Workbench is a set
of collaborative tools that supports the CR30 safety relays. CCW is based on
Rockwell Automation and Microsoft® Visual Studio® technology. The CCW is
used to configure the CR30, program the Micro800 controllers, and configure
many PowerFlex® drives and PanelView™ graphic display terminals.

Obtain Connected Components Workbench

The Connected Components Workbench is free and can be downloaded from:

http://compatibility.rockwellautomation.com/Pages/
MultiProductDownload.aspx?Keyword=Free&crumb=112

To help you configure your relay through the Connected Components

Workbench software, you can refer to the Connected Components Workbench
Online Help (provided with the software).

USB Connection

The CR30 has a USB interface for connection to a personal computer for
configuration. Use a standard USB A Male to B Male cable for connecting to the
relay.

Serial Port Connection

The embedded serial port is used to transfer control and status to other
Allen­Bradley products. The CR30 only supports RS-232 protocol. The
connection is not isolated. The RS-232 signals are referenced to the relay power
ground.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 13

Chapter 1 Overview

Notes:

14 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 2

Installation

Mounting Dimensions DIN Rail Mounting

Mounting dimensions exclude mounting feet or DIN Rail latches.

Figure 3 - DIN Rail Mounting [mm (in.)]

100 (3.94) 80 (3.15)

90 (3.54)

Maintain spacing from objects such as enclosure walls, wireways, and adjacent
equipment. Allow 50.8 mm (2 in.) of space on all sides for adequate ventilation. If
optional accessories/modules are attached to the relay, such as the power supply
Cat. No. 2080-PS120-240VAC, make sure that there is 50.8 mm (2 in.) of space
on all sides after attaching the optional parts.
The module can be mounted using the following DIN Rails:
35 x 7.5 x 1 mm (EN 50 022 - 35 x 7.5).
To mount the module on a DIN Rail:
1. Use a flat-blade screwdriver in the DIN Rail latch and pry it downwards
until it is in the unlatched position.
2. Hook the top of the DIN Rail mounting area of the relay onto the DIN
Rail, and then press the bottom until the relay snaps onto the DIN Rail.
3. Push the DIN Rail latch back into the latched position.
Use DIN Rail end anchors (Allen-Bradley Cat. Nos. 1492-EAJ35 or
1492­EAHJ35) for vibration or shock environments.
To remove the module from the DIN Rail, pry the DIN Rail latch downwards
until it is in the unlatched position.
For environments with greater vibration and shock concerns, use the panel
mounting method, instead of DIN Rail mounting.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 15

Chapter 2 Installation

Panel Mounting
Figure 4 - Panel Mounting [mm (in.)]
86 (3.39)

100 (3.94)

The preferred mounting method is to use four M4 (#8) screws per module. Hole
spacing tolerance: ±0.4 mm (0.016 in.).

Follow these steps to install your relay using mounting screws.

1. Place the relay against the panel where you are mounting it. Make sure that
the relay is spaced properly.
2. Mark drilling holes through the mounting screw holes and mounting feet
then remove the relay.
3. Drill the holes at the markings, then replace the relay and mount it.

Leave the protective debris strip in place until you are finished wiring the relay
and any other devices.

16 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Installation Chapter 2

Enclosure Considerations Most applications require installation in an industrial enclosure to reduce the
effects of electrical interference and environmental exposure. Pollution Degree 2
is an environment where normally only non-conductive pollution occurs except
that occasionally temporary conductivity that is caused by condensation can be
expected. Overvoltage Category II is the load level section of the electrical
distribution system. At this level, transient voltages are controlled and do not
exceed the impulse voltage capability of the product insulation.

This equipment is intended for use in a Pollution Degree 2 industrial

environment, in overvoltage Category II applications (as defined in
IEC 60664­1), at altitudes up to 2000 m (6562 ft) without derating. This
equipment is considered Group 1, Class A industrial equipment according to
IEC/CISPR 11. Without appropriate precautions, there could be difficulties
with electromagnetic compatibility in residential and other environments due to
conducted and radiated disturbances.

This equipment is supplied as open-type equipment. It must be mounted within

an enclosure that is suitably designed for those specific environmental conditions
that are present. It must also be appropriately designed to prevent personal injury
as a result of accessibility to live parts. The enclosure must have suitable
flame­retardant properties to prevent or minimize the spread of flame, complying
with a flame spread rating of 5VA, V2, V1, V0 (or equivalent) if non-metallic.
The interior of the enclosure must be accessible only by the use of a tool.
Subsequent sections of this publication contain more information regarding
specific enclosure type ratings that are required to comply with certain product
safety certifications.

For more information, see:

• Industrial Automation Wiring and Grounding Guidelines, publication
1770-4.1, for more installation requirements.
• NEMA Standard 250 and IEC 60529, as applicable, for explanations of
the degrees of protection that is provided by different types of enclosure.

Preventing Excessive Heat For most applications, normal convective cooling keeps the controller within the
specified operating range. Verify that the specified temperature range is
maintained. Proper spacing of components within an enclosure is usually
sufficient for heat dissipation.

In some applications, other equipment inside or outside the enclosure produce a

substantial amount of heat. In this case, place blower fans inside the enclosure to
help with air circulation and to reduce “hot spots” near the controller.

More cooling provisions are necessary when high ambient temperatures are
encountered. Do not bring in unfiltered outside air. Place the controller in an
enclosure to help protect it from a corrosive atmosphere. Harmful contaminants
or dirt could cause improper operation or damage to components. In extreme
cases, you may need to use air conditioning to help protect against heat buildup
within the enclosure.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 17

Chapter 2 Installation

Notes:

18 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 3

Power, Ground, and Wiring

Wiring Requirements and

Recommendation WARNING: Before you install and wire any device, disconnect power to the
system.

WARNING: Calculate the maximum current in each power and common wire.
Observe all electrical codes dictating the maximum current allowable for each
wire size. Current above the maximum ratings can cause wiring to overheat,
which can cause damage.

• Allow for at least 50 mm (2 in.) between I/O wiring ducts or terminal

strips and the relay.
• Route incoming power to the relay by a path separate from the device
wiring. Where paths must cross, their intersection must be perpendicular.
• Do not run signal or communications wiring and power wiring in the same
conduit. Wires with different signal characteristics should be routed by
separate paths.
• Separate wiring by signal type. Bundle wiring with similar electrical
characteristics together.
• Separate input wiring from output wiring.
• Label wiring to all devices in the system. Use tape, shrink-tubing, or other
dependable means for labeling purposes. In addition to labeling, use
colored insulation to identify wiring based on signal characteristics. For
example, you can use blue for DC wiring and red for AC wiring.
• Disabling pulse testing on safety-related terminals, including dedicated
safety outputs and test-pulse source evaluating input signals, requires
protection (for example, cable conduit) and separated wiring of safety
signals to exclude potential cross loop faults.

IMPORTANT Fault exclusions for conductors and wiring must follow the requirements
according to EN ISO 13849-2 Table D.3 and D.4. A fault exclusion can reduce the
overall safety rating of the related safety function to a maximum of PLd per
EN ISO 13849-1

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 19

Chapter 3 Power, Ground, and Wiring

Wire Size
Table 1 - Wiring Requirements
Wire Size
Type Min Max
2
Copper Stranded 0.326 mm 1.31 mm2 Rated @ 90 °C (194 °F)
(22 AWG) (16 AWG) insulation min.

Terminal Assignments
Some terminals are designed to have one specific function. Some terminals can
perform multiple functions; these terminals must be configured in the
application software.

Table 2 - Terminal Assignments

Terminal Function
00 Safety Input (N.C.)
01 Safety Input (N.C.)
02 Safety Input (N.C.)
03 Safety Input (N.C.)
04 Safety Input (N.C.)
05 Safety Input (N.C.)
06 Safety Input (N.C.)
07 Safety Input (N.C.)
08 Safety Input (N.C.)
09 Safety Input (N.C.)
10 Safety Input (N.C.) or Single Wire Safety Input
11 Safety Input (N.C.) or Single Wire Safety Input
+24V DC A1 Power Supply (+24V, -15%, +10%)
COM 0V A2 Power Supply (0V)
12 Test Output or OSSD High Side or Safety Input (N.C.) or Safety Input N.O. or standard diagnostic.
13 Test Output or OSSD High Side or Safety Input (N.C.) or Safety Input N.O. or standard diagnostic.
14 Test Output or OSSD High Side or Safety Input (N.C.) or Safety Input N.O. or standard diagnostic.
15 Test Output or OSSD High Side or Safety Input (N.C.) or Safety Input N.O. or standard diagnostic.
16 Test Output or OSSD High Side or Safety Input (N.C.) or Safety Input N.O. or standard diagnostic.
17 Test Output or OSSD High Side or Safety Input (N.C.) or Safety Input N.O. or standard diagnostic.
18 OSSD High Side
19 OSSD High Side
20 OSSD High Side or Single-wire Safety Output
21 OSSD High Side or Single-wire Safety Output

20 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Power, Ground, and Wiring Chapter 3

Grounding the Configurable

Safety Relay WARNING: All devices that are connected to the RS-232 communication port
must be referenced to controller ground, or be floating (not referenced to a
potential other than ground). Failure to follow this procedure can result in
property damage or personal injury.

This product is intended to be mounted to a grounded mounting surface such as

a metal panel. See the Industrial Automation Wiring and Grounding Guidelines,
publication 1770-4.1, for more information.

Connecting a Power Supply Power for the relay is provided by an external 24V DC power supply source.

To comply with the CE Low Voltage Directive (LVD), the I/O must be powered
by a DC source compliant with Safety Extra Low Voltage (SELV) or Protected
Extra Low Voltage (PELV).

To comply with UL restrictions, I/O must be powered by DC sources whose

secondary circuits are isolated from the primary circuit by double insulation or
reinforced insulation. The DC power supply must satisfy the requirements for
Class 2.

The following Rockwell Automation power supplies are SELV- and PELV-
compliant, and they meet the isolation and output hold-off time requirements of
the CR30 relay:
• 2080-PS120-240VAC
• 1606-XLP30E
• 1606-XLP50E
• 1606-XLP50EZ
• 1606-XLP72E
• 1606-XLP95E
• 1606-XLDNET4
• 1606-XLSDNET4

Figure 5 - Power Supply

00 01 02 03 04 05 06 07 08 09 10 11
Input Terminal Block

+DC COM
24V 0V Input/Output Terminal Block
A1 A2 12 13 14 15 16 17 18 19 20 21

+24V DC
24V Common

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 21

Chapter 3 Power, Ground, and Wiring

Wire Input Devices Input Devices with Mechanical Contacts

WARNING: Applying an inappropriate DC or any AC voltage can result in a loss

of safety function, product damage, or serious injury. Properly apply only the
specified voltage to relay inputs.

Input devices with mechanical contact outputs, such as emergency stop buttons
and safety limit switches, use both a safety input terminal and a test output
terminal. This enables the circuit to achieve a Category 4 rating.

When safety devices are connected via test outputs to an input circuit on the
CR30 relay, the recommended wire length is 30 m (98.4 ft) or less.

Figure 6 - Input Devices with Mechanical Contacts

+24 V DC

00 01 02 03 04 05 06 07 08 09 10 11
Input Terminal Block

+DC COM
24V 0V
Input/Output Terminal Block
A1 A2 12 13 14 15 16 17 18 19 20 21

Configured for
3mA Typical
Pulse Test Output
24 V Common

Input Devices with OSSD Outputs

Devices, such as light curtains, laser scanners, and solid-state interlocks, having
current-sourcing PNP semiconductor outputs (OSSD) have built-in test pulses
(or other method of detecting faults). These devices are connected directly to the
inputs of the CR30 relay safety and do not use a test output. These devices must
have a common reference with the CR30.

Figure 7 - Input Devices with OSSD Outputs

+24 V DC
Receiver Transmitter
+ +
OSSD1
OSSD2
- -

00 01 02 03 04 05 06 07 08 09 10 11
Input Terminal Block

+DC COM
24V 0V Input/Output Terminal Block
A1 A2 12 13 14 15 16 17 18 19 20 21

Must have common reference.

24 V Common

22 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Power, Ground, and Wiring Chapter 3

Wire Output Devices Use Surge Suppressors

Because of the potentially high current surges that occur when switching
inductive load devices, such as motor starters and solenoids, the use of some type
of surge suppression to help protect and extend the operating life of the relays
output is required. By adding a suppression device directly across the coil of an
inductive device, you prolong the life of the outputs. You also reduce the effects
of voltage transients and electrical noise from radiating into adjacent systems.

The following diagram shows an output with a suppression device. We

recommend that you locate the suppression device as close as possible to the load
device. Since the outputs are 24V DC, we recommend 1N4001 (50V reverse
voltage) to 1N4007 (1000V reverse voltage) diodes for surge suppression for the
OSSD safety outputs, as shown in Figure 8. Connect the diode as close as
possible to the load coil.

Figure 8 - Surge Suppressors

+24V DC

+DC COM
24V 0V Input/Output Terminal Block
A1 A2 12 13 14 15 16 17 18 19 20 21

Diode
Surge
K1 Suppressor

24 V Common

Example suppressors include:

• 100-FSD250 for Bulletin 100S Contactors
• 1492-LD4DF terminal block with built-in 1N4007 diode

Embedded Serial Port Wiring The embedded serial port is a non-isolated RS-232 serial port that is targeted to
be used for short distances (<3 m) to devices such as HMIs (for example,
PanelView). Pin 2 and the shield are both internally connected to the -24V
Common (A2) terminal of the CR30.

The CR30 uses the minimal RS-232 connection; only transmit (TxD), receive
(RxD) and ground connections are required. The CR30 does not require nor
perform any handshaking, therefore the Request To Send (RTS), Clear To Send
(CTS), and Carrier Detect (DCD) are not used.

The CR30 only supports RS-232. The RS485 signals, which are used by some
products with the 8-pin mini DIN connector, are not used.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 23

Chapter 3 Power, Ground, and Wiring

Figure 9 - Pinouts

1 2
Receive
3 4 5

6 7 8
Transmit

24V Common

Pin RS-232 Example Pin RS-232 Example

1 RS-485 (not used) 5 DCD (not used)
2 GND 6 CTS (not used)
3 RTS (not used) 7 TxD
4 RxD 8 RS-485 (not used)

Table 3 shows a recommended list of cables for the serial connection between the
CR30 and other Allen-Bradley products. They may also be suitable for third-
party products.

DIN connectors were originally standardized by the Deutsches Institut für

Normung (DIN), the German national standards organization. Many variations
of this connector exist. To help ensure compatibility, select a cable from the
following table.

Table 3 - Cables
Cat. No. Description Length
1761-CBL-AM00 8-pin Mini DIN to 8-pin Mini DIN 0.5 m (1.5 ft)
1761-CBL-HM02 8-pin Mini DIN to 8-pin Mini DIN 2 m (6.5 ft)
1761-CBL-AP00 8-pin Mini DIN to 9-pin D-shell 0.5 m (1.5 ft)
1761-CBL-PM02 8-pin Mini DIN to 9-pin D-shell 2 m (6.5 ft)

The CR30 is categorized as Data Communications Equipment (DCE). The

PanelView HMI's are Data Terminal Equipment (DTE). This is important when
point-to-point wiring connections are made. When DTE communicates with
DCE, the connections are pin x to pin x. When DTE communicates with other
DTE, a cross over is required (for example, TxD must be connected to RxD).

Power Cycling The state of the CR30 upon power-up depends on its state when power was
turned off. The Run LED indicates the state of the CR30.

1. Program Mode (RUN LED off )

The CR30 is in program mode upon power-up.
2. Run Mode with Program Not Verified (RUN LED flashing)
The CR30 returns to Run mode. Run mode without verification is good
for only 24 hours on continuous running.
3. Run Mode with Program Verified (RUN LED solid green)
The CR30 returns to Run mode with no limitation on the run duration.

24 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 4

Configuring the CR30

This manual assumes that the Connected Components Workbench has been
loaded and describes basic operations. Use the online help for configuring the
safety functions.

ATTENTION: Activities including installation, adjustments, putting into service,

use, assembly, disassembly, and maintenance are required to be conducted by
suitably trained personnel in accordance with applicable code of practice. If this
equipment is used in a manner that is not specified by the manufacturer, the
protection that is provided by the equipment can be impaired.

Begin Configuration 1. In the Device Toolbox, expand the Safety Catalog.

2. Double-click the 440C-CR30-22BBB to open it in the Project
Organizer.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 25

Chapter 4 Configuring the CR30

3. Double-click the icon in the Project Organizer to open the project.

4. Click the Edit Logic button to begin the configuration process.

The Workspace The workspace is split into a grid of four columns: Safety Monitoring (the
inputs), Logic Level A, Logic Level B, and Safety Output.

By expanding the Toolbox on the left, blocks can be added to the Workspace and
safety functions can be created.

Figure 10 - Workspace

26 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Configuring the CR30 Chapter 4

5. Click and drag the Gate Switch function block to the first block in the
work space.
The CCW automatically assigns embedded input terminals EI_00 and
EI_01 to the function block. The terminal connection parameters can be
changed by you.
6. Click and drag the immediate Output to the first Safety Output block in
the workspace.
The CCW automatically assigns embedded output terminals EO_18 and
EO_19 to the output block. In addition, the output terminals are pulse
tested (PT). The terminal connection parameters can be changed by you.
7. Use the pull-down menu to change the Immediate Output Reset from
Manual to Automatic.
8. Click the input connection (shown in blue when no connection is made)
of the Immediate Off output block.
9. Click the output connection of the Emergency Stop button (shown in
blue when no connection is made).
The CCW automatically creates two Pass Through blocks in Logic Level
A and Logic Level B and makes the connection.
10. Click the second tab to compile and download the configuration.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 27

Chapter 4 Configuring the CR30

Download the Configuration Download initiates the transfer of the configuration file of your CR30 project to
the CR30 safety relay. The download process automatically performs a file
transfer verification to help ensure that the project configuration and
configuration in the CR30 is valid and equal. Successful file transfer verification
allows you to change the CR30 operation mode to Run and execute the safety
function.

IMPORTANT Transfer file verification only checks inconsistency of the configuration in the
project and the relay such as connection errors and corrupted files.
After file transfer, the configured safety function itself is still not verified. The
responsible personnel must check whether the configured safety function
meets the safety requirements according to the risk assessment and fulfills all
applicable standard and regulations

11. Click the Download icon to build and download the configuration to
the CR30.

12. Expand the navigation tree.

13. Select the CR30.
14. Click OK.

28 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Configuring the CR30 Chapter 4

15. File transfer successful or failed.

a. File transfer successful.
Click Yes to change the relay to Run mode. For unverified
configuration, this allows the CR30 to operate for a maximum duration
of 24 hours to perform relevant tests to validate the safety function.
Click No to maintain the relay in Program mode and continue with the
verification process.

b. File transfer failed.

If the transfer file verification failed, the following message occurs.
Click OK and repeat steps 11…15.

Validation and Verification To complete the safety system requirements, the configuration of the CR30 must
be validated and verified. At the first download, any configuration is in an
unverified state. This means that you have not confirmed that the configuration
and installation meets all specified operational and environmental requirements
of the machine to which CR30 is to be fitted.

ATTENTION: Before installation, a risk assessment must be performed to

determine whether the specifications of this device are suitable for all
foreseeable operational and environmental characteristics of the machine to
which it is to be fitted. At regular intervals during the life of the machine, check
whether the characteristics foreseen remain valid.

Validation

You must perform appropriate testing to validate the configured safety function
of the CR30. Entering Run mode after first download enables operation of a
maximum duration of 24 hours to execute relevant tests of the safety function.
The CR30 displays the execution of an unverified configuration by a flashing
Power LED. After 24 hours, the CR30 stops operation and the power to the
CR30 must be cycled to restore the operation for another 24 hours.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 29

Chapter 4 Configuring the CR30

Verification

After validation, you can assign a unique verification ID to the current

configuration in Connected Components workbench. Any change to a verified
configuration invalidates the verification ID and requires a new validation and
verification process.

To complete the validation and verification, you finally have to acknowledge that
the safety configuration and installation meets the operational and
environmental specification of the machine. Relevant documentation:
• Details of the authorized and responsible personnel
• Revision of the firmware of the CR30
• Version of the Connected Components workbench
• Identification of the configured safety function and project

IMPORTANT The verification process must be documented in the safety system

technical file.
Use the Configuration Reference Document on page 139 or the verification
report feature in CCW release 7 or higher.

16. The CCW must be connected to the CR30 during verification.

17. The CR30 must be in Program mode.
18. Click the Verify button (the Safety Verification window appears).
19. Answer all questions and check each box, if completed.
20. Click Generate.

ATTENTION: The verification process should be documented in the safety

system technical file.

30 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Configuring the CR30 Chapter 4

21. Click Yes to change the safety relay back to Run mode.

22. The CCW generates a Safety Verification ID. Click OK to continue.

23. Confirm the Verification ID in the CCW.

The ID is stored in the CR30. During power-up, the CR30 uses this
number during its self-testing to help ensure its internal processors are
functioning properly. When the configuration is uploaded from the
CR30, the CCW shows the Verification ID.
The ID is not stored with the CCW project file.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 31

Chapter 4 Configuring the CR30

Viewing the Verification ID without CCW

During machine lifecycle, it is required to check whether the system

requirements are still valid. The LEDs can be used to view the verification ID
without the use of the CCW and compare the documented verification ID of the
technical file of the machine.

If the CR30 configuration has not been verified, the ID is 0000. Press and release
the Verification button. The IN 0 LED is green. The OUT 1, 2, 3, and 4 LEDs
are green. After five seconds, the LEDS will revert to show the status of the inputs
and outputs as configured in the CCW.

Figure 11 - Verification ID is 0000 (Not Verified)

All Values
are 0

Verification Digits
1, 2, 3, and 4

If the CR30 configuration has been verified, pressing the Verification button will
cycle the LEDs through each verification digit. In the following example, the
Verification ID is 7916.

Press and release the verification button once.

Figure 12 - First Verification Digit

Value is 7

Verification Digit 1

32 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Configuring the CR30 Chapter 4

Press the Verification button within five seconds.

Figure 13 - Second Verification Digit

Value is 9

Verification Digit 2

Press the Verification button within five seconds.

Figure 14 - Third Verification Digit

Value is 1

Verification Digit 3

Press the Verification button within five seconds.

Figure 15 - Fourth Verification Digit

Value is 6

Verification Digit 4

After five seconds, the LED will revert to show the status of the inputs and
outputs as configured in the CCW.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 33

Chapter 4 Configuring the CR30

Multiple Block Connections Multiple blocks can be connected between:

• Safety Monitoring Functions and Logic Level A
• Logic Level A and Logic Level B, and
• Logic Level B and Safety outputs

This is done by clicking the desired input and output connection points. The
CCW automatically determines whether the connection can be made.

Figure 16 - Multiple Block Connections

34 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 5

Pulse Testing

The CR30 performs three types of pulse testing functions:

• N.O. inputs
• N.C. inputs
• Outputs

Normally Open Input Pulse When a safety input is configured for normally open (N.O.) operation, the CR30
periodically checks the status of the input. The purpose of the test pulse is to
Testing detect short circuits in the wiring to 24V DC, 0V and between two channels.
This test is independent of the “Input Test Pulses”. Six terminals (12…17) can be
configured for normally open operation.

When a terminal is configured for N.O. operation, the CR30 tests the status of
each terminal by generating a test pulse as shown in Figure 17.

The normally open input pulse testing cannot be configured to be on or off. If the
terminal is configured to be N.O., the pulse testing is performed by the CR30.

Figure 17 - N.O. Terminal Test Pulse

24V

0V

0 640μs

When multiple terminals are configured for normally open operation, the CR30
tests each one at 500 ms intervals. This test sequence is repeated every 6.4
seconds.

In Figure 18 on page 36, terminals 12, 14, 15, and 17 are configured for N.O.
operation, and are tested. Terminals 13 and 16 are configured for normally closed
(N.C.) operation, therefore the test pulse does not occur on these two terminals.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 35

Chapter 5 Pulse Testing

Figure 18 - Test Sequence

1 2 3 4 5 6

HI
Terminal 12 LO
HI
Terminal 13
LO
HI
Terminal 14
LO
HI
Terminal 15
LO
HI
Terminal 16
LO
HI
Terminal 17
LO

500ms intervals

Normally Closed Input Pulse Terminals 12…17 can be configured to generate test pulse outputs. These signals
are used to test for short circuits in the wiring to 24V DC, 0V and between two
Testing channels that are wired to separate test pulse sources (one channel that is sourced
from an odd number terminal [13, 15, and 17], and the other one from an even
number terminal [12, 14, and 16]).

IMPORTANT Safety systems requiring a Category 4 structure per ISO13849-1 and SIL 3
rating per IEC61508 must use pulse testing for the dual channel N.C. contacts.
Pulse testing for Category 3, 2, and 1 structures and SIL 2 and 1 ratings is
recommended.

The CR30 generates three distinct pulses, called A, B, and C. Each pulse is 1.7 ms
wide. Pulse Test B immediately follows Pulse Test A. Pulse Test C immediately
follows Pulse Test B. The pulse tests are repeated every 25 ms.

The timing diagram in Figure 19 shows an example of the pulse testing when the
respective terminals are configured for A, B, and C.

Figure 19 - Timing Diagram

1.7ms
24V
Terminal 12 - A 0V
24V
Terminal 13 - B 0V
24V
Terminal 14 - C 0V
24V
Terminal 15 - A 0V
24V
Terminal 16 - B 0V
24V
Terminal 17 - C 0V

0 25ms

36 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Pulse Testing Chapter 5

The purpose of the test pulses is to detect short circuits from the input signal to
24V DC, 24V common, and shorts from one input signal to another input signal.
If one input signal is assigned to Test Pulse A and another signal is assigned to
Test Pulse B (or C), then a short circuit from one input to the other is detected by
the CR30, and the CR30 de-energizes the outputs of those safety functions using
the two inputs. In this example, you cannot select terminal 12 as one test pulse
source and terminal 15 as the second test pulse source, as both of these produce
the “A” pulse.

The CCW automatically prevents the user from selecting two of the same pulses
when dual channel inputs and two test sources are selected.

Output Pulse Testing Internally, the CR30 provides dual channel capability to turn off its safety
outputs. Conceptually, think of this as a main output transistor feeding
individual output transistors. The CR30 repeats a test process where it tests the
main transistor twice and then sequentially tests each individual output twice.
After successful completion of the tests, the CR30 repeats the test sequence.

IMPORTANT Safety systems requiring a Category 4 structure per ISO13849-1 and SIL 3
rating per IEC61508 must use pulse testing for the dual channel outputs. Pulse
testing for Category 3, 2, and 1 structures and SIL 2 and 1 ratings is
recommended.

Figure 20 - Output Pulse Testing

+24V DC
00 01 02 03 04 05 06 07 08 09 10 11

CR30 Main Transistor

A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

When the main transistor is tested, a 50 μs test pulse appears simultaneously on

all outputs. The main transistor is tested again 125 ms later.

Figure 21 - Main Transistor Test

50μs
24V
Terminal 12 0V
24V
Terminal 13 0V

24V
Terminal 20 0V
24V
Terminal 21 0V

0 125ms

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 37

Chapter 5 Pulse Testing

Then a sequence occurs in which each output is individually tested twice. The
test pulse is 50 μs wide. The test pulses occur every 250 ms and switch to the next
output configured with testing.

Figure 22 - Test Pulse Sequence

24V
Terminal 12 0V
24V
Terminal 13 0V

24V
Terminal 20 0V
24V
Terminal 21 0V

0 250 500ms

38 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 6

Input Filter

Input filtering gives the CR30 the ability to filter out noise and, in some cases,
inadvertent operation.

Sometimes, an operator presses a push button and immediately realizes that they
pressed the wrong button and immediately releases the button. In muting
applications, an object, moving down a conveyor, might stop just at the point
where the muting sensor is deactivated and then back off enough that the muting
sensor is reactivated.

When an input filter time (t1) is specified, an input channel is allowed to go to

the LO state while the other channel is in the HI state for that length of time
without the output of the instruction going to the LO state. However, the output
goes to the LO state when both input channels are in the LO state
simultaneously. The input filter operates on both the leading edge and trailing
edge of the input signals. If specified, the filter time must be included in the
response time calculation.
Figure 23 - Input Filtering

1
Channel A
0
t1 t1

1
Channel B
0
t1 t1

1
Output
0

Input filtering can set in 25 ms increments, from 0…1000 ms. The default value is
0 ms.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 39

Chapter 6 Input Filter

The input filtering is set in the Advanced Settings of each safety monitoring
block. Figure 24 shows that the Enabling Switch function with the input filter is
set to 4 (4 x 25 = 100 ms).
Figure 24 - Enabling Switch

40 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 7

Discrepancy Time

Safety Monitoring functions using dual inputs have a feature that allows the
CR30 to test for the timing of the operation of both channels. In most cases, the
outputs of dual channel safeguarding devices change state within a few
milliseconds of each other. In some cases, the second channel can change state
much later than the first.
In these later cases, you want to allow (that is, make sure that) both channels
return to their “safety” state within a specified time relative to each other. For
example, the “safety” state of dual N.C. input is when both inputs are in the
closed state. Channel A can close before Channel B or Channel B can close before
Channel A. The CR30 allows you to specify a discrepancy time in 50 ms
increments, from 0…3 seconds.
Figure 25 - Discrepancy Time

1
Channel A
0

1
Channel B
0
t t

1
Output
0

t <= Discrepancy Time

The discrepancy is set in the Advanced Settings of each safety monitoring block.
The following example shows the Gate Switch function with the discrepancy
time set to 2 (2 x 50 = 100 ms).
When the discrepancy setting is set to zero, the CR30 does not test for
discrepancy. The duration between the operation of channel one and channel
two is infinite. The default value 100 ms.
Figure 26 - Setting Discrepancy Time

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 41

Chapter 7 Discrepancy Time

Notes:

42 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 8

Safety Block Renaming

General With Release 7 of the Connected Components Workbench (CCW) and

Release 7 of the CR30 firmware, the names of both the safety monitoring
functions and safety output functions can be edited. The editing rules follow
IEC 61131-3, section 2.1.2.

This feature is important because it allows you to distinguish between multiple

occurrences of the same function blocks during the design, wiring, and
troubleshooting phases.

The name change is initiated in one of two ways:

1. Simply double-click the name inside the block

2. Highlight the block and press F2.

The typical editing keys (Home, End, Backspace, Delete, Left Arrow, Right
Arrow, Page Up, Page Down, and Mouse Click) can be used to edit the name.

When the block is selected for editing, the name appears in a light blue box, and
the name is highlighted in light blue background, as shown in Figure 27.

Figure 27 - Block Name Selected for Editing

Follow these simple rules for naming the blocks:

• Names must begin with a letter (upper or lower case) or an underscore
• Names cannot have spaces
• Names can contain letters, numbers, and underscores (no special
characters)
• Name length can be anywhere from 1…30 characters
• Letter case is not significant
• Multiple leading or consecutive embedded underscores are not allowed
• Trailing underscores are not allowed

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 43

Chapter 8 Safety Block Renaming

Naming Error Indication After tabbing off, pressing enter, or mousing off the block, the CCW evaluates
the integrity of the name. If valid, the name appears in black letters. If invalid, the
CCW shows a naming error in two ways:

1. A red box around the name

2. An error message in the build results

Figure 28 - Red Box Indicates Naming Error

This example block has two errors:

1. The name starts with a period (“.”).

2. The name contains a space.

Figure 29 - Build Error List

After clicking the Build button, the Error List shows the name errors. In the
example above, SMF1 and SOF1 have naming errors.

When a naming error occurs, the project cannot be built and downloaded to the
CR30. Then naming errors must be corrected. However, the project can be saved
and reopened with the naming errors.

44 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 9

Safety Monitoring Functions

Many types of safeguarding and safety devices and safety related signals can be
connected as inputs to the CR30. The Connected Components Workbench
(CCW) facilitates the selection and connection of the device. Each block is
assigned the next available settings for input terminals, test sources number of
inputs, pulse testing, discrepancy time, and input filter.

Emergency Stop The Emergency Stop function block sets the parameters for typical emergency
stop push buttons. In the CCW, click and drag (or double-click) the block to an
available Safety Monitoring Function spot. When mechanical operated contacts
are used, these contacts must be direct-acting contacts.

Figure 30 - Emergency Stop Function Block

The available input selections for the Emergency Stop inputs are:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

You can modify the number and types of inputs:

• 2 N.C.
• 2 OSSD
• 1 N.C.

Pulse testing can be disabled or set to 2 Sources. When 2 Sources is selected, the
next available test sources are automatically selected. You can modify the sources
afterward.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 45

Chapter 9 Safety Monitoring Functions

You can use the default Discrepancy Time and Input Filter or choose to modify
these settings.

Figure 31 - Example Schematic of a Dual Channel E-stop Without Test Pulses

+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21
24V Com

Figure 32 - Example Schematic of a Dual Channel E-stop Using Test Pulses A and B
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A B
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Enabling Switch The Enabling Switch function block sets the parameters for typical enabling (or
hold-to-run) devices. In the CCW, click and drag (or double-click) the block to
an available Safety Monitoring Function spot. When mechanical operated
contacts are used, these contacts must be direct-acting contacts.

Note: This function block is intended to be used only in applications with

a 3­position enabling switch that only allows activation of its outputs
(closed contacts) when the operator presses and holds the switch into its
middle position. The switch has to be designed using a mechanical force to
reset to its default off (contact open) position.

Figure 33 - Enabling Switch Function Block

46 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

The available input selections for the Enabling Switch inputs are:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

You can modify the number and types of inputs:

• 2 N.C.
• 2 OSSD
• 1 N.C.

Pulse testing can be disabled or set to 2 Sources. When 2 Sources is selected, the
next available test sources are automatically selected. You can modify the sources
afterward.

You can use the default Discrepancy Time and Input Filter or choose to modify
these settings.

Figure 34 - Example Schematic of a Dual Channel Enabling Switch Without Test Pulses
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21
24V Com

Figure 35 - Example Schematic of a Dual Channel Enabling Switch Using Test Pulses A and B
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A B
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 47

Chapter 9 Safety Monitoring Functions

Feedback Monitoring The Feedback function block is used in safety systems to monitor the status of
output devices (like safety contactors). When the output device is off, a HI signal
is fed back to the input of the CR30 to indicate that the device is indeed off.
When the output device is energized, the feedback signal goes LO. If the output
device remained energized, the feedback signal remains LO and the CR30 will
not energize the output. The feedback contacts can be positive-guided,
mechanically linked, or mirrored contacts.

The CR30 accepts 1, 2, 3, or 4 inputs into each feedback block. All inputs must
be HI for the output of the block to go HI.

In the CCW, click and drag (or double-click) the block to an available Safety
Monitoring Function spot.

Figure 36 - Feedback Monitoring Function Block

The available input selections for the Feedback Monitoring are:

• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)
• P1_00…P1_03 (plug-in 1 terminals 00…03)
• P2_00…P2_03 (plug-in 2 terminals 00…03)
• SP_00…SP_15 (Modbus inputs 00…05)

You can modify the number of inputs within the range of 1…4.

You can use the default Input Filter or choose to modify this setting.

48 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Figure 37 - Example Feedback Schematic with Two Feedback Contacts Connected in Series to One
Input Terminal
+24V DC
K1

K2

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

K1 K2
24V Com

Figure 38 - Example Feedback Schematic with Four Feedback Contacts Connected Individually to
Four Input Terminals
+24V DC
K1 K2 K3 K4

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

K1 K2 K3 K4
24V Com

Gate Switch The Gate Switch function block sets the parameters for typical safety gate
interlock switches. In the CCW, click and drag (or double-click) the block to an
available Safety Monitoring Function spot.

Figure 39 - Gate Switch Function Block

The available input selections for the Gate Switch inputs are:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 49

Chapter 9 Safety Monitoring Functions

You can modify the number and types of inputs:

• 2 N.C.
• 2 OSSD
• 1 N.C.

Pulse testing can be disabled or set to 2 Sources. When 2 Sources is selected, the
next available test sources are automatically selected. You can modify the sources
afterward.

You can use the default Discrepancy Time and Input Filter or choose to modify
these settings.

Figure 40 - Example Schematic of a Dual Channel Safety Gate Switch Without Test Pulses
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21
24V Com

Figure 41 - Example Schematic of a Dual Channel Safety Gate Switch Using Test Pulses A and B
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A B
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Figure 42 - Example Schematic of a Dual Channel Safety Gate Switch Using OSSD Outputs
+24V DC
A1

A2

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21
24V Com

50 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Light Curtain The Light Curtain function block sets the parameters for light curtains that have
dual OSSD outputs. In the CCW, click and drag (or double-click) the block to
an available Safety Monitoring Function spot. This block can be used for other
devices, like laser scanners, with OSSD outputs.

Figure 43 - Light Curtain Function Block

The available input selections for the Light Curtain inputs are:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

You can use the default Discrepancy Time and Input Filter or choose to modify
these settings.

Figure 44 - Example Schematic of a Light Curtain

+24V DC Receiver Transmitter
+ +
OSSD1
OSSD2
- -

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21
24V Com

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 51

Chapter 9 Safety Monitoring Functions

Muting Muting is the temporary automatic suspension of the protective function of a

safeguarding device like a light curtain. The muting function allows the transport
of material through a light curtain without stopping a conveyor. To distinguish
between material and persons, a certain sequence of events and timings are used.

Muting sensors are mounted in a certain pattern, and the material must pass by
the sensors and light curtain within specified time limits. If the muting sensor
sequence is incorrect or the timing parameters are violated, the conveyor is
turned off. An override signal moves the material through the light curtain after a
violation.

Figure 45 - Muting Function Block

The light curtain (LC) signals can use the following terminals:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

The muting (S1…S4) and override (OV) signals can use the following terminals:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)
• P1_00…P1_03 (plug-in 1 terminals 00…03)
• P2_00…P2_03 (plug-in 2 terminals 00…03)

52 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

You can use the default Discrepancy Time and Input Filters or choose to modify
these settings.

The CR30 safety relay has three distinct types of muting, where the sequence and
timing of signals that are monitored by the CR30 allows objects to pass through
the light curtain without shutting down the machine process. The three types
are:
• 2-sensor T-Type
• 2-sensor L-Type
• 4-sensor

2-Sensor T-Type Muting

The sensors and light curtain form the shape of an upside down “T”, when
viewed from the side. The muting sensors (MS) are mounted to form an “X”
sensing pattern where the sensing beams cross near the center of the light curtain
(LC).

Figure 46 - 2-Sensor T-Type Muting Arrangement

LC
MS1 MS2

Machine Material Conveyor

Muting Lamp

The material must first break the two muting sensors and then the light curtain.
The order in which the muting sensors are block is not critical, but the
synchronization time (the time between block one sensor and the other sensor)
must be met. The muting lamp turns on when both sensors are blocked and the
light curtain is muted. The conveyor can move in the forward or reverse
direction.

In the example below, the OSSD outputs of the light curtain are connected to
terminals 00 and 01. The two muting sensors are connected to terminals 02 and
03. The momentary, normally open override switch is connected between
terminals 12 to 04 to take advantage of pulse testing. Contactor K1 and K2,
which provide power to the conveyor (and to other hazards), are connected to
terminals 18 and 19.

The muting lamp is connected to terminal 13; this terminal should be configured
with no pulse testing. Filament lamps will not be affected by pulse testing, but
LED lamps may appear to flicker if pulse testing is enabled.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 53

Chapter 9 Safety Monitoring Functions

Figure 47 - Example Schematic for 2-Sensor T-Type Muting

+24V DC
Light Curtain

MS1

MS2 Override

OSSD A
OSSD B
00 01 02 03 04 05 06 07 08 09 10 11
CR30
A
A1 A2 12 13 14 15 16 17 18 19 20 21

Muting Lamp K1 K2
Contactors
for Conveyor Power
24V Com

For simplicity, the power and ground connections of the light curtain and muting
sensors are not shown. The light curtain and muting sensors must have the same
reference (24V Com) as the CR30 for proper operation.

For proper operation, the muting sensors are on (normally closed) when not
muting, and the light curtain OSSD outputs are also on (the light curtain is
clear).

Figure 48 - Muting Time for 2-Sensor T-Type Muting

LC muted

Muting sensor 1

Muting sensor 2

Muting lamp
t > 30ms
t > 50ms

t > 30ms

t < muting time 30ms <= t

30ms <= t
t < synchronization t < synchronization
time time

Table 4 shows the muting and synchronization times that are selectable in the
CCW. These times are linked. For example, if you select a 10 s muting time, then
the synchronization time between MS1 and MS2 is 3 s. To use a synchronization
time of 6 s, you must select a 60 s muting time.

Note: The synchronization time also depends on the input filter time
settings for the muting sensor inputs.
Synchronization time (total) = 2 x Input Filter Time + Synch Time

54 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Table 4 - Muting and Synchronization Timing Selections

Muting Time Synchronization Time Muting Time Synchronization Time
10 s 3s 900 s (15 min) 90 s
20 s 3s 1800 s (30 min) 180 s (3 min)
30 s 3s 3600 s (1 hr) 180 s (3 min)
60 s (1 min) 6s 28,800 s (8 hr) 180 s (3 min)
300 s (5 min) 30 s Infinite Infinite

2-Sensor L-Type Muting

The sensors and light curtain form the shape of the letter “L”, when viewed from
the side. The muting sensors (MS) are mounted on one side of the light curtain
(LC).

Figure 49 - 2-Sensor L-Type Muting Arrangement

LC
MS1 MS2

Muted LC
Machine Conveyor Material

Muting Lamp

The material must first break MS1, then MS2 and then the light curtain. As the
material progresses, the material must clear MS1 and then MS2. The muting
lamp turns on and the light curtain is muted after MS2 is blocked. The conveyor
can only move one direction.

IMPORTANT The 2-L muting arrangement must only be used for material exiting the hazard
area. It must not be used for material entering the hazard area.

In the example below, the OSSD outputs of the light curtain are connected to
terminals 00 and 01. The two muting sensors are connected to terminals 02 and
03. The momentary, normally open override switch is connected between
terminals 12 to 04 to take advantage of pulse testing. Contactor K1 and K2,
which provide power to the conveyor (and other hazards if necessary), are
connected to terminals 18 and 19.

The muting lamp is connected to terminal 13; this terminal should be configured
with no pulse testing. Filament lamps will not be affected by pulse testing, but
LED lamps may appear to flicker if pulse testing is enabled.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 55

Chapter 9 Safety Monitoring Functions

Figure 50 - Example Schematic for 2-Sensor L-Type Muting

+24V DC
Light Curtain

MS1

MS2 Override

OSSD A
OSSD B
00 01 02 03 04 05 06 07 08 09 10 11
CR30
A
A1 A2 12 13 14 15 16 17 18 19 20 21

Muting Lamp K1 K2
Contactors
for Conveyor Power
24V Com

For simplicity, the power and ground connections of the light curtain and muting
sensors are not shown. The light curtain and muting sensors must have the same
reference (24V Com) as the CR30 for proper operation.

For proper operation, the muting sensors are on (normally closed) when not
muting, and the light curtain OSSD outputs are also on (the light curtain is
clear).

Figure 51 - Muting Time for 2-Sensor L-Type Muting

LC muted

Muting sensor 1

Muting sensor 2

Muting lamp
t > 30ms
t > 50ms

t > 30ms

t < muting time

30ms <= t
t < synchronization
time 30ms <= t
t < synchronization
time

56 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Table 5 shows the muting and synchronization times that are selectable in the
CCW. These times are selected independently. For example, you can select two
minute muting time, a 500 ms synchronization time between MS1 and MS2, and
a 1000 ms synchronization time between MS2 and the light curtain.

Note: The synchronization time also depends on the input filter time
settings for the muting sensor inputs.
Synchronization time (total) = 2 x Input Filter Time + Synch Time

Table 5 - Muting and Synchronization Times for ‘2L’ Muting

Muting Time Units Available Values Synchronization Time Available Values
Seconds 1…59 MS1 to MS2 50…10,000 ms in
50 ms increments
Minutes 1…59 MS2 to LC
Hours 1…23
Days 1…10

4-Sensor Muting

The sensors and light curtain form the shape of an upside down “T”, when
viewed from the side. Two muting sensors (MS) are mounted on either side of the
light curtain (LC).

Figure 52 - 4-Sensor Muting

LC
MS4 MS3 MS2 MS1
Muted LC

Machine Material Conveyor

Muting Lamp

The material can travel in either direction; breaking MS1 first and MS4 last or
breaking MS4 first and MS1 last. The muting lamp turns on and the light curtain
is muted after the second sensor is blocked. The object must be large enough to
break all four sensors.

In the example below, the OSSD outputs of the light curtain are connected to
terminals 00 and 01. The four muting sensors are connected to terminals 02 to
05. The momentary, normally open override switch is connected between
terminals 12 to 06 to take advantage of pulse testing. Contactor K1 and K2,
which provide power to the conveyor (and other hazards if necessary), are
connected to terminals 18 and 19.

The muting lamp is connected to terminal 13; this terminal should be configured
with no pulse testing. Filament lamps will not be affected by pulse testing, but
LED lamps may appear to flicker if pulse testing is enabled.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 57

Chapter 9 Safety Monitoring Functions

Figure 53 - Example Schematic for 4-Sensor Muting

+24V DC
Light Curtain

MS1 MS3

MS2 MS4 Override

OSSD A
OSSD B
00 01 02 03 04 05 06 07 08 09 10 11
CR30
A
A1 A2 12 13 14 15 16 17 18 19 20 21

Muting Lamp K1 K2
Contactors
for Conveyor Power
24V Com

For simplicity, the power and ground connections of the light curtain and muting
sensors are not shown. The light curtain and muting sensors must have the same
reference (24V Com) as the CR30 for proper operation.

For proper operation, the muting sensors are on (normally closed) when not
muting, and the light curtain OSSD outputs are also on (the light curtain is
clear).

Figure 54 - Muting Time for 4-Sensor Muting

LC muted

Muting sensor 1 (4)

Muting sensor 2 (3)

Muting sensor 3 (2)

Muting sensor 4 (1)

Muting lamp
t > 30ms
t > 50ms

t > 30ms

t > 30ms

t < muting time 30ms <= t

30ms <= t
t < synchronization t < synchronization
time time

58 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Table 6 shows the muting and synchronization times that are selectable in the
CCW. These times are linked. For example, if you select a 10 s muting time, then
the synchronization time between MS1 and MS2 is 3 s. To use a synchronization
time of 6 s, you must select a 60 s muting time.

Note: The synchronization time also depends on the input filter time
settings for the muting sensor inputs.
Synchronization time (total) = 2 x Input Filter Time + Synch Time

Table 6 - Muting and Synchronization Times for Four Sensor Muting

Muting Time Synchronization Time
10 s 3s
20 s 3s
30 s 3s
60 s (1 min) 6s
300 s (5 min) 30 s
900 s (15 min) 90 s
1800 s (30 min) 180 s (3 min)
3600 s (1 hr) 180 s (3 min)
28800 s (8 hr) 180 s (3 min)
Infinite Infinite

Muting Override
The muting function has an optional override input. Use the override to turn on
the conveyor to clear objects through the sensors in the case of a muting sequence
or timing fault.

To use the override, simply enable the feature in the safety monitoring function
block. The muting override can be either a single- or dual-input and can also use
input pulse testing if desired.

When the muting override input turns on, the safety outputs controlled by the
muting function turn on until the override time expires or the override input
turns off. The muting override can be set between 5…1275 seconds, in 5 second
increments.

Muting Lamp
The muting lamp shows four states.
• OFF – light curtain is not muted.
• ON – light curtain is muted.
• 1 Hz blink rate – muting sequence fault.
• 3 Hz blink rate – muting is overridden (the Override input is on).

The muting lamp is not monitored. If the lamp burns out, the muting function
continues to work properly.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 59

Chapter 9 Safety Monitoring Functions

Reset The reset block is used in safety functions that require a manual intervention to
turn on the safety system.

Figure 55 - Reset Function Block

To prevent inadvertent actuation of the reset block, the reset requires a leading
edge and trailing edge within a specific time frame. The pulse width must be
between 250…3000 ms. If the pulse width is too short or too long, the reset
function will not be executed.

Figure 56 - Reset Timing

+24V DC

250ms to
3000 ms
24V Com

The reset block is a Safety Monitoring Function in the CCW. For a valid Reset
operation, according to the requirements specified in the approved safety
concept, you must use the default Reset timing and leave the input filter setting
“0”.

The filter setting is enabled in CCW versions previous to Rev 7. A filter time
setting greater than “0” extends the Reset Timing by 2 x Filter Time.

The reset input signal can come from either one input wiring terminal or over the
Modbus communication input. The available input selections are:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)
• P1_00…P1_03 (plug-in 1 terminals 00…03)
• P2_00…P2_03 (plug-in 2 terminals 00…03)
• SP_00…SP_15 (Modbus inputs 00…15)

60 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Figure 57 - Wiring Connection for a Reset Signal to Terminal 00

+24V DC
Reset

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

The reset block works with one or more output blocks. When an output block
requires a manual reset, the CCW shows all available reset inputs that can be
used.

Restart The restart function works with an AND or OR logic block in Logic Level A and
Logic Level B. When all inputs are satisfied, exercising the restart input causes the
restart function go be effective. If the Restart function is already effective, the
Restart input has no affect.

The Restart can only be used with one AND or OR logic block.

Figure 58 - Restart Function Block

The Restart Function requires a leading edge and trailing edge within a specific
time frame. The pulse width must be between 250…3000 ms. If the pulse width is
too short or too long, the Restart function will not be executed.

Figure 59 - Restart Timing

+24V DC

250ms to
3000 ms
24V Com

The available input selections for the Restart are:

• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)
• P1_00…P1_03 (plug-in 1 terminals 00…03)
• P2_00…P2_03 (plug-in 2 terminals 00…03)
• SP_00…SP_15 (Modbus inputs 00…15)

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 61

Chapter 9 Safety Monitoring Functions

For a valid Restart operation, according to the requirements specified in the

approved safety concept, you must use the default Restart timing and leave the
input filter setting “0”.

The filter setting is enabled in CCW versions smaller than Rev 7. A filter time
setting greater than “0” extends the Reset Timing by 2 x Filter Time.

Figure 60 - Wiring Connection for a Restart Signal to Terminal 02 with Inputs on

Terminals 00 and 01
+24V DC
Restart

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Safety Mat Four wire safety mats can be connected to the CR30. The four wires create two
channels. Stepping on the safety mat creates a short circuit between channel 1
and 2. To detect the short circuit, input pulse testing is used. The mats must be
connected to the input test pulses.

Figure 61 - Safety Mat Function Block

The safety mat can be connected to the following terminals:

• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

You can use the default Discrepancy Time and Input Filter or choose to modify
these settings.

For input test pulses, terminals 12…17 are available. The CCW automatically
selects another test pulse pattern for each input.

An example schematic shows a safety mat that is connected to terminals 0 and 1.

The mat uses test pulses that are generated at terminals 12 and 13.

62 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Figure 62 - Example Schematic for a Safety Mat

+24V DC

Safety
00 01 02 03 04 05 06 07 08 09 10 11
Mat CR30
A B
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

SensaGuard The SensaGuard™ function block sets the parameters for interlocks having dual
OSSD outputs. In the CCW, click and drag (or double-click) the block to an
available Safety Monitoring Function spot. This block can be used for other
devices with OSSD outputs.

Figure 63 - SensaGuard Function Block

The available input selections for the SensaGuard inputs are:

• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

You can use the default Discrepancy Time (See Discrepancy Time on page 41)
and Input Filter (See Input Filter on page 39) or choose to modify these settings.

Figure 64 - Example Schematic of a SensaGuard Interlock

+24V DC
Brown 2
Yellow 4
Red 8
White (Aux)
1
Green
3
Blue 7
Gray (OSSD1) 5
Pink (OSSD2) 6

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21
24V Com

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 63

Chapter 9 Safety Monitoring Functions

Single Wire Safety Input When configured for this type of input, the CR30 expects a Single Wire Safety
(SWS) input signal from a GSR relay or a safeguarding device that has an SWS
output signal. The GSR relay family includes the CI, SI, DI, DIS, GLP, GLT,
EM, and EMD modules. Each of these modules provides the SWS signal on
terminal L11.

Figure 65 - Single Wire Safety Function Block

Only terminals 10 and 11 of the CR30 can be configured to receive the SWS
signal.
• EI_10…EI_11 (embedded input terminals 10…11)

The SWS signal is a long pulse followed by a short pulse, which is repeated while
the signal is active. The SWS is active when the safety outputs of a GSR safety
relay are ON. When the SWS is inactive, the SWS signal is 0V. The timing and
voltage characteristics of the SWS waveform are shown in Figure 66.

Figure 66 - SWS Waveform

4ms
0.7ms
0.5ms
1ms

+24 V

0V
Active (ON) Inactive (OFF)

Figure 67 shows an example schematic of the connection of the SWS from other
modules in the GSR family of relays. The CR30 and GSR modules must be
connected to the same 24V Common.

Figure 67 - SWS Connection Schematic

+24V DC

00 01 02 03 04 05 06 07 08 09 10 11 A1 L11 A1 L11
CR30 GSR Module GSR Module
A1 A2 12 13 14 15 16 17 18 19 20 21 A2 A2

24V Com

64 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Two-Hand Control The CR30 can be configured to operate in two different types of two-hand
control, which are specified in ISO 13851. The two types are:
• Type IIIA (for low-risk safety systems)
• Type IIIC (for high-risk safety systems)

Mechanically palm-operated buttons (Bulletin 800P) or the electronic output

push buttons (Bulletin 800Z Zero-Force Touch Buttons™) should be used as
actuating devices for two hand control. The CR30 requires two buttons to be
actuated simultaneously and maintained to turn the two-hand safety monitoring
function ON. To meet the simultaneity requirement, the two buttons must be
actuated within 500 ms of each other.

Figure 68 - Two-Hand Control Function Block

The two-hand controls can be connected to the following terminals.

• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

You can use the default Input Filter or choose to modify these settings.

When test pulses are used, the CCW automatically selects another test pulse
pattern for each input. The two-hand control can use input test pulses from
following terminals:
• MP_12…MP_17 (multi-purpose terminals 12…17)

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 65

Chapter 9 Safety Monitoring Functions

Type IIIA Two-hand Control

The Type IIIA uses only one normally open contact for each hand. This
configuration can be set up with or without the use of test pulses. The test pulses
provide short circuit fault detect between channels and between channel and
24V.

Figure 69 - Example Wiring Connection for a Type IIIA Two-hand Control without Test Pulses
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Figure 70 - Wiring Connection for a Type IIIA Two-hand Control with the Test Pulses
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A B
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Type IIIC Two-Hand Control

The Type IIIC uses a normally open and a normally closed contact for each hand.

Figure 71 - Example Wiring Connection for a Type IIIC Two-hand Control without Test Pulses
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

When test pulses are used, the CR30 will detect a short from Channel 1 to
Channel 2 after 3.7 seconds and turn the output OFF. To clear the fault, release
both buttons.

66 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Figure 72 - Wiring Connection for a Type IIIC Two-hand Control with Test Pulses
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A B
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

The timing diagram for the two-hand control is shown in Figure 73. The Type
IIIA uses only the N.O. contact of the button. The Type IIIC uses both the N.C.
and the N.O. contacts.

Figure 73 - Two-hand Control Timing Diagram

1 2 3 4 5 6 7 8

HI
Hand 1 N.C. LO

Hand 1 N.O. HI
LO

HI
Hand 2 N.C.
LO
HI
Hand 2 N.O.
LO

HI
Logic Output LO

must be less than 500ms

Description Description
1 Hand 1 button is pressed. 5 Hand 2 button is pressed.
2 Hand 2 button must be pressed within 500 ms 6 Hand 1 button must be pressed within 500 ms
for the output logic to turn ON. for the output logic to turn ON.
3 Releasing either hand button causes the logic 7 Releasing either hand button causes the logic
output to turn off. output to turn off.
4 Both hand buttons must be released to start a 8 Both hand buttons must be released to start a
new cycle. new cycle.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 67

Chapter 9 Safety Monitoring Functions

Alternate Device The Alternate Device provides the flexibility to create other types of input
monitoring blocks. Use this block for the following types of input functions:
• Single channel OSSD
• Single channel N.C.
• Dual channel OSSD
• Dual channel 2 N.C.
• Dual channel 1 N.C./1 N.O.
• Three channel N.C.
• Three channel OSSD

Figure 74 - Alternate Device Function Block

Single Channel

Single channel safety monitoring functions require only one connection to an

input terminal. The single channel input must only be used in low-risk safety
systems.

The available input terminals are:

• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

You can use the default Input Filter or choose to modify this setting.

When test pulses are used, the CCW automatically selects the test pulse pattern.
The single channel N.C. can use input test pulses from following terminals:
• MP_12…MP_17 (multi-purpose terminals 12…17)

68 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Figure 75 - Example Schematic for Single Channel N.C. without Test Pulse
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Figure 76 - Example Schematic for Single Channel N.C. with Test Pulse
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Figure 77 - Example Schematic for Single Channel OSSD

+24V DC
A1 Safeguarding
Device
A2

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Dual Channel
Dual channel safety monitoring functions require two independent circuit
connections to the CR30. Dual channel inputs are used for medium and high risk
applications.

You can modify the number and types of inputs:

• 2 N.C.
• 2 OSSD
• 1N.C./1 N.O.

The available input selections for the dual-channel OSSD and two N.C.
inputs are:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

The available input selections for the N.O. contact are:

• MP_12…MP_17 (multi-purpose terminals 12…17)

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 69

Chapter 9 Safety Monitoring Functions

Pulse testing can be set to 1 Source, 2 Sources, or Disabled. When 1 or 2 Sources

is selected, the next available test sources are automatically assigned by the CCW.
You can modify the sources afterward.

You can use the default Discrepancy Time and Input Filter or choose to modify
these settings.

The two terminals do not necessarily have to be consecutive.

Figure 78 - Example Schematic for 2 N.C. without Test Pulse

+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21
24V Com

Figure 79 - Example Schematic for 2 N.C. with Two Test Pulses Sources
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A B
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Dual Channel OSSD

Safeguarding devices with OSSD outputs generate their own test pulses to detect
for short circuit conditions or have other methods of detecting short circuit
conditions. When configured for dual channel OSSD, the CR30 ignores the test
pulses.

Table 7 shows examples of products that use dual channel OSSD outputs:

Table 7 - Products Using Dual Channel OSSD Outputs

Product Types Product Name
Light Curtains GuardShield™
Laser Scanners SafeZone™, SafeZone Multizone
Gate Interlocks SensaGuard™, SensaGuard with Integrated Latch
Guardlocking Interlocks TLS-ZR, 440G-LZ

Short circuits are detected by the safeguarding device, and the safeguarding
device turns off its safety outputs. Devices with OSSD outputs are capable of
operating in high risk applications.

70 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Figure 80 - Example Schematic for Two OSSD

+24V DC
A1 Safeguarding
Device
A2

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21
24V Com

Dual Channel N.C./N.O.

The N.C./N.O. configuration applies the diversity concepts, where one contact
is open and the other contact is closed. The contact, while in an open state,
cannot be welded closed. The CR30 turns off its safety outputs when either
channel changes state. Both channels must change state for proper performance.

Figure 81 - Example Schematic for N.C./N.O. without Test Pulse

+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Figure 82 - Example Schematic for N.C./N.O. with One Test Pulse

+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Figure 83 - Example Schematic for N.C./N.O. with Two Test Pulses

+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A B
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

If a short circuit occurs on terminal 12 to 24V, the CR30 turns off its safety
outputs within 35 ms. Remove the fault and cycle the contacts to clear the fault.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 71

Chapter 9 Safety Monitoring Functions

If a short circuit occurs on terminal 12 to ground, the CR30 turns off its safety
outputs within 3.3 seconds. Remove the fault and cycle the contacts to clear the
fault.

If a short circuit occurs from terminal 12 to terminal 13, the CR30 turns off its
safety outputs within 35 ms. Remove the fault and cycle the contacts to clear the
fault.

Three Channel
The CR30 can accept three channels into one safety monitoring function. All
three inputs must be HI to satisfy the input. If any one of the inputs goes LO, the
output of safety monitoring function goes LO and turns off its associated output
devices. The three N.C. inputs can be operated without input test pulses, with
one input test pulse, with only two input test pulses, or with three input test
pulses.

The available input selections for the three channel inputs are:
• EI_00…EI_11 (embedded input terminals 00…11)
• MP_12…MP_17 (multi-purpose terminals 12…17)

Pulse testing can be set to 1 Source, 2 Sources, 3 Sources, or Disabled. When 1, 2,

or 3 Sources is selected, the next available test sources are automatically assigned
by the CCW. You can modify the sources afterward.

You can use the default Discrepancy Time and Input Filter or choose to modify
these settings.

The three terminals do not necessarily have to be consecutive.

Figure 84 - Example Schematic for Three N.C. without Test Pulses

+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Figure 85 - Example Schematic for Three N.C. with One Test Pulse Source
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30 A
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

72 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Monitoring Functions Chapter 9

Figure 86 - Example Schematic for Three N.C. with Three Test Pulse Sources
+24V DC

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A B C
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Figure 87 - Example Schematic for Three OSSD

+24V DC
A1 Safeguarding
Device
A2

00 01 02 03 04 05 06 07 08 09 10 11
CR30
A1 A2 12 13 14 15 16 17 18 19 20 21

24V Com

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 73

Chapter 9 Safety Monitoring Functions

Notes:

74 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 10

Logic Levels A and B

The Connected Components Workbench (CCW) has two levels that allow you
to apply simple logic to create more sophisticated safety systems. The logic levels
are labeled A and B on the CCW workspace. The logic functions are available in
the Toolbox.

Figure 88 - Logic Levels A and B on the CCW Workspace

Pass Through When a logic level is not used, the CCW automatically creates a Pass Through
block.

AND The AND block accepts 2…24 inputs. When all inputs are HI, the output of the
block is HI. If any of the inputs is LO, the output of the block is LO.

The AND block is often used when multiple E-stops must be released and
multiple safety gates must be closed for the safety system to be energized.

Figure 89 - AND Logic Block

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 75

Chapter 10 Logic Levels A and B

Table 8 - AND Logic Table for Two Inputs

Input 1 Input 2 Output
0 0 0
0 1 0
1 0 0
1 1 1

OR The OR block accepts 2…24 inputs. If any of the inputs are HI, the output of the
block is HI. If all inputs go LO, the output of the block goes LO.

The OR block is often used with enabling devices.

Figure 90 - OR Logic Block

Table 9 - OR Logic Table for Two Inputs

Input 1 Input 2 Output
0 0 0
0 1 1
1 0 1
1 1 1

XOR The XOR block accepts 2…24 inputs. The output of the XOR block is HI when
any input is HI. The output is LO when multiple inputs are HI or if all inputs are
LO.

Figure 91 - XOR Logic Block

Table 10 - XOR Logic Table for Two Inputs

Input 1 Input 2 Output
0 0 0
0 1 1
1 0 1
1 1 0

76 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Logic Levels A and B Chapter 10

NAND The NAND block accepts 2…24 inputs. The NAND performs the opposite of
an AND block. The output of the NAND block is LO when all inputs are HI.
When any input is LO, the output is HI.

Figure 92 - NAND Logic Block

Table 11 - NAND Logic Table for Two Inputs

Input 1 Input 2 Output
0 0 1
0 1 1
1 0 1
1 1 0

NOR The NOR block performs the opposite of the OR block. When any input is HI,
the output is LO. When all inputs are LO, the output is HI.

Figure 93 - NOR Logic Block

Table 12 - NOR Logic Table for Two Inputs

Input 1 Input 2 Output
0 0 1
0 1 0
1 0 0
1 1 0

NOT The NOT block accepts only one input. The NOT inverts the input signal.
When the input is LO, the output is HI. When the input is HI, the output is LO.

Figure 94 - NOT Logic Block

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 77

Chapter 10 Logic Levels A and B

Table 13 - NOT Logic Table for Two Inputs

Input Output
0 1
1 0

AND with Restart The AND with Restart accepts 2…24 inputs and requires a Restart input. All
inputs must be HI when the Restart button is pressed.

The CCW automatically recognizes the Restart function blocks and allows you
to select one. Once selected, the Restart is no longer available for other logic
blocks.

Figure 95 shows an example with a gate switch and a light curtain. Both the gate
must be closed and the light curtain clear. Then, the Restart input must be
pressed. The output of the logic block goes HI on the trailing edge of the restart
signal.

Figure 95 - Example of AND with Restart

Figure 96 - Logic of the Restart Function with Two Input AND

Restart
Input 1
&
Input 2

The timing diagram shows how the output of the Logic block responds to the
input signals and the Restart signal. Both inputs must be HI when the Restart
signal occurs for the output to go HI. If any of the inputs go LO, the output goes
LO.

78 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Logic Levels A and B Chapter 10

Figure 97 - AND with Restart Timing Diagram

HI
Restart LO
HI
Input 1
LO
AND
HI
Input 2
LO
HI
Output
LO

OR with Restart The OR with Restart accepts 2…24 inputs and requires a Restart input. At least
one input must be HI when the Restart button is pressed.

The CCW automatically recognizes the Restart function blocks and allows you
to select one. Once selected, the Restart is no longer available for other logic
blocks.

Figure 98 shows an example with a gate switch and a light curtain. Either the gate
must be closed or the light curtain clear. Then, the Restart input must be pressed.
The output of the logic block goes HI on the trailing edge of the restart signal.

Figure 98 - Example OR with Restart

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 79

Chapter 10 Logic Levels A and B

Figure 99 - Logic of the Restart Function with Two Input OR

Restart
Input 1
>
Input 2

The timing diagram shows how the output of the Logic block responds to the
input signals and the Restart signal. Either or both inputs can be HI when the
Restart signal occurs for the output to go HI. If all inputs go LO, the output goes
LO.

Figure 100 - OR with Restart Timing Diagram

HI
Restart LO
HI
Input 1
LO
OR
HI
Input 2
LO
HI
Output
LO

80 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 11

Safety Outputs

The safety output blocks are the fourth stage of the configuration. Many of the
blocks have common features.

Input Connection Each output block has one input connection. This input connection can be
connected to only Logic Level B blocks.

Feedback The Immediate OFF, ON Delay, and OFF Delay blocks have a feedback
parameter. To use the feedback parameter, a feedback input block must be
declared. If a feedback input block is not available, the feedback parameter is set
to “None”, and can be considered to be always HI.

Reset The reset parameter must be set to either automatic or manual.

• If set to automatic, the output turns on when the input received from the
Logic Level B block is HI.
• If the reset is set to manual, a reset input block must be declared. Before the
reset button is pressed, the input that is received from the Logic Level B
block must be HI. Then, the output turns on if the reset button must be
pressed and held for at least 0.25 s and released within 3 s.

Timing Timing is used in the ON Delay, OFF Delay, and Jog functions.

The timing can be set between 50…300,000 ms (5 minutes) in 50 ms increments.

Output Connections The output of the block can be connected to one or more of the following wiring
terminals:
• 12…17 Multi-Purpose (MP)
• 18…21 Embedded Output (EO)
• 00…03 plug-in 1 module (not safety rated)
• 00…03 plug-in 2 module (not safety rated)

The multi-purpose outputs can be configured to operate with pulse test (PT) or
without test pulses (No PT). The embedded terminals always operate with test
pulses. Terminals 20 and 21 can be configured as Single Wire Safety (SWS)
output.

WARNING: The plug-in outputs must only be used for nonsafety rated
purposes.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 81

Chapter 11 Safety Outputs

Immediate OFF The Immediate OFF block is used to turn off output terminals immediately upon
a demand that is placed on a safety function.

Figure 101 shows the Immediate OFF output block that is connected to an
E­stop block through Logic Level LLB1. The feedback signal is provided by
SMF2 and manual reset by SMF3. The output is connected to:
• Terminals 18 and 19 for dual channel safety switching of the machine
hazards.
• Plug-in 1 terminal 00 for status indication.

Figure 101 - Immediate OFF Configuration

82 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Outputs Chapter 11

ON Delay The ON Delay block turns on the output after the specified time delay expires.

Figure 102 shows the ON Delay output block that is connected to an E-stop
block through Logic Level LLB1. The feedback signal is provided by SMF2 and
manual reset by SMF3. The time delay is set to 20. The output will turn on 1000
ms (20x50 ms) after the reset button is released. The output is connected to:
• Terminals 18 and 19 for dual channel safety switching of the machine
hazards.
• Terminal 20, which is configured as a Single Wire Safety (SWS) output.
• Plug-in 1 terminal 00 for status indication.

Figure 102 - ON Delay Configuration

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 83

Chapter 11 Safety Outputs

OFF Delay The OFF Delay block turns off the output after the specified time delay expires.

The retriggerable parameter can be set to enabled or disabled.

• When enabled, the input to the OFF Delay block can go HI again during
the timing cycle, and the output remains HI.
• When disabled, the timing cycle runs to completion, regardless of changes
to the input.

Figure 103 shows the OFF Delay output block that is connected to a gate switch
block through Logic Level LLB1. The feedback signal is provided by SMF2 and
manual reset by SMF3. The time delay is set to 30. The output will turn off 1500
ms (30x50 ms) after the gate is opened. The output is connected to:
• Terminals 18 and 19 for dual channel safety switching of the machine
hazards.
• Terminal 20, which is configured as a Single Wire Safety (SWS) output.
• Terminal 00 of Plug-in 2 for status reporting

Figure 103 - OFF Delay Configuration

84 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Safety Outputs Chapter 11

Jog The Jog block turns on the output for a specified duration while the jog input is
held HI. If the Jog input goes LO, the output immediately turns off.

Figure 104 shows the Jog output block that is connected to an enabling switch
block through Logic Level LLB1. The reset is set to automatic. The time delay is
set to 40. The output will turn on for a maximum of 2000 ms (40x50 ms) after
the enabling switch is closed. The output is connected to:
• Terminals 18 and 19 for dual channel safety switching of the machine
hazards.
• Terminal 20, which is configured as a Single Wire Safety (SWS) output.
• Plug-in 1 terminal 03 for status indication.

Figure 104 - Jog Configuration

Muting Lamp The Muting Lamp block works with the Muting safety monitoring function.

The muting lamp is not monitored. If the lamp burns out or becomes
disconnected, the muting function continues to function properly.

Figure 105 shows the muting lamp output block connected to the mute function
in SMF1. The output is connected to:
• Terminal 14, a multi-purpose terminal with no pulse testing (No PT).
• Plug-in 1 terminal 00 for more status indication.
• The muting lamp should be connected to terminals without pulse testing.
Pulse testing does not affect filament lamps, but LED lamps can appear to
flicker if pulse testing is enabled.

Figure 105 - Muting Lamp Configuration

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 85

Chapter 11 Safety Outputs

Notes:

86 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 12

Plug-in Modules

The CR30 accepts up to two plug-in I/O modules. Table 14 shows which
modules are available for the firmware that is installed in the CR30.

Table 14 - Plug-in Modules for the CR30

Module Description Firmware Release
2080-IQ4OB4 4 sinking inputs + 4 sourcing outputs 6 and later
2080-IQ4 4 sinking inputs 7 and later
2080-OB4 4 sourcing outputs 7 and later
2080-OW4I 4 electro-mechanical relay outputs 7 and later

ATTENTION: The input and output signals of these modules are not safety
rated. They must only be used for standard control functions.

Insert Module into Controller Follow the instructions to insert and secure the plug-in module to the controller.

Figure 106 - Plug-in Module

1. Position the plug-in module with the terminal block facing the front of the
controller as shown.
2. Snap the module into the module bay.
3. Using a screwdriver, tighten the 10…12 mm (0.39…0.47 in.) M3
self­tapping screw to 0.2 N•m (1.48 lb•in) torque.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 87

Chapter 12 Plug-in Modules

2080-IQ4OB4

The 2080-IQ4OB4 has four sinking inputs and four sourcing outputs. The
COM connection B3 is internally connected to A3. This COM connection is for
the inputs (without it, the inputs do not turn on). Terminal B4 must be
connected to the +24V supply to provide power to the outputs terminals
O­00…O-03.

Figure 107 - 2080-IQ4OB4 Schematic Showing Four Standard Input Signals

+24V DC

B1 B2 B3 B4 B5 B6
I-00 I-01 COM +24DC O-00 O-01

2080-IQ4OB4
I-02 I-03 COM -24DC O-02 O-03
A1 A2 A3 A4 A5 A6

24V Com

Figure 108 - 2080-IQ4OB4 Schematic Showing Four Standard Output Signals

+24V DC

B1 B2 B3 B4 B5 B6
I-00 I-01 COM +24DC O-00 O-01

2080-IQ4OB4

I-02 I-03 COM -24DC O-02 O-03

A1 A2 A3 A4 A5 A6

24V Com

88 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Plug-in Modules Chapter 12

2080-IQ4

The 2080-IQ4 has four sinking inputs. The four COM connections, A3, A4, B3,
and B4 are internally connected. At least one COM connection must be
connected to 24V Com (without it, the inputs do not turn on).

Figure 109 - 2080-IQ4 Schematic Showing Four Standard Input Signals

+24V DC

B1 B2 B3 B4 B5 B6
I-00 I-01 COM COM NU NU

2080-IQ4

I-02 I-03 COM COM NU NU

A1 A2 A3 A4 A5 A6

24V Com

2080-OB4

The 2080-OB4 has four sourcing outputs. Terminals B3 and B4 are internally
connected; one of these terminals must be connected to +24V DC. Terminals A3
and A4 are internally connected; one of these terminals must be connected to
24V Com.

Figure 110 - 2080-OB4 Schematic Showing Four Standard Output Signals

+24V DC

B1 B2 B3 B4 B5 B6
NU NU +24DC +24DC O-00 O-01

2080-OB4
NU NU -24DC -24DC O-02 O-03
A1 A2 A3 A4 A5 A6

24V Com

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 89

Chapter 12 Plug-in Modules

2080-OW4I

The 2080-OW4I has four electromechanical relays with normally open

(Form A) contacts.

Figure 111 - 2080-OW4I Schematic Showing Four Standard Output Signals

+24V DC

B1 B2 B3 B4 B5 B6
CM0 O-0 CM1 O-1 CM2 O-2

2080-OW4I
CM3 O-3 NU NU NU NU
A1 A2 A3 A4 A5 A6

24V Com

90 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 13

LEDs

The CR30 has 21 LEDs on the upper left front of the module. These 21 LEDs
fall into three categories:
• Input status
• Module status
• Output status

Figure 112 - LEDs

Input

Module

Output

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 91

Chapter 13 LEDs

Input and Output LEDs To access and configure the LEDs in the CCW,

1. In the Project Organizer, double-click Guardmaster_440C-CR30*.

2. Click LED Configuration.
3. Configure the filter type and value for input and output LEDs.

First select one of four Filter Types for each LED:

1. Not Used
2. Terminal Status
3. Safety Monitoring Function Status
4. Safety Output Function Status

Then select the instance for each Filter Type.

Monitoring a function is advantageous when the input and output logic blocks
have multiple inputs or outputs. A single LED can provide status information
about multiple inputs or outputs, when it provides the status of an input or
output block.

92 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 LEDs Chapter 13

In the previous example:

a. Input LED 1 is monitoring a terminal status. In this case, it is
monitoring terminal 01. When the signal to terminal 1 is HI, the LED
is on. When the signal to terminal 1 is LO, the LED is off. If this were a
single channel input, then the LED provides all information that we
need to know about the input.
b. Input LED 2 is monitoring safety monitoring function 1. If the LED is
on, then we know that all inputs are satisfied for whatever function (for
example, dual channel input, muting, or two-hand control) is being
monitored.
c. Output LED 3 is monitoring the status of a Safety Output Function. In
this case, SOF 1 is being monitored. If SOF 1 is driving four outputs
(two safety, one diagnostic, and one Modbus), we expect all four
outputs to be HI when LED 3 is on.

Controller Status LEDs The CR30 has five module status LEDs that are described in Table 15.

Table 15 - Status LEDs

LED Color Indicates
POWER Off No input power or power error condition
Green Power on
RUN Off Program mode
Green Run mode
Flashing Green [2 Hz] Application is running but not verified
FAULT Off No fault detected
Red Flashing [2 Hz] Application fault detected, recoverable
Red Controller hardware faulted, non-recoverable
LOCK Off Not used
COM Off No communications
Green Communications by serial port or USB

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 93

Chapter 13 LEDs

Notes:

94 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 14

Modbus Communication

The CR30 uses Modbus RTU communications to transfer status information

and control signals to Micro800® controllers and human-machine interfaces like
the Allen-Bradley PanelView.

The Modbus configuration of the CR30 is fixed to Modbus RTU slave at

address 1.

For more information on PanelView, refer to the following documents:

• User Manual: 2711C-UM001_-EN-P
• Quick Start Guide: 440C-QS001_-EN-P

Modbus Mapping The CR30 Modbus addresses are mapped to parameters shown in Table 16. The
addresses in the range of 1…512 can be accessed as coils. The fault log can be
accessed by holding register reads; each address contains 16 bits of data.

Table 16 - Modbus Addresses

Modbus Address Parameter
000001…000016 Modbus serial input data
000025…000028 Input Data for Plug-in 1 Terminals I-00…I-03
000033…000036 Output Data for Plug-in 1 Terminals O-00…O-03
000265 Processor HW fault
000266 Safety Input HW fault
000267 Safety Output HW fault
000268 Power supply fault / Main transistor fault
000269 Communication fault
000270 Configuration fault (wrong revision, invalid configuration)
000271 Time out (Clock monitoring)
000272 Plug-in fault
000273…000294 State of Embedded Terminals 00…21
000297…000300 Input of Plug-in 2 Terminals I-00…I-03
000301…000304 Output of Plug-in 2 Terminals O-00…O-03
000305…000328 State of Safety Monitoring Function (SMF) 0…23
000329…000344 State of Logic Level A Instance (LLA) 0…15 (1)
000345…000360 State of Logic Level B Instance (LLB) 0…15
000361…000376 State of Safety Output Function (SOF) 0…15

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 95

Chapter 14 Modbus Communication

Modbus Address Parameter

000377…000392 Ready-to-start of SOF 00…15
000393…000416 Fault bit 0 of SMF 0…23
00: No error
01: Crossloop
10: Simultaneity fault
11: One channel open after reset
000417…000440 Fault bit 1 of SMF 1…24
000441…000464 Fault bit 2 of SMF 1…24
000465…000488 Fault bit 3 of SMF 1…24
000489…000504 Retrigger Fault SOF 1…16
000505…000512 Cross Fault of Terminals 12…17
000513…000848 Reserved
000849…000860 Fault log
(1) When a Logic Level A block is automatically created as a Pass Through, the block does not
occupy memory and cannot be read over Modbus. This can be viewed in the CCW as a block
with no title. Pass Through blocks in Logic Level B can be read over Modbus.

Figure 113 - (Non-)Readable Pass-through Blocks

96 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Modbus Communication Chapter 14

Example Architectures Some examples of how the CR30 is used with Modbus are shown in Figure 114.

In the example below, a PanelView C600 is connected to the serial port of the
CR30. The C600 is configured over its Ethernet port. The C600 can read status
information from the CR30 and can send reset and restart signals to the CR30.

Figure 114 - Modbus RTU Communication — PanelView C600

To Ethernet DHCP-enabled Network

PanelView C600
2711C-T6T
Modbus Master

Ethernet Port RS-232 Serial Port

10/100Base-T 9-pin D-shell
Ethernet Cables

1761-CBL-PM02 Cable CR30

440C-CR30-22BBB
Modbus Slave
8-pin Mini DIN
RS232

In this example, a Micro830® is connected to the CR30 by the 8-pin DIN serial
port connections. The Micro830 can read/use status information from the CR30
and can send reset and restart signals to the CR30.

Figure 115 - Modbus RTU Communication — Micro830

Micro830
2080-LC30-24QBB
Modbus Master

1761-CBL-HM02
8 Pin mini DIN to 8 Pin mini DIN

CR30
Standard Cable 440C-CR30-22BBB
USB A Male to B Male Modbus Slave

In the example below, a PanelView C600 is connector the serial port of the
Micro830 and the Micro830 is connected to the CR30 through a SERIALISOL
plug-in module. The Micro830 can read/use status information from the CR30
and can send reset and restart signals to the CR30.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 97

Chapter 14 Modbus Communication

Figure 116 - Modbus RTU Communication — PanelView C600 & Micro830

To Ethernet Network
PanelView C600
2711C-T6T
Modbus Master

Ethernet Port
10/100Base-T 1761-CBL-PM02 Cable

2080-SERIALISOL

Ethernet Cables
Micro830
2080-LC30-24QBB
RXD TXD
GND

CR30
Standard Cable 440C-CR30-22BBB
USB A Male to B Male Modbus Slave

98 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Modbus Communication Chapter 14

Reading CR30 Status In the Micro800 family, the Msg_Modbus block must be used.

In the example ladder diagram below, a Micro830 reads the status of the first five
input wiring terminals of the CR30.
• Rung 1: When a push button, which is connected to terminal 03 of the
Micro830, is pressed, the Micro830 sends a Modbus message to the CR30
• Rung 2: The format of the data in LocalAddr is a 'WORD'. The first block
ANY_TO_DINT converts the 'WORD' to a 'DINT'. The second block
compares the DINT to the value of 1 with an AND_MASK. The third
block checks to see if the value is 1. If the value is 1, then the output
terminal _IO_EM_DO_00 goes HI.

Figure 117 - Read Ladder Diagram

You should configure local variables. In this example, they are labeled LocalCfg,
TargetCfg, and LocalAddr.
• LocalCfg must be configured as a MODBUSLOCPARA data type.
TargetCfg must be configured as a MODBUSTARPARA data type.
LocalAddr must be configured as a MODBUSLOCADDR data type.
• TargetCfg.Addr - Select the first value from the Modbus Mapping table
for the CR30. In this case, the initial value is set to 000273 (leading zeros
must be included), which is mapped to terminal 00 of the CR30.
• TargetCfg.Node - Enter a value of 1. The CR30 is fixed at Node 1.
• LocalCfg.Channel - Select the serial port location. Enter a 2 if the
embedded serial port is used. Enter a 5 to use the serial port in the fist plug-
in slot.
• LocatCfg.TriggerType - Enter a 0 to have the block execute only once. Each
time the push button that is connected to terminal _IO_EM-DI-00 is
pressed, message is sent once.
• LocalCfg.Cmd - Enter a 1 to instruct the block to read a 'coil' (which is
mapped to the CR30).
• LocalCfg.ElementCnt - Enter a 5 read the status if 5 inputs (starting at
000273 and ending at 000277).

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 99

Chapter 14 Modbus Communication

• LocalAddr - The results are placed in LocalAddr. There is no need to

make changes.
Figure 118 - Read Local Variables

Sending Reset to CR30 The Reset function must use a separate Modbus message block. Another
constraint that must be considered is reset signal must be between 0.5…3 s long.
In the example below, a momentary button is connected to embedded terminal
_IO_EM_DI_02.
• Rung 3: The push button initiates a TONOFF timer. The timer is set for a
100 ms delay ON and a 1100 ms delay OFF. This provides a reset signal of
1 s.
• Rung 4: The Modbus message is sent with every scan of the ladder. The
reset is executed because the reset value goes from 0 to 1 and back to 0
within the acceptable range of 0.5…3 s.
• Rung 5: When the TONOFF block goes LO, embedded output
_IO_EM_DO_01 goes LO and moves the value of 0 into Reset Addr.
• Rung 6: When the TONOFF block goes HI, embedded output
_IO_EM_DO_01 goes HI and moves the value of 1 into Reset Addr.

Figure 119 - Reset Ladder Diagram

100 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Modbus Communication Chapter 14

You should configure a second set of local variables. In this example, they are
labeled ResetCfg, ResetTrgt, and ResetAddr.
• ResetCfg must be configured as a MODBUSLOCPARA data type.
ResetTrgt must be configured as a MODBUSTARPARA data type.
ResetAddr must be configured as a MODBUSLOCADDR data type.
• ResetTrgt.Addr - Enter a value of 1, which is Modbus mapping of
the CR30.
• ResetTrgt.Node - Enter a value of 1. The CR30 is fixed at Node 1.
• ResetCfg.Channel - Select the serial port location. Enter a 2 if the
embedded serial port is used. Enter a 5 to use the serial port in the fist plug-
in slot.
• ResetCfg.TriggerType - Enter a 1 to have the block execute every time that
the ladder is scanned
• LocalCfg.Cmd - Enter a 5 to instruct the block to write to a 'coil' (that is,
turn on an input of the CR30).
• ResetCfg.ElementCnt - Enter a 1 to write only 1 bit.
• ResetAddr - The results are placed in LocalAddr. There is no need to make
changes.

Figure 120 - Reset Local Variables

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 101

Chapter 14 Modbus Communication

Notes:

102 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 15

Troubleshooting

Faults fall into two categories:

• Recoverable
• Nonrecoverable

Recoverable faults are those faults that can be corrected without having to cycle
the power to the CR30. Nonrecoverable faults require power cycling to recover
after the fault is corrected.

Recoverable Faults Recoverable faults can be cleared by eliminating the cause of the fault and cycling
the inputs that are associated with the fault. The output that is connected to an
input with that fault is switched off. The other non-affected outputs continue to
work.

Examples of recoverable faults include:

• SMF faults
• Cross loop
• Simultaneity faults
• Reset button fault
• Muting: Synchronization time exceed
• Muting time exceeded
• Sequence fault

LEDs Faults are indicated by the fault LED. If the fault LED is flashing red, a
recoverable fault has occurred. If the Fault LED is solid red, a nonrecoverable
fault has occurred.

Figure 121 - Fault LED

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 103

Chapter 15 Troubleshooting

Nonrecoverable Faults Nonrecoverable faults and failures are malfunctions of the device itself that occur
during operation. These faults are detected by internal monitoring measures
helping to ensure the safety integrity of the device itself. Nonrecoverable faults
require a power cycle to allow CR30 to perform all relevant internal system tests
during initialization. If there are transient malfunctions, CR30 will recover after
power cycle. If there is permanent damage or malfunction, the CR30 will remain
in safe-state after power cycle. Permanent nonrecoverable faults are typically
related to random hardware faults that cause permanent damage of components.

Potential root cause for nonrecoverable faults:

• Transient EMC disturbance causing asynchrony of the two CPU
• Environmental disturbances of high voltage or high current spikes that
cause internal damage of components
• Power supply interruptions that are detected by internal voltage level
monitor
• Transient overload conditions of safety outputs that trigger short circuit
and overload protection or the output (for example, high inrush currents)

Troubleshooting with the When connected to the CR30 through the USB port, the CCW Logic Editor
monitors and displays the status of each terminal and block.
CCW
• Green shows an ON (HI) state.
• Red shows a Fault state (output is LO).
• Grey blocks are OFF (LO) state.

Figure 122 - Monitor Status with Logic Editor

Mouse over the red block, and the CCW displays an error message for 5 seconds.
Move the mouse away and then back over the block to show the message again.

104 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Troubleshooting Chapter 15

Figure 123 - Mouse Over to Show Error Message (in Yellow Box)

The type of fault is also shown in the top panel of the Project tab (Figure 124).
• For a recoverable fault, the Device Details view only indicates “Fault:
Recoverable”. For further details, navigate to the “Logic Editor” view and
mouse over the red marked function block. A user is allowed to change the
operation mode to “Program Mode”
• For a nonrecoverable fault, the Device Details view provides the fault type
and status. The device automatically exits “RUN” mode and switches to
“Program mode”. You cannot change the operation mode. Mouse over the
fault status area to get more information.

Figure 124 - Mouse Over Fault in Project Tab

To see a list of the recent faults, click Faults in the Safety Tree.

The recent faults appear in the fault pane.

Click the Export button to export the faults to a comma-separated value (.csv)
file. The default path for Win7 for saving the exported fault log file is the folder
at C:\Users\<user name>\documents\CCW\Fault log.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 105

Chapter 15 Troubleshooting

Figure 125 - Recent Fault List

Troubleshooting with Many faults can be reported to an HMI or PLC using Modbus. Table 17 shows a
list of the Modbus addresses for faults.
Modbus
Table 17 - Modbus Addresses for Faults
Modbus Address Parameter
000265 Processor HW fault
000266 Safety Input HW fault
000267 Safety Output HW fault
000268 Power supply fault / Main transistor fault
000269 Communication fault
000270 Configuration fault (wrong revision, invalid configuration)
000271 Time out (Clock monitoring)
000272 Plug-in fault
000393...000416 Fault bit 0 of SMF 0...23
000417...000440 Fault bit 1 of SMF 0...23
000441...000464 Fault bit 2 of SMF 0...23
000465...000488 Fault bit 3 of SMF 0...23
000489...000504 Retrigger Fault SOF 0...23
000505...000512 Cross Fault of Terminals 12...17
000849...000860 Fault log

106 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Troubleshooting Chapter 15

Table 18 shows the 'fault bit' message for the type of functions that are selected
for the Safety Monitoring Function block.

Table 18 - Fault Messages for the SMF Type

SMF Type Fault Bit 3 Fault Bit 2 Fault Bit 1 Fault Bit 0
1 Channel Reserved Reserved Reserved Input circuit shorted to 24V.
2 Channel, Two Reserved The left and right buttons have been Reserved At least one circuit shorted to 24V or
Hand Control in an inconsistent state for longer another input circuit.
than 500 ms.
Safety Mat Reserved Discrepancy Fault: Input channels One channel went to the safe state At least one circuit shorted to 24V or
inconsistent greater than the and back to the active state while the another input circuit.
configured discrepancy time other channel remained active, or
One channel went to the safe state
upon power up.
3 Channel Reserved Reserved One channel went to the safe state At least one circuit shorted to 24V.
upon power up.
Reset Reserved Reserved Reserved A transition of the reset input from ON
(1) to OFF (0) did not occur within
3,000ms.
Override Reserved Reserved Reserved At least one circuit shorted to 24V or
another input circuit.
Restart Reserved Reserved Reserved A transition of the restart input from
ON (1) to OFF (0) did not occur within
3,000ms.
Mute Reserved Muting sensor sequence fault. The Light Curtain was muted for Too much time elapsed between
longer than the configured maximum Sensors being blocked.
mute time.
Lack of Muting Too much time elapsed between Muting sensor sequence fault. The Light Curtain was muted for Too much time elapsed between
L-Type Sensor2 and Light Curtain2 being longer than the configured maximum Sensor1 and Sensor2 being blocked.
blocked. mute time.

Example Fault Analysis – Create a crossfault from Input Test Pulse A to Input Pulse Test B with the safety
output ON.
Crossfault
• The Modbus address 000505 goes HI immediately, showing that the fault
was detected.
• About 4 seconds later, the fault is acted upon.
• Modbus address 000393 (Bit 0 of SMF1) goes HI.
• The Safety Output goes off.
• On the CCW Logic tab, the E-stop and gate inputs go off, and both logic
blocks show red color.
• The CCW Project tab shows “Recoverable Fault”.
Figure 126 - Mouse Over E-stop Block

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 107

Chapter 15 Troubleshooting

Remove the fault

• The Modbus address 000505 goes LO immediately, showing that the fault
was removed.
• Modbus address 000393 (Bit 0 of SMF1) remains HI.
• On the CCW Logic tab, both the E-stop and gate logic blocks continue to
show red color.
• The safety output remains off.
Cycle the E-stop.
• Modbus address 000393 (Bit 0 of SMF1) goes LO.
• On the CCW Logic tab, the E-stop block turns green, and the gate block
remains red,
Cycle the gate.
• On the CCW Logic tab, the gate block turns green.
The safety system is back to an operating state and waiting for the reset button to
be pressed.

108 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 16

Security and Password

Guardmaster 440C safety relay security has two components:

• Exclusive access that prevents simultaneous configuration of the safety
relay by two users.
• Password protection that secures the intellectual property that is
contained within the safety relay and prevents unauthorized access.

Exclusive Access Exclusive access is enforced on the Guardmaster 440C safety relay regardless of
whether the safety relay is password-protected or not. This means that only one
Connected Components Workbench (CCW) session is authorized at one time
and only an authorized client has exclusive access to the safety relay application.
This helps ensure that only one software session has exclusive access to the
Guardmaster 440C application-specific configuration.
Exclusive access is enforced on Guardmaster 440C firmware version 7 and later.
When a CCW user connects to a Guardmaster 440C safety relay, the software is
given exclusive access to that safety relay.

Password Protection By setting a password on the safety relay, you effectively restrict access to the
configuration software connections to the safety relay to software sessions that
can supply the correct password. Essentially, CCW operations such as upload,
download, and connect are prevented if the safety relay is secured with a
password and the correct password is not provided.
Guardmaster 440C safety relays with firmware version 7 and later are shipped
with no password. A password can be set through the CCW software (version 7
or later).
The safety relay password is also backed up to the memory backup module (Cat.
No. 2080-MEMBAK-RTC).

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 109

Chapter 16 Security and Password

Compatibility The Safety Relay Password feature is supported on:

• Connected Components Workbench version7 and later
• Guardmaster 440C safety relays with revision 7 or later firmware
Users with earlier versions of the software and/or hardware are advised to
upgrade the software and firmware. See Upgrade the Firmware on page 141 for
instruction on firmware upgrades.

Work with a Locked Safety The following workflows are supported on compatible Guardmaster 440C safety
relays (firmware revision 7 or later) and CCW version 7 or later.
Relay

Upload from a Password-Protected Safety Relay

1. Launch the CCW software project with your Guardmaster 440C safety
relay configuration.
2. Double-click the Guardmaster 440C safety relay in the Project
Organizer to open the Safety Relay workspace.
3. Select Upload from the pull-down menu in the safety relay header.
4. Select the target safety relay in the Connection Browser.
5. When requested, provide the safety relay password.

Connect to a Password-Protected Safety Relay

1. Launch the CCW software project with your Guardmaster 440C safety
relay configuration.
2. Double-click the Guardmaster 440C safety relay in the Project
Organizer to open the Safety Relay workspace.
3. Select Connect from the pull-down menu in the safety relay header.
4. Select the target safety relay in the Connection Browser.
5. When requested, provide the safety relay password.

Download to a Password-Protected Safety Relay

1. Launch the CCW software project with your Guardmaster 440C safety
relay configuration.
2. Double-click the Guardmaster 440C safety relay in the Project
Organizer to open the Safety Relay workspace.
3. Select Download from the pull-down menu in the safety relay header.
4. Select the target safety relay in the Connection Browser.
5. When requested, provide the safety relay password.

110 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Security and Password Chapter 16

Configure Password Set, change, and clear the password on a target safety relay through the
Connected Components Workbench software.

IMPORTANT The following instructions are supported on Connected Components

Workbench version 7 and Guardmaster 440C safety relays with firmware
revision 7.

Set Safety Relay Password

In the following instructions:
• The Connected Components Workbench software is connected to the
Guardmaster 440C safety relay.
• The relay is loaded with a viable configuration.
• The configuration does not necessarily have to be verified.
• The CR30 can be in either program or run mode.

1. On the Connected Components Workbench software, open the project

for the target safety relay by double-clicking the safety relay in the Project
Organizer.
2. On the Device Details toolbar, mouse over the Secure button. The tooltip
message “Set, Change, or Clear Safety Relay Password Protection” is
displayed.

3. Click the Secure button. Select Set Password.

4. Provide password. Confirm the password by providing it again in the
Confirm field.

TIP Passwords must have at least eight characters to be valid.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 111

Chapter 16 Security and Password

5. Click OK.
Once a password is created, any new session that tries to connect to the
safety relay has to supply the password to gain exclusive access to the target
safety relay.

IMPORTANT If you have to flash the safety relay, the project in the relay is lost. A new project
must be downloaded.

6. Click OK.

Change Password

With an authorized session, you can change the password on a target safety relay
through the Connected Components Workbench software. The target safety
relay must be in Connected status.

1. On the Device Details toolbar, click the Secure button. Select Change
Password.

The Change Safety Relay dialog appears.

112 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Security and Password Chapter 16

2. Enter the Old Password, New Password and confirm the new password.

3. Click OK.
The safety relay requires the new password to grant access to any new
session.

IMPORTANT Keep the password carefully. If lost, you have to flash the safety relay to reset
the password. The project in the safety relay is lost but a new project can be
downloaded.

Clear Password

With an authorized session, you can clear the password on a target safety relay
through the Connected Components Workbench software.

1. On the Device Details toolbar, click the Secure button. Select Clear
Password.

The Clear Password dialog appears.

2. Enter Password.
3. Click OK to clear the password.
The safety relay will require no password on any new session.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 113

Chapter 16 Security and Password

Lost Password

If the safety relay is secured with a password and the password has been lost, then
it becomes impossible to access the safety relay using the Connected
Components Workbench software.

To recover, use ControlFLASH™ to refresh the safety relay firmware, which also
clears the safety relay memory and clears the password

ATTENTION: The project in the safety relay is lost but a new project can be
downloaded.

114 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 17

Using the Memory Module

Overview Guardmaster 440C safety relays support the Cat. No. 2080-MEMBAK-RTC
memory modules for the following purposes:
• Project backup and restore
• Firmware and project backup and restore

ATTENTION: Removal and Insertion Under Power (RIUP) is not supported on

the Cat. No. 2080-MEMBAK-RTC memory module when used with a
Guardmaster® 440C safety relay.

ATTENTION: The Cat. No. 2080-MEMBAK-RTC module can only be installed in

Slot 1 (the leftmost plug-in slot) on the Guardmaster 440C safety relay.

IMPORTANT Do not remove the Cat. No. 2080-MEMBAK-RTC or power down while
operations such as backup and restore are ongoing to prevent data loss. A
blinking status indicator on the memory module indicates that these
operations are ongoing.

IMPORTANT Backup can only occur when the safety relay is in the Safety Verified state. To
learn about safety verification, see Verification on page 30.

IMPORTANT Using the Cat. No. 2080-MEMBAK-RTC with the CR30 is only supported with
firmware revision 7 or later.

Project Backup and Restore Project backup and restore on Guardmaster 440C safety relays are supported
through the Cat. No. 2080-MEMBAK-RTC memory module. Both backup and
restore can be initiated through the Connected Components Workbench™
(CCW) software and using buttons physically present on the Guardmaster 440C
safety relay and the Cat. No. 2080-MEMBAK-RTC module.

A backup of both the Guardmaster 440C safety relay firmware and project can
only occur through the CCW software.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 115

Chapter 17 Using the Memory Module

Backup and restore can only occur when the Cat. No. 2080-MEMBAK-RTC
module is present in plug-in Slot 1 (the leftmost slot) of the Guardmaster 440C
safety relay. On safety relay power-up, the safety relay enters a fault state where
the application logic is not executing. Backup and restore commands can be
issued in this fault state.

The Cat. No. 2080-MEMBAK-RTC memory module stores the safety relay
password, if present, in encrypted format. When the password is mismatched, the
contents of the Cat. No. 2080-MEMBAK-RTC memory module is not restored
on the safety relay.

Back-up Project
You can back up a Guardmaster 440C safety relay project to a Cat. No.
2080­MEMBAK-RTC memory module using the button on the memory
module.

1. Power down the Guardmaster 440C safety relay.

2. Remove the dustcover or plug-in module that is currently located in slot 1,
the leftmost slot, of the safety relay module bay.
3. Snap the Cat. No. 2080-MEMBAK-RTC module into slot 1 of the
module bay.
4. Power on the Guardmaster 440C safety relay.
The safety relay detects the presence of the Cat. No. 2080-MEMBAK-
RTC memory module and enters a fault state

The LEDs are as follows:

PWR - solid green
RUN - off (not executing)
FAULT - solid red
LOCK - solid green
COM - off

The behavior of the IN and OUT LEDs depends on whether the

configuration is verified:
• Verified - the IN and OUT LEDs continuously cycle through the
verification number.
• Not Verified - the IN 0 and the OUT 1, 2, 3 and 4 are solid green. The
backup cannot take place since the configuration is not verified.

116 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Using the Memory Module Chapter 17

5. Using a small flathead screwdriver press the Backup button on the Cat. No.
2080­MEMBAK-RTC memory module. Hold the button until the Status
LED on the Cat. No. 2080-MEMBAK-RTC module begins flashing
indicating the backup process has begun.
When the backup operation is complete the Status LED on the Cat. No.
2080­MEMBAK-RTC stops flashing.
TIP If the Status LED does not blink and turns on after 15 seconds, the
program is not verified and backup cannot take place.

6. Confirm the Verification ID displayed on the safety relay match the

expected Verification ID of the application to be backed up.
7. Power down the Guardmaster 440C safety relay.
8. Remove the Cat. No. 2080-MEMBAK-RTC memory module from slot 1
of the safety relay module bay.
9. Snap the dustcover or previous plug-in module into slot 1 of the module
bay.
10. Power on the Guardmaster 440C safety relay to resume normal operation.

Restore Project

You can restore a Guardmaster 440C safety relay project from a Cat. No. 2080-
MEMBAK-RTC memory module using the buttons on the memory module and
safety relay.

1. Power down the Guardmaster 440C safety relay.

2. Remove the dustcover or plug-in module that is currently located in slot 1,
the leftmost slot, of the safety relay module bay.
3. Snap the Cat. No. 2080-MEMBAK-RTC module into slot 1 of the
module bay.
4. Power on the Guardmaster 440C safety relay.
The safety relay detects the presence of the Cat. No. 2080-MEMBAK-
RTC memory module and enters a fault state. The Fault LED is solid Red
and the application logic is not executed.

The LEDs are as follows:

PWR - solid green
RUN - off (not executing)
FAULT - solid red
LOCK - solid green
COM - off

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 117

Chapter 17 Using the Memory Module

The behavior of the IN and OUT LEDs depends on whether the

configuration is verified:
• Verified - the IN and OUT LEDs continuously cycle through the
verification number of the configuration currently running in the
CR30.
• Not Verified - the IN 0 and the OUT 1, 2, 3 and 4 are solid green. The
restore can take place since the configuration being downloaded is
verified.
5. Press and hold the MEM/ID button that is located on the Guardmaster
440C safety relay just below the USB port.
6. While holding the MEM/ID button, using a small flathead screwdriver
press the Backup button on the Cat. No. 2080-MEMBAK-RTC memory
module. Hold both buttons until the Status LED on the Cat. No. 2080-
MEMBAK-RTC module begins flashing (approximately 5 seconds) which
indicates the restore process has begun.
TIP You do not have to hold the Backup button down until the flashing
stops.

When the restore operation is complete, the Status LED on the Cat. No.
2080-MEMBAK-RTC stops flashing and the LEDs on the Guardmaster
440C safety relay begin to cycle through each of the verification digits of
the application that is restored to the safety relay from the memory
module.
7. Confirm the Verification ID displayed on the safety relay match the
expected Verification ID of the application to be restored from the
memory module.
8. Power down the Guardmaster 440C safety relay.
9. Remove the Cat. No. 2080-MEMBAK-RTC memory module from slot
1of the safety relay module bay.
10. Snap the dust cover or previous plug-in module into slot 1 of the module
bay.
11. Power on the Guardmaster 440C safety relay to resume normal operation.

118 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Chapter 18

Reports

The Connected Components Workbench™ (CCW) allows you to generate a

report using Microsoft Word automatically. The report is editable, which allows
you to add more information or combine the report with other documents for
the safety technical file.

The report generator button is at the top of the logic editor. Mouse over the icon
that looks like a printer and click.

Figure 127 - Report Icon at Top of Logic Editor

The report generator takes a snapshot of the logic editor as viewed by the
operator. If the editor is actively monitoring the configuration, the report
generator captures the colors reflected the block status. You can expand or
collapse the blocks as desired to show or hide the advanced setting of each block.

Figure 128 - Report Output Settings

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 119

Chapter 18 Reports

Select the desired output type, orientation, image options, header/footer options,
and output file location and name. If a report with the same name already exits,
the user is prompted to overwrite it.

An example of a report is shown in the following two figures.

Figure 129 - Example Report - Page 1

Figure 130 - Example Report - Page 2

120 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Appendix A

Specifications

SIL Rating The CR30 meets the requirements of SIL CL 3 in accordance with
IEC/EN 61508.

Table 19 - SIL Rating

Safety Integrity Level Claim Limit 3
PFD 1,76 10-3 (whole safety function)
PFH 1 10-8
Mode of Operation High-demand mode
Safety Related Subsystems Type B (use of programmable / complex components)
Hardware Fault Tolerance HFT = 1 (two channel system)
Safe Failure Fraction 90…99%

Performance Level/Category The performance Level of the safety function is dependent on the structure of all
devices that comprise the safety function.

The CR30 is capable of being used in safety systems meeting up to Category 4

and Performance Level PLe in accordance with ISO 13849-1.

Table 20 - Performance Level/Category

Category Up to 4
Performance Level Up to e

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 121

Appendix A Specifications

General Number of I/O 22

Dimensions 90 x 100 x 80 mm (3.54 x 3.94 x 3.15 in.)
Shipping Weight, approx. 0.423 kg (0.933 lb)
Wire Size 0.2…2.5 mm2 (24…12 AWG) solid copper wire or
0.2…2.5 mm2 (24…12 AWG) stranded copper wire
rated @ 90 °C (194 °F) insulation max
Wiring Category 2 – on signal ports
2 – on power ports
Use this Conductor Category information for planning conductor routing. See Industrial
Automation Wiring and Grounding Guidelines, publication 1770-4.1.
Insulation Stripping Length 7 mm (0.28 in.)
Terminal Screw Torque 0.6 N•m (4.4 lb•in) max
(Using a 2.5 mm (0.10 in.) flat-blade screwdriver)
Input Circuit Type 24V DC source
Output Circuit Type 24V DC source
Power Supply Voltage Range 24V DC +10% -15% ➊
Fuse Specification 6A
Power Consumption 5.28 W
I/O Rating Input 24V DC, 4 mA
Output 24V DC, Class 2, 0.5 A per point
Enclosure Type Rating IP20

➊ Power has to be supplied by a power supply that complies with IEC / EN 60204 and IEC / EN 61558-1. Such a power supply meets the
electrical safety requirements and maintain the minimum power of 18V DC during 20 ms even in the event of voltage dips.

Environmental Temperature, Operating -5…+55 °C (23…131 °F)

Relative Humidity 90%
Vibration 10…55 Hz, 0.35mm
Shock 10 g, 16 ms
Pollution Level 2

122 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Specifications Appendix A

Inputs Number of Inputs Up to 18 embedded

12 dedicated inputs
6 configurable as Inputs
Operating Voltage Range 20.4…26.V DC
Off-state Voltage, max 5V DC
Off-state Current, max 2.91 mA (independent of supply)
On-state Voltage, max 26.4V DC
On-state Voltage, min 11.0V DC
On-state Current, min 3.14 mA at 20.4V DC
On-state Current, nominal 3.2 mA at 24V DC
On-state Current, max 3.25 mA at 26.4V DC
Off Pulse Accepted for OSSD Min = 0 μs
Setting without Declaring Max = 700 μs
the Input as OFF
Reverse Voltage Protection No
Input Capacitance 10 nF
Galvanic Isolation: I/O from No
Logic

Outputs Number of Outputs Up to 10

Output Signals Standard, OSSD and Single Wire Safety
Continuous Output Current 0.5 A (Terminals 12…19)
0.3 A (Terminals 20…21)
Aggregate Current of Outputs 3A
per Device (Max)
Surge Output Current 1A
Surge Output Current 5 ms
Duration
Residual Voltage (Drop from 0.2V DC
Power Supply), max
Max Load Capacitance 200 nF / 20 mA load
100 nF / 10 mA load
22 nF without load
Off-state Leakage Current, < 0.1 mA
max
Short Circuit Detection Yes
Short Circuit Protection Yes
Galvanic Isolation: I/O from No
Logic
Pulse Test Duration ≤700 μs
Pulse Test Period ≤13000 ms (less than 15 s)

Reaction Times Safety Input

Automatic reset < 100 ms
Single Wire Safety Input
Manual monitored reset < 500 ms
Safety Mats

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 123

Appendix A Specifications

Recovery Times To trigger Inputs again Response time as demand + reaction time + 100 ms

Response Times Safety Input 45 ms + Input Filter time

Single Wire Safety Input <45 ms
Safety Mats <70 ms
Single Wire Safety Output <60 ms

System Response Time The safety response time is the time that is required to establish the safe state of
the safety output function considering the demand of the safety monitoring
Calculation function and/or occurrence of faults and failures in the safety chain. The overall
response time of the safety function considers the whole safety chain, including
the safety input device, logic device, and actuator. The safety response time is
used to calculate the safety distance, distance between a safeguarding device, and
the hazardous area.

The following paths have to be considered:

Figure 131 - System Response Time

Input Logic Actuator
E.g.
E.g.
Interlock E.g. CR30
Contactor
switch

Embedded CPU, Logic Embedded

Input routing Output

124 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Specifications Appendix A

Response Time - Demand of the Safety Function

The safety response time of CR30 is the screw-to-screw response time to turn off
a safety output at demand of the safety function by the safety input device. The
safety response has to be calculated for each safety monitoring function. Table 21
shows the possible safety chain with all considerable response times.

Table 21 - Safety Chain Response Times

Description Where to find: Value
Safety Sensors Safety response time of sensor device Sensor operating manual
SMF Specific Processing time of safety Below table of specific SMF processing
monitoring function configured in CCW times
Input Filter Configured Input Filter time From SMF configuration “advanced
settings” (2)
Logic Internal execution time to process input From technical specification 45 ms
signal, routing and output processing (1)
SOF Configured Off-Delay time From SOF configuration
Actuator Safety switching device controlling the Actuator operating manual
load
Total
(1) The internal execution time is static and independent of the number of function blocks that are configured for the safety function.

(2) The maximum input filter time shall not be greater than 250 ms.

Table 22 shows the additional processing time of dedicated SMF

Table 22 - Processing Time

SMF Description SMF response time
Emergency Stop SMF inputs deactivated 0 ms
Enabling Switch
Gate Switch
Light Curtain
Alternative Device
Muting N/A 0 ms
Light Curtain Light interrupted, not muted 0 ms
Override Deactivate Override when light 0 ms
curtain is interrupted
Safety Mats Step on Mat, cross loop between 25 ms
safety mat inputs
Single Wire Safety Deactivated SWS signal 15 ms
Two Hand Control Release of at least 1 Hand actuator 0 ms

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 125

Appendix A Specifications

Figure 132 - Example

Table 23 - For SMF1 - E-stop:

Comment Value
Safety Sensors Safety response time of sensor device 0 ms
- considered as 0 ms since
mechanical device only
SMF An E-stop SMF does not require extra 0 ms
processing time
Input Filter Advanced Settings: Input Filter: 10 x 250 ms
25 ms = 250 ms
Logic Internal execution time to process 45 ms
input signal, routing, and output
processing
SOF Configured Off-Delay time - 0 ms
immediate OFF
Actuator Assuming a contactor with a 30 ms
response time of 30 ms
Total 325 ms

A demand of the E-stop will force a safe state after 325 ms.

126 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Specifications Appendix A

Table 24 - For SMF2 - Safety Mat

Comment Value
Safety Sensors Safety response time of sensor device 0 ms
- considered as 0 ms since
mechanical device only
SMF Safety mat processing time 25 ms
Input Filter Advanced Settings: Input Filter: 0 ms 0 ms
Logic Internal execution time to process 45 ms
input signal, routing, and output
processing
SOF Configured Off-Delay time - 0 ms
immediate OFF
Actuator Same contactor is controlled by the 30 ms
safety mat SMF as by the E-stop
Total 100 ms

A demand of the Safety Mat will force a safe state after 100 ms.

Monitoring Time - Occurrence of Recoverable Faults and Failures

Recoverable faults as defined earlier (Chapter 15 - Troubleshooting) are faults

and failures within the connected periphery of the CR30. The ability to detect
faults depends on the wiring, the type of sensor, and the signal evaluation
function that is applied to the circuit. The monitoring time is the amount of time
to evaluate the fault or failure after detection and to initiate appropriate system
response. Recoverable faults can be recovered by removing the fault and cycling
the appropriate input circuit.

The detection of a recoverable fault does not lead to the loss of the safety
function. When the safety function is demanded during the monitoring time,
after the occurrence of a recoverable fault, the system will respond within the
safety response time according to the response time considerations of this safety
function (See System Response Time Calculation on page 124).

Note: Monitoring measures that are provided by CR30 to the periphery

define the diagnostic coverage of the application and thus the safety rating.
Internal monitoring measures related to a fail-safe design of CR30 are only
related to the safety integrity of the CR30 itself, see “nonrecoverable”
faults.

Examples of recoverable faults include:

• Cross loop and shorts to 24V and COM faults
• Input discrepancy
• Muting: Synchronization times exceed
• Muting time exceeded
• Muting sequence fault
• Two-hand discrepancy fault
• Reset/Restart timing fault

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 127

Appendix A Specifications

The evaluation method of the input or output signal depends on the

configuration of the SMF and SOF in CCW and the wiring of the sensor.
Table 25 shows typical evaluation functions and required settings to be enabled.

Table 25 - Evaluation Method

Evaluation Method Configuration Applicable for
Multi-channel signal evaluation Inputs: 2 N.C., 2 OSSD, 3 N.C. (1) or SMF:
(1)
3 OSSD Emergency Stop
Enabling Switch
Gate Switch
Light Curtain
Two Hand Control
Alternative Device
Muting: Light Curtain settings
Muting: Override settings
Test pulse evaluation Test Pulses: 1 or 2 sources, or 3 SMF:
sources (1): >0 Emergency Stop
Enabling Switch
Gate Switch
Two Hand Control
Alternative Device
Muting: Override settings

Input Discrepancy Time Discrepancy Time (2): >0 SMF:

Range: 0.05…3 s Emergency Stop
Enabling Switch
Gate Switch
Light Curtain
Two Hand Control
Alternative Device
Muting: Light Curtain settings
Muting: Override settings
Two Hand Discrepancy Monitoring Default: 0.5 s SMF
The maximum amount of time Two Hand Control
between activation of Hand 1 and
Hand 2 to enable SMF
Muting Sequence Muting Type: 2 Sensor T-Type, 2 SMF
Sensor L-Type, 4 Sensor Muting
Defines the type of muting
application and thus the valid
sequence of clearing or blocking the
muting sensors and protective
device.

128 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Specifications Appendix A

Evaluation Method Configuration Applicable for

Muting: Synchronization time Synch Time: 0.05…10 s SMF
The maximum amount of time that is Muting
allowed between clearing or blocking
of the muting sensor inputs before
generating a fault.

Muting time Max. Mute Time: 1 s…10 days SMF

Maximum amount of time during Muting
which the instruction lets the
protective function of the light
curtain be disabled before
generating a fault.

Input pulse monitoring Input Pulse of 250 ms…3 s SMF

Monitors the operation of a valid Reset
reset or restart actuation. Restart
Retrigger Time Delay If retrigger function is disabled, once SOF
the Time Delay has begun timing, it Off Delay
cannot be reset.
When SOF input signal transitions
from the Safe state back to the Active
state, when timing has started, the
time will completely lapse but the
SOF indicates a fault

Integral test pulses Integral test pulses are enabled for SOF
safety outputs controlled by an SOF Immediate OFF
When using the multi-purpose OFF Delay
terminals 13…17 as outputs, the ON Delay
integral test pulses can be disabled.
Jog

(1) For Alternative SMF only

(2) A Discrepancy time of 0 disables discrepancy monitoring. The time between opening or closing the channels is infinite.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 129

Appendix A Specifications

Test Pulse Evaluation

Integral test pulses are applied to the input circuit of safety sensor with
electromechanical outputs. The test pulse output signal becomes input signal of a
safety input through the contacts of the safety sensor. Sensors with electronic
OSSDe (output safety switching device electronic) semiconductor outputs have
their own test pulses and do not require a test pulse evaluation that is sourced by
the logic device.

Note: In case multiple input circuits are sourced by the same test pulse
output, a fault affects all inputs that are connected to this output.

Multi-Channel Signal Evaluation and Discrepancy Monitoring

Independent of the test pulse evaluation or sensor type, components can be wired
in a single, dual channel, or even three channel structure. In a dual or three
channel structure, all channels must be active to enable the SMF. Disabling at
least one of the channels will demand the safety function. These channels can be
monitored against discrepancy.

The discrepancy time is the amount of time that input channels of an SMF are
allowed to be in an inconsistent state before an instruction fault is generated. The
discrepancy time cannot be set in Single Channel Mode.

Sequence and Timing Faults

Typically applied to specialty safety functions such as Muting or Two-hand

control. It monitors the sequence of events to evaluate the validity of input
signals to enable the SMF.

Integral Test Pulses of Safety Outputs

Test pulses are applied to safety outputs to detect faults within the connected
periphery such as short circuits to 24V of 0V or cross-loop faults between two
output sources. Integral pulses on safety outputs are also used to help ensure the
safety integrity of the output itself, such as ability to switch off. An output fault,
internal or external, always requires a power cycle to test if the fault is recoverable
or not.

Note: To help ensure the ability to switch off actuator devices in case of
short circuits to 24V DC within the control line of one actuator, it is
recommended to use a pair of safety outputs controlling two redundant
switching actuators. Once the fault is detected, a second channel is able to
switch off the load. Fault exclusions of potential short circuits between
two conductors are also possible when following the requirements for fault
exclusions according to EN ISO 13849-2 Table D.3 and D.4, among
others protection (for example, cable conduit) and separated wiring of
safety signals.

130 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Specifications Appendix A

The overall monitoring time to evaluate a fault and initiate a system response,
after the occurrence of a recoverable fault must consider any specific-fault
processing times depending on the I/O evaluation method and configured input
filter times. Table 26 shows the response time for specific recoverable faults, if the
safety function is not demanded, and the required settings of SMF and SOF to
enable the proper fault evaluation method.

Table 26 - Processing Time of Recoverable Faults and Required Settings

Recoverable Fault Detection Enabled by Processing Time
Cross loop fault Inputs: 2 N.C. 3s
Pulse Testing: 2 Sources
Short circuit fault Inputs: 1 N.C., or 2 N.C. 3s
Pulse Testing: 1 Source, 2 Sources
Input discrepancy fault Inputs: 2 N.C., 2 OSSD Discrepancy time + Input Filter time
Discrepancy Time: >0…3 s
Reset/restart timing fault Default: 0.25…3 s 0 s (1)
Non-retriggerable timer fault Retriggerable: Disabled Configured time delay (2)
Muting: Synchronization time Synch Time: 0.05…10 s Max. Synch Time (3)
exceeded Muting Sensors Input Filter: 0…3 s + 2 x Input Filter Time
Muting time exceeded Max. Mute Time: 1 s…10 days Configured Max. Mute Time
Muting sequence fault Muting Type: 2 Sensor T-Type, 2 Input Filter Time
Sensor L-Type, 4 Sensor
(1) A Reset/Restart Timing Fault can only occur when safety outputs are OFF, so there is no impact on the safety response time

(2) The maximum of the configured delay must be considered. The remaining time at occurrence of fault will lapse.

(3) The synchronization time between the Muting Sensors, and between Muting Sensor can be set individually. The longest
synchronization must be considered.

Table 27 - Response time of the Safety Chain at Occurrence of Recoverable Faults without a
Demand of the Safety Function
Description Where to find: Value
SMF Fault processing Above table, according to
configured input
evaluation of the SMF
Logic Internal execution time to From technical 45 ms (fix)
process input signal, specification
routing and output
processing (1)
SOF Fault processing time and From SOF configuration
configured time delay
Actuator Safety switching device Actuator Operating manual
controlling the load
Total
(1) The internal execution time is static and independent of the number of function blocks that are configured for the safety function.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 131

Appendix A Specifications

Figure 133 - Example

Table 28 - Consideration for Recoverable Faults of E-stop Safety Function

Description Value
SMF Cross loop fault: 3 s according to 3s
above table
Logic Internal execution time to process 45 ms
input signal, routing, and output
processing
SOF No off delay configured 0s
Actuator Assuming a contactor with a 30 ms
response time of 30 ms
Total 3.075 s

Response Time - Occurrence of Nonrecoverable Faults and Failures

Nonrecoverable faults are detected by internal monitoring measures applied to

monitor the safety integrity of the system. These faults are independent of the
logic configuration. Once detected the CR30 forces the safe state within the
internal process cycle time of 45 ms.

132 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Specifications Appendix A

Reaction Time The reaction time is the time to enable the safety output function when
activating the safety input devices and performing a valid reset operation. The
overall reaction time of the safety function considers the whole safety chain,
including the safety input device, logic device, and actuator. The reaction time
must be calculated for each safety function.

Table 29 shows the possible chain with all considerable reaction times for a safety
function.

Table 29 - Safety Function Reaction Times

Description Where to find: Value
Feedback Feedback Input Filter time From SMF configuration
“advanced settings” (3)
Safety Sensors Reaction time of sensor Sensor operating manual
device
SMF Configured Input Filter From SMF configuration
time “advanced settings” (3)
Reset/Restart Reset/Restart Pulse Time + Reset Pulse: max 3s 3s + 2 x Input Filter
2 x Filter Time (1) Input Filter Time from SMF
configuration
Logic Internal execution time to From technical 100 ms
process input signal, specification
routing, and output
processing (2)
SOF Configured On-Delay time From SOF configuration
Actuator Safety switching device Actuator Operating manual
controlling the load
Total
(1) If input filter time settings are not disabled, the recommended setting is “0”. Values greater “0” must be considered for the
reaction time.
(2) The internal execution time is static and independent of the number of function blocks that are configured for the safety function.

(3) The maximum input filter time must not be greater than 250 ms.

Figure 134 - Example 1:

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 133

Appendix A Specifications

Table 30 - For SMF1 - E-stop:

Comment Value
Feedback Disabled for SOF 0 ms
Safety Sensors Reaction time of sensor device - 0 ms
considered as 0 ms since mechanical
device only
SMF Configured Input Filter time 250 ms
10x25 ms = 250 ms
Reset/Restart SOF configured for Automatic 0s
Logic Internal execution time to process 100 ms
input signal, routing, and output
processing 2)
SOF No On delay configured for SOF 0s
Actuator Assuming a contactor with a 10 ms
response time of 10ms
Total 360 ms

It takes 360 ms to enable the outputs when the E-stop is active (closed contacts).

Table 31 - For SMF2 – Safety Mat:

Comment Value
Feedback Disabled for SOF 0 ms
Safety Sensors Reaction time of sensor device - 0 ms
considered as 0 ms since mechanical
device only
SMF Input Filter Disabled 0 ms
Reset/Restart SOF configured for Automatic 0 ms
Logic Internal execution time to process 100 ms
input signal, routing and output
processing 2)
SOF No On delay configured for SOF 0s
Actuator Assuming a contactor with a 10 ms
response time of 10 ms
Total 110 ms

It takes 110 ms to enable the outputs when the Safety Mat is released.

134 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Specifications Appendix A

Figure 135 - Example 2: Same as Figure 134 on page 133 but with manual monitored reset and
feedback monitoring

Table 32 - For SMF1 - E-stop:

Comment Value
Feedback Configured Input Filter time 250 ms
10x25 ms = 250 ms
Safety Sensors Reaction time of sensor device - 0 ms
considered as 0 ms since mechanical
device only
SMF Configured Input Filter time 250 ms
10x25 ms = 250 ms
Reset/Restart Min: 2 x Input Filter Time + 250 ms = Min: 0.75 s
500ms + 250 ms = 0.75 s Max: 3.5 s
Max: 2 x Input Filter Time + 3 s = 0.5
+ 3 s = 3.5 s
Logic Internal execution time to process 100 ms
input signal, routing, and output
processing 2)
SOF No On delay configured for SOF 0s
Actuator Assuming a contactor with a 10 ms
response time of 10 ms
Total Min: 1.36 s
Max: 4.11 s

It takes a minimum of 1.36 s, after a valid Reset operation of at least 250 ms to

enable the outputs when the E-stop is active (closed contacts).

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 135

Appendix A Specifications

Table 33 - For SMF2 - Safety Mat:

Comment Value
Feedback Configured Input Filter time 250 ms
10x25 ms = 250 ms
Safety Sensors Reaction time of sensor device - 0 ms
considered as 0 ms since mechanical
device only
SMF Input Filter Disabled 0 ms
Reset/Restart Min: 2 x Input Filter Time + 250 ms = Min: 0.75 s
500ms + 250 ms = 0.75 s Max: 3.5 s
Max: 2 x Input Filter Time + 3 s = 0.5
+ 3 s = 3.5 s
Logic Internal execution time to process 45 ms
input signal, routing, and output
processing 2)
SOF No On delay configured for SOF 0s
Actuator Assuming a contactor with a 10 ms
response time of 10 ms
Total Min: 1.055 s
Max: 3.3 s

It takes a minimum of 1055 s, after a valid Reset operation of at least 250 ms to

enable the outputs when the E-stop is active (closed contacts).

136 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Appendix B

Regulatory Approvals

Agency Certifications • UL Listed Industrial Control Equipment (certified for US and Canada)
• CE marked for all applicable directives
• C-Tick marked for all applicable acts
• CCC Mark
• S-Mark

Compliance to European This product has the CE mark and is approved for installation within the
European Union and EEA regions. It has been designed and tested to meet the
Union Directives following directives.

Machine Safety Directive

This product is designed and tested to meet the European Council Directive
2006/42/EC on machinery and the following standards.
• IEC/EN 61508 - Functional safety of electrical/electronic/programmable
electronic safety-related systems
• IEC/EN 62061 - Safety of machinery - Functional safety of safety-related
electrical, electronic, and programmable electronic control systems
• EN ISO 13849-1 - Safety of machinery -- Safety-related parts of control
systems -- Part 1: General principles for design

This product is intended for use in an industrial environment.

EMC Directive

This product is designed and tested to meet the European Council Directive
2004/108/EC on Electromagnetic Compatibility (EMC) and the following
standards:
• EN 61000-6-4: Generic Standards - Emission Standard for Industrial
Environments
• EN 61000-6-2: Generic Standards - Immunity for Industrial
Environments

This product is intended for use in an industrial environment.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 137

Appendix B Regulatory Approvals

Notes:

138 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Appendix C

Configuration Reference Document

The Configuration Reference Document must be stored together with technical

documentation of the machine. It includes information about the validity of a
configuration that is created for the machine. This document must be updated
anytime changes to the configuration have been made, validated, and verified.

Any new configuration or changes to an existing configuration require a

validation and verification before putting it into service. An unverified
application will stop operating after 24 hr after power-up.

With your signature you confirm that:

• you have conducted validation and verification of the safety configuration,
identified the above mentioned details AND
• the configuration and installation meets all specified operational and
environmental requirements of the machine to which CR30 is to be fitted
AND
• you have read and understood the "Important User Information"

Important User Information Read the documents that are listed in the additional resources section about
installation, configuration, and operation of this equipment before you install,
configure, operate, or maintain this product. Users are required to familiarize
themselves with installation and wiring instructions in addition to requirements
of all applicable codes, laws, and standards.

Activities including installation, adjustments, putting into service, use, assembly,

disassembly, and maintenance are required to be conducted by suitably trained
personnel in accordance with applicable code of practice. If this equipment is
used in a manner that is not specified by the manufacturer, the protection that is
provided by the equipment can be impaired.

In no event will Rockwell Automation, Inc. be responsible or liable for indirect or

consequential damages resulting from the use or application of this equipment.
Resource Description
Guardmaster® 440C-CR30 Software-Configurable Safety A detailed description of module functionality,
Relay User Manual, publication 440C-UM001_-EN-P. configuration, installation procedure, and information
on how to use the Guardmaster Software-Configurable
Safety Relay (440C-CR30).
Industrial Automation Wiring and Grounding Guidelines, Provides general guidelines for installing a Rockwell
publication 1770-4.1 Automation industrial system.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 139

Appendix C Configuration Reference Document

Configuration Reference Document

Device Information:
Device Name:
From Name Field, General View
Description:
From Description Field, General View

Vendor:
Allen-Bradley
Catalog ID:
440C-CR30-22BBB
Safety Relay Firmware Version:
Found in the Device Details Window of CCW

Project Information:
Project Name:
As stored in the configuration tool
Project File Name:
From file name
Software revision:
From Help -> About CCW

Verification ID:
Generated in verification window

Approval:

Project Developer Name:

Date:

Signature

140 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 Appendix D

ControlFLASH Firmware Upgrade

Upgrade the Firmware This appendix shows how to flash update the firmware in a Guardmaster CR30
safety relay using ControlFLASH™. To download the latest Guardmaster CR30
safety relay firmware revision, go to http://www.rockwellautomation.com/
support/pcdc.page and select your desired revision.

1. Through USB connection: Verify successful RSLinx Classic

communications with you Guardmaster CR30 safety relay by USB using
RSWho. The Guardmaster CR30 uses the AB_VBP-x driver.

2. Start ControlFLASH
Click Start > All Programs > FLASH Programming Tools >
ControlFLASH.
3. Select Local and click OK.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 141

Appendix D ControlFLASH Firmware Upgrade

4. Click Next

5. Select the catalog number of the Guardmaster CR30 safety relay

(440C­CR30-22BBB) that you are updating and click Next.

142 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 ControlFLASH Firmware Upgrade Appendix D

6. Expand the AB_VBP-1, 1789-A17/A Virtual Chassis by clicking the +.

7. Select the safety relay in the browse window and click OK.
If the device comes up unrecognized, the EDS file has not been loaded.

8. Verify the revision, and click Next to continue.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 143

Appendix D ControlFLASH Firmware Upgrade

9. Click Finish.

10. Click Yes to initiate the update.

The next screen shows the download progress.

11. When the flash update is complete, you see a status screen similar to the
following. Click OK to complete the update.

144 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 ControlFLASH Firmware Upgrade Appendix D

12. The “Welcome to ControlFlash” window appears again. Click Cancel.

13. Click Yes to end the session.

Unrecognized Device

If the device comes up as Unrecognized, the EDS file must be uploaded.

1. Right-click the device and select Upload EDS file from device.

2. Click Yes.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 145

Appendix D ControlFLASH Firmware Upgrade

3. Click Next.

4. Click Next.

5. Click Next.

146 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

 ControlFLASH Firmware Upgrade Appendix D

6. Click Next.

7. Click Finish.

Rockwell Automation Publication 440C-UM001C-EN-P - November 2014 147

Appendix D ControlFLASH Firmware Upgrade

Notes:

148 Rockwell Automation Publication 440C-UM001C-EN-P - November 2014

Rockwell Automation Support
Rockwell Automation provides technical information on the Web to assist you in using its products.
At http://www.rockwellautomation.com/support you can find technical and application notes, sample code, and links to
software service packs. You can also visit our Support Center at https://rockwellautomation.custhelp.com/ for software
updates, support chats and forums, technical information, FAQs, and to sign up for product notification updates.

In addition, we offer multiple support programs for installation, configuration, and troubleshooting. For more
information, contact your local distributor or Rockwell Automation representative, or visit
http://www.rockwellautomation.com/services/online-phone.

Installation Assistance

If you experience a problem within the first 24 hours of installation, review the information that is contained in this
manual. You can contact Customer Support for initial help in getting your product up and running.
United States or Canada 1.440.646.3434
Outside United States or Canada Use the Worldwide Locator at http://www.rockwellautomation.com/rockwellautomation/support/overview.page, or contact your local
Rockwell Automation representative.

New Product Satisfaction Return

Rockwell Automation tests all of its products to help ensure that they are fully operational when shipped from the
manufacturing facility. However, if your product is not functioning and needs to be returned, follow these procedures.
United States Contact your distributor. You must provide a Customer Support case number (call the phone number above to obtain one) to your
distributor to complete the return process.
Outside United States Please contact your local Rockwell Automation representative for the return procedure.

Documentation Feedback
Your comments will help us serve your documentation needs better. If you have any suggestions on how to improve this
document, complete this form, publication RA-DU002, available at http://www.rockwellautomation.com/literature/.

Rockwell Automation maintains current product environmental information on its website at

http://www.rockwellautomation.com/rockwellautomation/about-us/sustainability-ethics/product-environmental-compliance.page.

Rockwell Otomasyon Ticaret A.Ş., Kar Plaza İş Merkezi E Blok Kat:6 34752 İçerenköy, İstanbul, Tel: +90 (216) 5698400

Publication 440C-UM001C-EN-P - November 2014

Supersedes Publication 440C-UM001B-EN-P - September 2014 Copyright © 2014 Rockwell Automation, Inc. All rights reserved. Printed in the U.S.A.