Home › 1756 ControlLogix Digital Safety I/O Modules User Manual, 1756-UM013B-EN-P

1756 ControlLogix Digital Safety I/O Modules User Manual, 1756-UM013B-EN-P

File info: application/pdf · 136 pages · 3.78MB

Safety, 1756-IB16S, 1756-OBV8S, I/O, Digital I/O

1756 ControlLogix Digital Safety I/O Modules User Manual ...

This manual describes how to use 1756 ControlLogix Digital Safety I/O modules in Logix 5000™ control systems. Make sure that you are familiar with the following: • Use of a safety controller in a Logix 5000 control syst…

1756-Ib16 Manual Pdf - ControlLogix Digital I/O Modules User Manual

Full PDF Document

If the inline viewer fails, it will open the original document in compatibility mode automatically. You can also open the file directly.

Extracted Text

User Manual
Original Instructions
1756 ControlLogix Digital Safety I/O Modules
Catalog Numbers 1756-IB16S, 1756-OBV8S

Important User Information
Read this document and the documents listed in the additional resources section about installation, configuration, and operation of this equipment before you install, configure, operate, or maintain this product. Users are required to familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws, and standards.
Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to be carried out by suitably trained personnel in accordance with applicable code of practice.
If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be impaired.
In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment.
The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware of safety considerations.
WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury or death, property damage, or economic loss.
ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.
IMPORTANT Identifies information that is critical for successful application and understanding of the product.
Labels may also be on or inside the equipment to provide specific precautions.
SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.
BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures.
ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Table of Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7
Summary of Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Terminology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Digital Safety I/O Module Operation in a Control System

Chapter 1
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Controller and Software Compatibility. . . . . . . . . . . . . . . . . . . . . . 11
Overall System Safety Function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Determine Conformity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 1756-IB16S Single-channel Point Operation Type . . . . . . . . . . . 14 1756-OBV8S Single-channel or Dual-channel Point Operation Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Obtain Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Safety Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Safety Application Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Safe State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 Configuration Signature and Ownership . . . . . . . . . . . . . . . . . . . . 19 Reset 1756 ControlLogix Digital Safety I/O Modules to Out-of-Box State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
About the Modules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Local I/O Modules or Remote I/O Modules . . . . . . . . . . . . . . . . . . . . 23
Local I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Remote I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Ownership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Construct a System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Local I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Remote I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Configure the Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Connections with 1756 ControlLogix Digital Safety I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Requested Packet Interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Connection Over an EtherNet/IP Network . . . . . . . . . . . . . . . . . 31 Input Module Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Local 1756 ControlLogix Digital Safety Input Modules. . . . . . . 31 Remote 1756 ControlLogix Digital Safety Input Modules . . . . 32 Output Module Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Local Safety Output Modules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Remote Safety Output Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 External Means . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Protected Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Table of Contents

Features Common to 1756 ControlLogix Digital Safety I/O Modules

Chapter 2
Input Module Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Output Module Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Software Configurable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Module Data Quality Reporting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Fault and Status Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Module Inhibiting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Electronic Keying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Module Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Producer/Consumer Communication . . . . . . . . . . . . . . . . . . . . . . . . . . 44

1756-IB16S Input Module Features

Chapter 3
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Safety Application Suitability Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Use Test Output with a Safety Input. . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Single-channel Point Operation Type . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Safety Input Fault Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
'Latch Fault until reset via output tag' mode is Enabled . . . . . . . 50 'Latch Fault until reset via output tag' mode is Disabled . . . . . . . 50 Safety Input Delay Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Off to On Delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 On to Off Delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Data Transfer at RPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Module Health Diagnostic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 Point Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Fault and Status Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Field Power Loss Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 Short Circuit Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 Test Output Recovery After Overload or Short Circuit to Ground Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

1756-OBV8S Output Module Features

Chapter 4
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Safety Application Suitability Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 Safety Output with Test Pulse. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Single-channel Point Operation Type . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Dual-channel Point Operation Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Safety Output Fault Reset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
`Latch Fault until reset via output tag' mode is Enabled . . . . . . . 63 `Latch Fault until reset via output tag' mode is Disabled. . . . . . . 63 Fault and Status Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Module Health Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Point Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Field Power Loss Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 No Load Detection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Table of Contents

Short Circuit Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Other Conditions That Can Trigger the Short Circuit Diagnostic on the 1756-OBV8S Module . . . . . . . . . . . . . . . . . . . . 69 Output Recovery After Overload or Short Circuit to Ground Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Thermal Shutoff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Fault and Status Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Configurable Channel-level Output State in Program Mode or Fault Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Connection Fault Handling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Output Behavior Immediately After a Connection Fault. . . . . . 72 Output State Once Connection is Re-established . . . . . . . . . . . . 72 Forcing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Enable Forces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Disable or Remove a Force . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Check Force Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 GSV Instruction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Configure and Replace Safety Modules

Chapter 5
Create a New Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 New Local Safety Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 New Remote I/O Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Edit the Module Configuration Common Categories . . . . . . . . . . . . 82 General Category. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Connection Category . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Safety Category. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Module Info Category . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Edit the 1756-IB16S Module Configuration Categories . . . . . . . . . . 88 Input Points Category . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Test Output Points Category. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Edit the 1756-OBV8S Module Points Category . . . . . . . . . . . . . . . . . 90 Point Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Output State During Program Mode and Communications Fault Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
View the Module Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92 Replace a Safety Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Reset to Out-of-Box Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 93 Replace a Module in a Logix 5000 System . . . . . . . . . . . . . . . . . . . 95

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Table of Contents

Troubleshoot Your Module

Appendix A
Module Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 OK Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Use the Logix Designer Application for Troubleshooting . . . . . . . . 105 Warning Signal in the I/O Configuration Tree . . . . . . . . . . . . . 105 Status and Fault Information in Module Properties Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Module and Point Diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Logix Designer Application Tag Editor. . . . . . . . . . . . . . . . . . . . . 110
InternalFault Triggered on the Safety Output Module . . . . . . . . . . 111

Module Tag Definitions

Appendix B
Access the Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Name Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 1756-IB16S Module Tags. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Input Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Output Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 1756-OBV8S Module Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Input Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Output Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Application and Wiring Examples for Safety Modules

Appendix C
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 1756-IB16S Module Wiring Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . 120 1756-OBV8S Module Wiring Diagrams . . . . . . . . . . . . . . . . . . . . . . . 123
Bipolar Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Sourcing Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

Appendix D
Safety Data for Safety Modules 1756-IB16S Safety Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
1756-OBV8S Safety Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Summary of Changes

Preface
This manual describes how to use 1756 ControlLogix� Digital Safety I/O modules in Logix 5000TM control systems.
Make sure that you are familiar with the following: � Use of a safety controller in a Logix 5000 control system. � Use of safety systems. � Use Studio 5000 Logix Designer� application environment.

This publication contains new and updated information.

Topic

Page

The 1756-IB16S and 1756-OBV8S modules are only compatible with a 1756 ControlLogix Chassis, Series C. 10

Due to the higher internal power dissipation of the 1756-OBV8S module, do not install the 1756-OBV8S module next to any controller or communication module.

10, 25

Terminology

The following table defines terms that are used in this manual.

Abbreviation 1oo2 CIPTM
CIP SafetyTM
--
CL DC EDS
EN GSV -- NAT ODVA PC PFD
PFH
PL --

Full Term

Definition

One out of Two

Identifies the programmable electronic controller architecture.

Common Industrial Protocol

An industrial communication protocol that is used by Logix 5000-based automation systems on EtherNet/IPTM, ControlNet�, and DeviceNet� communication networks.

Common Industrial Protocol � Safety Certified

SIL-rated version of CIP.

Connection

Logical communication channel for communication between nodes. Connections are maintained and controlled between masters and slaves.

Claim Limit

The maximum safety integrity level (SIL) that can be achieved.

Diagnostic Coverage

The ratio of the detected failure rate to the total failure rate.

Electronic Data Sheet,

A template that is used in RSNetWorxTM software to display the configuration parameters, I/O data profile, and connection-type support for a given I/O module. RSNetWorx software uses these simple text files to identify products and commission them on a network.

European Norm.

The official European Standard.

Get System Value

A ladder logic instruction that retrieves specified controller status information and places it in a destination tag.

Multicast

The transmission of information from one sender to multiple receivers.

Network Address Translation

The translation of an Internet Protocol (IP) address to another IP address on another network.

Open DeviceNet Vendor Association A nonprofit association of vendors that are established for the promotion of CIP networks.

Personal computer

Computer that is used to interface with and control a Logix-based system via the Studio 5000� environment.

Probability of a dangerous failure on The average probability of a system to fail to perform its design function on demand. demand

Average frequency of a dangerous The probability of a system to have a dangerous failure occur per hour. failure per hour

Performance Level

ISO 13849-1 safety rating.

Process safety time

Period of time between a failure, that has the potential to give rise to a hazardous event, occurring in the Equipment Under Control (EUC) or EUC control system and the time by which action has to be completed in the EUC to help prevent the hazardous event occurring.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Preface

Abbreviation --
SIL SNN
SSV -- --

Full Term Proof test
Safety Integrity Level Safety Network Number
Set System Value Standard Unicast

Definition
Periodic test that detects failures in a safety-related system so that, if necessary, the system can be restored to an as-new condition or as close as practical to this condition.
A relative level of risk-reduction that is provided by a safety function, or to specify a target level of risk reduction.
Safety network number, which uniquely identifies a network across all networks in the safety system. You are responsible for assigning a unique number for each safety network or safety subnet within a system.
A ladder logic instruction that sets controller system data.
Devices or portions of devices that do not participate in the safety function.
The transmission of information from one sender to one receiver.

Additional Resources

These resources contain information about related products from Rockwell Automation.

Resource
1756 ControlLogix 16-point Sinking Safety Input Module Installation Instructions, publication 1756-IN079A-EN-P 1756 ControlLogix 8-point Safety Bipolar/Sourcing Output Module Installation Instructions, publication 1756-IN081A-EN-P ControlLogix Chassis Installation Instructions, publication 1756-IN621 ControlLogix Power Supply Installation Instructions, publication 1756-IN619 ControlLogix I/O Modules Specifications Technical Data, publication 1756-TD002 GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012
ControlLogix 5580 and GuardLogix 5580 Controllers User Manual, publication 1756-UM543
Safety Automation Builder and SISTEMA Library
Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Product Certifications website, rok.auto/certifications

Description
Provides installation information for the 1756-IB16S safety input module.
Provides installation information for the 1756-OBV8S safety output module.
Provides installation information for ControlLogix chassis.
Provides installation information for ControlLogix power supplies.
Provides specifications, wiring diagrams, and schematics for ControlLogix I/O modules.
Provides information on how to achieve and maintain Safety Integrity Level (SIL) and Performance Level (PL) safety application requirements for GuardLogix� 5580 and Compact GuardLogix 5380 controllers.
Provides information on how to install, configure, program, and use ControlLogix 5580 controllers and GuardLogix 5580 controllers in Studio 5000 Logix Designer application projects.
Download Safety Automation Builder� software to help simplify machine safety design and validation, and reduce time and costs. Integration with our risk assessment software provides you with consistent, reliable, and documented management of the Functional Safety Lifecycle.
The SISTEMA tool, also available for download from the Safety Automation Builder page, automates calculation of the attained Performance Level from the safety-related parts of a machine's control system to (EN) ISO 13849-1.
Provides general guidelines for installing a Rockwell Automation industrial system.
Provides declarations of conformity, certificates, and other certification details.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1 Chapter
Digital Safety I/O Module Operation in a Control System

Topic

Page

Overview

Overall System Safety Function

About the Modules

Local I/O Modules or Remote I/O Modules

Ownership

Construct a System

Configure the Modules

Input Module Operation

Output Module Operation

External Means

Protected Operations

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System

Overview

GuardLogix� controllers use 1756-IB16S and 1756-OBV8S modules to control devices in a control system.
Table 1 - 1756 ControlLogix� Digital Safety I/O Modules

Module Type Safety(1)

Cat. No. 1756-IB16S

Description 18...32V DC 16-point sinking safety input module

1756-OBV8S

18...32V DC 8-point, safety output module that can be used as: � Bipolar output module � Sourcing output module

(1) You can use the safety modules in applications that are rated up to, and including, SIL CL3, PLe, Cat. 4 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1.

ControlLogix modules mount in a ControlLogix chassis, and require a removable terminal block (RTB) to connect all field-side wiring.

ATTENTION: The 1756-IB16S and 1756-OBV8S modules are compatible with a 1756 ControlLogix Chassis, Series C. Do not install the 1756-IB16S and 1756-OBV8S modules in a 1756 ControlLogix Chassis, Series B.
ATTENTION: Due to the higher internal power dissipation of the 1756-OBV8S module, do not install the 1756-OBV8S module next to any controller or communication module.

IMPORTANT

A ControlLogix system with 1756-IB16S and 1756-OBV8S safety I/O modules has been agency certified using only the ControlLogix RTB catalog numbers 1756-TBCHS, 1756-TBNHS, 1756-TBSHS, and 1756-TBS6HS.
Any application that requires agency certification of the ControlLogix system using other wiring termination methods can require application-specific approval by the certifying agency.

ATTENTION: To comply with the CE Low Voltage Directive (LVD), this equipment, and all connected I/O, must be powered from a safety extra low voltage (SELV) or protected extra low voltage (PELV) compliant source. For UL-compliant applications, the 1756-IB16S and 1756-OBV8S modules, and all connected IO, must be powered from a SELV or PELV-compliant power source that is rated 150VA maximum.
IMPORTANT All other I/O modules in the same chassis must use an SELV/PELV power supply.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1

Controller and Software Compatibility

Controller and programming software compatibility requirements apply when you use 1756 ControlLogix digital I/O modules.

Table 2 - Controller and Software Compatibility Requirements

Safety Modules Location

1756-IB16S, 1756-OBV8S

Local Remote

Controller System GuardLogix 5580 GuardLogix 5580 Compact GuardLogix 5380

Cat. Nos. 1756-L81ES, 1756-L82ES, 1756-L83ES, 1756-L84ES, 1756-L8SP 1756-L81ES, 1756-L82ES, 1756-L83ES, 1756-L84ES
5069-L306ERS2, 5069-L306ERMS2, 5069-L310ERS2, 5069-L310ERMS2, 5069-L320ERS2, 5069-L320ERS2K, 5069-L320ERMS2, 5069-L320ERMS2K, 5069-L330ERS2, 5069-5069-L330ERS2K, L330ERMS2, 5069-L330ERMS2K, 5069-L340ERS2, 5069-L340ERMS2, 5069-L350ERS2, 5069-L350ERS2K, 5069-L350ERMS2, 5069-L350ERMS2K, 5069-L380ERS2, 5069-L380ERMS2, 5069-L3100ERS2, 5069-L3100ERMS2

Supported

Studio 5000

Communication Logix Designer�

Protocol

application

1756 Backplane EtherNet/IPTM

Version 32.00.00 or later, with Add-on Profile.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System

Overall System Safety Function

The following apply to the modules:
� Type-approved and certified for use in safety applications up to and including SIL 3 per IEC 61508
� Suitable for use in safety applications up to and including SIL CL 3 per IEC 62061
� Suitable for use in safety applications up to and including Performance Level e (PLe), category 4 per ISO 13849-1

IMPORTANT

Functional safety certification and performance of 1756-IB16S and 1756-OBV8S modules requires that the modules operate in conditions at or below the ambient operating temperature specification.
The probability of a dangerous failure on demand (PFD) and average frequency of a dangerous failure per hour (PFH) calculations for these modules are based on the module operating conditions adhering to the ambient operating temperature specification.
For more information on the maximum ambient operating temperature specification, see the 1756 ControlLogix I/O Specifications Technical Data, publication 1756-TD002.

IMPORTANT

Requirements are based on the standards current at the time of certification. For more information on safety application suitability levels: � 1756-IB16S Input Module Features on page 45 � 1756-OBV8S Output Module Features on page 57

Determine Conformity
ATTENTION: Use only appropriate components or devices that comply with the relevant safety standards and meet the required safety integrity level or Performance Level and safety category. � Conformity to the requirements of the relevant safety standards must be
determined for the entire system by conducting a risk assessment. � Use devices properly according to the installation environment,
performance rating, and functions of the machine. � Use devices within their specified ratings. � We recommend that you consult a certification body regarding assessment
of conformity to the required safety integrity level or Performance Level. You are responsible for confirming compliance with the applicable standards for the entire system. You must read, understand, and fulfill the functional safety requirements of the standard applicable to your safety application.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1
The type approval, certification, and suitability levels for 1756-IB16S and 1756-OBV8S modules describe a system with an overall system safety function of SIL 3. However, you are not required to use 1756 ControlLogix digital safety I/O modules only in safety applications with an overall system safety function of SIL 3.
For example, a GuardLogix 5580 controller without a 1756-L8SP safety partner is suitable for use in safety applications that are rated up to, and including, SIL CL2, PLd, Cat. 3 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1. You can use 1756-IB16S and 1756-OBV8S modules in such an application.
GuardLogix 5580 controllers, when used with a 1756-L8SP safety partner are suitable for use in safety applications that are rated up to, and including SIL 3, and PLe, cat. 4 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1. You can use 1756-IB16S and 1756-OBV8S modules in such an application.
For more information on the suitability level of Logix 5000TM safety controllers, see the GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System
1756-IB16S Single-channel Point Operation Type
The1756-IB16S module is single-channel Point Operation Type only. The module channels are pre-configured and fixed at single channel Point Operation Type. The signal status of each channel is evaluated. Based on that status, safety input data and safety input status can be off or on.
To detect discrepancy faults between the channels of a dual channel safety device, use dual channel safety instructions the GuardLogix safety task, for example, the Dual Channel Input Stop (DCS) instruction.

1756-OBV8S Single-channel or Dual-channel Point Operation Type
You can use the 1756-OBV8S modules only in single-channel Point Operation Type while in bi-polar mode. Bi-polar single channel Point Operation Type consists of a P-M pair. P is the sourcing terminal, and M is the sinking terminal.
In sourcing mode, you can configure single channel or dual-channel Point Operation Type. In sourcing, dual-channel Point Operation Type, both channels must always be in the same logical state.
Dual-channel Point Operation Type is typically used when both safety outputs are controlling the same load. Rockwell Automation recommends configuring the module for dual-channel Point Operation Type in dual-channel applications because it decreases the dangerous undetectable failure rate (DU) within the module.

OUT0-M OUT1-M OUT2-M OUT3-M OUT4-M

OUT0-P OUT1-P OUT2-P OUT3-P OUT4-P

K K
M
DC �

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1
Obtain Firmware
Verify that the firmware revision of the 1756-IB16S and 1756-OBV8S modules that you use is correct before commissioning the system.
Firmware information for safety I/O devices is available at the Rockwell Automation Product Compatibility and Download Center (PCDC). The PCDC is available at:
https://compatibility.rockwellautomation.com/Pages/home.aspx
Only download firmware and access product release notes from the Rockwell Automation PCDC.
Do not download firmware from non-Rockwell Automation sites.
Safety Function During Firmware Update
The 1756-IB16S and 1756-OBV8S modules are not safety capable when a firmware update is in process. You must use other methods to maintain the safety function during the update process.
For information on how to maintain the safety function during the update process, for example, remove the module from service to perform the update, see the GuardLogix and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System
Safety Precautions
ATTENTION: Personnel responsible for the application of safety-related programmable electronic systems (PES) shall be aware of the safety requirements in the application of the system and shall be trained in the use of the system.
Observe these precautions for the proper use 1756 ControlLogix digital safety I/O modules.
ATTENTION: As serious injury can occur due to loss of required safety function, follow these safety precautions. � Never use test outputs as safety outputs. Test outputs are not safety outputs. � Do not use standard I/O data or explicit message data as safety data. � Do not use the light-emitting diode (LED) status indicators on the I/O
modules for safety operations. � Do not connect loads beyond the rated value to the safety outputs. � Apply properly specified voltages to the module. Applying inappropriate
voltages can cause the module to fail to perform its specified function, which could lead to loss of safety functions or damage to the module. � Wire the 1756 ControlLogix digital safety I/O modules as shown in the 1756 ControlLogix I/O Specifications Technical Data, publication 1756-TD002. � Set unique network node addresses before you connect devices to the network. � Perform testing to confirm that device wiring, configuration, and operation is correct before you start system operation. � Do not disassemble, repair, or modify the module. This can result in loss of safety functions.
For more information about safety precautions, see Ownership on page 24.
Installing and Replacing Modules
ATTENTION: � Configure the replacement device properly and confirm that it operates
correctly. � After installation of the module, a safety administrator must confirm the
installation and conduct trial operation and maintenance.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1
Safety Application Requirements
Safety application requirements include evaluating the following: � Probability of failure rates (PFD and PFH) � System reaction time settings � Functional verification tests that fulfill appropriate safety-level criteria
Creating, recording, and verifying the safety signature is also a required part of the safety application development process. The safety controller creates the safety signatures. The safety signature consists of an identification number, date, and time that uniquely identifies the safety portion of a project. This number includes all safety logic, data, and safety I/O configuration.
For safety system requirements, including information on the safety network number (SNN), verifying the safety signature, functional verification test intervals, system reaction time, and PFD/PFH calculations, see the GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.
You must read, understand, and fulfill the requirements that are described in this publication before you operate a safety system that uses 1756 ControlLogix digital safety I/O modules.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System

Safe State

ATTENTION: � The safe state of the outputs is defined as the off state. � The safe state of the module and its data is defined as the off state. � Use the 1756 ControlLogix digital safety I/O modules only in applications
where the off state is the safe state.

The following are the safe states of the safety modules: � Safety outputs: OFF � Safety input data to network: OFF
Figure 1 - Safety Status

Networks

Input to Networks OFF

Output OFF

Safety Status Input

The modules are designed for use in applications where the safe state is the off state.

IMPORTANT

If you inhibit a safety module from transitioning to a safe state when a fault occurs because an I/O connection is lost, you accept responsibility for any consequences that result from your decision to inhibit.
We recommend that you use other means to maintain the safe state if you inhibit the safety module from transitioning to a safe state.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1
Configuration Signature and Ownership
Every 1756 ControlLogix digital safety I/O module in a system has a configuration signature and configuration ownership.
Configuration Signature
Each safety device has a unique configuration signature that defines the module configuration. The configuration signature includes the following:
� ID number � Date � Time The configuration signature is used to verify a module's configuration.
Configuration Ownership
The connection between the owner-controller and the 1756 ControlLogix digital safety I/O module is based on the following:
� 1756 ControlLogix digital safety I/O module node number � 1756 ControlLogix digital safety I/O module safety network number � Controller node or slot number
IMPORTANT If the owner-controller is a GuardLogix 5580 controller, the controller has a slot number.
� Controller safety network number � Path from the controller to the 1756 ControlLogix digital safety I/O
module � Configuration signature If any differences are detected, the connection between the owner-controller and the 1756 ControlLogix digital safety I/O module is lost, the yellow yield icon appears in the controller project tree.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System
Different Configuration Owner
When a controller owns the I/O module configuration, other controllers can listen to the input module. In this case, the module configuration signature in the Logix Designer application project for any listening controller must match the one in the owner-controller project.
TIP If the safety module is configured for inputs only, you can copy and paste the configuration signature from one project to the other. If the safety module has safety outputs, for example, the 1756-OBV8S module, the configuration signature parameter is disabled.
Reset 1756 ControlLogix Digital Safety I/O Modules to Out-of-Box State
If a 1756 ControlLogix digital safety I/O module was used previously, you must clear the configuration ownership before you can install it on a safety network. That is, you must return the module configuration to its out-of-box state.
When a 1756 ControlLogix digital safety I/O module is in the out-of-box state, its configuration is not owned by a controller.
The Safety category on the Module Properties dialog box displays the module Configuration Ownership. The Logix Designer application project must be online to check.
If the module configuration is owned, the Safety category displays whether the controller for the opened project owns the module configuration or another controller owns it.
For information on how to reset the module in the Logix Designer application, see Reset to Out-of-Box Configuration on page 93.
You cannot reset the module to its out-of-box configuration if any of the following conditions exist:
� There are pending edits to the module properties. � When a safety signature exists in the controller project.
The I/O modules use removable terminal blocks (RTBs) to connect field-side wiring. You use the Studio 5000 Logix Designer application to configure the modules (see Controller and Software Compatibility on page 11).
The I/O modules use the Producer/Consumer network communication model. This communication is an intelligent data exchange between modules and other system devices in which each module produces data without first being polled.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

About the Modules

Digital Safety I/O Module Operation in a Control System Chapter 1

Figure 2 below and Figure 3 on page 22 show the parts of a 1756 ControlLogix digital safety I/O modules.
Figure 2 - Example 1756-IB18S Module

DC INPUT

ST 0 1 2 3 4 5 6 7

FLT 0 1 2 3 4 5 6 7 O

ST 8 9 10 11 12 13 14 15 K

FLT 8 9 10 11 12 13 14 15

SAFETY

DC INPUT
ST 0 1 2 3 4 5 6 7 FLT 0 1 2 3 4 5 6 7 O ST 8 9 10 11 12 13 14 15 K FLT 8 9 10 11 12 13 14 15
SAFETY

1 6

Item Description

Backplane Connector--Interface for the ControlLogix system that connects the module to the backplane.

Top and bottom guides--Guides provide assistance in seating the RTB onto the module.

Status indicators--Indicators display the status of communication, module health, and input/output devices.

Indicators help in troubleshooting anomalies.

Connector pins--Input/output, power, and grounding connections are made to the module through these pins with

the use of an RTB.

Locking tab--The locking tab anchors the RTB on the module, maintaining wiring connections.

Slots for keying--Mechanically keys the RTB to help prevent making the wrong wire connections to your module.

Module with RTB installed

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System

Figure 3 - Example 1756-OBV8S

DC OUTPUT

ST 0 1 2 3 4 5 6 7 O

FLT 0 1 2 3 4 5 6 7 K

SAFETY

DC OUTPUT
ST 0 1 2 3 4 5 6 7 O FLT 0 1 2 3 4 5 6 7 K
SAFETY

1 6

Item Description

Backplane Connector--Interface for the ControlLogix system that connects the module to the backplane.

Top and bottom guides--Guides provide assistance in seating the RTB onto the module.

Status indicators--Indicators display the status of communication, module health, and input/output devices.

Indicators help in troubleshooting anomalies.

Connector pins--Input/output, power, and grounding connections are made to the module through these pins with

the use of an RTB.

Locking tab--The locking tab anchors the RTB on the module, maintaining wiring connections.

Slots for keying--Mechanically keys the RTB to help prevent making the wrong wire connections to your module.

Module with RTB installed

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Local I/O Modules or Remote I/O Modules

Digital Safety I/O Module Operation in a Control System Chapter 1
You can use 1756 ControlLogix digital safety I/O modules as local or remote I/O modules, with some restrictions that are based on the module and controller type. Compatibility requirements apply and are described in Controller and Software Compatibility on page 11.

Local I/O Modules
When I/O modules reside in the same system as the controller, the modules are local I/O modules.
Figure 4 - Local 1756 ControlLogix digital safety I/O modules

NET LINK
RUN FORCE SD OK

RUN

REM

PROG

DC INPUT
ST 0 1 2 3 4 5 6 7 FLT 0 1 2 3 4 5 6 7 O ST 8 9 10 11 12 13 14 15 K FLT 8 9 10 11 12 13 14 15

DC OUTPUT
ST 0 1 2 3 4 5 6 7 O FLT 0 1 2 3 4 5 6 7 K

OK SAFETY

SAFETY

GuardLogix 5580 Controller 1756-L8SP Safety Partner 1756-IB16S Safety Input Module 1756-OBV8S Safety Output Module

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System

Remote I/O Modules

When 1756 ControlLogix digital safety I/O modules reside in a separate location from a GuardLogix 5580 or Compact GuardLogix 5380 controller, they are remote I/O modules.

Remote 1756 ControlLogix digital safety I/O modules are accessible over an EtherNet/IP network via a 1756 ControlLogix EtherNet/IP adapter.

Figure 5 shows remote safety I/O modules in a GuardLogix 5580 control application.

Figure 5 - Remote Safety I/O Modules in a GuardLogix 5580 Control Application

GuardLogix 5580 Safety Controller 1756-L8SP Safety Partner

1756 ControlLogix EtherNet/IP Adapter 1756 ControlLogix Safety I/O Modules

Logix5584ESTM NET LINK
RUN FORCE SD OK

RUN

REM

PROG

Logix55L8SPTM OK

DC INPUT

DC INPUT
ST 0 1 2 3 4 5 6 7 FLT 0 1 2 3 4 5 6 7 O ST 8 9 10 11 12 13 14 15 K FLT 8 9 10 11 12 13 14 15
SAFETY

DC OUTPUT
ST 0 1 2 3 4 5 6 7 O FLT 0 1 2 3 4 5 6 7 K
SAFETY

F10

F11

F12

F13

F14

F15

F16

PanelViewTM Plus 7 Terminal

Stratix� 5400 Switch

Compact 5000TM I/O

5069-IB8S

OUTPUT 5069-OBV8S

527
PowerFlex� 527 Drive

Kinetix� 5500 Drive

Compact 5000TM I/O
Compact 5000TM I/O EtherNet/IP Adapter Compact 5000 I/O Safety Modules

Ownership
24

Every standard or safety I/O module in a GuardLogix 5580 control system must be owned by a controller, also known as the owner-controller.
1756 ControlLogix digital safety I/O modules digital input modules can only have one owner-controller. When a 1756 ControlLogix Digital Safety I/O Module is used in a GuardLogix 5580 control system, the owner-controller performs the following:
� Stores configuration data for every module that it owns. � Sends the I/O module configuration data to define module behavior and
begin operation in the control system.
Each I/O module must continuously maintain communication with its ownercontroller during normal operation.
Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Construct a System

Digital Safety I/O Module Operation in a Control System Chapter 1
Before you install and use your module, you must do the following: � Install and ground a 1756 ControlLogix Series C chassis, and power supply. To install these products, refer to the publications listed in Additional Resources on page 8. � Order and receive an RTB and its components for your application. RTBs are not included with your module purchase.
1756 ControlLogix 16-point Sinking Safety Input Module (1756-IB16S) uses these RTBs: � 1756-TBCHS Cage-clamp removable terminal block with standard
housing, 36-pin � 1756-TBS6HS Spring-clamp removable terminal block with standard
housing, 36-pin � 1756-TBES Extended-depth terminal block housing. Requires the
underlying connector.
For how to assemble and wire the RTB, see the 1756 ControlLogix 16-point Sinking Safety Input Module Installation Instructions, publication 1756-IN079.
The 1756 ControlLogix 8-point Safety Bipolar/Sourcing Output Module (1756-OBV8S) uses these RTBs: � 1756-TBNHS Cage-clamp removable terminal block with standard
housing, 20-pin � 1756-TBSHS Spring-clamp removable terminal block with standard
housing, 20-pin � 1756-TBES Extended-depth terminal block housing. Requires the
underlying connector.
For how to assemble and wire the RTB, see the 1756 ControlLogix 8-point Safety Bipolar/Sourcing Output Module Installation Instructions, publication 1756-IN081.

ATTENTION: Due to the higher internal power dissipation of the 1756-OBV8S module, do not install the 1756-OBV8S module next to any controller or communication module.

Local I/O Modules
Complete the following: 1. Install a GuardLogix 5580 controller. 2. Install the modules.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System
Remote I/O Modules
Complete the following:
1. Install a GuardLogix 5580 controller. 2. Install an EtherNet/IP network. 3. Connect the controller to the network. 4. Install a 1756 ControlLogix EtherNet/IP adapter in the remote chassis. 5. Connect the adapter to the network. 6. Install the 1756 ControlLogix digital safety I/O modules.
For information on how to install compatible controllers, adapters, and I/O modules, see the publications that are listed in Additional Resources on page 8.

Configure the Modules

You must create a Logix Designer application project for the controller that owns the 1756 ControlLogix digital safety I/O modules. The project includes module configuration data for the module.
The Logix Designer application transfers the project to the owner-controller during the program download. Data is then transferred to the I/O modules either across the backplane or over an EtherNet/IP network.
The I/O modules can operate immediately after receiving the configuration data.

IMPORTANT

This section shows some Logix Designer application screens; it is not a complete description of how to configure a module.
� For more information on how to use the Logix Designer application to configure 1756 ControlLogix digital safety I/O modules, see Chapter 5, Configure and Replace Safety Modules on page 77.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1
Connections with 1756 ControlLogix Digital Safety I/O Modules
During module configuration, you must define the module. Among the Module Definition parameters with 1756 ControlLogix digital I/O modules, you must choose a connection type for the module. A connection is a real-time data transfer link between the owner-controller and the module that occupies the slot that the configuration references.
When you download module configuration to a controller, the controller attempts to establish a connection to each module in the configuration.
Because part of module configuration includes a slot number in the local or remote system, the owner-controller checks for the presence of a module there. If a module is detected, the owner-controller sends the configuration. One of the following occurs:
� If the configuration is appropriate to the module detected, a connection is made and operation begins.
� If the configuration is not appropriate to the module detected, the data is rejected and the Logix Designer application indicates that an error occurred.
The configuration can be inappropriate for many reasons. For example, a mismatch in electronic keying that prevents normal operation.
The owner-controller monitors its connection with a module. Any break in the connection, for example, the loss of power to the system, causes a fault. The Logix Designer application monitors the fault status tags to indicate when a fault occurs on a module.
During module configuration, you must define the module. Among the Module Definition parameters with 1756 ControlLogix digital safety I/O modules, you must choose how module is configured.
The choice depends on whether the project is downloaded to the controller that owns the module configuration, that is, the owner-controller, or to a controller that is listening to input modules in a project.
A real-time data transfer link is established between the controller and the module that occupies the slot that the configuration references.
When you download module configuration to a controller, the controller attempts to establish a connection to each module in the configuration.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System

Configured By Options Available with the 1756 ControlLogix Digital Safety I/O Modules
The Configured By choice determines what data is exchanged between the owner-controller and the module. These are example Module Definition dialog boxes, and available Connection choices, for the 1756-IB16S and 1756-OBV8S safety modules.

1756-IB16S Module

1756-OBV8S Module

Table 3 describes the connection types that you can use with the 1756-IB16S and 1756-OBV8S safety modules.

Table 3 - Configured By Choices - 1756-IB16S and 1756-OBV8S Safety Modules

Configured By Choice This Controller
External Means

Description

1756-IB16S Safety Input Module

1756-OBV8S Safety Output Module

The module returns the following to the owner-controller: � General fault data � Safety input data

The module returns the following to the owner-controller: � General fault data � Safety input data � Safety output data
When you choose This Controller, you must define the output mode that the module uses, that is, sourcing or bipolar output mode.

When the External Means option is chosen, another controller listens to the data exchanged with the owner-controller. That is, it receives Safety input data. A controller with this option does not write configuration for the module.
For more information on External Means, see External Means on page 35.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1

Data Types Available with 1756 ControlLogix Digital Safety I/O Modules

On the Module Definition dialog box for 1756 ControlLogix digital safety I/O modules, you must configure data type parameters.

Table 4 describes the available data type choices based on module type.

Table 4 - 1756 ControlLogix Digital Safety I/O Modules - Data Types

Catalog Number 1756-IB16S
1756-OBV8S

Supported Data Types Input Data Input Data Output Data

Data Type Choices
Safety Data Safety Packed Data
Safety Data Safety Packed Data
Safety Data Safety Packed Data

For information on the Data Types, see Module Tag Definitions on page 113.

Output Mode Available with 1756-OBV8S Safety Output Module
The Module Definition for the 1756-OBV8S safety output module includes the Output Mode parameter. This parameter defines whether the module is operating in Sourcing or Bipolar mode.

IMPORTANT If the Configured By parameter is External Means, the Output Mode parameter is disabled. It is automatically set to None.

For more information on the Module Definition parameters that are available with 1756 ControlLogix digital safety I/O modules, see the Logix Designer application.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System

Requested Packet Interval
The Requested Packet Interval (RPI) is a configurable parameter that defines a rate at which the owner-controller and the module exchange data.
You set the RPI value during initial module configuration and can adjust it as necessary after module operation has begun. Valid RPI values for 1756 ControlLogix Digital Safety I/O Modules are 2...500 ms.

IMPORTANT

You can change the RPI while the project is online. If you change the RPI while the project is online, however, the connection to the module is closed and reopened in one of the following ways:
� You inhibit the connection to the module, change the RPI value, and uninhibit the connection.
� You change the RPI value. In this case, the connection is closed and reopened immediately after you apply the change to the module configuration.

Connection Reaction Time Limit With 1756 ControlLogix Digital Safety I/O Modules
With 1756 ControlLogix digital safety I/O modules, the Connection Reaction Time Limit configuration affects the module RPI.
The Connection Reaction Time Limit defines the maximum time that is allowed between valid safety packets on the associated connection. If the Max Network Delay exceeds the Connection Reaction Time Limit, a connection fault occurs.
By default, the Connection Reaction Time Limit is four times the RPI.
Use the default values for Timeout Multiplier (2) and Network Delay Multiplier (200). The Network Delay Multiplier value is in terms of percentage. Thus, 200 means 200%.

IMPORTANT

To determine what is appropriate, analyze each safety channel. The default Timeout Multiplier of 2 and Network Delay Multiplier of 200 creates a worse-case input connection reaction time limit of 4 times the RPI, and an output connection reaction time limit of 3 times the RPI.
Changes to these parameters must be approved only after a thorough review by a safety administrator.

For more information on how to specify RPI rates, see page 85.
Also see: � GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012. � Logix 5000 Controllers Design Considerations Reference Manual, publication 1756-RM094.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1
Connection Over an EtherNet/IP Network
When you configure a remote safety module, you must configure the Connection over EtherNet/IP parameter in the configuration for the remote adapter that connects the I/O modules to the network. The configuration choice dictates how input data is transmitted over the network.
The 1756 ControlLogix digital safety I/O modules use one of the following methods to transmit data:
� Multicast - Data is sent to all network devices.
� Unicast - Data is sent to one or more controllers depending on module configuration.
Unicast is the default setting.

Input Module Operation

Logix 5000 controllers do not poll the safety input modules for input data.
The data exchange process between the input modules and the controller differs based on whether the module is a local I/O module or remote I/O module.

Local 1756 ControlLogix Digital Safety Input Modules
Local 1756 ControlLogix digital safety input modules broadcast their input data, that is, channel and status data, to the system backplane at the time that is defined in the RPI.
At the RPI, the following events occur.
1. The local input module scans its channels for input data. 2. The module sends the data to the system backplane. 3. The controller receives the data immediately.
IMPORTANT 1756 ControlLogix digital safety input modules cannot trigger events.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System
Remote 1756 ControlLogix Digital Safety Input Modules
Remote digital safety input modules broadcast their input data to the backplane at the time that is defined in the RPI. The input data consists of channel and status data.
At the RPI, the following events occur.
1. The remote input module scans its channels for input data. 2. The module sends the data to the remote system backplane. 3. The EtherNet/IP adapter sends the data over the EtherNet/IP network. 4. One of the following:
� When a GuardLogix 5580 or Compact GuardLogix 5380 controller is directly connected to the EtherNet/IP network, it receives the input data immediately.
� When a GuardLogix 5580 controller is connected to the EtherNet/IP network through another communication module, the module sends the data to its backplane and the controller receives it.

Output Module Operation

Logix 5000 controllers send data to safety output modules at the RPI. The RPI defines when the controller sends data to an output module and when the module echoes data.

IMPORTANT You cannot use Immediate Output (IOT) instructions in safety programs.

At the RPI, not only does the controller send data to the output module, but also the output module sends data to the controller. For example, the output module sends an indication of the channel data quality.

IMPORTANT The RPI for a safety output module is the Safety Task period. Safety output data is sent at the completion of the Safety Task scan.

The data exchange process between safety output modules and a controller differs based on whether the module is a local I/O module or remote I/O module.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Digital Safety I/O Module Operation in a Control System Chapter 1
Local Safety Output Modules
Local safety output modules receive output data from a controller and send data to the controller. The data exchange occurs over the system backplane.
Controller to Local Output Module Data Transmission
The controller broadcasts data to its local backplane at the RPI.
IMPORTANT You cannot use Immediate Output (IOT) instructions in safety programs.
The safety outputs are sent to the safety output module at the end of safety task.
The safety output RPI is set by the safety task period.
These events occur when the controller sends data to a local safety output I/O module.
1. The controller sends data to system backplane at the RPI. 2. The local output module receives the data from the system backplane and
behaves as dictated by its configuration.
Local Output Module to Controller Data Transmission
When a local safety output module receives new data and the requested data value is present on the RTB, the output module sends output readback status to the controller. The data value corresponds to the signal present at its terminals.
In addition to the output readback, the output module sends other data to the controller at the RPI. For example, the module alerts the controller if a short circuit condition exists on the module.
The following events occur when a local safety output module sends data to the controller at the RPI.
1. The module sends the data to the system backplane. 2. The controller receives the data immediately.

Remote Safety Output Modules
Remote safety output modules receive output data from a controller and send data to the controller. The data exchange occurs over an EtherNet/IP network.
Controller to Remote Output Module Data Transmission
The controller broadcasts data to its local backplane at the RPI. The ownercontroller does not depend on the program scan to complete to send data.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System
These events occur when the controller sends data to a digital safety output module.
1. Data is sent in one of the following ways: � If the controller is directly connected to the EtherNet/IP network, it broadcasts data to the network. In this case, skip to step 3.
� If the controller is connected to the EtherNet/IP network via a communication module, the controller transmits the data to the backplane. In this case, proceed to step 2.
2. The EtherNet/IP communication module transmits the data to the EtherNet/IP network.
3. The EtherNet/IP adapter in the remote system receives the data from the network and transmits it to the system backplane.
4. The remote output module receives the data from the backplane and behaves as dictated by its configuration.
Remote Output Module to Controller Data Transmission
When a safety output module receives new data and the requested data value is present on the RTB, the output module sends output readback status to the controller. The data value corresponds to the signal present at its terminals.
In addition to the output readback, the output module sends other data to the controller at the RPI. For example, the module alerts the controller if a short circuit condition exists on the module.
The following events occur when a remote safety output module sends data to the controller at the RPI.
1. The module sends the data to the remote system backplane. 2. The EtherNet/IP adapter in the system sends the data over the
EtherNet/IP network. 3. One of the following:
� If the controller is directly connected to the EtherNet/IP network, it receives the input data from the network without need for a communication module.
� If the controller is connected to the EtherNet/IP network through another communication module, the module transmits the data to its backplane and the controller receives it.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

External Means

Digital Safety I/O Module Operation in a Control System Chapter 1

Any controller in the system can listen to the data from an I/O module. An owner-controller, as described in Ownership on page 24, exchanges data with I/O modules.
Controllers that do not own a module but must listen to data from it use the following on the Module Definition dialog box:
� 1756 ControlLogix digital safety I/O modules - Configured By = External Means.
In this case, the `listening' controller can only listen to input data. The listening controller does not own the module configuration or exchange other data with the module.
When the module is configured by External Means, you can disable the module configuration signature. This disables the configuration validation check when connections are made.
During the I/O configuration process, you can specify an External Means connection. For more information on Connection options, see Module Definition on page 84.

IMPORTANT

Remember the following:
� If a controller uses External Means, the connection can be Multicast or Unicast.
� Once a module has been configured by the owner-controller, External Means connections can be created and maintained regardless of owner state.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 1 Digital Safety I/O Module Operation in a Control System

Protected Operations

To maintain the secure operation of your safety I/O modules, operations that can disrupt module operation are restricted based on the module operating mode.

Table 5 describes the restrictions.

Table 5 - Protected Operations on safety I/O modules

Activity

Current Module Operation

Firmware Update Request

Module Reset Connection

Request

Configuration Connection or Electronic

Change

Data Format Keying

Change

RPI Change

Connection not running Connection running

Rejected

Accepted(1)

Accepted Accepted(2)

Not allowed(3)

Accepted(4)

Firmware update is in process

Rejected

(1) Only requests for Listen Only connections are accepted. (2) Configuration change is accepted in the following scenarios:
- Changes are made in the Module Properties dialog box and you click Apply. - Changes are made in the Configuration tags and you send a Reconfigure Module MSG to the module.

(3) The difference between Rejected and Not allowed is that rejected activities can be attempted in the Logix Designer application but do not take effect. The activities that are not allowed, that is, attempts to change the Connection or Data Format used, do not occur in the Logix Designer application. For example, if you attempt to reset a module that is connected to the owner-controller, the Logix Designer application executes the request and alerts you that it was rejected. If you attempt to change the data format on a module that is connected to an owner-controller, the Logix Designer application does not execute the attempted change. The application only alerts you that the change is not allowed. In the case, if the change is attempted online, the Module Definition dialog box field that changes the data format is disabled.
(4) The change occurs after the connection is closed and reopened. You can close and reopen the connection in the following ways: - Change the project while it is offline and download the updated project before going online again. - Change the project while it is online and click Apply or OK in the Module Properties dialog box. In this case, before the change is made, a dialog box alerts you of the ramifications before the change is made.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

2 Chapter
Features Common to 1756 ControlLogix Digital Safety I/O Modules

Topic

Page

Input Module Compatibility

Output Module Compatibility

Software Configurable

Module Data Quality Reporting

Fault and Status Reporting

Module Inhibiting

Electronic Keying

Module Firmware

Producer/Consumer Communication

This chapter describes features that are common to 1756 ControlLogix� Digital Safety I/O Modules modules unless otherwise noted.

Some features are supported on all I/O modules and other features are specific to module types. The differences are indicated in feature descriptions.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 2 Features Common to 1756 ControlLogix Digital Safety I/O Modules
Input Module Compatibility Digital safety input modules interface to sensing devices and detect whether they
are On or Off.
These input modules convert DC On/Off signals from user devices to appropriate logic level for use in the controller. Typical input devices include:
� Proximity switches � Limit switches � Selector switches � Float switches � Push button switches
When you design systems with a digital safety input module, consider these factors:
� Voltage necessary for your application � Current leakage � Whether you need a solid-state device � Whether your application uses sinking or sourcing wiring

Output Module Compatibility

You can use a digital safety output module to drive output devices. Typical devices compatible with these output modules include:
� Motor starters � Solenoids � Indicators
When you design systems with a digital safety output module, follow these guidelines:
� Make sure that the output modules can supply the necessary surge and continuous current for proper operation.
� Make sure that the surge and continuous current are not exceeded. Damage to the module could result.
When you size output loads, refer to the documentation supplied with the output device for the surge and continuous current necessary to operate the device.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Software Configurable

Features Common to 1756 ControlLogix Digital Safety I/O Modules Chapter 2
You use the Studio 5000 Logix Designer� application to configure the module, monitor system operation, and troubleshoot issues. You can also use the Logix Designer application to retrieve this information from any module in the system:
� Serial number � Firmware revision information � Product code � Vendor � Error and fault information � Diagnostic information
By minimizing the need for tasks, such as setting hardware switches and jumpers, the software makes module configuration easier.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 2 Features Common to 1756 ControlLogix Digital Safety I/O Modules

Module Data Quality Reporting

The digital safety I/O modules indicate the quality of channel data that is returned to the owner-controller. Data quality represents accuracy. Levels of data quality are reported via module input tags.
These input tags indicate the level of data quality.

IMPORTANT

Once the condition that causes the Fault or Uncertain tag to change to 1 is removed, the tag automatically resets to 0. The Logix Designer application controls the tags. You cannot change the status of the tags.
Keep in mind that in some system configurations, the tag is not reset immediately after the condition is removed. The tag typically resets after a small delay.

� I.Ptxx.Fault - This tag indicates that the reported channel data is inaccurate and cannot be trusted for use in your application. Do not use the reported channel data for control.
If the tag is set to 1, you cannot trust the data reported. You must troubleshoot the module to correct the cause of the inaccuracy.
Example causes of inaccurate data include: � Field Power Loss condition (output modules) � Short Circuit condition (output modules)
We recommend that you troubleshoot the module for the typical causes first.
� I.Ptxx.Uncertain - This tag indicates that the reported channel data can be inaccurate but the degree of inaccuracy is unknown. We recommend that you do not use the reported channel data for control.
If the module sets this tag to 1, you know that the data can be inaccurate. You must troubleshoot the module to discover what degree of inaccuracy exists.
Example cause of uncertain data includes: � Module is operating outside its designed operating temperature range

IMPORTANT We strongly recommend that you monitor the tags in your program to make sure that the application is operating as expected with accurate channel input data.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Features Common to 1756 ControlLogix Digital Safety I/O Modules Chapter 2
Fault and Status Reporting The digital safety I/O modules report fault and status data along with channel
data. Fault and status data is reported in these ways: � Logix Designer application � Module status indicators � I/O status indicators IMPORTANT Do not use the module status indicators or I/O status indicators on 1756 ControlLogix digital safety I/O modules for safety operations.
For more information on fault and status reporting, see: � Input modules - Fault and Status Reporting on page 54 � Output modules - Fault and Status Reporting on page 71 � Appendix A, Troubleshoot Your Module on page 103

Module Inhibiting

Module inhibiting lets you indefinitely suspend a connection, including Listen Only connections, between an owner-controller and an I/O module without removing the module from the configuration. This process lets you temporarily disable a module, such as to perform maintenance.
IMPORTANT You cannot inhibit a connection when the controller is safety-locked or a safety signature exists for the controller.
You can use module inhibiting in these ways:
� You write a configuration for an I/O module but inhibit the module to help prevent it from communicating with the owner-controller. The owner does not establish a connection and the configuration is not sent to the module until the connection is uninhibited.
� In your application, a controller already owns a module, has downloaded the configuration to the module, and is exchanging data over the connection between the devices.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 2 Features Common to 1756 ControlLogix Digital Safety I/O Modules

In this case, you can inhibit the module and the connection to the module does not exist.

IMPORTANT

Whenever you inhibit an output module that is ProgMode enabled, it enters Program mode, and all outputs change to the state configured for Program mode.
For example, if an output module is configured so that the state of the outputs transition to zero during Program mode, whenever that module is inhibited, outputs transition to zero.

You can use module inhibiting in these instances: � You want to update an I/O module, for example, update the module firmware revision. Use this procedure. a. Inhibit the module. b. Perform the update. c. Uninhibit the module.
� You use a program that includes a module that you do not physically possess yet. You do not want the controller to look for a module that does not yet exist. In this case, you can inhibit the module in your program until it physically resides in the proper slot.
You can inhibit the connection to a 1756 ControlLogix digital safety I/O module on the Connection category of the Module Properties dialog box.
To see where to inhibit a connection, see Connection Category on page 85.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Electronic Keying

Features Common to 1756 ControlLogix Digital Safety I/O Modules Chapter 2

Electronic Keying reduces the possibility that you use the wrong device in a control system. It compares the device that is defined in your project to the installed device. If keying fails, a fault occurs. These attributes are compared.

Attribute Vendor Device Type Product Code Major Revision Minor Revision

Description The device manufacturer. The general type of the product, for example, digital I/O module. The specific type of the product. The Product Code maps to a catalog number. A number that represents the functional capabilities of a device. A number that represents behavior changes in the device.

The following Electronic Keying options are available.

Keying Option Compatible Module
Exact Match

Description
This is the default keying option. Compatible Module lets the installed device accept the key of the device that is defined in the project when the installed device can emulate the defined device. With Compatible Module, you can typically replace a device with another device that has the following characteristics: � Same catalog number � Same or higher Major Revision � Minor Revision as follows:
� If the Major Revision is the same, the Minor Revision must be the same or higher. � If the Major Revision is higher, the Minor Revision can be any number.
Indicates that all keying attributes must match to establish communication. If any attribute does not match precisely, communication with the device does not occur.
This is a suitable keying option for safety applications.

Carefully consider the implications of each keying option when selecting one.

IMPORTANT

Changing Electronic Keying parameters online interrupts connections to the device and any devices that are connected through the device. Connections from other controllers can also be broken.
If an I/O connection to a device is interrupted, the result can be a loss of data.

More Information
For more detailed information on Electronic Keying, see Electronic Keying in Logix 5000TM Control Systems Application Technique, publication LOGIX-AT001.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 2 Features Common to 1756 ControlLogix Digital Safety I/O Modules

Module Firmware

The digital safety I/O modules are manufactured with module firmware installed. If updated module firmware revisions are available in the future, you can update the firmware.
If the module is configured for Exact Match, the controller checks to make sure that the module has the correct firmware revision.
Updated firmware revisions are made available for various reasons, for example, to correct an anomaly that existed in previous module firmware revisions.
IMPORTANT Verify that the module firmware revisions for the 1756 ControlLogix digital safety I/O modules that you use are correct before commissioning your system.
You access updated firmware files at the Rockwell Automation� Product Compatibility and Download Center (PCDC). The PCDC is available at:
https://compatibility.rockwellautomation.com/Pages/home.aspx
Only download firmware and access product release notes from the Rockwell Automation� PCDC.
Do not download firmware from non-Rockwell Automation sites.

Producer/Consumer Communication

Digital safety I/O modules use the Producer/Consumer communication model to produce data without a controller polling them first. The modules produce the data, and the owner-controller (and controllers with a Listen Only connection to the module) can consume the data.
When an input module produces data, the controllers can consume the data simultaneously. Simultaneous data consumption minimizes the need for one controller to send the data to other controllers.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Overview

3 Chapter
1756-IB16S Input Module Features

Topic

Page

Overview

Safety Application Suitability Level

Use Test Output with a Safety Input

Single-channel Point Operation Type

Safety Input Fault Reset

Safety Input Delay Time

Data Transfer at RPI

Module Health Diagnostic

Fault and Status Reporting

Field Power Loss Detection

Short Circuit Protection

This section describes features that are available on the 1756-IB16S module.
The following apply to the safety inputs:
� You can connect safety devices, such as Emergency Stop Push Button, gate switches, and safety light curtains.
� Evaluate an input signal, that is, input data, in single-channel mode or dual-channel mode.
� An external wiring short circuit check is possible when inputs are wired in combination with test outputs. The module must be wired in combination with test outputs when this function is used.
� Independently adjustable on and off delays are available per channel.
� Diagnostics.
� Safety input points are configured as:
� Not Used � Safety � Safety Pulse Test

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 3 1756-IB16S Input Module Features
The following apply to the test outputs: � Test outputs can be configured as: � Not Used � Power Supply � Pulse Test
� Separate test outputs are provided for short circuit detection of a safety input (or inputs).
� Can supply 24V DC power to devices, such as safety sensors.
� Test output rating (TO) 200 mA @ 18...32V DC

Safety Application Suitability Level

Table 6 describes the safety application suitability levels for the 1756-IB16S module.

Table 6 - Safety Application Suitability for 1756-IB16S

Suitability Level

Conditions

Notes

Safety applications that are rated up to and including SIL CL3, PLd, Cat. 2 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1
Safety applications that are rated up to and including SIL CL3, PLd, Cat. 3 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1
Safety applications that are rated up to, and including, SIL CL3, PLe, Cat. 4 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1.

The safety function uses single-channel mode. � Module channel Point Mode is Safety Pulse
Test.
The safety function uses dual-channel mode(1). � Module channel Point mode is Safety.
The safety function uses dual-channel mode. � Module channel Point Mode is Safety Pulse
Test. The safety function uses dual-channel mode. � Module channel Point mode is Safety. � Use shredded cable or cable trunk to separate
channel wiring to mitigate short circuit faults.

Consider the following:
� Single-channel mode and dual-channel mode, as stated in this table, refer to the number of channels used in the safety function.
� The 1756-IB16S module is capable of being a SIL CL3/PLe/Cat. 4 subsystem (SRP/CS) when either a single-channel or dual-channel safety device is wired to the input channels.
� The channel mode type, that is, single or dual, affects Performance Level and Category. You can use the modules in SIL CL3 applications regardless of channel mode type.
The determining factor to whether a 1756 ControlLogix� I/O safety module resides in a SIL CL3, PLe, Cat. 4 safety application is that the overall safety architecture be a dual-channel system.
� To achieve SIL CL3 single-channel, the sensor that is used must be SIL CL 3 single-channel as well.
� The requirement that Point Mode be Safety Pulse Test assumes that only the safety modules provide diagnostics to a specific Suitability Level.
The larger safety system within which the safety modules reside can provide the diagnostics necessary to achieve the stated Suitability Level without the requirement that Point Mode be Safety Pulse Test.

(1) You cannot configure the module for dual-channel operation via the Logix Designer application module properties dialog box. You use dual-channel safety instructions in the Safety Task to provide cross monitoring.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-IB16S Input Module Features Chapter 3

Use Test Output with a Safety Input

A test output can be used in combination with a safety input for short circuit and cross-channel fault detection. In this case, Point Mode must be Safety Pulse Test. Safety input pairs must be associated with different Test Output sources.
When pulse testing is used, the only test source available for each channel is the test output to the left as shown on the wiring diagram.

IMPORTANT Because of the pre-configured relationships between test outputs and input channels, wiring a
dual channel device to input channels 0 and 8 is not supported if pulse testing is required, the same holds true for 1/9, 2/10, 3/11, 4/12, 5/13, 6/14, 7/15.
TIP The test output also can be configured as a power supply to source 24V DC to an external device, for example, a light curtain.
Figure 6 - 1756-IB16S Module - Input Connected to Test Output
Channel Connections The diagram shows devices that are connected to safety input channel 0 and test output channel 0. You can connect devices to all 16 channels.

TO-0

IN-0

2-wire sensor

TO-1

IN-1

TO-2

IN-2

TO-3

IN-3

TO-4

IN-4

TO-5

IN-5

TO-6

IN-6

TO-7

IN-7

TO-0

IN-8

TO-1

IN-9

TO-2

IN-10

3-wire sensor

TO-3

IN-11

TO-4

IN-12

TO-5

IN-13

TO-6

IN-14

TO-7

IN-15

DC(-)

DC(+)

DC(-)

DC(+)

24V DC SELV/PELV-listed power supply

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 3 1756-IB16S Input Module Features

Figure 7 - 1756-IB16S Test Pulse in a Cycle On

OUT Off

On the 1756-IB16S module, the test pulse width (X) is less than 600 �s; the test pulse period (Y) is less than 100 ms.
When the external input contact is closed, a test pulse is output from the test output terminal to diagnose the field wiring and input circuitry. By using this function, short-circuits between inputs and 24V power, and between input signal lines can be detected.
Figure 8 - Short Circuit Between Input Signal Lines

IN + 24V DC
COM TO0
IN 0

24V DC 0V DC
External Contact
Short circuit between input signal lines and power supply (positive side)

TO1 External Contact

IN 1

Short circuit between channels 0 and 1.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-IB16S Input Module Features Chapter 3

Single-channel Point Operation Type
Normal Operation

If an error is detected on the input channel, Safety Input Data and Safety Input Status turn off.

For information on how using single-channel Point Operation Type with a 1756-IB16S module affects the safety application suitability level, see Table 6 on page 46.

Figure 9 - Normal Operation and Fault Detection (Not to Scale)

Test Output 0

24V DC 0V DC

ON External Device
OFF
ON Input Terminal 0
OFF

Safety Network Data Sent to the Controller
Fault Detection Safety Network Data Sent to the Controller

Safety Input 0 Data
Safety Input 0 Status
Test Output 0

ON OFF ON OFF 24V DC 0V DC

ON External Device
OFF

ON Input Terminal 0
OFF

Safety Input 0

Data

OFF

Safety Input 0

Status

OFF

Fault Detected
Fault is declared at the end of the Test Output pulse.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 3 1756-IB16S Input Module Features

Safety Input Fault Reset

The I/O channel supports a module-level user-configurable 'Latch Fault until reset via output tag' mode and recovers from these faults:
� Field Power Off Detection � Safety Input Short Circuit

'Latch Fault until reset via output tag' mode is Enabled
When Latch Fault... mode is Enabled, the I/O channel holds safety input fault indications until it checks that the fault is removed. If the fault is removed, the channel clears the fault status only upon detecting that the ResetFault in its consume assembly channel sees a rising edge.

'Latch Fault until reset via output tag' mode is Disabled
When Latch Fault... mode is Disabled (default), the I/O channel holds safety input fault indications for 1 second until it checks if the fault is removed. If the fault is removed, the channel clears the fault status only upon detecting the safety input is low on the screw. If not, the channel continues to check if the fault is removed.

Safety Input Delay Time

You can increase the time that it takes for an input point to transition from On to Off and Off to On on the 1756-IB16S module. The increase in time is a delay of the signal from the module to the controller.
The RPI defines a rate at which the owner-controller and the module exchange data (2...500 ms). For example, if you set the RPI at 10 ms and use an input delay time of 2 ms, it could take up to12 ms for a signal change to be seen at the controller.
An increase in the time it takes to transition from one state to another improves noise immunity within a signal.
To set the Input Delay Time on the 1756-IB16S module, see Edit the 1756IB16S Module Configuration Categories on page 88.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-IB16S Input Module Features Chapter 3
Off to On Delay
An input signal is treated as Logic 0 during the Off to On delay time after the rising edge of the input contact.
The input turns on only if the input contact remains on after the Off to On delay time has elapsed. This setting help prevent rapid changes of the input data due to contact bounce.
You can delay the Off to On transition by the following times: � 0 ms � 1 ms � 2 ms � 5 ms � 10 ms � 20 ms � 50 ms
Figure 10 - Off to On Delay
ON Input Signal
OFF

Safety Input

Network Data

OFF

Off to On Delay

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 3 1756-IB16S Input Module Features
On to Off Delay
An input signal is treated as Logic 1 during the On to Off delay time after the falling edge of the input contact.
The input turns off only if the input contact remains off after the On to Off delay time has elapsed. This setting helps to prevent rapid changes of the input data due to contact bounce.
You can delay the On to Off transition by the following times: � 0 ms � 1 ms � 2 ms � 5 ms � 10 ms � 20 ms � 50 ms
Figure 11 - On to Off Delay ON
Input Signal OFF

Safety Input

Network Data

OFF

On to Off Delay

Data Transfer at RPI

The safety input module always sends data to the owner-controller at the RPI. You set the RPI on the Connection page of the Module Properties dialog box in the Logix Designer application.

Module Health Diagnostic Every I/O module has a status indicator on the front of the module that indicates
module health.
For more information on status indicators, see Appendix A, Troubleshoot Your Module on page 103.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Point Diagnostics

1756-IB16S Input Module Features Chapter 3
Point diagnostics provide information on an individual point basis. For example, you can check individual input points and test output points on a 1756-IB16S safety input module for the presence of a Short Circuit condition.
Figure 12 shows how to access output point diagnostics on the 1756-IB16S module and the diagnostics dialog box.
Figure 12 - Point Diagnostics

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 3 1756-IB16S Input Module Features

Fault and Status Reporting The input modules send fault and status data with channel data to the owner and
listening controllers. The data is returned via module tags that you can monitor in your Logix Designer application.
With some exceptions, the digital input modules provide the fault and data status in a point-centric format. The tag names that include Ptxx represent pointcentric data in the table. The xx represents the point number.
Table 7 lists tags that are used on 1756-IB16S module.
IMPORTANT For more information on the valid values for each tag, see Appendix B, Module Tag Definitions on page 113.

Table 7 - 1756-IB16S Module - Fault and Data Status

Data Type

Tag Name ConnectionFaulted(1)

Triggering Event That Sets The owner-controller loses its connection to the module.

Ptxx.Fault

The point data quality is bad or the channel is set to Not Used.

Ptxx.ShortCircuit
Fault Testxx.Fault

A short circuit condition exists on the point. The point data quality is bad or the channel is set to Not Used.

Testxx.ShortCircuit

A short circuit condition exists on the test point.

Testxx.FieldPowerOff

A field power lost condition exists on the test point.

RunMode

The module is in Run Mode.

DiagnosticActive

Indicates if any diagnostics are active or if the prognostics threshold is reached.

DiagnosticSequenceCount

The count increments each time that a diagnostic condition is detected or removed.

Ptxx.Data

The data currently at the point.

Status

Ptxx.Uncertain

The point data can be imperfect because an Over temperature or Critical Temperature condition exists.

Ptxx.Status

The point state transitions from normal to faulted or faulted to normal.

Testxx.Readback

A 24V DC power is present at the test output.

Testxx.Uncertain

The test point data can be imperfect.

Testxx.Status

The test point state transitions from normal to faulted or faulted to normal.

(1) This tag provides module-wide data an affects all channels simultaneously.

For more information on fault reporting, see Appendix A, Troubleshoot Your Module on page 103.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-IB16S Input Module Features Chapter 3

Field Power Loss Detection The Field Power Loss Detection feature monitors for the loss of field-side power.

When power is lost, the module detects the loss of field power and faults. As a result, fault data is sent to the controller. Keep in mind that all points on the module fault when a field power is lost.

Table 8 describes what happens when a field power loss condition is detected.

Table 8 - Field Power Loss Detection - Condition Detected

Test Output Tag Value Behavior

� Faults � Turns off

� I.Testxx.FieldPowerOff tag = 1
� I.Testxx.Fault tag = 1

Diagnostic Value

I/O Status Indicator State

FieldPowerOff diagnostic = 1 Solid red

SA Status Indicator
Off

To correct the issue, you must reapply field power to the module.

Table 9 describes what happens when a field power is restored and the error latch time, if set, has expired.

Table 9 - Field Power Loss Detection - Power Restored

Test Output Tag Value Behavior

Restarts in its � I.Testxx.FieldPowerOff

commanded tag = 0

state.

� I.Testxx.Fault tag = 0

Diagnostic Value

I/O Status Indicator State

FieldPowerOff diagnostic = 0 Off

SA Status Indicator
Steady green

IMPORTANT The module can require up to 1 second to complete the recovery in addition to the Input Error Latch Time.
Field Power Loss Detection has a corresponding tag that can be examined in the user program if a fault occurs. For information on modules, see Appendix B, Module Tag Definitions on page 113.
You can also monitor a point for the presence of a field power loss via the diagnostics that are available in the Module Properties dialog box in Logix Designer application.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 3 1756-IB16S Input Module Features

Short Circuit Protection

Short Circuit Protection helps to prevent damage to a test output that can result when more current is present at the output than it can handle. The diagnostic is supported on all module outputs.

Table 10 describes what happens when a short circuit condition is detected.

Table 10 - Short Circuit Protection - Condition Detected

Test Output Behavior
� Faults � Turns off

Tag Value
I.Testxx.ShortCircuit tag = 1 I.Testxx.Fault tag = 1

Diagnostic Value Short Circuit diagnostic = 1

I/O Status Indicator State
Flashing red

To correct the issue, remove the short.

Table 11 describes what happens when the short circuit condition is corrected.

Table 11 - Short Circuit Protection - Condition Corrected

Test Output Behavior
Restarts in its commanded state.

Tag Value
I.Testxx.ShortCircuit tag = 0 I.Testxx.Fault tag = 0

Diagnostic Value Short Circuit diagnostic = 0

I/O Status Indicator State
Turns off if there is no longer a load that is connected to the output.

For more information on the maximum current that you can apply to an output, see the ControlLogix I/O Modules Specifications Technical Data, publication 1756-TD002.

Test Output Recovery After Overload or Short Circuit to Ground Condition

Table 12 describes test output recovery after overload or short circuit to ground conditions occur.

Table 12 - Test Output Recovery - 1756 ControlLogix Digital Safety Input Modules

Cause of Fault Overload Condition
Short Circuit to Ground Condition

Module Operating Conditions

Correction

Recovery Time

� Test Output Point Mode - Pulse Test, Power Supply
� Test Output Data tag = 1. � Overload current 0.7 A.
� Test Output Point Mode - Pulse Test, Power Supply
� Test Output Data tag = 1. � Test output is connected directly to ground.

Remove the load from the test output point.
One of the following: � If the Point Mode for the test output is Pulse
Test or Power Supply when the Short Circuit condition is detected, the condition can be corrected but you cannot set the test output to a safe state.

After the condition is corrected, and the test output is returned to the safe state, it recovers in whichever of these times is higher:
� 10 seconds
� Input Error Latch Time - This time is set on the Input Points category of the Module Properties dialog box.
To see where to set the Input Error Latch Time, go to page 88.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

4 Chapter
1756-OBV8S Output Module Features

Topic

Page

Overview

Safety Application Suitability Level

Safety Output with Test Pulse

Single-channel Point Operation Type

Dual-channel Point Operation Type

Safety Output Fault Reset

Fault and Status Reporting

Module Health Diagnostics

Field Power Loss Detection

No Load Detection

Short Circuit Protection

Thermal Shutoff

Fault and Status Reporting

Configurable Channel-level Output State in Program Mode or Fault Mode

Connection Fault Handling

Forcing

This chapter describes features that are supported on the 1756-OVB8S output module.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features

Overview

The 1756-OBV8S is a safety output module that uses eight safety outputs. You use the outputs in one of the following ways:
� Sourcing/sinking outputs in Bipolar Output mode � Sourcing outputs in Sourcing Output mode. � Solid-state outputs � Single-channel mode uses one output signal, that is, data from an output
channel, to provide control.

IMPORTANT

Single-channel mode is only certified for functional safety applications with process safety times greater than or equal to 200 ms; or, applications with demand rates less than or equal to 3 demand per minute.

� Dual-channel mode uses two output signals, that is, data from two output channels to provide redundant control.
� Safety outputs can be pulse-tested to detect field wiring short-circuits to 24V DC.
� The 1756-OBV8S module follows the mode of the Safety Task, which can be different than the mode of the controller.
When the safety task encounters a nonrecoverable safety fault, a standard major recoverable fault is also logged, and the controller proceeds to execute the controller fault handler, if one exists. If the controller fault handler handles this fault, then the standard tasks continue to run, even though the safety task remains faulted.
If a recoverable fault occurs in the safety application, the system can halt the execution of the safety task, depending upon whether or not the fault is handled by Program Fault Routines in the safety application. If the recoverable safety fault is not handled, a standard major recoverable fault is also logged, and the controller proceeds to execute the controller fault handler, if one exists. If the controller fault handler handles this fault, then the standard tasks continue to run, even though the safety task remains faulted.
In these scenarios, the 1756-OBV8S module follows the Safety Task and will be in Program Mode/Communications Fault mode even though the controller is still in Run mode.
For information on Safety Faults, see the ControlLogix� 5580 and GuardLogix� 5580 Controllers User Manual, publication 1756-UM543.

IMPORTANT If there is a fault on a separate safety output on the same module, the module could switch off all outputs.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-OBV8S Output Module Features Chapter 4

Safety Application Suitability Level

Table 13 describes the safety application suitability levels for the 1756-OBV8S module.

Table 13 - Safety Application Suitability for 1756-OBV8S Module

Suitability Level

Conditions

Notes

Safety applications that are rated up to, and including, SIL CL3, PLd, Cat. 2 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1.
Safety applications that are rated up to, and including, SIL CL3, PLe, Cat. 4 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1.

The safety function uses single -channel mode.
� Module Output Mode is Sourcing
� Module channel Point Operation Type is SINGLE
� Module channel Point mode is Safety Pulse test.
The safety function uses single-channel mode
� Module Output Mode is bipolar
� Module channel Point mode is Safety Pulse test
The safety function uses dual-channel mode.
� Module Output Mode is Sourcing
� Module Channel Point Operation Type is DUAL
� Module channel Point mode is Safety Pulse test.
The safety function uses dual-channel mode
� Module Output Mode is bipolar
� Module channel Point mode is Safety Pulse test

Consider the following:
� Single-channel mode refers to a single-channel actuator subsystem driven by one sourcing output channel configured for SINGLE, or one bipolar output channel configured for SINGLE.
� Dual channel mode refers to a dual channel actuator subsystem driven by two sourcing output channels configured for DUAL, or one bipolar output channel configured for SINGLE.
� The 1756-OBV8S module is capable of being a SIL CL3/PLe/Cat. 4 subsystem (SRP/CS) when either a single-channel or dual-channel safety device is wired to the output channels.
� The channel mode type, that is, single or dual, affects Category and Performance Level. You can use the modules in SIL CL3, PLe applications regardless of channel mode type.
The determining factor to whether a 1756 ControlLogix digital safety I/O module resides in a SIL CL3, PLe, Cat. 4 safety application is that the overall safety architecture be a dual-channel system.
� The requirement that Point Mode be Safety Pulse Test assumes that only the safety modules provide diagnostics to a specific Suitability Level.
The larger safety system within which the safety I/O module resides can provide the diagnostics necessary to achieve the stated Suitability Level without the requirement that Point Mode be Safety Pulse Test.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features

Safety Output with Test Pulse

When the safety output is on, the safety output can be configured to pulse test the safety output channel. By using this function, you can continuously test the ability of the safety output to remove power from the output terminals of the module.
If an error is detected, the safety output data and individual safety output status turn off.
Figure 13 - 1756-OBV8S Test Pulse in a Cycle
Sourcing Output
On

OUT Off

Sinking Output

Off

OUT

On the 1756-OBV8S module, the pulse width (X) is less than 750 �s, and the pulse period (Y) is less than 96 ms.
TIP To help prevent the test pulse from causing the connected device to malfunction, pay careful attention to the input response time of the output device. An open wire test and main switch pulse test can also generate a pulse on a safety output even in safety mode. Two successive safety output pulses are required to determine if a short circuit fault exists. As a result, the effective pulse period is 192 ms, max.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Single-channel Point Operation Type
Normal Operation

1756-OBV8S Output Module Features Chapter 4
When the output channel is in the On state and without any faults, the safety outputs turned on. The status is normal. If a fault is detected on the output channel, the safety output data and individual safety output status turn off.
For information on how using single-channel Point Operation Type with a 1756-OBV8S module affects the safety application suitability level, see Table 13 on page 59.
Figure 14 - 1756-OBV8S Single-channel Point Operation Type (Not to Scale)
ON Output 0
OFF

Safety Network Data Sent to the Controller
Fault Detection

ON Safety Output 0

Status

OFF

Output 0

OFF

Safety Network Data Sent to the Controller

Safety Output 0

Status

OFF

Error Detected

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features

Dual-channel Point Operation Type

When dual-channel Point Operation Type is used, output channels function as connection pairs. Connection pairs are as follows:
� Channels 0 and 1 � Channels 2 and 3 � Channels 4 and 5 � Channels 6 and 7

IMPORTANT Dual-channel Point Operation Type is only available if the module is connected so that Output Mode is Sourcing.
When both output channels in a connection pair are in the On state and without any faults, the safety outputs are turned on.
For information on how to use dual-channel Point Operation Type with a 1756-OBV8S module affects the safety application suitability level, see Table 13 on page 59.
Figure 15 - 1756-OBV8S Dual-channel Point Operation Type (Not to Scale)

Normal Operation
Safety Network Data Sent to the Controller

ON Output 0
OFF

ON Output 1
OFF

Safety Outputs 0

and 1 Status

OFF

Fault Detection
Safety Network Data Sent to the Controller

ON Output 0
OFF

ON Output 1
OFF

Safety Outputs 0 ON

and 1 Status

OFF

Error Detected

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-OBV8S Output Module Features Chapter 4

Safety Output Fault Reset

The I/O channel supports a module-level user-configurable `Latch Fault until reset via output tag' mode and recovers from only these field faults:
� Field Power Off Detection � Safety Output ShortCircuitGround � Safety Output Overload

The recovery time is 1 second for Field Power Off, and 10 seconds for Short or Overload.

`Latch Fault until reset via output tag' mode is Enabled
When Latch Fault... mode is Enabled, the I/O channel holds safety output fault indications until it checks that the field fault is removed. If the field fault is removed, the channel clears the fault status only upon detecting that the ResetFault in its consume assembly channel sees a rising edge.

`Latch Fault until reset via output tag' mode is Disabled
When Latch Fault... mode is Disabled (default), the I/O channel holds safety output fault indications for 1 second until it checks if the field fault is removed. If the field fault is removed, the channel clears the fault status only upon detecting the consume data bit is low. The fault status will also be cleared by a module reset or power cycle or when "Output State During Program Mode and Communications Fault Mode" is configured to Off and any of the following conditions:
� Controller in Program mode � Controller or Safety task fault � Communications fault � Module inhibit
After the channel clears the fault, the I/O indicator (red) turns off. The output data can now be controlled.
IMPORTANT If module outputs experience persistent high faults, consider cycling power to the module to clear the error.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features
Fault and Status Reporting The 1756-OBV8S module multicasts fault and status data with channel data to
the owner and listening controllers. The data is returned via module tags that you can monitor in your Logix Designer application. For more information on how to use module tags to monitor fault and status reporting, see Table 24 on page 71
� Appendix A, Troubleshoot Your Module on page 103.
Module Health Diagnostics Each output module has a status indicator on the front of the module that
indicates module health. For more information on module health diagnostics, see Appendix A, Troubleshoot Your Module on page 103.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Point Diagnostics

1756-OBV8S Output Module Features Chapter 4
Point diagnostics provide information on an individual point basis. For example, you can check individual points on a 1756-OBV8S safety output module for the presence of a Short Circuit condition.
To access output point diagnostics on the 1756-OBV8S module, click the Diagnostics button for the point.
Figure 16 - Point Diagnostics

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features

Field Power Loss Detection The Field Power Loss Detection feature monitors for the loss of field power.

IMPORTANT

The 1756-OBV8S module supports Field Power Loss Detection.
The module receives field-side power via the DC power terminals on the module. When field-side power is lost on the 1756-OBV8S, it is lost from the DC power terminals.
See 1756-OBV8S Module Wiring Diagrams on page 123.

Keep in mind that all points on the module fault when a field power is lost.

Table 14 describes what happens when a field power loss condition is detected.

Table 14 - Field Power Loss Detection

Output Tag Value Behavior
� Faults One of the following: � Turns off � I.Ptxx.FieldPowerOff tag = 1
� I.Ptxx.Fault tag = 1

Diagnostic Value

I/O Status Indicator State

FieldPowerOff diagnostic = 1 � Solid red

To correct the issue, you must reapply field power to the output module.

Table 15 describes what happens when a field power loss condition is resolved, and the module is recovered.

Table 15 - Field Power Loss Detection

Output Behavior

Tag Value

Restarts in its commanded state.

One of the following:
� I.Ptxx.FieldPowerOff tag = 0
� I.Ptxx.Fault tag = 0

Diagnostic Value

I/O Status Indicator State

FieldPowerOff diagnostic = 0 Off

IMPORTANT The module can require up to 2 seconds to complete the recovery.

Field Power Loss Detection has a corresponding tag that can be examined in the user program if a fault occurs. For information on module tags, see Appendix B, Module Tag Definitions on page 113.
You can also monitor a point for the presence of a field power loss via the diagnostics that are available in the Module Properties dialog box in Logix Designer application.

IMPORTANT

Keep in mind the following:
� For the 1756-OBV8S module, Field Power Loss detection is in regard to loss of field power on the DC power terminals, or the presence of Undervoltage or Overvoltage conditions on the DC Power bus.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

No Load Detection

1756-OBV8S Output Module Features Chapter 4

No Load Detection detects when a wire is disconnected from the output, or a missing load for each output point in the Off state.
No Load Detection is enabled by default on the 1756-OBV8S modules. You cannot configure it.
The module supports these minimum load currents:
� Safety output modules - The load detection current is 10 mA. For example, 2.4 k at 24V DC.
In the On state, the module must be connected to a load that draws a minimum current equal to these values.

IMPORTANT An output must remain in the off state a minimum of 300 ms for an open load to be detected.

Table 16 describes what happens when a No Load condition is detected.

Table 16 - No Load Detection - 1756-OBV8S Module

Condition No Load condition exists

I/O Status Indicator State
� Flashing red if a No Load condition exists and the output is off. � Flashing red/yellow if a No Load condition already exists and the output is
on. IMPORTANT: A No Load condition is only detected when the output is off.

Table 17 describes what happens when a No Load condition is corrected.

Table 17 - No Load Detection - 1756-OBV8S Module

Condition No Load condition corrected

I/O Status Indicator State
� Off if the output is off. � Steady yellow if the output is on.

You can monitor a point for the presence of a No Load condition via the diagnostics page that is available in the Module Properties dialog box in Logix Designer application.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features

Short Circuit Protection

Short Circuit Protection helps to prevent damage to the output that can result when more current is present at the output than it can handle.

Table 18 describes what happens when a short circuit condition is detected on a 1756-OBV8S module.

Table 18 - Short Circuit Protection - 1756-OBV8S Module

Output Behavior
� Faults � Turns off

Tag Value

Module Properties Points I/O Status Indicator

Tab Diagnostic Value

State

One of the following:
� If the output point is shorted to 24V DC, the I.Ptxx.ShortCircuit tag = 1.
� If the output point is shorted to ground, no tags are changed.

One of the following:
� If the output point was shorted to 24V DC when the short circuit condition was detected, the Short Circuit diagnostic = Yes.
� If the output point is shorted to ground when the short circuit condition was detected, the Short Circuit to Ground diagnostic = Yes.

One of the following:
� Flashes red if the output point is shorted to 24V DC.
� Off if the output point is shorted to ground.

Table 19 describes what happens when the short circuit condition is removed from a 1756-OBV8S module and the data is set to safe state, that is, the off state.

Table 19 - Short Circuit Protection - 1756-OBV8S Module

Output Behavior
Restarts in its commanded state

Tag Value

Module Properties Points I/O Status Indicator

Tab Diagnostic Value

State

One of the following:
� If the output point is shorted to 24V DC, the I.Ptxx.ShortCircuit tag = 0.
� If the output point is shorted to ground, no tags are changed.

One of the following:
� If the output point was shorted to 24V DC when the short circuit condition was detected, the Short Circuit diagnostic = No.
IMPORTANT: You must cycle power to the module to reset the diagnostic.
� If the output point is shorted to ground when the short circuit condition was detected, the Short Circuit to Ground diagnostic = No

Turns off if there is no longer a load that is connected to the output.

You can monitor a point for the presence of short circuit faults via the diagnostics page that is available in the Module Properties dialog box in Logix Designer application.
For more information on the maximum current that you can apply to an output, see the 1756 ControlLogix I/O Specifications Technical Data, publication 1756-TD002.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-OBV8S Output Module Features Chapter 4

Other Conditions That Can Trigger the Short Circuit Diagnostic on the 1756-OBV8S Module

Table 20 describes conditions that can trigger the Short Circuit diagnostic.

Table 20 - Conditions That Trigger Short Circuit Diagnostic

Conditions
� Output Mode - Sourcing � Point Operation Type - Single � Point Mode - Safety Pulse Test � O.Ptxx.Data tag = 1 � Output point is shorted to 24V DC.

Output Behavior
� Faults � Turns off

These conditions exist on a pair of module outputs: � Output Mode - Sourcing � Point Operation Type - Dual � Point Mode - Safety Pulse Test � O.Ptxx.Data tag = 1 (Either output point in the pair) � Output point is shorted to 24V DC (Either output
point in the pair).

� Faults � Turns off

These conditions exist on a pair of module outputs: � Output Mode - Sourcing � Point Operation Type - Dual � O.Ptxx.Data tag = 1 (Both output points in the pair) � Output points are shorted to each other.

� Faults � Turns off

Tag and Diagnostic Combinations
� I.Ptxx.ShortCircuit tag = 1 � Short Circuit diagnostic = 1 � I.Ptxx.Fault tag = 1

I/O Status Indicator State

� I.Ptxx.Fault tag = 1 � Internal Fault diagnostic = 1

IMPORTANT: The tag and diagnostic combinations that are described occur on the faulted output point and all of its associated group points.
� I.Ptxx.ShortCircuit tag = 1 � I.Ptxx.Fault tag = 1 � Short Circuit diagnostic = 1 � Internal Fault diagnostic = 1

or
� I.Ptxx.Fault tag = 1 � Internal Fault diagnostic = 1

The I/O status indicator for the faulted output point turns off.

IMPORTANT: The tag and diagnostic combinations that are described occur on the faulted output point and all of its associated group points.

� I.Ptxx.ShortCircuit tag = 1 (Both output points in the pair)
� Short Circuit diagnostic = 1 (Both output points in the pair)
� I.Ptxx.Fault tag = 1

� I.Ptxx.Fault tag = 1 (Faulted output point and all of its associated group points)
� Internal Fault diagnostic = 1 (Faulted output point and all of its associated group points

When the conditions that trigger the diagnostics as described in Table 20 are corrected, the results are the same as described in Table 19 on page 68.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features

Output Recovery After Overload or Short Circuit to Ground Condition

Table 21 describes test output recovery after overload or short circuit to ground conditions occur.

Table 21 - Output Recovery - 1756-OBV8S Module

Cause of Fault Overload Condition
Short Circuit to Ground Condition

Module Operating Conditions
� Output Point Mode - Safety or Safety Pulse Test.
� Output Data tag = 1. � Overload current 1.5 A(1)
� Output Point Mode - Safety or Safety Pulse Test.
� Output Data tag = 1. � Output is connected directly to ground.

Correction Remove the load from the output point.

Recovery Time See Safety Output Fault Reset on page 63.

Remove the output connection to ground and set the output to a safe state.

(1) Do not use the module beyond the rated the capacity of 1 A per channel for continuous operation. For ratings, see the 1756 ControlLogix I/O Specifications Technical Data pub 1756-TD002.

Thermal Shutoff

Thermal Shutoff helps prevent damage to the output that can result when an output gets hotter than it can handle.

This feature is directly related to Short Circuit Protection feature. The increased temperature at the output results from an excessive load at the output. That is, a load with high current is applied to the output. The high current heats the output beyond an acceptable temperature and the output turns off.

Table 22 describes what happens when a thermal shutoff condition is detected on a 1756-OBV8S module.

Table 22 - Thermal Shutoff - 1756-OBV8S Module

Output Behavior Tag Value

Diagnostic Value

I/O Status Indicator State

� Faults � Turns off

One of the following:
� If the output point is shorted to 24V DC when the thermal shutoff condition occurred, the I.Ptxx.ShortCircuit tag = 1.
� If the output point is shorted to ground when the thermal shutoff condition occurred, there is no change to the tags.

One of the following:
� If the output point is shorted to 24V DC when the thermal shutoff condition occurred, there is no change in the diagnostics.
� If the output point is shorted to ground when the thermal shutoff condition occurred, the ShortCircuitGround diagnostic = 1.

Steady red

Table 23 describes what happens when the thermal shutoff condition is corrected on a 1756-OBV8S module.

Table 23 - Thermal Shutoff - 1756-OBV8S Module

Output Behavior Remains in the off state

Tag Value I.Ptxx.ShortCircuit tag = 0

Diagnostic Value

I/O Status Indicator State

One of the following:
� If the output point was shorted to 24V DC when the thermal shutoff condition occurred, the Overload diagnostic = 0. IMPORTANT: You must cycle power to the module to reset the diagnostic.
� If the output point was shorted to ground when the thermal shutoff condition occurred, the ShortCircuitGround diagnostic = 0.

Turns off if there is no longer a load that is connected to the output.

For more information on how to use the modules, see Appendix B, Module Tag Definitions on page 113.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-OBV8S Output Module Features Chapter 4

Fault and Status Reporting The output modules multicast fault and status data with channel data to the
owner and listening controllers. The data is returned via module tags that you can monitor in your Logix Designer application.
Table 24 lists tags that are used on the 1756-OBV8S module.
IMPORTANT For more information on the valid values for each tag in Table 24, see Appendix B, Module Tag Definitions on page 113.

Table 24 - 1756-OBV8S - Fault and Data Status

Data Type Tag Name ConnectionFaulted(1) Ptxx.Fault
Fault Ptxx.ShortCircuit Ptxx.FieldPowerOff RunMode

Triggering Event That Sets The owner-controller loses its connection to the module. The point data quality is bad or the channel is set to Not Used. A short circuit condition exists on the point. A field power lost condition exists on the point. The module is in Run Mode.

DiagnosticActive DiagnosticSequenceCount Status Ptxx.Readback

Indicates if any diagnostics are active or if the prognostics threshold is reached. The count increments each time that a diagnostic condition is detected or removed. A 24V DC power source is connected to the output circuit.

Ptxx.Uncertain Ptxx.Status

The point data can be imperfect. The point state transitions from normal to faulted or faulted to normal.

(1) This tag provides module-wide data an affects all channels simultaneously.

For more information on fault reporting, see Appendix A, Troubleshoot Your Module on page 103.

Configurable Channel-level Output State in Program Mode or Fault Mode

You can configure individual output channels to specific states when the module is in Program mode or Communications Fault mode. These output states are available:
� Off
� Hold

WARNING: The selection of "Hold"for Output State During Program Mode and Communications Fault Mode prevents the output point from going to the safe state, making the output point not suitable for a SIL or PL rated safety function. Set Output State During Program Mode and Communications Fault Mode to "Off" to allow points to go to safe state.
T�V Rheinland has approved GuardLogix 5580 and Compact GuardLogix 5380 controller systems for use in safety-related applications where the de-energized state is always considered to be the safe state. You must ensure each configuration of the safety IO module is set for "Off" under the Output State During Program Mode and Communications Fault Mode selection to consider those output points as part of any equipment's safety function.
To see how to configure the output states in Program mode or Fault mode, see Edit the 1756-OBV8S Module Points Category on page 90:

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features
Connection Fault Handling You can configure module behavior when a connection fault occurs, that is, the
connection between the owner-controller and the output module breaks. You must define the immediate output behavior when the connection breaks.
Output Behavior Immediately After a Connection Fault
ATTENTION: If you change the Output state from OFF to HOLD during Program or Communication Fault modes, make sure this does not create an unsafe state of your safety system.
When the connection between an owner-controller and output module breaks, the output can behave in these ways, depending on how the Fault Mode parameter is configured:
� Turn off - Default � Hold its last state
If you configure the output to hold its last state, the output remains at that state value until this occurs:
� The connection to the owner-controller is re-established. � The output returns to normal operation, as defined in the module
configuration.
Output State Once Connection is Re-established
Once the connection between the owner-controller and output module is reestablished, the output resumes normal operation.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Forcing

1756-OBV8S Output Module Features Chapter 4
Use a force to override data that your logic either uses or produces.
IMPORTANT When a safety signature exists, forcing safety I/O is not permitted in the safety portion of the application.
� Test and debug your logic.
� Temporarily maintain normal system operations when an input device has failed.
Use forces only as a temporary measure. They are not intended to be a permanent part of your application.
Make sure that you understand this before you use forces.
ATTENTION: Forcing can cause unexpected machine motion that could injure personnel. Before you use a force, determine how the force affects your machine or process and keep personnel away from the machine area. � Enabling I/O or SFC forces causes your machine or process to go to another
state or phase. � Removing forces can still leave forces in the enabled state. � If forces are enabled and you install a force, the new force immediately
takes effect.
Enable Forces
For a force to take effect, you enable forces. You can only enable and disable forces at the controller level.
� You can enable I/O forces and SFC forces separately or simultaneously.
� You cannot enable or disable forces for a specific module, tag collection, or tag element.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features
Disable or Remove a Force
To stop the effect of a force and let your project execute as programmed, disable or remove the force.
� You can disable or remove I/O and SFC forces simultaneously or separately.
� When you remove a force on an alias tag, you also remove the force on the base tag.

ATTENTION: Changes to forces can cause unexpected machine motion that could injure personnel. Before you disable or remove forces, determine how the change affects your machine or process and keep personnel away from the machine area.

Check Force Status
Before you use a force, determine the status of forces for the controller.
The Online toolbar shows the status of forces. It shows the status of I/O forces and SFC forces separately.

To determine the status of this I/O forces
SFC forces

Use any of these � Online toolbar � GSV instruction Online toolbar

Forces tab
Forces Tab Status Enabled
Disabled Installed None Installed

Means
� If the project contains any forces of this type, they are overriding your logic.
� If you add a force of this type, the new force immediately takes effect
Forces of this type are inactive. If the project contains any forces of this type, they are not overriding your logic.
At least one force of this type exists in the project.
No forces of this type exist in the project.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-OBV8S Output Module Features Chapter 4
GSV Instruction
This example shows how to use a GSV instruction to get the status of forces. For the purposes of this example, Force_Status is a DINT tag.

To determine this Forces are installed. No forces are installed. Forces are enabled. Forces are disabled.

Examine this bit 0 0 1 1

For this value 1 0 1 0

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 4 1756-OBV8S Output Module Features
Notes:

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

5 Chapter
Configure and Replace Safety Modules

Topic

Page

Create a New Module

Edit the Module Configuration Common Categories

Edit the 1756-IB16S Module Configuration Categories

Edit the 1756-OBV8S Module Points Category

View the Module Tags

Replace a Safety Module

This chapter describes how to configure your 1756 ControlLogix� Digital Safety I/O Modules in a Studio 5000 Logix Designer� application project.

IMPORTANT

You must use the Logix Designer application, version 32 or greater with the modules.
By default, all safety input and output channels on 1756 ControlLogix Digital Safety I/O Modules are disabled. You must configure each point that is used in a Safety application.

This chapter does not explain the user-configurable parameters, or corresponding module features, in your Logix Designer application project.
For detailed information about module features, see the following:
� Chapter 2, Features Common to 1756 ControlLogix Digital Safety I/O Modules on page 37
� Chapter 3, 1756-IB16S Input Module Features on page 45
� Chapter 4, 1756-OBV8S Output Module Features on page 57

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules

Create a New Module

The project must be offline to add safety modules to it.
You can create a new local or remote safety module. Local I/O modules are installed in the same system as the GuardLogix� 5580 controllers. Remote I/O modules are installed in a system that includes a 1756 ControlLogix EtherNet/IPTM adapter that connects to an EtherNet/IP network.

New Local Safety Module
To create a new local safety I/O module, complete these steps. 1. Create a Logix Designer application project. 2. Right-click the 1756 Backplane and choose New Module.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
3. At the Select Module Type window, click Create to add the discovered module to your project.

4. At the New Module window, configure the module properties and click OK.

Follow the same steps to add additional local I/O modules.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules
New Remote I/O Module
To create a new remote safety I/O module, complete these steps. 1. Add a ControlLogix EtherNet/IP adapter to the project. 2. Right-click the EtherNet/IP adapter and choose New Module.
3. Select the module and click Create.

The New Module dialog box appears with a list of categories on the left side. The number and type of categories varies by module type.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
4. You can click OK to use the default configuration as shown or edit the module configuration. The rest of this chapter describes how to edit module configuration categories.
Follow the same steps to add additional remote I/O modules.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules

Edit the Module Configuration Common Categories

You click the category names in the New Module dialog box to view and change the configuration parameters. Before you edit the module configuration, consider the following:
� This chapter shows how to edit the module configuration when you add the module to the Logix Designer application project.
If you access the module configuration after it is added to the project, the dialog box is named Module Properties. The same categories are displayed as the categories displayed on the New Module dialog box.
� Some new module configuration categories apply to all 1756 ControlLogix digital safety I/O modules. Some categories are specific to the module type.
IMPORTANT By default, all safety input and output channels on 1756 ControlLogix digital safety I/O modules are disabled. You must configure each point that is used in a Safety application.
The following categories apply to all 1756 ControlLogix digital safety I/O modules and are described in this section.
� General Category
� Connection Category
� Safety Category
� Module Info Category

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
General Category
The General category appears first when you create a module. The parameters in this category are the same for all 1756 ControlLogix digital safety I/O modules.
You use this category to complete the following tasks: � Name the module. � Assign a node number. � Describe the module. � Access the Module Definition.
Safety Network Number
The Logix Designer application automatically assigns a Safety Network Number (SNN) to safety modules as they are added to the project.

The SNN is a time-based number that uniquely identifies subnets across all networks in the safety system. All 1756 ControlLogix digital safety I/O modules in the same subnet use the same SNN by default.
� Local 1756 ControlLogix digital safety I/O modules are automatically assigned the same SNN as the 1756 Backplane SSN in the controller configuration.
� Remote 1756 ControlLogix digital safety I/O modules are automatically assigned the same SNN.
The Logix Designer application assigns an SNN to the first safety module that is added to a remote system. The application assigns the same SNN to additional safety modules that are added to this remote I/O system.
For more information on Safety Network Numbers, see the GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules

1756-IB16S

Module Definition
Module Definition parameters are available on the General tab of the Module Properties dialog box in the Logix Designer application project. Table 25 describes the parameters on the Module Definition dialog box.
1756-OBV8S

Table 25 - Module Definition Parameters

Table 25 describes the parameters on the Module Definition dialog box.

Parameter Series Revision Electronic Keying
Configured By
Input Data
Output Data - 1756-OBV8S module only
Output Mode - 1756-OBV8S

Definition Module hardware series Module firmware revision, including major and minor revision levels Software method by which you reduce the possibility of using the wrong device in a control system. For more information, see the following: � Electronic Keying on page 43 � Electronic Keying in Logix5000 Control Systems Application Technique, publication LOGIX-AT001 Determines the following for the module type you configure: � Which controller tags are generated when configuration is complete � Whether you can choose an Output Data type - Output module only � Whether you can choose an Output Mode - Output module only Determines what type of input data is exchanged between the module and the controller. Creates all controller tags specific to the module type being used. IMPORTANT: The 1756-OBV8S output module exchanges input data with the controller. Determines what type of output data is exchanged between the module and the controller. The available choices are dictated by the Configured By parameter choice.
Determines how the outputs are used. That is, one of the following: � Sourcing outputs. In this case, you connect the external device to only the sourcing point on an output
channel. � As connection pairs. In this case, you connect the external device to both the sourcing and sinking points
of the bipolar output pair.

Available Choices Module-specific Module-specific � Exact Match � Compatible Module
� This Controller � External Means(1)
� Safety data � Safety packed data
� None - If Configured By is External Means.
� Safety data and Safety packed data - If Configured By is This Controller.
� Sourcing � Bipolar

(1) Controller and module establish communication without the controller sending any configuration or output data to the module. A full input data connection is established but depends on the connection between the owner-controller and the module.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
Connection Category
The Connection category lets you inhibit the module. Before you inhibit the module, make sure that you are aware of the impact it has on your application. For more information on inhibiting the module, see page 41.
IMPORTANT You cannot set the Requested Packet Interval (RPI) for the safety modules on the Connections category. For safety modules, you set the RPI on the Safety category.

Remote safety modules support the Connection over EtherNet/IP parameter. � With safety input data, you can choose Unicast or Multicast. � With safety output data, you must use Unicast.
For more information, see page 31.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules
Safety Category
The Safety category lets you set the RPI rate. You must click the Advanced button to change the Connection Reaction Time Limit configuration.
IMPORTANT Remember, the Safety Task period determines the 1756-OBV8S module RPI.

For more information on the RPI and the Connection Reaction Time Limit parameters, see Requested Packet Interval on page 30.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
Module Info Category
The Module Info category displays module and status information about the module when the project is online. You can use this category to complete the following :
� Determine the identity of the module. � Access module diagnostics. � Refresh the data on the screen. � Reset the module.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules

Edit the 1756-IB16S Module These categories are available when you configure a 1756-IB16S module:

Configuration Categories

� Input Points Category

� Test Output Points Category

Input Points Category

The Input Points category is only available if you choose This Controller for the Configured By parameter on the Module Definition dialog box. You must configure each point to use it in a Safety application. The inputs are disabled by default.

Point Mode
Determines the operation mode of the output point. � Not Used - The output point is disabled. � Safety - The output point is enabled. � Safety Pulse Test - The output point is enabled and a pulse test is periodically performed on the output to make sure the output is functioning. The pulse test only occurs when the point is On. The pulse has a fixed state of periodic.
The default value is Not Used.
Test Source
Displays the Test Source values. There is a value for each point, 00-15. When Safety Pulse Test is selected in Point Mode, the value appears according to the point number.
Input Delay Time (ms)
For more information on input delay times, see page 50.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
Test Output Points Category
The Test Output Points category is only available if you choose This Controller for the Configured By parameter on the Module Definition dialog box. You must configure each point to use it in a Safety application. The outputs are disabled by default.
Point Mode
Determines the mode of the test output for the point. � Not Used - Test output is not used. � Pulse Test - Use the test output point as a pulse test source. � Power Supply - Use the test output as a power supply.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules

Edit the 1756-OBV8S Module Points Category

To use the Points category, on the Module Definition dialog box choose Configured By > This Controller.
The outputs are disabled by default. To use an output in a Safety application, you must configure the Point Operation Type and Point Mode. Optionally, you can configure the Output State During Program Mode and During Communications Fault Mode (Off, Hold)

IMPORTANT If you configure the output state to be Hold, then the output channel cannot be used in a safety application.
WARNING: The selection of "Hold"for Output State During Program Mode and Communications Fault Mode prevents the output point from going to the safe state, making the output point not suitable for a SIL or PL rated safety function. Set Output State During Program Mode and Communications Fault Mode to "Off" to allow points to go to safe state. T�V Rheinland has approved GuardLogix 5580 and Compact GuardLogix 5380 controller systems for use in safety-related applications where the de-energized state is always considered to be the safe state. You must ensure each configuration of the safety IO module is set for "Off" under the Output State During Program Mode and Communications Fault Mode selection to consider those output points as part of any equipment's safety function.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
Point Operation Type
Single
When the output channel is in the On state and without any faults, the safety outputs turned on. The status is normal. If a fault is detected on the output channel, the safety output data and individual safety output status turn off. See Single-channel Point Operation Type on page 61.
Dual
When dual-channel Point Operation Type is used, output channels function as connection pairs. Connection pairs are as follows:
� Channels 0 and 1 � Channels 2 and 3 � Channels 4 and 5 � Channels 6 and 7
When both output channels in a connection pair are in the On state and without any faults, the safety outputs are turned on. See Dual-channel Point Operation Type on page 62.
Point Mode
Determines the operation mode of the output point. � Not Used - Output is not used. � Safety - Output is a safety output. � Safety Pulse Test - Tests the safety output itself using an internally generated test pulse. Pulse testing detects shorts to the 24V power supply and channel-to-channel shorts. The pulse test only occurs when the point is On. The pulse has a fixed state of periodic.
Output State During Program Mode and Communications Fault Mode
You can select the output state (Off or Hold) for each channel to change to during :
� Program Mode and you encounter a Communications Fault. � Run Mode and you encounter a Communications Fault.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules

View the Module Tags

When you create a module, the Logix Designer application creates a set of tags that you can view in the Tag Editor. Each configured feature on your module has a distinct tag that is available for use in the controller program logic.
Complete the following steps to access the tags for a module.
1. In the Controller Organizer, right-click Controller Tags and choose Monitor Tags.

The Controller Tags dialog box appears with data. 2. To view the tags, click the triangle symbols.

For more information on module tags, see Appendix B,Module Tag Definitions on page 113.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5

Replace a Safety Module

Replacing a safety module that sits on a CIP SafetyTM network is more complicated than replacing standard devices because of the Safety Network Number (SNN).
Safety devices require this more complex identifier to make sure that module numbers that are duplicated on separate subnets across all of the networks in the application do not compromise communication between the correct safety devices.
The SNN is a unique identifier that is automatically assigned to each subnet in a safety application. The same SNN is assigned to all of the devices on the subnet.
For example, when an EtherNet/IP adapter is used in a safety application, the Logix Designer application project assigns it an SNN. All safety modules that are installed with that adapter, are automatically assigned the same SNN.
However, each safety module requires a unique identifier within the same subnet. A DeviceID is used to uniquely identify each safety module. The SNN and module slot number make up the DeviceID of the safety module.

Reset to Out-of-Box Configuration
When the Logix Designer application is online, the Safety tab of the Module Properties dialog box displays the current configuration ownership. When the opened project owns the configuration, Local is displayed.
When a second device owns the configuration, Remote is displayed, along with the SNN, and node address or slot number of the configuration owner. Communication error is displayed if the module read fails.
If the connection is Local, you must inhibit the module connection before you reset ownership. To inhibit the module:
1. Right-click the module and choose Properties. 2. On the Connection tab, click Inhibit module. 3. Click Apply and then OK.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules
Follow these steps to reset the module to its out-of-box configuration when online.
1. Right-click the module and choose Properties. 2. On the Safety tab, click Reset Ownership.
3. When a dialog box appears asking if you want to continue with the reset, read it and click Yes.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5

Replace a Module in a Logix 5000 System

Consider the following conditions before you replace a safety module in a Logix 5000TM system:
� If you rely on a portion of the CIP Safety system to maintain SIL 3 behavior during module replacement and functional testing, you must use the Configure Only When No Safety Signature Exists feature.
� If there is only one safety controller on the network, or if you do not rely on the entire routable CIP Safety control system to maintain SIL 3/PL (d or e) during the replacement and functional testing of a module, you can use the Configure Always feature.
Replacement with `Configure Only When No Safety Signature Exists' Enabled

When a module is replaced, the configuration is downloaded from the safety controller if the DeviceID of the new module matches the original. The DeviceID is updated whenever the SNN is set.

If the project is configured with Configure Only When No Safety Signature Exists enabled, follow the appropriate instructions in to replace a 1756 ControlLogix digital safety I/O module.

After you complete the steps in a scenario correctly, the DeviceID matches the original. This match enables the safety controller to download the proper module configuration, and re-establish the safety connection

Table 26 - Replacing a Module

GuardLogix� Safety Signature Exists No Yes or No
Yes
Yes
No

Replacement

Action Required

Module Condition

No SNN (Out-of-box) None. The device is ready for use.

Same SNN as original None. The device is ready for use. safety task configuration

No SNN (Out-of-box) See Scenario 1 - Replacement Device is Out-of-box and Safety Signature Exists on page 96.

Different SNN from original safety task configuration

See Scenario 2 - Replacement Device SNN is Different from Original and Safety Signature Exists on page 98.
See Scenario 3 - Replacement Device SNN is Different from Original and No Safety Signature Exists on page 101.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules
Scenario 1 - Replacement Device is Out-of-box and Safety Signature Exists
1. Remove the old I/O device and install the new device. 2. Right-click the replacement safety I/O device and choose Properties. 3. On the General category, click to the right of the safety network
number to open the Safety Network Number dialog box.
4. Click Set.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
5. Click Yes on the confirmation dialog box to set the SNN and accept the replacement device.
6. Follow your company-prescribed procedures to functionally test the replaced I/O device and system and to authorize the system for use.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules
Scenario 2 - Replacement Device SNN is Different from Original and Safety Signature Exists
1. Remove the old I/O device and install the new device. 2. Right-click your safety I/O device and choose Properties. 3. Click the Safety tab. 4. Click Reset Ownership.

5. On the Logix Designer application Dialog, click Yes. 6. On the next Logix Designer application Dialog, click Yes.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
7. The Configuration Ownership now shows Not Owned.
8. Click the module General category. 9. Click to the right of the safety network number to open the Safety
Network Number dialog box.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Chapter 5 Configure and Replace Safety Modules
10. Click Set.
11. Click Yes on the confirmation dialog box to set the SNN and accept the replacement device.

12. Follow your company-prescribed procedures to functionally test the replaced I/O device and system and to authorize the system for use.

100

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Configure and Replace Safety Modules Chapter 5
Scenario 3 - Replacement Device SNN is Different from Original and No Safety Signature Exists
1. Remove the old I/O device and install the new device. 2. Right-click your safety I/O device and choose Properties. 3. Click the Safety tab.

4. Click Reset Ownership. 5. On the Logix Designer application Dialog, click Yes.

6. On the next Logix Designer application Dialog, click Yes.

7. Follow your company-prescribed procedures to functionally test the replaced I/O device and system and to authorize the system for use.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

101

Chapter 5 Configure and Replace Safety Modules

Replacement with `Configured Always' Enabled

ATTENTION: Enable the `Configure Always' feature only if the entire CIP Safety Control System is not being relied on to maintain SIL 3 behavior during the replacement and functional testing of a module.
Do not place modules that are in the out-of-box condition on a CIP Safety network when the Configure Always feature is enabled, except while following this replacement procedure.

When the `Configure Always' feature is enabled, the controller automatically checks for and connects to a replacement module that meets all the following requirements:

� The controller has configuration data for a compatible module at that network address.

� The module is in out-of-box condition or has an SNN that matches the configuration.

If the project is configured for `Configure Always', follow the appropriate steps to replace a safety module.

1. Remove the old I/O module and install the new module.

Then

the module is in out-of-box condition

go to step 6.
No action is needed for the controller to take ownership of the module.

an SNN mismatch error occurs (because the module go to the next step to reset the module to out-of-

was previously owned)

box condition.

2. Right-click your I/O module and choose Properties. 3. Click the Safety tab. 4. Click Reset Ownership. 5. Click OK. 6. Follow your company-prescribed procedures to functionally test the
replaced I/O module and system and to authorize the system for use.

102

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Troubleshoot Your Module

A Appendix

Topic

Page

Module Status Indicators

103

Use the Logix Designer Application for Troubleshooting

105

You can use the module status indicators and the Studio 5000 Logix Designer� application to troubleshoot the I/O modules.

Module Status Indicators 1756 ControlLogix� digital safety I/O modules use these status indicators:

I/O Status (ST) and Fault Status (FLT)
Indicators

DC INPUT
ST 0 1 2 3 4 5 6 7 FLT 0 1 2 3 4 5 6 7 O ST 8 9 10 11 12 13 14 15 K FLT 8 9 10 11 12 13 14 15
SAFETY

Module OK Status Indicator

I/O Status (ST) and Fault Status (FLT)
Indicators

DC OUTPUT
ST 0 1 2 3 4 5 6 7 O FLT 0 1 2 3 4 5 6 7 K
SAFETY

Module OK Status Indicator

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

103

Appendix A Troubleshoot Your Module

OK Status Indicators

The OK status indicator shows the module status.

Table 1 - Module OK Status Indicator

Indicator State Off Green Flashing Green
Red Flashing red
Flashing Red/Green

Description
There is no module power applied.
The device is operating in a normal condition. At least one IO connection is in the established state.
The device is OK, but it does not have a connection. A connection may be established, but the Validator has not completed an initial Time Coordination exchange.
The device has an unrecoverable fault. Minimum recovery is to cycle power. It may be necessary to replace the device.
� The device has a recoverable fault. The fault can be read from the device through the bus or network.
� An IO connection time-out. � Recoverable NVS Fault. � A firmware update is being performed on the module.
� Indicates that you must commission the UNID on the device.

Table 2 describes the I/O Status (ST) and Fault Status (FLT) status indicators.

Table 2 - Module ST/FLT Status Indicator

Indicator State Off
Yellow Flashing red
Red Flashing Red/Yellow

Description
The digital I/O point is Off. Channel is not configured or enabled.
The digital I/O point is On.
� Open wire / open load � Input/output Off � Short circuit
Internal Malfunction
� Open load � Output ON / Open wire � Input ON

104

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Use the Logix Designer Application for Troubleshooting

Troubleshoot Your Module Appendix A
The Logix Designer application indicates the presence of fault conditions. Fault conditions are reported in the following ways:
� Warning Signal in the I/O Configuration Tree � Status and Fault Information in Module Properties Categories � Logix Designer Application Tag Editor
Warning Signal in the I/O Configuration Tree
As shown in Figure 1, a warning icon appears in the I/O Configuration tree when a fault occurs.
Figure 1 - Warning Icon in Controller Organizer

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

105

Appendix A Troubleshoot Your Module

Status and Fault Information in Module Properties Categories
The Module Properties section in the Logix Designer application includes a series of categories. The numbers and types of categories varies by module type.
Each category includes options to configure the module or monitor the status of the module. The following are ways to monitor the state of a module for faults:
� Module Status on General Category
� Module Fault Descriptions on Connection Category
� Module Fault Descriptions on Module Info Category
Module Status on General Category
As shown in Figure 2, the status of a module is indicated on the General category of the Modules Properties.
Figure 2 - Fault Message in Status Line

106

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Troubleshoot Your Module Appendix A
Module Fault Descriptions on Connection Category
As shown in Figure 3, a module fault description that includes an error code that is associated with the specific fault type is listed on the Connection category.
Figure 3 - Fault Description with Error Code
Module Fault Descriptions on Module Info Category
As shown in Figure 4, major and minor fault information is listed on the Module Info tab in the Status section.
Figure 4 - Major and Minor Fault Information

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

107

Appendix A Troubleshoot Your Module

Module and Point Diagnostics
You can use diagnostics in a Logix Designer application project to monitor module and/or point operating conditions and to troubleshoot issues that affect a module and/or point. Diagnostics when the project is online.
� Module Diagnostics � Point Diagnostics
Module Diagnostics
Module diagnostics provide information on a module-wide basis. For example, the Module Diagnostics dialog box indicates the mode within which a module is operating, that is, Run, Remote Run, Remote Program, or Program.
Module Diagnostics are accessible from the Module Info category on the Module Properties dialog box, as shown in Figure 5.
Figure 5 - Module Information Diagnostics

108

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Troubleshoot Your Module Appendix A
Point Diagnostics
Point diagnostics provide information on an individual point basis. For example, you can check individual points on a 1756-IB16S safety input module for the presence of a Short Circuit condition.
Remember the following: � Not all 1756 ControlLogix digital safety I/O modules provide point diagnostics. � The point diagnostics that are available vary by module type and functionality. � There are some differences between modules, but most commonly, the Module Properties dialog box category from which you can access point diagnostics is Points.
Figure 6 shows how to access output point diagnostics on the 1756-IB16S module and the diagnostics dialog box.
Figure 6 - Point Diagnostics

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

109

Appendix A Troubleshoot Your Module

Logix Designer Application Tag Editor
Figure 7 show how fault conditions are indicated in the controller tags.
Figure 7 - Fault Indication in Controller Tags

110

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Troubleshoot Your Module Appendix A

InternalFault Triggered on the Safety Output Module

Table 3 describes conditions that can trigger InternalFault.

Table 3 - Conditions That Trigger InternalFault

Conditions

Output Behavior

� Output Mode - BIpolar Faults � Point Operation Type -
Single � Point Mode - Safety � A load is connected
between a sourcing output point and a sinking output point. � O.Ptxx.Data tag = 0 � An overload resistor shorts the sourcing output point to 0V DC
� Output Mode - Bipolar Faults � Point Operation Type -
Single � Point Mode - Safety or
Safety Pulse Test � A load is connected
between a sourcing output point and a sinking output point. � O.Ptxx.Data tag = 0 � Either output point shorts to 0V DC
� Output Mode - Sourcing Faults � Point Operation Type -
Single � Point Mode - Safety or
Safety Pulse Test � O.Ptxx.Data tag = 1 � Output point shorts to
24V DC

Tag Value I.Ptxx.Fault tag = 1

Diagnostic Value InternalFault = 1

I/O Status Indicator State

I.Ptxx.Fault tag = 1 InternalFault = 1

The I/O status indicator for the faulted output point is steady red.

I.Ptxx.Fault tag = 1 InternalFault = 1

IMPORTANT: The tag value occurs on the faulted output point and all of its associated group points.

IMPORTANT: The diagnostic value occurs on the faulted output point and all of its associated group points.

When the conditions that trigger the diagnostics as described in Table 3 are corrected, the output faults are cleared, the tags and diagnostics reset to 0, and the I/O status indicators turn off.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

111

Appendix A Troubleshoot Your Module
Notes:

112

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Module Tag Definitions

B Appendix

Topic

Page

Access the Tags

114

Access the Tags

114

1756-IB16S Module Tags

115

1756-OBV8S Module Tags

117

Module tags are created when you add a module to the Studio 5000 Logix Designer� application project.
The set of tags that are associated with any module depends on the choices that you make in the Module Definition dialog box.
For the 1756-IB16S and 1756-OBV8S modules, there are Input and Output tags.

IMPORTANT The tables that are in this section list all tags available with a module. Not all tags in the list are used when that module type is added to a project. Tag use varies by module configuration.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

113

Appendix B Module Tag Definitions
Access the Tags

You can view tags from the Tag Editor.
1. Open your Logix Designer application project. 2. Right-click Controller Tags and choose Monitor Tags.

3. Open the tags as necessary to view specific tags.

Name Conventions

The module tags use defined naming conventions. The conventions are as follows: (example tag name = remote_ethernet_adapter_1:I.Pt00.Data).
An example module tag name is constructed as follows: � remote_ethernet_adapter = name of the EtherNet/IPTM adapter in the system � 1 = slot number � I = tag type
For the 1756-IB16S and 1756-OBV8S modules, the possible I/O tag types are I (input) and O (output). � Pt00 = module point number � Data = function
In this case, Data represents the input data that is returned to the ownercontroller.

114

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Module Tag Definitions Appendix B

1756-IB16S Module Tags This section describes the tags that are associated with the 1756-IB16S module.

Input Tags

Table 4 describes the 1756-IB16S module input tags.

Table 4 - 1756-IB16S Module Input Tags

Name RunMode ConnectionFaulted DiagnosticActive Uncertain
DiagnosticSequenceCount Ptxx.Data Ptxx.Fault
Ptxx.Uncertain

Data Type BOOL BOOL BOOL BOOL
SINT BOOL BOOL
BOOL

Definition

Valid Values

Available With These Input Data Type Choices

Module operating state

� 0 = Idle � 1 = Run

Safety Data Safety Packed Data

Indicates if a connection is running.
The module sets this tag to 0 when connected. If the module is not connected, it changes the tag to 1.

� 0 = Connection running � 1 = Connection not running

Safety Data Safety Packed Data

Indicates if any diagnostics are active or if the prognostics threshold is reached.

� 0 = No diagnostics active

Safety Data

� 1 = One or more diagnostics are active Safety Packed Data or the prognostics threshold is reached

Indicates that the channel data can be inaccurate but the degree of inaccuracy is not known.
For more information, see Module Data Quality Reporting on page 40.

� 0 = Good data
� 1 = Uncertain data
This tag is set to 1 when the module has reached a critical operating temperature or is higher the acceptable operating temperature.
IMPORTANT: Once the condition that causes the tag to change to 1 is removed, the tag automatically resets to 0.

Safety Packed Data

Increments for each time a distinct diagnostic condition is detected, and when a distinct diagnostic condition transitions from detected to not detected.
Set to zero by product reset or power cycle. Wraps from 255 (-1) to 1 skipping zero.

� 1...255
The value of 0 is skipped except during module power-up.

Safety Data Safety Packed Data

Indicates the current safety input value.

� 0 = Off � 1 = On

Safety Data Safety Packed Data

Indicates one of the following:
� The channel data is inaccurate and cannot be trusted for use in the application. For more information, see Module Data Quality Reporting on page 40.
� The channel is set to Not Used.

� 0 = Good data
� 1 = Bad data (faulted) or set to Not Used
If the tag is set to 1, you must troubleshoot the module to correct the cause of the inaccuracy.
IMPORTANT: Once the condition that causes the tag to change to 1 is removed, you must complete the steps described in Safety Input Fault Reset on page 50 to reset this tag to 0.
If the tag is 1 because the channel is set to Not Used, no action is required.

Safety Data

Indicates that the channel data can be inaccurate but the degree of inaccuracy is not known.
For more information, see Module Data Quality Reporting on page 40.

Safety Data

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

115

Appendix B Module Tag Definitions

Table 4 - 1756-IB16S Module Input Tags

Name Ptxx.ShortCircuit Ptxx.Status Ptxx.TestOutputStatus Testxx.Readback Testxx.Fault
Testxx.Uncertain
Testxx.ShortCircuit Testxx.FieldPowerOff Testxx.Status

Data Type BOOL BOOL BOOL BOOL BOOL
BOOL
BOOL BOOL BOOL

Definition

Valid Values

Available With These Input Data Type Choices

Indicates a short circuit.

� 0 = No short circuit � 1 = Short circuit

Safety Data

Indicates the status of the channel.

� 0 = Bad, causing a fault � 1 = Good

Safety Data Safety Packed Data

�

Safety Packed Data

Indicates that a 24V DC power source is present � 0 = 24V DC power is not present

at the test output.

� 1 = 24V DC power is present

Safety Data

� 0 = Good data � 1 = Bad data (faulted) or set to Not
Used
If the tag is set to 1, you must troubleshoot the module to correct the cause of the inaccuracy.
IMPORTANT: Once the condition that causes the tag to change to 1 is removed, you must complete the steps described in Safety Input Fault Reset on page 50 to reset this tag to 0.(1)
If the tag is 1 because the channel is set to Not Used, no action is required.

Safety Data

Indicates that the channel data can be inaccurate but the degree of inaccuracy is not known.
For more information, see Module Data Quality Reporting on page 40.

Safety Data

Indicates an output short circuit

� 0 = No short circuit � 1 = Short circuit

Safety Data

Indicates that a field power loss condition exists � 0 = No field power off condition

on the channel.

� 1 = Field power off condition

Safety Data

Indicates the channel status.

� 0 = Fault � 1 = Good

Safety Data

(1) If the Point Mode for the test output is Pulse Test or Power Supply when the Short Circuit condition is detected, the condition can be corrected but you cannot set the test output to a safe state.

Output Tags

Table 5 describes the 1756-IB16S module output tags.

Table 5 - 1756-IB16S Module Output Tags

Name Ptxx.ResetFault

Size

Definition

Valid Values

Available With These Output Data Type Choice

BOOL When 'Latch Fault until reset via output tag' mode is Rising edge: the fault status is released Safety Data Enabled, the I/O channel will hold safety input fault if the fault has been removed. indications until it checks that the fault is removed. If the fault is removed, it will clear only the fault status upon detecting that the ResetFault bit in its channel sees a rising edge.

116

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Module Tag Definitions Appendix B

1756-OBV8S Module Tags This section describes the tags that are associated with the 1756-OBV8S module.

Input Tags

Table 6 describes the 1756-OBV8S module input tags.

Table 6 - 1756-OBV8S Module Input Tags

Name RunMode ConnectionFaulted DiagnosticActive Uncertain
DiagnosticSequenceCount Ptxx.Readback Ptxx.Fault
Ptxx.Uncertain
Ptxx.ShortCircuit

Data Type Definition

BOOL

Module's operating state

BOOL

Indicates if a connection is running.

The module sets this tag to 0 when connected. If the module is not connected, the controller overwrites the tag to 1.

BOOL

Indicates if any diagnostics are active or if the

prognostics threshold is reached.

BOOL

Indicates that the channel data can be inaccurate

but the degree of inaccuracy is not known.

For more information, see Module Data Quality Reporting on page 40.

SINT

Increments for each time a distinct diagnostic

condition is detected, and when a distinct

diagnostic condition transitions from detected to

not detected.

Set to zero by product reset or power cycle. Wraps from 255 (-1) to 1 skipping zero.

BOOL

Indicates that a 24V DC power source is connected

to the output circuit

BOOL

Indicates one of the following:

� The channel data is inaccurate and cannot be trusted for use in the application.
For more information, see Module Data Quality Reporting on page 40.

� The channel is set to Not Used.

BOOL

Indicates that the channel data can be inaccurate

but the degree of inaccuracy is not known.

For more information, see Module Data Quality Reporting on page 40.

BOOL

Indicates a short circuit

Valid Values
� 0 = Idle � 1 = Run � 0 = Connection is working � 1 = Connection is not working

Available With These Input Data Type Choices
Safety Data Safety Packed Data
Safety Data Safety Packed Data

� 0 = No diagnostics active

Safety Data

� 1 = One or more diagnostics are active or Safety Packed Data the prognostics threshold is reached

Safety Packed Data

� 1...255

Safety Data Safety Packed Data

� 0 = 24V DC power is not present � 1 = 24V DC power is present

Safety Data Safety Packed Data

� 0 = Good data

Safety Data

� 1 = Bad data (faulted) or set to Not Used

If the tag is set to 1, you must troubleshoot the module to correct the cause of the inaccuracy.

IMPORTANT: Once the condition that causes the tag to change to 1 is removed, you must complete the steps described in Safety Output Fault Reset on page 63 to reset this tag to 0.(1)

If the tag is 1 because the channel is set to Not Used, no action is required.

Safety Data

� 0 = No short circuit � 1 = Short circuit

Safety Data

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

117

Appendix B Module Tag Definitions

Table 6 - 1756-OBV8S Module Input Tags

Name Ptxx.FieldPowerOff Ptxx.Status

Data Type Definition

Valid Values

BOOL

Indicates that a field power loss condition exists on � 0 = No field power off condition

the channel.

� 1 = Field power off condition

BOOL

Indicates the channel status.

� 0 = Bad, causing fault � 1 = Good

Available With These Input Data Type Choices Safety Data
Safety Data Safety Packed Data

Output Tags

Table 7 describes the 1756-OBV8S module output tags.

Table 7 - 1756-OBV8S Module Output Tags

Name

Size

Definition

Valid Values

Available With These Output Data Type Choices

Ptxx.Data

BOOL

Indicates the current output value.

� 0 = Off � 1 = On

Safety Data Safety Packed Data

Ptxx.ResetFault

BOOL

When 'Latch Fault until reset via output tag' mode is Rising edge: the fault status is released if Safety Data

Enabled, the I/O channel will hold safety input fault the fault has been removed.

indications until it checks that the fault is removed. If

the fault is removed, it will clear only the fault status

upon detecting that the ResetFault bit in its channel

sees a rising edge.

118

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

C Appendix
Application and Wiring Examples for Safety Modules

Before You Begin

Topic

Page

1756-IB16S Module Wiring Diagrams

120

1756-OBV8S Module Wiring Diagrams

123

This appendix provides example wiring diagrams for the 1756 ControlLogix� safety I/O modules that can be used in functional safety applications.
The wiring configuration affects the safety application level to which a 1756 ControlLogix I/O safety module is suitable.

IMPORTANT This section shows example wiring diagrams on the 1756-IB16S safety input module and the 1756-OBV8S safety output module.

Before you wire your module, remember that a SELV/PELV-rated 24V power supply is required to supply field-side power to 1756 ControlLogix I/O safety modules.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

119

Appendix C Application and Wiring Examples for Safety Modules

1756-IB16S Module Wiring Diagrams

You must connect a 24V DC SELV/PELV power source to the DC+/- terminals to provide field-side power.
IMPORTANT � The 24V (DC+ and DC-) power connections are used to supply field-side power to the module.
� All terminals with the same name are connected together on the module. For example, DC+ can be connected to either terminal marked DC +.
� Do not physically connect more than two wires to a single RTB terminal.

When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 2 and PLd as defined in ISO 13849-1.

To achieve that suitability rating, you may have to perform diagnostic testing of the safety function. One diagnostic test method is to configure the safety input channel for Safety Pulse Test to test the circuit for short circuits to 24V DC.

Channel Connections The diagram shows devices that are connected to safety input channel 0
and test output channel 0. You can connect devices to all 16 channels.

TO-0

IN-0

TO-1

IN-1

TO-2

IN-2

TO-3

IN-3

TO-4

IN-4

TO-5

IN-5

TO-6

IN-6

TO-7

IN-7

TO-0

IN-8

TO-1

IN-9

TO-2

IN-10

TO-3

IN-11

TO-4

IN-12

TO-5

IN-13

TO-6

IN-14

TO-7

IN-15

DC(-)

DC(+)

DC(-)

DC(+)

24V DC SELV/PELV-listed power supply

120

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Application and Wiring Examples for Safety Modules Appendix C
When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 3 and PLd as defined in ISO 13849-1.

IMPORTANT Switches are suitable for applications that are rated up to, and including SIL 3 CL3, PLe, Cat 3.
Channel Connections This diagram shows devices that are connected to safety input channels 0 and 1. You can connect devices to all 16 channels.

TO-0 TO-1 TO-2 TO-3 TO-4 TO-5 TO-6 TO-7 TO-0 TO-1 TO-2 TO-3 TO-4 TO-5 TO-6 TO-7 DC(-)
DC(-)

IN-0 IN-1
IN-2 IN-3 IN-4 IN-5 IN-6 IN-7 IN-8 IN-9
IN-10 IN-11 IN-12 IN-13 IN-14 IN-15 DC(+)
DC(+)

24V DC SELV/PELV-listed power supply

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

121

Appendix C Application and Wiring Examples for Safety Modules

Channel Connections This diagram shows devices that are connected to safety input channels O and 1; and to test outputs 0 and 1. You can connect devices to all 16 channels.

TO-0

IN-0

TO-1

IN-1

TO-2

IN-2

TO-3

IN-3

TO-4

IN-4

TO-5

IN-5

TO-6

IN-6

TO-7

IN-7

TO-0

IN-8

TO-1

IN-9

TO-2

IN-10

TO-3

IN-11

TO-4

IN-12

TO-5

IN-13

TO-6

IN-14

TO-7

IN-15

DC(-)

DC(+)

DC(-)

DC(+)

24V DC SELV/PELV-listed power supply

122

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

1756-OBV8S Module Wiring Diagrams

Application and Wiring Examples for Safety Modules Appendix C

You can use the 1756-OBV8S module in Bipolar mode or Sourcing mode.

IMPORTANT

� The 24V (DC+ and DC-) power connections are used to supply field-side power to the module.
� All terminals with the same name are connected together on the module. For example, DC+ can be connected to either terminal marked DC +.
� Do not physically connect more than two wires to one RTB terminal.

Bipolar Mode
When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 2 and PLd as defined in ISO 13849-1.
To achieve that suitability rating, you may have to perform diagnostic testing and monitoring of the safety function. One diagnostic test method is to configure the safety output channel for Safety Pulse Test to test the circuit for short circuits to 24V DC.

Channel Connections This wiring example shows connections to Safety Output 0. You are not limited to using channel 0 in this mode. You can use all channels as determined by your application.
We strongly recommend that, if you have a direct connection between the safety output module and an input module and those modules are powered by separate power supplies, you connect module DC- and actuator DC- together. This practice helps to eliminate grounding float from disrupting diagnostics.

OUT0-M OUT1-M OUT2-M OUT3-M OUT4-M OUT5-M OUT6-M OUT7-M
DC(+) DC(+)

OUT0-P OUT1-P OUT2-P OUT3-P OUT4-P OUT5-P OUT6-P OUT7-P DC(-) DC(-)

K M

+-
24V DC SELV/PELV-listed power
supply

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

123

Appendix C Application and Wiring Examples for Safety Modules

When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 4 and PLe as defined in ISO 13849-1.

For Cat.4 applications, if your application remains in safe state, that is, the output is off, for a prolonged duration, we recommend that you take one of these actions:
� Apply output monitoring at the actuator. The monitoring can be direct or indirect.
� Limit the safe state to no more than 24 hours.
� Conduct functional test if safe state dwell time increases.

Connection Pairs The terminals for each channel function as a Bipolar connection pair when you use a 1756-OBV8S module in Bipolar switching mode. For example, the Safety Output 0 P (Sourcing) terminal and Safety Output 0 M (Sinking) terminal are a Bipolar connection pair. That is, they are a P-M pair. When the module is in Bipolar switching mode, you must connect the device to both terminals.
Channel Connections This wiring example shows connections to the P-M pair for Safety Output 0. You are not limited to using channel 0 in this mode. You can use all channel pairs as determined by your application.
We strongly recommend that, if you have a direct connection between the safety output module and an input module and those modules are powered by separate power supplies, you connect the DC- terminals together. This practice helps to eliminate grounding float from disrupting diagnostics.

K K M

OUT0-M OUT1-M OUT2-M OUT3-M OUT4-M OUT5-M OUT6-M OUT7-M
DC(+) DC(+)

OUT0-P OUT1-P OUT2-P OUT3-P OUT4-P OUT5-P OUT6-P OUT7-P DC(-) DC(-)

+-
24V DC SELV/PELV-listed power
supply

124

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Application and Wiring Examples for Safety Modules Appendix C

When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 4 and PLe as defined in ISO 13849-1.

To achieve that suitability rating, you may have to perform diagnostic testing and monitoring of the safety function. One diagnostic test method is to configure the safety output channel for Safety Pulse Test to test the circuit for short circuits to 24V DC.
� We strongly recommend that you connect separate shielded cables to the P terminal and the M terminal to reduce possibility of a short between these terminals. If a short is detected across the P-M pair, the module outputs are turned off, but the actuator that is connected to the output pair remains on.
� No Load and Overload conditions are only detectable at the P terminal.

Actuator DC Power In this wiring configuration, you must connect the DC+ terminal to an SELV/PELV-listed power supply. The DC+ and DC- on the actuator must be connected to the same power supply as the DC+ and DC- on the module.
Connection Pairs The terminals for each channel function as a Bipolar connection pair when you use a 1756-OBV8S module in Bipolar switching mode. For example, the Safety Output 0 P (Sourcing) terminal and Safety Output 0 M (Sinking) terminal are a Bipolar connection pair. That is, they are a P-M pair. When the module is in Bipolar switching mode, you must connect the device to both terminals.
Channel Connections This wiring example shows connections to the P-M pair for Safety Output 0. You are not limited to using channel 0 in this mode. You can use all channel pairs as determined by your application.
We strongly recommend that, if you have a direct connection between the safety output module and an input module and those modules are powered by separate power supplies, you connect the DCterminals together. This practice helps to eliminate grounding float from disrupting diagnostics.

DC +

DC �

OUT0-M OUT1-M OUT2-M OUT3-M OUT4-M OUT5-M OUT6-M OUT7-M
DC(+) DC(+)

OUT0-P OUT1-P OUT2-P OUT3-P OUT4-P OUT5-P OUT6-P OUT7-P DC(-) DC(-)

+-
24V DC SELV/PELV-listed power
supply

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

125

Appendix C Application and Wiring Examples for Safety Modules

Sourcing Mode
When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 2 and PLd as defined in ISO 13849-1.
To achieve that suitability rating, you may have to perform diagnostic testing and monitoring of the safety function. One diagnostic test method is to configure the safety output channel for Safety Pulse Test to test the circuit for short circuits to 24V DC.

OUT0-M OUT1-M OUT2-M OUT3-M OUT4-M OUT5-M OUT6-M OUT7-M
DC(+) DC(+)

OUT0-P OUT1-P OUT2-P OUT3-P OUT4-P OUT5-P OUT6-P OUT7-P DC(-) DC(-)

K M
DC �

+-
24V DC SELV/PELV-listed power
supply

126

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Application and Wiring Examples for Safety Modules Appendix C

When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 4 and PLe as defined in ISO 13849-1.
To achieve that suitability rating, you may have to perform diagnostic testing and monitoring of the safety function. One diagnostic test method is to configure the safety output channel for Safety Pulse Test to test the circuit for short circuits to 24V DC.
For Cat.4 applications, if your application remains in safe state, that is, the output is off, for a prolonged duration, we recommend that you take one of these actions:
� Apply output monitoring at the actuator. The monitoring can be direct or indirect.
� Limit the safe state to no more than 24 hours. � Conduct functional test if safe state dwell time increases.

Connection Pairs When you use dual-channel sourcing wiring on the 1756-OBV8S module, you must connect the devices to dual-channel connection pairs. For example, the devices are connected to channels 4 and 5 because they are a connection pair. These channels are dual-channel connection pairs: � Channels 0 and 1 (shown) � Channels 2 and 3 � Channels 4 and 5 � Channels 6 and 7
Channel Connections This wiring example shows connections to Safety Output 0 P and Safety Output 1P. You are not limited to using channels 0 and 1 in this mode. You can use all channel pairs as determined by your application.
We strongly recommend that, if you have a direct connection between the safety output module and an input module and those modules are powered by separate power supplies, you connect module DC- and actuator DC- together. This practice helps to eliminate grounding float from disrupting diagnostics.

OUT0-M OUT1-M OUT2-M OUT3-M OUT4-M OUT5-M OUT6-M OUT7-M
DC(+) DC(+)

OUT0-P OUT1-P OUT2-P OUT3-P OUT4-P OUT5-P OUT6-P OUT7-P DC(-) DC(-)

K K M
DC �

+-
24V DC
SELV/PELV-listed power supply

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

127

Appendix C Application and Wiring Examples for Safety Modules
Notes:

128

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

D Appendix
Safety Data for Safety Modules
This appendix lists calculated values for probability of a dangerous failure on demand (PFD), average frequency of a dangerous failure per hour (PFH), and mean time to failure (MTTF). PFD and PFH calculations comply with IEC61508, edition 2, 2010.
� For the 1756-IB16S, calculated values of PFD and PFH appear in Table 8 on page 130
� For the 1756-OBV8S, calculated values of PFD and PFH appear in Table 9 on page 131 .
PFD and PFH must be calculated for the devices within the system to comply with the SIL level that is required for application.
You are responsible for following the requirements of ISO 13849-1:2008, to assess Performance Levels in your safety system.
You must functionally test every I/O module by individually toggling each input point and also verify that the controller detects it within the safety reaction time (SRT). Additionally, you must individually toggle each output point by the controller and user-verified that the output point changes state.
For more information, see the GuardLogix� 5580 and CompactGuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

129

Appendix D Safety Data for Safety Modules

1756-IB16S Safety Data

Table 8 lists the safety data for the 1756-IB16S module.

Table 8 - 1756-IB16S Module Safety Parameter Data

Point Operation Type

Attribute

Single Channel

Dual Channel
(at controller instruction level)

Safety Function Architecture (HFT)

Safe Failure Rate (s) [failures/hr] Safe Detected Failure Rate (SD)(1) Safe Undetected Failure Rate (SU)(1)
Dangerous Failure Rate (D) [failures/hr] Dangerous Detected Failure Rate (DD) [failures/hr] Dangerous Undetected Failure Rate (DU) [failures/hr] SRT [millisecond]

7.9621E-07

8.6252E-07

7.95153E-07

8.61767E-07

1.05746E-09

7.52962E-10

4.49496E-07

5.34022E-07

4.48899E-07

5.33556E-07

3.80996E-10

4.6619E-10

Automatic Diagnostic Test Interval (TD) [hr]

Useful Life [yr]

Systematic Capability (SC)

Safe Failure Fraction (SFF) [%]

99.97%

PFH

3.80996E-10

4.6619E-10

PFDAVE Mission TimeTM

10 yrs

1.66876E-05

2.04191E-05

20 yrs

3.33753E-05

4.08383E-05

Diagnostic Coverage Average (DCAVE) Spurious Trip Rate (STR)

99.87% 5.90E-06

99.91% --

MTTF [years]

91.64

81.74

MTTFD [years]

253.96

213.76

(1) (SD) and (SU) are calculated with assumption of Diagnostic Coverage of Safe Failure is same as Diagnostic Coverage of Dangerous Failure

130

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Safety Data for Safety Modules Appendix D
1756-OBV8S Safety Data Table 9 lists the safety data for the 1756-OBV8S module.

Table 9 - 1756-OBV8S Module Safety Data

Output Mode

Sourcing

Point Operation Type

Attribute

Single

Dual

Safety Function Architecture (HFT)

1.16E-06 1.16E-06 4.23E-10 9.01E-07 9.01E-07 3.29E-10

9.3E-07 9.3E-07 5E-10 5.9E-07 5.9E-07 3.1E-10
4.5

Automatic Diagnostic Test Interval (TD) [hr]

Useful Life [yr]

Systematic Capability (SC)

Safe Failure Fraction (SFF) [%]

99.98%

PFH

3.29E-10

3.1E-10

PFDAVE Mission TimeTM

10 yrs

1.44E-05

1.4E-05

20 yrs

2.89E-05

2.8E-05

Diagnostic Coverage Average (DCAVE) Spurious Trip Rate (STR)

99.96% 3.99E-06

99.95% 2.68E-06

MTTF [years]

55.50

75.09

MTTFD [years]

126.69

194.80

(1) (SD) and (SU) are calculated with assumption of Diagnostic Coverage of Safe Failure is same as Diagnostic Coverage of Dangerous Failure

Bipolar Point Operation Type
Single 1
9.5E-07 9.5E-07 4.9E-10 6.1E-07 6.1E-07 3.1E-10
99.98% 3.1E-10 1.4E-05 2.8E-05 99.95% 2.79E-06 72.91 186.19

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

131

Appendix D Safety Data for Safety Modules
Notes:

132

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Index

C
configuration reset safety modules to out-of-box configuration 93
configure with Logix Designer application 39
connection 7 connection category
1756-IB16S and 1756-OBV8S modules 85 connection types 28 controller organizer
monitor tags 92 view module tags 92
D
data transmission multicast method 28
data types available with I/O modules 28
E
EDS See electronic data sheet
electronic data sheet 7
F
firmware obtain from PCDC 44
G
general category 1756-IB16S and 1756-OBV8S modules 83
I
I/O status indicators safety input modules 104
input points category 1756-IB16S module 88
K
keying
mechanical 21, 22
L
load current digital output module 67
local I/O modules 23, 31, 33 locking tab 21, 22
Logix 5000 controllers ownership of I/O modules 24

Logix Designer application 39 configuration overview 26 connection types 28 module definition safety modules 84 module tag definition 113 name module tags 114
replace a safety module 93 - 102
reset safety modules to out-of-box configuration 93
safety modules configuration 77 - 102
safety network number 83 tag editor 114 view module tags 92
M
masters 7 mechanical
keying 21, 22
module definition dialog box safety modules 84
module info category 1756-IB16S and 1756-OBV8S modules 87
module location local I/O modules 23 remote I/O modules 24
module tags definition 113 naming 114 tag editor 114 view 92
multicast data broadcast method 31
N
no load detection minimum time 67
O
ODVA 7 out-of-box 96 ownership 24
P
PCDC obtain firmware 44
PFD 7 See probability of failure on demand.
PFH 7 See probability of failure per hour.
probability of failure on demand 7 per hour 7
proof test 8

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

133

Index
R
remote I/O modules 24, 32, 33
removable terminal block 10
replace a safety module 93 - 102
reset safety modules to out-of-box configuration 93
RPI valid value 30
RTB. See removable terminal block
S
safety category 1756-IB16S and 1756-OBV8S modules 86
safety network number 8, 83
short circuit protection digital output modules 68 safety input modules 56
slaves 7 SNN 8
See safety network number.
status indicators 21, 22
safety input modules I/O status indicators 104
T
test output points category 1756-IB16S module 89
thermal switch digital output modules 70
troubleshooting connection category 107 general category 106 module Info category 107
module status indicators 21, 22
safety input modules I/O status indicators 104
tag editor 110
V
voltage range digital I/O module 10
W
wiring connections removable terminal block 10

134

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

.
Rockwell Automation Support

Use the following resources to access support information.

Technical Support Center
Local Technical Support Phone Numbers Direct Dial Codes
Literature Library
Product Compatibility and Download Center (PCDC)

Knowledgebase Articles, How-to Videos, FAQs, Chat, https://rockwellautomation.custhelp.com/ User Forums, and Product Notification Updates.

Locate the phone number for your country.

http://www.rockwellautomation.com/global/support/get-supportnow.page

Find the Direct Dial Code for your product. Use the http://www.rockwellautomation.com/global/support/direct-dial.page code to route your call directly to a technical support engineer.

Installation Instructions, Manuals, Brochures, and http://www.rockwellautomation.com/global/literature-library/

Technical Data.

overview.page

Get help determining how products interact, check http://www.rockwellautomation.com/global/support/pcdc.page features and capabilities, and find associated firmware.

Documentation Feedback
Your comments will help us serve your documentation needs better. If you have any suggestions on how to improve this document, complete the How Are We Doing? form at https://literature.rockwellautomation.com/idc/groups/literature/documents/du/ra-du002_-en-e.pdf

Rockwell Automation maintains current product environmental information on its website at http://www.rockwellautomation.com/rockwellautomation/about-us/sustainability-ethics/product-environmental-compliance.page.
Allen-Bradley, Compact 5000, ControlLogix, GuardLogix, Kinetix, Logix 5000, PanelView, PowerFlex, RSNetWorx, Rockwell Automation, Rockwell Software, Safety Automation Builder, Stratix, and Studio 5000 Logix Designer are trademarks of Rockwell Automation, Inc. CIP, CIP Safety, ControlNet, DeviceNet, and EtherNet/IP are trademarks of ODVA, Inc. Trademarks not belonging to Rockwell Automation are property of their respective companies.
Rockwell Otomasyon Ticaret A.., Kar Plaza Merkezi E Blok Kat:6 34752 �erenk�y, stanbul, Tel: +90 (216) 5698400

Publication 1756-UM013B-EN-P - October 2019
Supersedes Publication 1756-UM013A-EN-P - June 2019