The Emergency Stop Mode Framework
In most installations, the safety system powers up with the Emergency Stop response in effect and remains in that condition until it is reset. In rare cases, the safety system may power up in another validated condition. In either case, the PLC must continuously monitor the safety-system status and place the program in E-Stop Mode whenever the Emergency Stop response is in effect. Using PLC Pro Methods, the PLC Pro will:
Define When the PLC Enters E-Stop Mode
As the PLC powers up, it must determine whether the safety system is enforcing the Emergency Stop response. The PLC enters E-Stop Mode whenever that response is in effect. In the uncommon case where the safety system powers up without the Emergency Stop response in effect, the PLC must reflect the actual safety-system status.
When loss of an essential resource or required condition creates a hazard requiring the Emergency Stop response, that condition must be detected by the safety-related control system. The PLC enters E-Stop Mode when it detects that the safety system has invoked that response.
A person may invoke the Emergency Stop response through an Emergency Stop pushbutton, pull cord, or other Emergency Stop device. When the PLC detects that the safety system has invoked that response, it enters E-Stop Mode.
Define the Programmatic E-Stop Mode Response
When the PLC enters E-Stop Mode, the programmatic response must be defined and predictable. It must recognize the Emergency Stop response already being executed by the safety system and coordinate the ordinary control logic with the resulting safe condition of the installation.
The programmatic response must not assume that the Emergency Stop response immediately de-energizes every output. Depending on the risk assessment and safety-system design, selected functions may remain active to complete a controlled stop, apply a brake in a coordinated manner, maintain a holding function, or move equipment to a safer position. E-Stop Mode must recognize and coordinate with that behavior rather than interfere with it.
When the PLC enters E-Stop Mode, operator commands for machine operation are ignored. The programmatic response must cancel or inhibit ordinary control commands, suspend automatic operation, and coordinate the control logic with the Emergency Stop response being executed by the safety system and controls hardware.
HMI must clearly indicate when the PLC is in E-Stop Mode. When diagnostic information from the safety system identifies the condition that invoked the Emergency Stop response, HMI should display that information so the operator understands what must be corrected before the safety system can be reset and recovery can proceed.
Coordinate and Verify the Complete Installation Response
The Emergency Stop response and the programmatic E-Stop Mode response must be coordinated across the installation design. Mechanical, electrical, controls, and safety-system decisions must establish the required installation response. The ordinary control program must detect when that response is in effect, enter E-Stop Mode, and execute the corresponding programmatic response.
The PLC Pro should participate in the risk assessment and design of the Emergency Stop response. She or he contributes an understanding of how the installation operates, how its actions are sequenced, and what loads, products, or stored energy may be present when the response is invoked. This may reveal interactions or unacceptable behavior that are not apparent from the individual mechanical, electrical, controls, or safety-system designs alone.
During commissioning, the PLC Pro must observe and verify the completed installation’s actual Emergency Stop response. If she or he identifies a safety risk or other unacceptable installation or process condition, it must be brought to the attention of the mechanical designer, controls designer, or both for resolution before the installation is placed into service.
A safety PLC may execute part or all of the Emergency Stop response through validated safety-related application software. Those programmed actions are part of the safety system, not the ordinary E-Stop Mode response. The standard, non-safety-related user program separately enters E-Stop Mode when it detects that the safety-system response is in effect.
Define Recovery After Safety-System Reset
Clearing the condition that invoked the Emergency Stop response does not reset the safety system. Releasing an Emergency Stop device or restoring a required safety-system condition only removes the demand for that response. The safety system must then be reset according to its design.
The PLC remains in E-Stop Mode until it detects that the safety system has been reset.
Using PLC Pro Methods, when the PLC detects that the safety system has been reset, it leaves E-Stop Mode and places the installation in Manual Mode. The recovery process may restore supporting services or initiate ancillary functions, but it must not initiate machine motion or automatic cycling.