How-To Guide  ·  Allen-Bradley Compact 5000 Safety  ·  E-Stop Safety Circuit Design

E-Stop Safety Circuit: Compact GuardLogix 5380 + 5069-IB8S Wiring & Configuration Guide

Part Number: 5069-IB8S  ·  Compact GuardLogix 5380 · 5069-IB8S Safety Input · 5069-OBV8S Safety Output · Studio 5000

1. Introduction to Safety Systems

Functional safety is the part of overall equipment safety that depends on automatic protection systems operating correctly in response to hazardous conditions. In industrial automation, this means sensors detect a hazard, a safety controller processes the logic, and actuators remove the hazard, typically by removing power from dangerous motion or energy sources.

The Rockwell ratings quoted in this guide are expressed against these standards:

The Compact 5000 safety I/O modules are designed for applications where the off state is the safe state: safety outputs OFF, and safety input data to the controller OFF (5069-UM004, p.38; 1756-RM012, p.31). Safety I/O devices run self-diagnostics at power-up and periodically during operation; if a diagnostic failure is detected, safety input data to the controller and the local safety outputs are set to the safe state, OFF (1756-RM012, p.31).

An E-Stop circuit is one of the most common safety functions. When an operator presses the E-Stop button, the safety system must de-energize the hazardous motion within a known time, and it must detect faults in its own wiring and go to the safe state when it finds one.

2. SIL, Performance Level, and Category Ratings

Safety system reliability is expressed through two parallel frameworks. The IEC 61508 / IEC 62061 path uses Safety Integrity Levels (SIL), while the ISO 13849-1 path uses Performance Levels (PL) and Categories. In Rockwell documentation, "SIL 2" represents SIL 2, SIL CL 2 and PLd, and "SIL 3" represents SIL 3, SIL CL 3 and PLe (1756-RM012, p.8).

Controller Ratings

Sources: 1756-RM012, p.8 (ratings) and p.12 (1oo1 / 1oo2); 5069-UM001, p.47 (catalog-number suffixes, internal safety partner, 1oo2).

Safety I/O Module Ratings

The 5069-IB8S and 5069-OBV8S are rated SIL CL 3, PLe, Cat. 4 (5069-TD001, pp.38 and 42). Whether a module actually sits in a PLe, Cat. 4 function is decided by the overall architecture: it must be a dual-channel system (5069-UM004, pp.72 and 79). For a function to be SIL 3, the entire chain of devices and programming from sensor to actuator must be SIL 3; do not use a SIL 2 input signal for a function that requires SIL 3 (1756-RM012, p.10).

3. System Hardware Overview

This bill of materials covers a single E-Stop station with a dual-channel input and two contactors on the output:

4. How a Dual-Channel E-Stop Circuit Works

A dual-channel circuit uses two separate normally closed contacts on the E-Stop button, each wired to its own safety input on the 5069-IB8S. On this platform the two inputs are not paired in the module. The 5069-IB8S has no point operation type; all of its inputs are treated as single channels (1756-RM012, p.34), and you cannot configure dual-channel mode in the Module Properties. Dual-channel operation is set up with a safety instruction in the safety task (5069-UM004, p.72). Rockwell recommends single-channel mode for inputs that feed a dual-channel instruction such as the Dual Channel Input - Stop (DCS) instruction (5069-UM004, p.36).

1. Both channels ON (contacts closed): the E-Stop is not pressed and both safety inputs read 1.
2. Both channels OFF (contacts open): the E-Stop is pressed, both inputs read 0, and the safety logic turns the safety outputs off.
3. Channels disagree: the DCS instruction evaluates the two channels; dual-channel instruction diagnostics give fault codes that identify channel-specific discrepancy (1756-RM012, p.34).
4. Wiring fault on a channel: with Safety Pulse Test, the module detects short circuits between an input and 24V and between input signal lines; on an error, Safety Input Data and Safety Input Status for that channel turn off (5069-UM004, pp.73-74).

Choosing the two inputs: you can connect devices to any channel or combination of channels (5069-TD001, p.35). Use one even and one odd input with the safety instruction (5069-UM004, p.36), for example Safety IN 0 and Safety IN 1, and feed each from a different test output (5069-UM004, p.73).

Test Outputs (Safety Pulse Test) Explained

The 5069-IB8S has four test outputs: Test OUT 0, Test OUT 1, Test/Muting OUT 2 and Test/Muting OUT 3 (5069-UM004, p.72; 5069-TD001, p.38 lists 2 test output channels and 2 test output/muting output channels). Each test output is brought out to two RTB terminals (5069-TD001, p.37). Test outputs are rated 300 mA per channel in horizontal mounting, 200 mA in other orientations (5069-TD001, p.38).

When an input is configured for Safety Pulse Test, the external contact is wired between a test output and the input. While the contact is closed, the test output sends a pulse through the field wiring and input circuit, so short circuits between the input and 24V power, and between input signal lines, can be detected (5069-UM004, p.73). The test pulse width is < 700 µs and the test pulse period is < 100 ms (5069-UM004, p.73; 5069-TD001, p.38).

Two rules come from the manuals: safety input pairs must be associated with different test output sources (5069-UM004, p.73), and Rockwell recommends wiring even-numbered inputs to even-numbered test outputs and odd-numbered inputs to odd-numbered test outputs to maximize diagnostic independence (5069-TD001, p.38). Studio 5000 also limits how many pulse-tested inputs one test source can serve; for example, Test Source 0 can be mapped to a maximum of two Safety Pulse tests (5069-UM004, p.106).

5. Wiring the E-Stop to the 5069-IB8S

This section wires a dual-channel E-Stop to Safety IN 0 and Safety IN 1 on the 5069-IB8S, with both inputs set to Safety Pulse Test. This is the Category 4 connection method for an emergency stop button (5069-UM004, p.135). Wire the module as shown in 5069-TD001 (5069-UM004, p.37), and follow the terminal markings on the module and RTB.

Dual-Channel Wiring Table (Safety IN 0 + IN 1, Safety Pulse Test)

Terminal numbers from the 5069-IB8S wiring diagram, 5069-TD001, p.37. Pairing rules: 5069-UM004, p.73; 5069-TD001, p.38.

The module takes its field power from the SA power bus; it uses DC SA power, supplied through the SA power RTB on the Compact GuardLogix 5380 controller, a 5069-AENTR or 5069-AEN2TR adapter, or a 5069-FPD field potential distributor (5069-TD001, pp.35 and 37). When a Compact 5000 safety module is on an SA power bus, only a 24V DC SELV/PELV-rated supply may provide SA power to that bus (5069-IN020, p.6). The COM terminals are used as the return when a test output is configured to power a device or a muting lamp (5069-TD001, p.37).

Terminal Map: 5069-IB8S RTB

Source: 5069-TD001, p.37 (wiring diagram with RTB terminal numbers); same terminal order in 5069-UM004, p.113.

Wiring Practices

1. Feed the contacts from the test outputs. In the Category 4 method the E-Stop contacts sit between the safety inputs and the test outputs (5069-UM004, p.135). Connecting the contacts to an external 24V supply instead is the Category 3 method (5069-UM004, p.135).
2. Use a different test output for each channel. Safety input pairs must be associated with different test output sources (5069-UM004, p.73). Note that terminals 8 and 9 are both Test OUT 0, so do not use terminals 8 and 9 for the two channels.
3. Wire size and type. 0.5–1.5 mm² (22–16 AWG) solid or stranded shielded copper wire rated 105 °C (221 °F) or greater, one wire per terminal (5069-TD001, p.35). Do not wire more than 2 conductors on any terminal (5069-IN020, p.4).
4. Stripping and torque. Strip 10 mm (0.39 in.) for the spring RTB and 12 mm (0.47 in.) for the screw RTB; torque screw terminals to 0.4 N•m (3.5 lb•in). On the spring RTB, crimp a ferrule on a wire that is too thin (5069-IN020, p.8).
5. Power off first. The RTB and the module do not support removal and insertion under power (5069-IN020, p.7). Confirm MOD power and all SA power are off before you wire (5069-IN020, p.8).

Using the Remaining Inputs

The IB8S has eight safety inputs and four test outputs, and each test source can serve at most two Safety Pulse tests (5069-UM004, pp.72 and 106). Plan the test-source assignment for every pulse-tested input before you wire, keeping each dual-channel pair on two different test outputs (5069-UM004, p.73). Test/Muting OUT 2 and 3 can be used as pulse-test sources when their Point Mode is Pulse Test rather than Muting Lamp (5069-UM004, p.57). The example in this guide also uses spare inputs for the reset button and the contactor feedback (Sections 6 and 8).

6. Wiring the Safety Contactors to the 5069-OBV8S

The 5069-OBV8S has eight safety outputs that are used either as sourcing/sinking pairs in Bipolar Output Mode or as sourcing outputs in Sourcing Output Mode (5069-UM004, p.79). Each channel has a P (sourcing) and an N (sinking) terminal (5069-TD001, p.39). Dual-channel mode, where two output channels act as a connection pair, is only available with Output Mode = Sourcing; the pairs are 0 and 1, 2 and 3, 4 and 5, 6 and 7 (5069-UM004, p.82). Bipolar outputs have no point operation type and operate as a sinking/sourcing pair on one channel (1756-RM012, p.35).

Dual-Channel Sourcing Wiring (Outputs 0 + 1)

Source: 5069-TD001, p.41, "Dual Channel with Actuator" (suitable up to Category 4 with diagnostic testing, for example Safety Pulse Test). Terminal numbers from the RTB in the same diagrams, 5069-TD001, pp.39 and 41.

The motor power runs through the contacts of both K1 and K2 in series, as drawn in the Rockwell diagram (5069-TD001, p.41), so either contactor opening removes power from the motor.

Bipolar alternative: in Bipolar Output Mode, the documented "Single Channel with Actuator" example connects K1 and K2 between Safety OUT 0 P and Safety OUT 0 N; in Bipolar mode you must connect the device to both terminals of the pair (5069-TD001, p.39). That arrangement is also listed as suitable up to Category 4 with diagnostic testing, and requires configuring the application so that a No Load fault is detected only if both the P and N wires are disconnected (5069-TD001, p.39). This guide uses the dual-channel sourcing arrangement above.

Output Monitoring (Contactor Feedback)

For Category 4 applications where the output stays off for a prolonged time, Rockwell recommends one of these: apply output monitoring at the actuator (direct or indirect), limit the safe state to no more than 24 hours, or conduct a functional test if the safe-state dwell time increases (5069-TD001, pp.39 and 41). Monitoring at the actuator is done with the Configurable Redundant Output (CROUT) safety instruction, which controls and monitors redundant outputs and takes two feedback signals (1756-RM012, pp.82 and 88).

1. Wire a feedback contact from K1 to a spare 5069-IB8S safety input, for example Safety IN 4, fed from Test/Muting OUT 2 (terminal 12) with Point Mode = Safety Pulse Test.
2. Wire a feedback contact from K2 to Safety IN 5, fed from Test/Muting OUT 3 (terminal 14). Even input to even test output and odd to odd (5069-TD001, p.38).
3. In the safety logic, use IN 4 and IN 5 as CROUT Feedback 1 and Feedback 2 (Section 8). Use feedback contacts that the contactor manufacturer specifies for monitoring. With normally closed feedback contacts, as in Rockwell's CROUT example, set the CROUT Feedback Type to Negative; with normally open contacts, set it to Positive (1756-RM095, pp.22 and 29-30).

7. Studio 5000 Safety Project Configuration

Use Studio 5000 Logix Designer version 32 or greater with the Compact 5000 safety I/O modules (5069-UM004, p.99). By default, all safety input and output channels are disabled, so you must configure every point you use (5069-UM004, p.103).

Create the Safety Project

1. Create a project for the Compact GuardLogix 5380 controller, for example 5069-L306ERS2 (SIL 2) or 5069-L306ERMS3 (SIL 3).
2. The safety task. A safety application includes a safety task with a safety program and main routine. There can be only one safety task per controller, it cannot be deleted, and only ladder diagram is supported in it (1756-RM012, pp.47-48).
3. Set the safety task period, priority and watchdog (right-click the safety task → Properties → Configuration). Period: 2–500 ms; watchdog: 2–500 ms; a priority of 1 is recommended (1756-RM012, pp.48-49 and 108). The watchdog must be less than or equal to the period (1756-RM012, p.103). The period cannot be edited online (1756-RM012, p.48).

Add the 5069-IB8S Safety Input Module

1. Go offline. Compact 5000 safety I/O modules cannot be added while the project is online (5069-UM004, p.100).
2. Right-click the 5069 Backplane → New Module, select 5069-IB8S, and assign the slot number on the General page (5069-UM004, pp.100 and 103).
3. Module Definition (General page → Change): Configured By = This Controller; Input Data = Safety data; Muting Lamp Points = None (5069-UM004, p.105).
4. Input Points page: enable Safety IN 0 and Safety IN 1 with Point Mode = Safety Pulse Test, and assign each a different test source (Test Output 0 for IN 0, Test Output 1 for IN 1) (5069-UM004, pp.73 and 106). Leave the channels in single-channel operation; there is no dual-channel setting on this page (5069-UM004, p.72; 1756-RM012, p.34). Configure IN 2, IN 4 and IN 5 the same way for the reset button and contactor feedback.
5. Input delay: Off to On and On to Off delays are 0–50 ms, default 0 ms (5069-UM004, pp.49 and 75). Any delay adds to reaction time (1756-RM012, p.32).
6. Test Output Points page: set the test outputs you use to Point Mode = Pulse Test (5069-UM004, pp.57 and 106; 5069-TD001, p.38).
7. Transition Time Limit: the IB8S checks its two internal signals for each input; the user-configurable limit is 2–500 ms on firmware revision 2.011 or later (fixed 2 ms on revision 1.011), and the Add-On Profile version 2.01 is needed to see the setting (5069-UM004, p.77). This is an internal per-channel check. The channel-to-channel comparison of the two E-Stop contacts is done by the DCS instruction.
8. Safety page: set the RPI here (not on the Connection page); the Advanced button sets the Connection Reaction Time Limit (5069-UM004, pp.103-104).

Add the 5069-OBV8S Safety Output Module

1. Right-click the 5069 Backplane → New Module and select 5069-OBV8S (5069-UM004, p.100).
2. Module Definition: Configured By = This Controller; Output Mode = Sourcing for the dual-channel wiring in Section 6 (5069-UM004, p.105).
3. Points page: configure outputs 0 and 1 with Point Operation Type = Dual and Point Mode = Safety Pulse Test (5069-UM004, pp.63 and 79; 1756-RM012, p.35). Short Circuit Detection is required in functional safety applications (5069-UM004, p.63). No Load Detection is enabled by default (5069-UM004, p.62).
4. RPI: the safety task period determines the RPI for the 5069-OBV8S (5069-UM004, p.104).

Safety Network Number (SNN)

The SNN uniquely identifies CIP Safety subnets within a routable safety network, and the combination of SNN plus node address identifies each CIP Safety port on each device. A Compact GuardLogix 5380 controller has as many as three SNNs: one for each Ethernet port and one for the backplane. Each CIP Safety network must have a unique SNN (5069-UM001, pp.47-48).

Local Compact 5000 safety I/O modules are automatically assigned the same SNN as the 5069 Backplane SNN in the controller configuration (5069-UM004, p.103). Manual SNN assignment is required when a controller port joins a CIP Safety subnet that already has an established SNN, or when a safety project is copied to another installation within the same routable CIP Safety system (5069-UM001, p.48).

Module Tags Used in This Example

Source: 5069-UM004, pp.130-131 (safety I/O module tags) and p.105 (OBV8S input data). In this example the 5069-IB8S is in slot 1 and the 5069-OBV8S in slot 2; replace the slot numbers with yours.

8. Safety Logic

All safety logic runs in the safety task, and only safety application instructions can be used in the safety task for SIL 2 or SIL 3 applications (1756-RM012, p.88). Safety tags can be read or written by safety logic; standard logic can read controller-scoped safety tags directly, and external devices such as HMIs cannot write safety tags (5069-UM001, p.50).

The E-Stop function uses two safety instructions from the Compact GuardLogix 5380 instruction set (1756-RM012, p.88):

Example Routine Structure

The dual-channel safety instructions have built-in safety I/O status monitoring: the DCS has input status for channels A and B, and the CROUT has input status for Feedbacks 1 and 2 and output status for the output channels driven by its O1 and O2 outputs. These status tags must be 1 for the instruction outputs (O1 for input instructions, O1/O2 for CROUT) to energize, and Rockwell states it is important to drive them before (above) the safety instruction (1756-RM012, p.82). The routine therefore builds the status bits first:

DCS and CROUT are ladder-only instructions; neither is available in function block or structured text (1756-RM095, pp.21-22 and 81). Rungs 5 and 6 follow the CROUT programming example, where the instruction's O1 and O2 members each drive one safety output point (1756-RM095, p.30). Use a separate backing tag for each instruction, and never write to an instruction output tag or a backing tag member; Rockwell warns this can cause unexpected operation, including a major nonrecoverable fault (1756-RM095, pp.22 and 81).

DCS Operands

CROUT Operands

9. Safety Signature and Validation

The safety signature verifies the integrity of a safety application. It applies to the entire safety portion of the controller project and consists of a unique 64-character alphanumeric ID plus a time stamp. Creating, recording and verifying it is a mandatory part of the safety-application development process, and it must be present for the controller to operate as a SIL 2/PLd or SIL 3/PLe safety controller; operation without it is only suitable during development (1756-RM012, pp.9 and 16; 5069-UM001, p.49). Nothing in the standard application is included in the safety signature (1756-RM012, p.16).

The signature is a hierarchy of safety signature elements (safety task, programs, routines and so on), each with its own ID and time stamp. The elements help impact analysis by identifying which parts changed; the Safety Signature report lists them (1756-RM012, p.16).

Generating the Safety Signature

1. Check the prerequisites: programming tests complete but verification testing not begun; software online with the controller; controller safety-unlocked; no safety forces or pending online safety edits; safety task status OK. With firmware revision 37 or earlier the controller must be in Program/Remote Program mode; with revision 38 or later it can be in Remote Run, Program/Remote Program, or Remote Test (1756-RM012, pp.67-68).
2. Generate it from the Safety tab of the Controller Properties (click Generate), from Tools → Safety → Generate Signature, or from the Safety Status menu (1756-RM012, p.68).
3. Record it. Manually record the safety signature after initial creation, and check it after every download to confirm it matches (1756-RM012, p.68). Click the ellipsis next to the ID to view and copy all 64 characters (1756-RM012, p.68).
4. Safety-lock the controller (recommended). Safety-locking helps protect safety components from modification and the signature from accidental deletion, but it is not a SIL 2 or SIL 3 requirement and does not by itself satisfy them (1756-RM012, p.71). Safety-lock and unlock are on the Safety tab of the Controller Properties or Tools → Safety → Safety Lock/Unlock (1756-RM012, p.71).

10. System Reaction Time

The system reaction time is the worst-case time from a safety-related event, input to the system or a fault within it, until the system is in the safe state (1756-RM012, p.12). It is the sum of the reaction times of every component in the chain (1756-RM012, p.103):

System reaction time = Sensor reaction time + Logix system reaction time + Actuator reaction time

For a simple input-logic-output chain, the Logix system reaction time is made of five parts (1756-RM012, pp.103-104):

Example Calculation

Assume default connection settings, input delay 0 ms, and a safety task period and watchdog that you have set to 10 ms each (example values, not defaults):

Add the E-Stop's own reaction time and the contactor's release time (from their manufacturers' data) to get the system reaction time. 5069-TD001, p.42 also lists a 4 ms maximum output delay time (backplane to screw) for the OBV8S; if you are not sure it is included in the 4.5 ms reaction time, add it for a conservative figure (104.7 ms in this example). Any input delay you configure must be counted in the system reaction time (1756-RM012, p.32), and if you raise the connection reaction time limits to avoid connection loss, use the new limits in the calculation (1756-RM012, p.101).

11. Troubleshooting

Status Indicators (5069-IB8S and 5069-OBV8S)

The IB8S has 1 green/red module status indicator, 1 green/red SA power status indicator and 12 yellow/red I/O status indicators; the OBV8S has 1 module, 1 SA power and 16 I/O status indicators (5069-TD001, pp.38 and 42). Do not use the status indicators for safety operations (5069-UM004, p.37).

Source: 5069-UM004, pp.113-115.

12. Related Guides

Explore more Compact 5000 and safety-related guides from PLC Exchange:

Reference Documentation

The following Rockwell Automation publications were used as references for this guide. These are the official manufacturer documents for the hardware covered in this article.