LADX
Start free
← Resources
Safety·7 min read·

Programming a safety PLC without inventing anything

Certified blocks, restricted logic, and the discipline that separates a safety program from an ordinary one.

Short answer

You configure certified function blocks rather than writing safety logic from scratch. Each block, E-stop, guard monitoring, two hand control, muting, has been assessed as part of the controller's certification, and using it unmodified is what carries the rating. The safety program stays small, holds no sequencing, and communicates with the standard program in one direction only.

The safety chain, and where the rating appliesSensorguard switchLogicrelay or safety PLCActuatorcontactorTHE RATING APPLIES TO ALL OF THIS, NOT TO ONE BOXONE SAFETY FUNCTION

The first surprise for anybody coming to a safety controller from an ordinary one is how little programming there is to do, and how firmly the environment stops you doing more.

That restriction is not a limitation of the tool. It is the mechanism by which the rating survives contact with your project.

Use the blocks

A certified safety controller ships with function blocks that have been assessed as part of its certification: emergency stop, guard monitoring with and without lock, light curtain, two hand control, muting, safe speed, safe direction.

Using one unmodified means its behaviour is already covered. Reimplementing the same behaviour from contacts and coils means it is not, and you have quietly moved the assessment boundary to include your code.

The test is simple. If a block exists for what you are doing, and you are not using it, you should be able to say why in a sentence an assessor would accept.

Keep the safety program small

A safety program should contain safety functions and the minimum needed to express them. Not the machine sequence, not the recipe handling, not the HMI logic.

There is a practical reason beyond tidiness. Every change to a safety program is a change to a safety related part of a control system, and carries revalidation with it. A program that also contains the sequence is a program that gets modified weekly, and each modification drags the safety assessment along behind it.

The direction of information

The standard PLC may read anything from the safety program. The safety program should depend on the standard program for as little as possible, and never for a decision.

Reading a mode selector position from the standard side to choose between two safety behaviours is where this gets argued about. The usual answer is that the mode selector must itself be a safety rated input if a safety behaviour depends on it, which is exactly why safe mode selector switches exist as products.

Reset, properly

Three rules, and each one exists because of a specific failure.

  • Reset acts on the falling edge, so a shorted button cannot hold the reset condition true.
  • Reset does not start the machine. It clears the safety function's latch; starting is a separate action.
  • Reset is only accepted when the safety condition has already been restored. Pressing reset with the guard still open must do nothing at all.

Feedback loops

Every final switching element that can weld should be monitored. Contactors have mechanically linked auxiliary contacts for this, and the safety block has an input for them.

Skipping the feedback is the commonest way a Category 3 architecture on paper becomes a Category 1 architecture in the panel: two contactors, one welded, nobody knows.

Diagnostics are worth wiring up

The safety controller knows why it tripped. Discordance between channels, a test failure, a feedback timeout: all of it is available.

Bringing that across to the standard PLC and putting it on the HMI turns a machine that stopped for no visible reason into one that says which channel of which guard disagreed. Maintenance time saved by this is the reason most people stop regretting the safety controller's cost.

Common questions

Can I write my own safety function blocks?
On most certified platforms, no, or only within tightly defined limits. The certification covers the supplied blocks and the restricted language subset. Writing your own means your code becomes part of the safety assessment, which is a much larger undertaking than it first appears.
Should machine sequencing live in the safety program?
No. The safety program should contain safety functions and nothing else. Sequencing in there makes the program large, makes every change a safety change, and forces a revalidation for reasons that have nothing to do with safety.
Why does a reset have to be on the falling edge?
So that a stuck or shorted reset button cannot hold the machine in a permanently resettable state. Requiring the button to be pressed and released proves it is a deliberate action by somebody present, not a jammed contact.

Keep reading