Creating a TwinSAFE Simulation Project for ESTOP PL d Logic

Creating a TwinSAFE Simulation Project for ESTOP PL d Logic

This technical reference walks through the complete creation, mapping, debug, and verification of a TwinSAFE simulation project implementing an Emergency Stop function (variant 1) classified as Category 3 / PL d per TwinSAFE project design. The project uses the EL6910 TwinSAFE logic terminal, the EL1904 safe 4-channel digital input, and the EL2904 safe 4-channel digital output. The procedure runs entirely in the TwinCAT 3 development environment (TC3 Safety Editor) so that the safety logic can be exercised, fault-injected, and verified without wiring physical E-Stops.

1. Overview and Scope

TwinSAFE is Beckhoff's integrated safety technology that runs safety logic directly on dedicated EtherCAT terminals (EL6900/EL6910) and uses Fail Safe over EtherCAT (FSoE / Safety over EtherCAT protocol) to communicate with safe I/O. The simulation mode provided in the TC3 Safety Editor allows the safety program to be loaded into the engineering PC and executed against virtual I/O so that:

• Application logic can be developed and tested before hardware is on the bench.
• Function-block libraries (TwinSAFE Logic) such as safeESTop can be exercised with deterministic input sequences.
• Diagnostic states, error acknowledgements, and Group RUN transitions can be validated.
• Variant 1 E-Stop behavior (PL d, Cat 3, dual-channel with cross-fault detection) can be proven out before commissioning on the machine.

2. Prerequisites

3. Create the TwinCAT Project Skeleton

1. Open Visual Studio with the TwinCAT 3 Shell installed and create a new TwinCAT XAE Project (Project with PLC).
2. Once the project loads, locate the SAFETY node in the Solution Explorer. Right-click and choose Add → New Item.
3. In the Add New Item dialog, three TwinSAFE project templates are offered:
   • Empty TwinSAFE Project (no mappings)
   • TwinSAFE Project with ErrAck mappings
   • TwinSAFE Project with ErrAck mappings and Run mappings (recommended for E-Stop simulation)
4. Select the third option (ErrAck + Run mappings) and assign a meaningful name, e.g. ESTOP_PLd_Variant1.sal. Confirm with OK.

The template generates a safety project with two pre-wired alias groups: TwinSafeGroup1 and a default connection to the safety target. The pre-populated ErrAck and GroupPort_RunStop signals are essential for driving the TwinSAFE group from the editor.

4. Select the Safety Target System

Double-click the Target System node of the new safety project to open the configuration dialog.

1. In the Target System dropdown, choose EL6910 TwinSAFE PLC (or the equivalent CX safety runtime).
2. Click the External Device button to expose the simulation binding. The Safety Editor creates a virtual TwinSAFE target bound to the local AMS router.
3. Verify the AMS Net ID matches the local TwinCAT router (default 127.0.0.1.1.1). Click OK to commit the selection.

5. Add the Safety I/O Alias Devices

Alias Devices are the safety editor's symbolic handles for safe I/O. They decouple the safety program from the physical slot position of the terminals in the EtherCAT tree.

1. Right-click Alias Devices → Add → New Item.
2. From the vendor list choose Beckhoff Automation, then select EL1904 (4-channel safe digital input, 24 V DC). Click Add.
3. Repeat the process and add the EL2904 (4-channel safe digital output, 24 V DC, 0.5 A per channel).
4. Set a unique FSoE address for each alias:

The FSoE address must be unique on the FSoE segment and must match the rotary switches (or automatic FSoE address assignment) configured on the physical terminals. In simulation mode the addresses are logical; they only need to be unique within the project.

6. Implement the safeESTop Function Block

1. Open TwinSafeGroup1.sal in the Safety Editor.
2. From the Toolbox (View → Toolbox if not visible), drag the safeESTop function block into the network area.
3. Under the block's Assigned Variable Name properties, declare the following Boolean inputs and outputs:

The safeESTop block implements variant 1 per EN 60204-1: dual-channel evaluation, cross-fault monitoring, and a manual reset with positive-guided output. Achieving PL d / Cat 3 requires that both channels agree and that the reset signal is a separate, deliberate operator action.

7. Variable Mapping to Physical I/O

1. Open the Variable Mapping tab at the bottom of the Safety Editor.
2. For each declared variable, click the three-dot selector and bind it to the corresponding safe I/O channel:

• Reset_In → EL1904 → Input Channel 3
• Estop1_In → EL1904 → Input Channel 1
• Estop2_In → EL1904 → Input Channel 2
• EStopOut → EL2904 → Output Channel 1

Save the project (Ctrl+S). The Safety Editor runs an automatic consistency check on every save; mapping errors are highlighted in the Error List.

8. Enable the Safety Toolbar and Start Debug

1. Enable the dedicated safety toolbar: View → Toolbars → TwinCAT Safety. The toolbar exposes Debug Safety Project, Stop, Single Cycle, and online-value write controls.
2. With the target set to EL6910 and a valid simulation binding, the Debug Safety Project button activates. Click it to build and load the project into the simulated TwinSAFE runtime.
3. After successful load, click Run on the safety toolbar to start the safe logic task. The group state changes from Init to Run-Request.

9. Commissioning - Group RUN and Reset Sequence

Variant 1 E-Stops require the operator to acknowledge restart conditions, so a deliberate run-up sequence is mandatory. In simulation this is exercised through the online-value write controls.

1. Open the Variable Mapping tab. Locate GroupPort_RunStop; double-click its Online Value and force it to TRUE.
2. The TwinSafeGroup1 state transitions to RUN. Observe that the E-Stop block is still active (red) because no reset has occurred yet.
3. Set the two E-Stop signals (Estop1_In, Estop2_In) to TRUE via the online-value editor. This represents the contactor / pushbutton returning to a safe state.
4. Double-click the Online Value of Reset_In and force it to TRUE. The safeESTop block state indicator turns red and green, signalling that the block is armed and waiting for a falling edge of the reset signal.
5. Force Reset_In back to FALSE. The block releases the output - the E-Stop output (EStopOut) goes to TRUE, the simulation output channel 1 of the EL2904 latches high.

This sequence (Run-Request → Both channels TRUE → Reset rising → Reset falling) is the canonical variant 1 start-up. Any deviation (no reset, channels not both TRUE, simultaneous reset and channel change) must cause the block to remain in the safe state and raise a diagnostic bit.

10. Verification Checklist

Use this matrix to confirm the simulation behaves as designed. All tests are run in the Safety Editor's online mode; no live wiring is required.

11. Troubleshooting Matrix

12. Frequently Asked Questions