Engineering Light Curtain Muting on SIMATIC F-CPUs

Conditional bypass of an electro-sensitive protective equipment (ESPE) such as a Type 4 safety light curtain is a recurring requirement in automated pallet-handling cells, AGV/ATV transfer zones, and interlocked guarded machinery. The naive approach — wiring a 24 V signal into the light curtain's OSSD return or writing a one-liner in a standard (non-failsafe) PLC to force the output true — produces an unprotected machine that may still appear to satisfy a customer because the safety controller is branded "failsafe". Performance Level (PL) and SIL classifications describe the architecture, not the residual risk. This reference covers the lawful, defensible approach: muting as defined by IEC 61496-1, executed in a SIMATIC F-CPU (e.g., S7-1500F, ET 200SP F-CPU, or S7-1200F) with PROFIsafe and validated against ISO 13849-1.

1. Application Context and Boundary Definition

The reference installation is a pallet-transfer cell with the following hazard boundaries:

• An enclosed hazardous area fenced on all four sides.
• An automated transfer vehicle (ATV) that shuttles pallets between two conveyors on opposite sides of the fenced area.
• A horizontal Type 4 safety light curtain across the ATV's travel lane, providing whole-body detection per ISO 13855.
• Two personnel access doors, one on each side of the light curtain, each fitted with a guard locking switch (e.g., Siemens Sirius 3SE5 or Schmersal RSS 36).
• Two conveying sections inside the hazardous area, one adjacent to each door.

Operational states:

2. Standards Framework

The applicable standards for a light curtain muting application on a SIMATIC F-CPU are:

The achieved Performance Level must be at least one level above the risk reduction required by the risk graph (ISO 13849-1, Annex A) for each individual hazard. Muting does not lower the PL of the protective function; it temporarily suspends the protective function under conditions proven safe by the risk assessment.

3. Muting vs. Bypass vs. Override

Three terms are routinely confused, with serious compliance consequences:

4. Risk Assessment Workflow

Before commissioning any muting logic, complete the following:

1. Identify the hazard for the zone behind the curtain (e.g., crushing by ATV, shearing at conveyor head pulley).
2. Estimate the severity (S1 = minor, S2 = serious, S3 = fatal) per ISO 13849-1 Annex A.
3. Estimate the frequency/duration of exposure (F1, F2) and the possibility of avoidance (P1, P2).
4. Select the required PL_r from the risk graph (typically PL_r = d or e for the ATV passage hazard).
5. Iterate the assessment with muting active: with the door closed and the ATV legitimate transit, is the residual risk acceptable? If the light curtain is muted for any other reason (e.g., during a maintenance access where the door is also opened), the assessment must be repeated and additional safeguards added.
6. Document the result in the technical file, including SISTEMA archives and the safety validation plan.

Any "what if" without an answer must be treated as a hazard. If the muting sequence could be defeated by, e.g., a person standing in front of one muting sensor, the sequence is invalid and a different arrangement (crossing muting sensors, retroreflective muting arms, or two-independent-position sensors) is required.

5. SIMATIC Safety Hardware Selection

A representative BOM for the reference cell:

The light curtain is wired to a 24 V failsafe digital input channel. The OSSDs feed an F-DI configured as a 1oo2 or 2oo2 evaluation. The muting sensors feed separate F-DI channels. The muting indicator lamp is driven by a non-failsafe output, but the lamp state is fed back into the F-DI as a "muting active" confirmation; a burned-out lamp must drop the muting enable.

6. Muting Sequence Design

IEC 61496-1 does not prescribe a specific sensor count, but industry practice (SICK, Banner, Pilz) uses the following patterns:

6.1 Four-Sensor L-Pattern (most common)

Two sensors (A, B) upstream of the curtain and two sensors (C, D) downstream, arranged so the pallet trips them in the order A→B→(curtain entry)→C→D. The muting window opens when A AND B are both active; it closes when D goes inactive. Reverse direction: D→C→(curtain)→B→A.

6.2 Two-Sensor Crossing Pattern (compact cells)

Two sensors mounted at a shallow angle to the conveyor; both must be active simultaneously, and the curtain must be broken within a configurable time window (e.g., 250 ms).

6.3 Parameter Set

7. PROFIsafe Wiring and Slot Assignment

The PROFIsafe address is set via the SIMATIC Automation Tool or by the F-CPU on first power-up; the F-Host writes the F-Parameter CRC into the device. Sample slot layout in TIA Portal V18 or later:

F-Parameter settings in the device configuration of the F-CPU (per Siemens PROFIsafe Profile):

• F_WD_Time: 100 ms (must be ≥ 2 × bus cycle; 50 ms is the minimum for PROFINET 1 ms).
• F_Par_CRC: auto-generated and locked once the device is commissioned.
• F_Source_Add and F_Dest_Add: configured per slot, must be unique on the F-network.

8. F-FBD Muting Logic in TIA Portal

The muting logic must reside inside an F-runtime group. The F-runtime group has a defined maximum cycle time (F_CYC_TIME) and a maximum response time. Sample logic (F-FBD notation):

// Inputs (all tags generated by F-I/O DB)
// %I0.0  LightCurtain_OSSD_OK        (F-DI channel 0, 1oo2)
// %I0.1  Door_1_Closed
// %I0.2  Door_1_Locked
// %I0.3  Door_2_Closed
// %I0.4  Door_2_Locked
// %I0.5  MutingSensor_A
// %I0.6  MutingSensor_B
// %I0.7  MutingSensor_C
// %I1.0  MutingSensor_D
// %I1.1  MutingLamp_FB_OK
// %I1.2  Override_Key
// %I1.3  Reset_PB

// Outputs
// %Q0.0  Conveyor1_EnableSafe
// %Q0.1  Conveyor2_EnableSafe
// %Q0.2  ATV_EnableSafe
// %Q0.3  MutingLamp_On

// --- Network 1: General permit (no access, no fault) ---
ALL_DOORS_CLOSED  := Door_1_Closed AND Door_1_Locked
                  AND Door_2_Closed AND Door_2_Locked;

PERMIT_BASE := ALL_DOORS_CLOSED
            AND LightCurtain_OSSD_OK
            AND MutingLamp_FB_OK;

// --- Network 2: L-pattern mute sequence timer ---
TON_DB "MuteSeqTON" (PT := T#5s);
IF MutingSensor_A AND MutingSensor_B AND NOT Mute_Sequence_Active THEN
    Mute_Sequence_Active := TRUE;
    MuteSeqTON(IN := TRUE);
END_IF;

IF Mute_Sequence_Active AND NOT MutingSensor_D THEN
    Mute_Sequence_Active := FALSE;
    MuteSeqTON(IN := FALSE);
END_IF;

Mute_TimeOut := MuteSeqTON.Q;

// --- Network 3: Override (time-limited, 30 s) ---
TON_DB "OverrideTON" (PT := T#30s);
IF Override_Key AND LightCurtain_Broken AND NOT Override_Active THEN
    Override_Active := TRUE;
    OverrideTON(IN := TRUE);
END_IF;

// --- Network 4: Muting enable ---
MUTING_ENABLE := PERMIT_BASE
              AND ALL_DOORS_CLOSED
              AND Mute_Sequence_Active
              AND NOT Mute_TimeOut;

// --- Network 5: Curtain OK output ---
Curtain_OK := LightCurtain_OSSD_OK OR MUTING_ENABLE OR Override_Active;

// --- Network 6: Safe outputs ---
Conveyor1_EnableSafe := Curtain_OK;
Conveyor2_EnableSafe := Curtain_OK;
ATV_EnableSafe       := Curtain_OK;

// --- Network 7: Muting lamp feedback check ---
IF MUTING_ENABLE AND NOT MutingLamp_FB_OK THEN
    SAFE_FAULT(Muting_Lamp_Failed);  // F-stop the runtime group
END_IF;

This logic lives inside a single F-runtime group, scheduled by the F-CPU every F_CYC_TIME (e.g., 5 ms). The F-runtime group's maximum response time is bounded by 2 × F_CYC_TIME + F_WD_Time, and is reported in the F-CPU's safety summary for the safety validation report.

9. TIA Portal Configuration Steps

1. Create the project with the F-CPU (e.g., S7-1516F-3 PN/DP) and the ET 200SP station on PROFINET.
2. In Device configuration, add the F-DI and F-DO modules. Set the PROFIsafe addresses.
3. Add the F-runtime group (automatic insertion in TIA V17+). Assign F-CYC-TIME = 5 ms and F-WD-TIME = 100 ms.
4. Insert the F-FBD/F-ST logic above into the F-runtime group's main safety block.
5. Enable Passivation on each F-I/O. Configure the discrepancy time on 1oo2 inputs (typ. 50 ms for OSSD, 500 ms for door contacts).
6. Compile the safety program. The F-Compiler generates a checksum visible in the project properties; this checksum must be archived.
7. Download to the F-CPU. Accept the F-Parameter CRC prompt. Sign the safety program with the project password.
8. Run an online safety diagnostics session to confirm no F-I/O faults are present.

10. SISTEMA Validation

Import the SISTEMA project file generated by TIA Portal (or rebuild the safety function block library manually). For the muting function, the inputs to the SISTEMA block are:

• Light curtain: PFHd = 8.0 × 10⁻⁹ /h (SICK deTec4 Core, Type 4, PL e).
• F-DI channel: PFHd = 1.0 × 10⁻⁹ /h per Siemens declaration.
• F-DO channel: PFHd = 1.0 × 10⁻⁹ /h per Siemens declaration.
• Muting sensors: arranged as a 2-channel voted pair (DCavg = High).
• Door guard locks: Sirius 3SE5 series, B10d = 1 000 000 cycles, single channel with monitoring, MTTFd high.

The aggregated PL of the safety function (Stop on Curtain Break, Pallet Mute) is computed by SISTEMA. The result must equal or exceed PL_r derived in §4. Save the SISTEMA report as PDF and attach to the technical file.

11. Verification and Validation

The validation plan is a documented test sequence, not a one-time checkbox:

Each test must be recorded with date, signature, and F-runtime group CRC. The CRC must match the value archived at project sign-off.

12. Troubleshooting Matrix

13. Operating Discipline

• The customer must be informed in writing that the safety PLC is a tool, not a guarantee. The risk assessment and validation report are the deliverable.
• Access to the muting lamp test, the override key, and the safety password must be controlled. The password changes with each change to the F-program; the change is captured in the change log.
• Periodic proof test: at least annually, exercise the mute sequence with a test pallet, record the result, and re-archive the SISTEMA file.
• Any modification to the mechanical layout, conveyor speed, or pallet dimensions invalidates the muting time budget and forces a re-assessment.

14. Frequently Asked Questions