Beckhoff TwinSAFE

The input value (InValue) has expired, and its current state is below zero. This suggests that the input signal has either become invalid or has dropped below its expected range, leading to a safety state. The fault provides the FB instance, the current InValue, and the MinAllowedValue for detailed diagnosis.

The input value (InValue) has expired, and its current state is above zero. This suggests that the input signal has either become invalid or has risen above its expected range, leading to a safety state. The fault provides the FB instance, the current InValue, and the MaxAllowedValue for detailed diagnosis.

The 'InValueError' flag within the FB Envelope function block is TRUE, indicating a specific issue with the input value. This signifies that the input signal is not valid or within the expected operational parameters, forcing the FB into a safe state. The fault provides the FB instance and the current InValue for diagnosis.

The 'MaxTimeExpired' flag within the FB Envelope function block is TRUE. This confirms that the maximum permissible time for the safety function output to be active has been reached, causing the output to switch off. This fault prioritizes safety by ensuring the output does not remain active beyond its design limit.

The PressStarted input was TRUE, commanding the press to move, but the position did not change (or 'Stopped' did not become FALSE) within the PressStartedDelayTime. This indicates a failure to initiate motion after the start command, potentially due to a mechanical jam or drive issue, preventing operation.

The PressStarted input was TRUE, indicating a commanded motion, but the position subsequently stopped ('Stopped' changed to TRUE) after having moved. This suggests an unexpected halt during a commanded press operation, which could be due to an obstruction, overload, or sensor fault, potentially damaging equipment or causing an unsafe state.

With the PressStarted input TRUE and the system not explicitly stopped ('Stopped' is FALSE), the position did not change by at least the MinPositionChange within the MoveDetectionTime. This means the press initiated movement but did not travel the expected minimum distance within the allotted time, possibly due to a partial jam or restricted motion, impacting process quality or safety.

The FB CamMonitor entered the WAIT-FOR-RESET state because the Reset input was FALSE, but then the position unexpectedly changed from stopped to moving. This indicates the mechanism moved when it should have been static while awaiting a reset command, posing a risk of unintended motion.

When LED Diag 1 is off and LED Diag 2 flashes with code 1 (400ms ON / 400ms OFF), it indicates that the internal supply voltage for microcontroller μC1 has exceeded its maximum permissible limit. This environment-related error signals an overvoltage condition, potentially risking damage to the μC1 or compromising its safety functions due to electrical stress.

When LED Diag 1 is off and LED Diag 2 flashes with code 2 (400ms ON / 400ms OFF), it indicates that the internal supply voltage for microcontroller μC1 has fallen below its minimum permissible value. This environment error suggests insufficient power delivery, which could lead to erratic behavior, component instability, or a complete shutdown of safety functions for μC1.

When LED Diag 1 is off and LED Diag 2 flashes with code 3 (400ms ON / 400ms OFF), it indicates that the internal supply voltage for microcontroller μC2 has exceeded its maximum permissible limit. This environment error suggests an overvoltage condition, carrying a risk of damage to μC2 or other internal components due to excessive electrical input.

When LED Diag 1 is off and LED Diag 2 flashes with code 4 (400ms ON / 400ms OFF), it indicates that the internal supply voltage for microcontroller μC2 has fallen below its minimum permissible value. This environment error can lead to unreliable operation or unexpected behavior of the TwinSAFE component due to insufficient power for μC2, potentially impacting safety integrity.

When LED Diag 1 is off and LED Diag 2 flashes with code 5 (400ms ON / 400ms OFF), it indicates that the TwinSAFE component's internal temperature has exceeded its maximum safe operating limit. This environment error signifies an overheating condition, which can cause thermal stress on internal components, potentially leading to reduced lifespan, immediate shutdown, or component damage if not addressed.

When LED Diag 1 is off and LED Diag 2 flashes with code 6 (400ms ON / 400ms OFF), it indicates that the TwinSAFE component's internal temperature has fallen below its minimum safe operating limit. This environment error suggests operation in an excessively cold environment, which might affect component performance, material properties, or lead to condensation issues if cold-soaked.

When LED Diag 1 is off and LED Diag 2 flashes with code 7 (400ms ON / 400ms OFF), it indicates that the temperature difference between microcontrollers μC1 and μC2 has exceeded a valid threshold. This environment error could point to uneven cooling, a sensor malfunction, or an internal fault causing one μC to heat differently than the other, potentially compromising the integrity of dual-channel temperature monitoring.

When LED Diag 1 is off and LED Diag 2 flashes with code 10 (400ms ON / 400ms OFF), it indicates a general environment error. This code signifies an unspecified fault related to the module's operating conditions (e.g., power supply, ambient temperature, humidity) that does not fall under more specific environment error categories. Further investigation of external environmental factors or diagnostic history (CoE objects F984 hex, F985 hex) may be required to pinpoint the issue.

This error code indicates that a terminal error has triggered a reset of the TwinSAFE Connection. This condition occurs when the 'Error acknowledge active' parameter is set to 'True'. The TwinSAFE communication and associated safety functions will be interrupted and remain in an error state until manually acknowledged, preventing safe operation.

An error has occurred specifically at digital output 1. This can be caused by faulty test pulses (due to external supply or cross-circuit), high capacitive coupling from parallel cables, an actuator current outside the 20 mA to 500 mA range, or a short-circuit/voltage drop at the output. If left unresolved, output 1 may not function safely or correctly, potentially affecting the connected safety function.

An error has occurred specifically at digital output 2. This can be caused by faulty test pulses (due to external supply or cross-circuit), high capacitive coupling from parallel cables, an actuator current outside the 20 mA to 500 mA range, or a short-circuit/voltage drop at the output. If left unresolved, output 2 may not function safely or correctly, potentially affecting the connected safety function.

An error has occurred specifically at digital output 3. This can be caused by faulty test pulses (due to external supply or cross-circuit), high capacitive coupling from parallel cables, an actuator current outside the 20 mA to 500 mA range, or a short-circuit/voltage drop at the output. If left unresolved, output 3 may not function safely or correctly, potentially affecting the connected safety function.

An error has occurred specifically at digital output 4. This can be caused by faulty test pulses (due to external supply or cross-circuit), high capacitive coupling from parallel cables, an actuator current outside the 20 mA to 500 mA range, or a short-circuit/voltage drop at the output. If left unresolved, output 4 may not function safely or correctly, potentially affecting the connected safety function.

The voltage supplied to the power contacts of the terminal is below the permissible operating range (24V -15%/+20%). This can be caused by the voltage not being switched on, being switched on after the terminal supply, being generally too low, or by a short-circuit at an output causing a voltage drop. This affects the overall operation of the terminal's outputs and can lead to unreliable behavior or shutdown of safety functions.

The voltage supplied to the power contacts of the terminal is too high. This could be due to a consistent overvoltage on the power contacts or brief external influences such as switching off contactors causing voltage spikes. An overvoltage can damage internal components of the terminal and compromise its safe operation.

The internal temperature of the terminal has fallen below its specified operating range. This cold condition can negatively impact the performance, response time, and reliability of the internal electronics and overall safety functions. Continued operation outside the specified temperature range may lead to malfunction or damage to components.

The internal temperature of the terminal has exceeded its specified operating range, indicating overtemperature for internal microcontrollers (μC1 or μC2). This can lead to reduced performance, component degradation, thermal shutdown, or even complete failure of the terminal, compromising safety. Prompt resolution is required to prevent permanent damage.

A significant temperature difference has been detected between internal components of the terminal, such as between different processor boards or specific microcontrollers. This indicates an imbalance in heat distribution or a localized thermal issue that could affect the stability and longevity of the terminal's electronics. Unresolved, it can lead to unreliable operation or component failure.

A general error has been detected in the terminal's output circuit, not necessarily specific to a single output. This can include faulty test pulses (from external supply or cross-circuit), excessive current draw or open load conditions (current below 20 mA or above 500 mA), or general output voltage issues like short-circuits. This impacts the safe and reliable operation of the terminal's digital outputs.

A discrepancy has been detected in input group 1 for the FB CONNECTION SHUTDOWN. This means the redundant input signals ('DeactivateX TRUE') are not in agreement, which prevents the Connection Shutdown function from reliably commanding a SHUTDOWN state or detecting it from the assigned Connection. This poses a risk to controlled deactivation and will stop the machine.

The switch-OFF timer for the EDM (External Device Monitoring) function block has elapsed. This means that the feedback signal from the monitored device (e.g., safety contactor) did not transition to its expected OFF state within the configured time after the EDM output commanded it. This indicates a delay or failure in the monitored device's deactivation, posing a safety risk if the device fails to open.

The switch-ON timer for the EDM (External Device Monitoring) function block has elapsed. This means that the feedback signal from the monitored device (e.g., safety contactor) did not transition to its expected ON state within the configured time after the EDM output commanded it. This indicates a delay or failure in the monitored device's activation, which could prevent safety outputs from being enabled.

The input value (InValue) has fallen below the defined lower limit of the envelope in the FB Envelope function block. This indicates a deviation from the expected operating range, potentially causing the safety function to trip or behave unpredictably, leading to an unsafe state.

The input value (InValue) has exceeded the defined upper limit of the envelope in the FB Envelope function block. This indicates a deviation from the expected operating range, potentially causing the safety function to trip or behave unpredictably, leading to an unsafe state.

A general error related to the input value (InValue) has occurred within the FB Envelope function block. This could be due to invalid input data, a fault in the input signal path, or internal processing issues. This fault will lead to the FB entering a safe state, halting operation.

The maximum allowed time for the SafeFunctionOut output to remain active has been exceeded within the FB Envelope function block. This indicates that the input value ('InValue') stayed within the 'Target Value' window for too long, or the configured 'Max Time (ms)' parameter was reached. This will force the output to switch off for safety.

A discrepancy has been detected between the two channels of input group 1 for the FB ESTOP. This indicates that the redundant E-Stop input signals are not in agreement, suggesting a potential failure of one channel, a wiring issue, or an incorrect switching sequence. This will prevent the E-Stop function from operating safely and halt the machine.

A discrepancy has been detected between the two channels of input group 2 for the FB ESTOP. This indicates that the redundant E-Stop input signals are not in agreement, suggesting a potential failure of one channel, a wiring issue, or an incorrect switching sequence. This will prevent the E-Stop function from operating safely and halt the machine.

A discrepancy has been detected between the two channels of input group 3 for the FB ESTOP. This indicates that the redundant E-Stop input signals are not in agreement, suggesting a potential failure of one channel, a wiring issue, or an incorrect switching sequence. This will prevent the E-Stop function from operating safely and halt the machine.

A discrepancy has been detected between the two channels of input group 4 for the FB ESTOP. This indicates that the redundant E-Stop input signals are not in agreement, suggesting a potential failure of one channel, a wiring issue, or an incorrect switching sequence. This will prevent the E-Stop function from operating safely and halt the machine.

An External Device Monitoring (EDM) error has been detected for the EDM1 feedback loop of the FB ESTOP. This typically means that the feedback from the safety contactors or relays, which are expected to open after an E-Stop activation, has not been received within the allowed time or in the correct state. This indicates a failure in the safety output circuit or feedback path, preventing safe operation.

An External Device Monitoring (EDM) error has been detected for the EDM2 feedback loop of the FB ESTOP. This typically means that the feedback from the safety contactors or relays, which are expected to open after an E-Stop activation, has not been received within the allowed time or in the correct state. This indicates a failure in the safety output circuit or feedback path, preventing safe operation.

This fault indicates a discrepancy in E-Stop input group 1, similar to 'FB ESTOP Bit 0', but specifically when the 'Safe Inputs after Disc Error' option is activated. This means that even after a discrepancy, the FB attempts to maintain a safe state for the inputs, but a persistent or critical discrepancy has occurred, preventing normal operation and requiring intervention.

This fault indicates a discrepancy in E-Stop input group 2, similar to 'FB ESTOP Bit 1', but specifically when the 'Safe Inputs after Disc Error' option is activated. This means that even after a discrepancy, the FB attempts to maintain a safe state for the inputs, but a persistent or critical discrepancy has occurred, preventing normal operation and requiring intervention.

This fault indicates a discrepancy in E-Stop input group 3, similar to 'FB ESTOP Bit 2', but specifically when the 'Safe Inputs after Disc Error' option is activated. This means that even after a discrepancy, the FB attempts to maintain a safe state for the inputs, but a persistent or critical discrepancy has occurred, preventing normal operation and requiring intervention.

This fault indicates a discrepancy in E-Stop input group 4, similar to 'FB ESTOP Bit 3', but specifically when the 'Safe Inputs after Disc Error' option is activated. This means that even after a discrepancy, the FB attempts to maintain a safe state for the inputs, but a persistent or critical discrepancy has occurred, preventing normal operation and requiring intervention.

A discrepancy has been detected between the channels of input group 1 in the FB MON function block. This means the redundant inputs are not switching in sync or are reporting different states, indicating a potential sensor fault, wiring issue, or incorrect timing that could compromise the monitoring function, leading to a safety stop.

A discrepancy has been detected between the channels of input group 2 in the FB MON function block. This means the redundant inputs are not switching in sync or are reporting different states, indicating a potential sensor fault, wiring issue, or incorrect timing that could compromise the monitoring function, leading to a safety stop.

A discrepancy has been detected between the 'Secure1' and 'Secure2' input channels in the FB MON function block. These inputs are used to switch off the evaluation of 'MonIn(x)' inputs. A discrepancy here means the redundant secure inputs are not in agreement, which can lead to unintended disabling of monitoring functions, potentially bypassing safety.

An External Device Monitoring (EDM) error has been detected for the EDM1 feedback loop of the FB MON. This indicates that the feedback from safety contactors or relays, expected to open or close in response to the FB MON's output, has not been received correctly or within the allowed time. This implies a fault in the external safety output circuit or its feedback path, compromising safe monitoring.

A discrepancy has been detected in muting input group 1 (e.g., MuteIn1/MuteIn2) within the FB MUTING function block. This means the redundant muting sensors (e.g., light barriers) are not switching synchronously or are reporting different states, which can compromise the safe muting function, potentially leading to an unsafe bypass of a safety device. This triggers a safety stop.

A discrepancy has been detected in the OSSD (Output Signal Switching Device) input group (e.g., OssdIn1/OssdIn2) within the FB MUTING function block. These inputs typically come from a safety light curtain or area scanner. A discrepancy means the redundant OSSD signals are not synchronized, indicating a fault in the safety device or its wiring, compromising the primary safeguarding function and stopping the machine.

A discrepancy has been detected in muting input group 2 (e.g., MuteIn3/MuteIn4) within the FB MUTING function block. This means the redundant muting sensors are not switching synchronously or are reporting different states, which can compromise the safe muting function, potentially leading to an unsafe bypass of a safety device. This triggers a safety stop.

An External Device Monitoring (EDM) error has been detected for the EDM1 feedback loop of the FB MUTING. This indicates a fault in the external safety output circuit (e.g., safety contactors) or its feedback path, which should confirm that the outputs have switched correctly in response to a muting event. This prevents unsafe operation if the outputs fail to respond, leading to a safety stop.

An External Device Monitoring (EDM) error has been detected for the EDM2 feedback loop of the FB MUTING. This indicates a fault in the external safety output circuit (e.g., safety contactors) or its feedback path, which should confirm that the outputs have switched correctly in response to a muting event. This prevents unsafe operation if the outputs fail to respond, leading to a safety stop.

The programmed muting sequence has been violated. This occurs if muting sensors are activated in an incorrect order or at incorrect times, or if an object remains in the detection zone for too long during muting. This is a critical safety fault, as it implies an attempt to bypass the safety function improperly or unintentionally, causing an immediate safety stop.

The maximum allowed duration for the muting function has been exceeded. This indicates that an object has remained in the muting zone for longer than permitted, or the 'MaxMutingTime' parameter is set too short for the process. This fault ensures that muting is not active indefinitely, which would compromise safety and results in a safety shutdown.

A discrepancy error in 'MuteIn1'/'MuteIn2' was detected and has not yet been acknowledged or reset. This indicates a persistent underlying issue with muting input group 1 that needs active resolution and acknowledgment before normal operation can resume. The system will remain in a safe, stopped state.

A discrepancy error in 'OssdIn1'/'OssdIn2' was detected and has not yet been acknowledged or reset. This indicates a persistent underlying issue with the OSSD input group that needs active resolution and acknowledgment before normal operation can resume. The system will remain in a safe, stopped state.

A discrepancy error in 'MuteIn3'/'MuteIn4' was detected and has not yet been acknowledged or reset. This indicates a persistent underlying issue with muting input group 2 that needs active resolution and acknowledgment before normal operation can resume. The system will remain in a safe, stopped state.

A discrepancy has been detected in the input signals monitored by the FB OPMODE function block. This usually means that dual-channel inputs (e.g., OpInX) are not switching or remaining in sync as expected, indicating a potential sensor failure, wiring issue, or timing problem. This will cause the FB to switch to an ERROR state, preventing mode selection.

A discrepancy has been detected within the two channels of input pair 1 for the FB TWOHAND. This means the redundant hand actuation signals are not synchronizing correctly, indicating a potential issue with the two-hand device, its wiring, or incorrect timing. This will prevent safe two-hand operation and put the machine into a safe state.

A discrepancy has been detected within the two channels of input pair 2 for the FB TWOHAND. This means the redundant hand actuation signals are not synchronizing correctly, indicating a potential issue with the two-hand device, its wiring, or incorrect timing. This will prevent safe two-hand operation and put the machine into a safe state.

A discrepancy has been detected between the actuation times of input pair 1 and input pair 2 for the FB TWOHAND. This means the operator is not actuating both hands simultaneously within the allowed time window, or there's an issue with the timing of the two-hand control device itself. This fault ensures true simultaneous actuation for safety and stops the machine.

A specific two-hand error sequence violation has occurred: one input pair was actuated, and while waiting for the second, the first input pair was released before the second was actuated. This indicates an incorrect operating procedure or a 'teasing' attempt, which compromises the safety principle of simultaneous two-hand control and halts the machine.

Similar to 'FB TWOHAND Bit 0', but specifically when the 'Safe Inputs after Disc Error' option is active for input pair 1. This means a discrepancy occurred, and although the FB is attempting to maintain a safe state for the inputs, the error persists, indicating a critical issue with the input pair that requires immediate attention and prevents operation.

Similar to 'FB TWOHAND Bit 1', but specifically when the 'Safe Inputs after Disc Error' option is active for input pair 2. This means a discrepancy occurred, and although the FB is attempting to maintain a safe state for the inputs, the error persists, indicating a critical issue with the input pair that requires immediate attention and prevents operation.

Similar to 'FB TWOHAND Bit 2', but specifically when the 'Safe Inputs after Disc Error' option is active for the discrepancy between input pairs. This means a timing discrepancy occurred between the two-hand input pairs, and despite the FB's attempt to maintain a safe state, the error persists, indicating a critical violation of the simultaneous actuation requirement, stopping the machine.

When LED Diag 1 is lit and LED Diag 2 flickers (50 ms ON / 50 ms OFF), it indicates an error specifically within an input or output module. This suggests a malfunction at the physical interface where signals are read or controlled. The specific input or output module affected is not specified by the flickering pattern alone, requiring further investigation.

At least one TwinSAFE function block (FB) within the EL/EJ69x0 group has entered an ERROR state. This indicates a localized issue within a specific safety function, which then propagates to the group level, causing the entire group to halt safe operation. Investigation of individual FB diagnostics is required.

At least one TwinSAFE connection within the EL/EJ69x0 group is faulty. This implies a disruption or loss of communication between safety devices or across the EtherCAT network for safety-relevant data. This will prevent safe operation and necessitate immediate investigation of network integrity, as safety communication is compromised.

The 'ModuleFault' input for the EL/EJ69x0 group is active (set to 1). This indicates a general fault detected by the safety module itself, possibly a hardware issue, internal diagnostic failure, or a critical input signal indicating a module problem. The group will enter an ERROR state, preventing safe operation.

On startup, at least one analog TwinSAFE function block input deviates from its last saved value (Power-On Analog Value Check Error). This indicates an inconsistency in analog safety input signals during the system's power-on self-test, which could signify sensor drift, wiring issues, or faulty input modules. This prevents the system from starting safely.

A timeout has elapsed while waiting for a communication error in 'passivate' mode of a manual control unit. This suggests a problem with the deactivation sequence or communication with the manual control unit, potentially preventing the system from entering a safe passive state correctly. The system will remain in an unsafe or error state.

The TwinSAFE logic program was unexpectedly restarted because the EtherCAT connection was restarted or a user logged in without reloading the TwinSAFE logic program (or parts of it). This can lead to an inconsistent or unsafe state if the logic program's state is not properly re-initialized, requiring a safety shutdown.

An invalid or unrecognized command was received over the FSoE connection. This indicates a potential communication protocol mismatch or a corrupted command transmission. Unresolved, this can prevent proper safety control and lead to system downtime or an unsafe state.

An unknown command was received over the FSoE connection. This signifies a command that the recipient device does not recognize or support. It suggests a configuration error or an attempt to use unsupported functionality, potentially disrupting safety communication and causing a shutdown.

The FSoE connection ID used in communication is invalid or does not match the expected ID configured in the devices. This prevents the establishment or continuation of a secure safety connection, rendering the system inoperable due to a breakdown in trusted communication.

A Cyclic Redundancy Check (CRC) error was detected in an FSoE telegram. This indicates data corruption during transmission, usually due to noise, damaged cabling, or faulty network components. It compromises safety integrity and prevents reliable communication, forcing a safe state.

The FSoE watchdog timer on a device has expired, meaning that a safety telegram was not received within the configured watchdog period. This indicates a communication timeout, potentially due to network delays, device malfunction, or disconnection, leading to a safe state.

An invalid FSoE address was detected during communication. This means a device is either configured with an incorrect address or is attempting to communicate with an unassigned or out-of-range address. It prevents proper safety device identification and communication, rendering safety functions inoperable.

The FSoE telegram contained data that was syntactically or semantically invalid according to the FSoE protocol specification. This indicates corrupted data or a protocol deviation, compromising the integrity of safety information. If left unresolved, this can lead to unreliable safety performance or system shutdown.