Banner XS/SC26 Security Controller Debugging and Troubleshooting

Banner XS/SC26 Security Controller Debugging and Troubleshooting

In the field of industrial automation, safety controllers are the last line of defense for equipment safety circuits. Banner Engineering's XS/SC26 series (expandable) and SC10-2 (compact) safety controllers are gradually replacing traditional safety relay modules with flexible functional block programming, rich industrial Ethernet protocol support, and powerful ISD (In Series Diagnostic) diagnostic capabilities. However, grounding negligence, incorrect connection of functional blocks, Ethernet communication failures, and false triggering of latch states during on-site installation often result in extended debugging cycles. This article is based on the official Banner manual, which outlines the installation points, programming pitfalls, communication configuration, and fault code response strategies of safety controllers from an engineering practical perspective, helping engineers quickly put them into use.

The 'invisible killer' in hardware installation

1.1 Electrostatic Discharge (ESD) and Protective Strips

Manual repeatedly warns: ESD sensitive devices. Before installing a processor, memory module, or data access tool (DAT), the base power must be disconnected and static electricity must be released by touching the grounded metal. Do not touch the bus connector pins when disassembling or assembling modules. In addition, the protective dust strip on the base must not be removed before wiring is completed - drilling metal debris that falls into the circuit board may cause permanent damage. After wiring is completed and debris is cleaned, the dust strip can be removed and the processor can be installed.

1.2 Grounding and Common Mode Voltage

All Banner safety controllers require the use of a 24V DC ± 20% SELV/PELV power supply. A detail that is easily overlooked: the USB interface is not isolated from the 24V return line. Special warning in the manual: USB cables may cause the computer and controller to become accidental grounding circuits for other devices, and high currents can burn out the computer or controller. Therefore, it is recommended to use SC-USB2 dedicated cables during debugging and place the computer on a non-conductive surface. If necessary, disconnect the laptop's AC power supply. If long-term monitoring is required, Ethernet interface (only applicable to FID 7 and above models) should be used.

1.3 DIN rail installation and heat dissipation

The controller must be installed vertically (with the ventilation opening facing up/down), with a 50mm heat dissipation gap reserved around it. It is strictly prohibited to level or invert. The DIN rail lock can extend 15 mm in the open state, and it needs to be pried open with a screwdriver when removed. For XS26 scalable systems, a maximum of 8 I/O modules are supported (16 for FRN 6 and later), and each extended I/O group (Bank) must be separately configured with a power supply (such as 1769-PA2/PB2), and the EtherCAT gateway module must be located adjacent to the base.

The 'Function Block Trap' in Software Configuration

Banner safety controller software (free download) adopts drag and drop function block programming, greatly simplifying logic design, but the following errors can easily lead to invalid configuration or output failure.

2.1 Essence of Connection Rules

An output node can connect multiple input nodes, but an input node can only accept one source. Attempting to connect two manual reset signals to the same Latch Reset block LR node will result in an error.

Manual Reset can only be connected to specific nodes: LR (latch reset), FR (fault reset), RST (enable device reset), SET/RST (trigger block), and the input of the reset dedicated OR block. Ordinary OR blocks cannot be used for reset signals.

In the Muting function, emergency stop and pull switch cannot be muted. If E-Stop is connected to the IN node of the Muting block, the software will report error F.1.

2.2 ATO automatic terminal optimization and external terminal block

SC10-2 defaults to ATO (Automatic Terminal Optimization). When the input terminals are insufficient, the system will automatically share the same I/O output terminal with multiple devices that require+24V test pulses (such as door switches) through an external terminal block (ETB). This will expand the number of inputs from 10 to a maximum of 14. If ATO is disabled, the terminals must be manually reassigned, otherwise more devices cannot be added. If it is found during debugging that "new input cannot be added", check whether ATO has been unexpectedly closed.

2.3 Virtual Reset and Activation Code

Starting from XS/SC26 FID 2 and SC10-2, virtual manual reset and delay cancellation (via Ethernet or Modbus register writing) are supported. But ISO 13849-1 requires that resetting must be an 'intentional operation'. To this end, Banner has designed an activation code mechanism: the PLC must first write the correct activation code to the RCD Enable Register (which can be customized in the software), then write 1 to the RCD Register Bit, and reset the activation code within 2 seconds. If the activation code does not match or times out, the reset is invalid. If virtual reset is used in the configuration, the activation code must be set in Network Settings, otherwise the configuration cannot be confirmed.

Application of Input/Output Wiring and EDM/AVM

3.1 Sink/Source Input Configuration

The 24V DC input group of XS/SC26 and SC10-2 can be switched to Sinking or Sourcing through the common terminal (COM) wiring method:

Sinking input: COM connected to 0V, suitable for PNP sensors (high level effective).

Sourcing: COM connected to+24V, suitable for NPN sensors (low level active).

Each group of inputs has independent COM terminals that can be configured in a mixed manner. Note that this option is not available for communication input (1764-24AWA base).

3.2 External Device Monitoring (EDM) and Adjustable Valve Monitoring (AVM)

To achieve Category 4/PL e, it is strongly recommended to enable EDM on safe output. EDM monitors the forced disconnection of NC contacts on external contactors or valves, and checks whether the contacts are truly disconnected after the safety output is closed. If no closure is detected within 250 ms, the controller enters a latch and displays fault 3.2.

AVM is suitable for monitoring devices that may slow down, such as single/double solenoid valves. The AVM input must become high within the set time (50 ms~5 s) after the safety output is turned off, otherwise an error of 2.25 will be reported. When using AVM, the output will not turn on until the AVM input meets the conditions - this will result in additional ON delay, which must be considered in the design.

3.3 Common Line Resistance and Latch Mistriggering

When the solid-state safety output is turned off, its terminal voltage must be lower than 1.7 V relative to the module's 0V terminal. If the 0V common line is too long or too thin, the load current will cause the voltage drop to increase, causing the controller to misjudge that the output is not turned off and trigger a latch. Countermeasure: Use thicker wires (above 14 AWG), shorten the distance, or use single point grounding (as shown in Figure 42 of the manual).

Troubleshooting of Industrial Ethernet Communication Malfunctions

XS/SC26 supports EtherNet/IP, Modbus TCP, and PROFINET starting from FID 2; Add EtherCAT (requiring XSeCAT gateway) for FID 6 and above. SC10-2 supports the above protocol from FID 1. In actual debugging, communication failures are mostly caused by the following reasons:

4.1 IP Address Conflict and Firewall

The factory default IP is 192.168.0.128/24. When using Ethernet for the first time, it is necessary to first connect via USB, select "Enable Network Interface" in the software, set a unique IP address, and send it to the controller. Important: If multiple controllers are connected to the network using the default IP, you can click the "Flash LED" button in the software (to make the corresponding controller LED flash) to identify the physical device.

The PC side must allow the Banner Safety Controller software to pass through the Windows Firewall (Domain/Private/Public three checkboxes). If the authorization is cancelled during the first startup, you need to manually add xs26.exe in the "allowed applications" section.

4.2 EDS files and Assembly instances

When adding banner devices in the Rockwell system, the correct EDS file must be selected based on the controller's FID (Feature ID) and date code. The manual provides a detailed comparison table (see the original document table "Which XS/SC26 EDS file..."). Common error: Used "VI Status/Fault" connection, but the controller does not support virtual input (FID 1); Or "VRCD plus ISD" was used, but the controller does not support ISD. At this time, the PLC will report a connection timeout or size mismatch.

The recommended minimum RPI (Request Packet Interval) is 100 ms. The data format must be INT and DINT cannot be used.

4.3 PROFINET device name and IP

PROFINET controllers (such as Siemens S7-1200/1500) are assigned IP addresses based on device names. Although the Banner controller has a default IP address of 192.168.0.128 when first powered on, the PROFINET bus may overwrite it with zero. Correct approach: First, enable the PROFINET protocol in the software and write the configuration via USB. Then, use PLC software (such as TIA Portal) to execute "Assign device name" and assign the target name to the MAC address of the controller. Afterwards, the IP is dynamically allocated by the PLC.

4.4 EtherCAT State Machine

XSeCAT gateway supports EtherCAT, but PDO allocation can be customized. If the PLC master station requires specific TxPDO/RXPDO, the required PDO (such as ISD chain status) can be checked through the "Industrial Ethernet" tab of the software. Please note that before downloading the configuration, the PLC should place the EtherCAT module in the Initiat or PREOP state, otherwise the module may enter an error state and require a power outage and restart.

Quick search for fault codes and system reset

When the safety controller detects input, output, or system faults, it will enter a lockout state and all affected outputs will be turned off. Fault codes can be read through the panel (with display model) or software Live Mode. The following are the most commonly encountered codes and solutions on site:

Common causes and solutions for displaying fault code information

2.1/2.2 Concurrent/Simultaneous Fault: The time difference between the changes in the two signals of the dual channel input exceeds 3 seconds (or the simultaneity requirement is not met). Check if the wiring is loose, adjust the filtering time of the input signal (Debounce), or check the sensor itself.

2.8-2.9 Input stuck high: The input terminal is short circuited to the power supply. Check if the circuit is in contact with+24V or if there is an internal fault in the input device.

3.1-3.2 EDM Fault External device monitoring contacts did not close/open as expected. Check if the contactor is stuck and if the coil is disconnected.

4.1 Supply Voltage Low 24V power supply voltage drops by more than 6 ms. Check the power supply capacity and output load for excessive load.

4.20 Unassigned Terminal in Use detected 24V for terminals that are not mapped in the configuration. Check if the wiring is incorrect or if the running configuration is consistent with the physical wiring.

1.1 Output Fault (Solid state) The safety output still detects voltage when turned off. Usually it is due to excessive voltage drop of the 0V common line (see 3.3).

Recovery steps:

Input latch: After repairing the fault, turn on and off the input device again to clear it.

Output latch (including EDM/AVM faults): After repairing the fault, operate the reset input connected to the output FR node.

System latch (e.g. 4.20): After fixing the cause, perform a system reset - this can be done through the reset input configured as System Reset, or by clicking "System Restart" in the software (when connected via Ethernet), or by powering off and then on again.

Practical case: Silent function and two-level manual reset

6.1 Requirements

A robot welding workstation, with an entrance protected by a light curtain, needs to achieve one-way silence: when the workpiece enters from the conveyor belt, the light curtain automatically silences, and the protection is restored after the workpiece passes through. At the same time, it is required that the operator press the "allow entry" button on the side of the machine before manually resetting the safety circuit.

6.2 Configuration Points

Input device:

Light curtain (PNP, dual channel) → IN1, IN2.

Silent sensor 1 (M1) and silent sensor 2 (M2) → IN9/IN10 and IN11/IN12.

Manual reset button (non safety) → a normal input.

Function block:

Add a Muting block and select 'One Way Muting, 2 Muting Sensor pairs'.

Connect the light curtain to the IN node of the Muting block, and connect M1/M2 to the MP1/MP2 nodes respectively.

Connect the output of the Muting block to the secure output SO1.

Check LR (Latch Reset) and FR (Fault Reset) in the attribute of safe output SO1, and connect the manual reset button to both LR and FR nodes (via a Reset OR block).

Timing verification:

The workpiece triggers M2 → M1 → departure in sequence, the light curtain is muted, and the output remains ON.

If the mute timeout (default 30 seconds) or sensor sequence error occurs, the output will be turned off and manual reset is required.

If the light curtain is blocked during non silent periods, the output will be immediately turned off and manually reset.

6.3 Details that are easily overlooked during debugging

The mute sensor must be dual channel, and both channels must be turned on simultaneously within 3 seconds, otherwise the mute cannot be activated (Manual I.2).

Mute Enable is optional. If enabled, additional input signals are required to allow mute - suitable for situations where workpieces are only allowed to enter during certain stages of the machine cycle.

The mute lamp is a physical state output that can be configured to flash or stay on, indicating the mute activation status. According to the standard, the operator must be able to see the indication from the location of the silent device.