Beckhoff TwinSAFE — ComErr/FbErr & ERR_ACK Reset

Beckhoff · advanced · 30 min

A Beckhoff EL6900 TwinSAFE group fault stops all its function blocks and drives outputs safe. Read the ComErr/FbErr diagnostics, fix the discrepancy or connection, then reset via the group's ERR_ACK input.

⚠️ A TwinSAFE group error takes the whole group to the safe state on purpose. Resolve the discrepancy or communication fault it detected, then acknowledge with ERR_ACK — never bypass a safe TwinSAFE output.

What a TwinSAFE group fault does

Beckhoff TwinSAFE builds a safety application from an EL6900 TwinSAFE Logic terminal running certified Boolean function blocks, with safe inputs (e.g. EL1904) and safe outputs (e.g. EL2904). When an error occurs — either TwinSAFE communication within the group or an error within a function block — it affects the complete TwinSAFE group: the group stops all associated function blocks and switches their outputs into the safe state. So a single fault safely shuts down the whole group, which is by design.

Read the diagnostic outputs

The EL6900 provides diagnostic outputs that tell you the class of error:

• ComErr (Communication Error) — an error in the connection between the EL6900 and one of the safe I/O cards (EL1904 / EL2904). Points at the safety-over-EtherCAT (FSoE) link or a missing/faulted safe terminal.
• FbErr (Function Block Error) — an error inside a function block, such as a two-channel discrepancy on an input pair or a feedback-loop error.

Read these (and the terminal's own diagnostics in TwinCAT) to know whether you're chasing a connection problem or a logic/discrepancy problem.

Fix the cause

• ComErr: check the EtherCAT/FSoE connection to the flagged EL1904/EL2904 — the terminal's presence, its FSoE address, and that it's reaching OP. A dropped or misaddressed safe terminal breaks the group.
• FbErr (discrepancy): for a two-channel input, the two channels disagreed beyond the monitored discrepancy time — inspect both channels of the E-stop/guard device and their wiring; both must switch together. For a feedback loop (EDM), check the monitored contactor/valve feedback.

Reset with ERR_ACK

Once the cause is eliminated, the error is cleared by an acknowledge: the error reset is carried out via the ERR_ACK input of the related TwinSAFE group. Drive a signal (typically an operator acknowledge routed into the safety project) to the group's ERR_ACK to clear the fault and let the group return to operation.

• The engineering tools are TwinCAT 3.1 and the TwinSAFE Loader; use them to read the project, the diagnostics, and confirm the group state.

Step-by-step

1. Read ComErr / FbErr (and TwinCAT diagnostics) to classify the fault.
2. ComErr: restore the EtherCAT/FSoE connection to the flagged safe terminal (presence, address, OP state).
3. FbErr: fix the two-channel discrepancy (both input channels) or the feedback-loop condition.
4. Acknowledge via the group's ERR_ACK input once the cause is gone.
5. Verify the group resumes and outputs leave the safe state; re-validate the safety functions.

Never do this

Do not defeat a safe input channel or force a safe output to clear ComErr/FbErr. The discrepancy and communication checks exist to catch exactly these faults; acknowledge only after the real cause is fixed, and re-validate the safety functions.