Content      ..      1       2         ..

SINUMERIK 840D sl. Service - Safety Integrated. Manual (2020) - page 1

Regulations and standards

2.2 Machine safety in Europe

from the basic and group standards. Type C/product standards have the highest priority for

machine manufacturers who can assume that it fulfills the basic requirements of Annex I of the

Machinery Directive (automatic presumption of compliance). If no product standard has been

defined for a particular machine, type B standards can be applied when the machine is being

constructed.

A complete list of the standards and the mandated draft standards are available on the Internet

at the following address:

http://www.newapproach.org/

Recommendation: Due to the rapid pace of technical development and the associated changes

in machine concepts, the standards (and C standards in particular) should be checked to ensure

that they are up to date. Where appropriate, note that the application of a particular standard

may not be mandatory provided that all the safety requirements of the applicable EU directive

are fulfilled.

2.2.3

Standards for implementing safety-related controls

If the functional safety of a machine depends on various control functions, the controller must

be implemented in such a way that the probability of the safety functions failing is sufficiently

minimized. The standards EN ISO 13849-1 and EN 62061 define guidelines for implementing

safety-related machine controls which, when properly applied, ensure that all the safety

requirements of the EC Machinery Directive are fulfilled. These standards ensure that the

relevant safety requirements of the Machinery Directive are fulfilled.

$Q\ DUFKLWHFWXUHV

'HILQHG DUFKLWHFWXUHV UHVWULFWHG

DOO 6,/

IURP 3/ E

PD[LPXP 3/ IRU HOHFWURQLFV

(1b

(1 ,62

6DIHW\ RI PDFKLQHU\

6DIHW\ RI PDFKLQHU\

)XQFWLRQDO VDIHW\ VDIHW\ UHODWHG

6DIHW\ UHODWHG SDUWV RI FRQWURO V\VWHPV

HOHFWULFDO HOHFWURQLF DQG SURJUDPPDEOH

HOHFWURQLF FRQWURO V\VWHPV

6HFWRU VWDQGDUG (1

IRU

)RU GHYLDWLRQV IURP WKH GHILQHG

WKH DUHD RI PDFKLQHV EHORZ

DUFKLWHFWXUHV UHIHUHQFH WR

(1

(1

8QLYHUVDO DSSURDFK IRU HOHFWULFDO HOHFWURQLF DQG SURJUDPPDEOH HOHFWURQLF V\VWHPV WKDW

H[HFXWH VDIHW\ IXQFWLRQV RU WKDW JXDUDQWHH IXQFWLRQDO VDIHW\

(1b

)XQFWLRQDO VDIHW\ VDIHW\ UHODWHG HOHFWULFDO HOHFWURQLF SURJUDPPDEOH HOHFWURQLF FRQWURO

V\VWHPV 3DUW WR

Safety Integrated (system-integrated)

22

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Regulations and standards

2.2 Machine safety in Europe

used to eliminate hazards as far as possible and so that the appropriate protective measures can

be taken.

Risk assessment encompasses the following

• Risk analysis

a) Determining the machine limits

b) Identifying hazards

c) Techniques to estimate risk

• Risk evaluation

As part of the iterative process to achieve the appropriate degree of safety, after the risk has been

analyzed the risk is assessed. A decision must then be made as to whether the residual risk needs

to be reduced. If the risk is to be further reduced, suitable protective measures must be selected

and applied. The risk assessment must then be repeated.

67

$57

'HWHUPLQLQJ WKH PDFKLQH OLPLWV

,GHQWLI\LQJ WKH SRWHQWLDO KD]DUG

5LVN DQDO\VLV

5LVN DVVHVVPHQW

5LVN HVWLPDWLRQ

5LVN HYDOXDWLRQ

<HV

,V WKH PDFKLQH VDIH

(1'

1R

5LVN PLQLPL]DWLRQ

0LQLPL]LQJ ULVNV DQG VHOHFWLQJ VXLWDEOH SURWHFWLYH PHDVXUHV DUH QRW SDUW RI WKH ULVN DVVHVVPHQW

Figure 2-1

Iterative process to achieve the required level of safety according to DIN ISO 12100

Risks must be reduced by suitably designing and implementing the machine - for instance a

control system or protective measures suitable for the safety-related functions.

If the protective measures involve the use of interlocking or control functions, these must be

designed in accordance with EN ISO 13849-1. For electrical and electronic controls, EN 62061

can be used as an alternative to EN ISO 13849-1. Electronic controls and bus systems must also

comply with EN 61508.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

27

Regulations and standards

2.6 Other safety-related issues

Instead of legal requirements to apply standards have been defined, an administrative

recommendation to apply JIS (Japanese Industrial Standard) is in place. Japan bases its approach

on the European concept and uses basic standards as national standards:

Table 2-1

Japanese standards

ISO/IEC number

JIS number

Comment

ISO12100 (EN 1050)

JIS B 9700, JIS B 9702

Earlier designation TR B 0008 and TR B 0009

ISO13849-1

JIS B 9705-1

-

ISO13849-2

JIS B 9705-1

-

IEC 60204-1

JIS B 9960-1

Without annex F or route map of the European

foreword

IEC 61508-0 to -7

JIS C 0508

-

IEC 62061

-

JIS number not yet assigned

2.5

Equipment regulations

In addition to the requirements of the guidelines and standards, company-specific requirements

must be taken into account. Large corporations in particular (e.g. automobile manufacturers)

make stringent demands regarding automation components, which are often listed in their own

equipment specifications.

Safety-related issues (e.g. operating modes, operator actions with access to hazardous areas,

EMERGENCY STOP concepts, etc.) should be clarified with customers early on so that they can be

integrated in the risk assessment/risk reduction process.

2.6

Other safety-related issues

2.6.1

Information sheets from the various regulatory bodies

Safety-related measures to be implemented cannot always be derived from directives, standards

or regulations. In this case, supplementary information and explanations are required.

Some regulatory bodies issue publications on a wide range of subjects and topics. Information

sheets covering the following areas are available, for example:

• Process monitoring in production environments

• Axes subject to gravitational force

• Roller pressing machines

• Lathes and turning centers - purchasing/selling

These information sheets handling specific subjects and issues can be ordered from all parties

interested - e.g. for providing support in plants and factories, when drawing-up regulations or

for implementing safety-related measures at machines, plants and systems. These information

sheets provide support in machinery construction, production systems, steel construction.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

31

Brief description

3

3.1

Control/drive systems

In order to implement safety-related measures, up until now, external equipment and devices

were used - e.g. contactors, switches, cams and monitoring devices. If a hazardous situation is

detected, these devices generally interrupt the power circuit using contacts, thus stopping

motion.

([WHUQDO

6DIHW\ WHFKQRORJ\

&1&

'ULYH

UHJXODWRU

'ULYH

UHJXODWRU

,QWHJUDWHG

VDIHW\

WHFKQRORJ\

([WHUQDO

6DIHW\ WHFKQRORJ\

0

0

Figure 3-1

Safety technology: External -> integrated

With the integration of safety functions, drive systems and CNC controls perform safety

functions in addition to their functional tasks. Very short response times can be achieved

because of the short data paths from acquisition of the safety-related information - e.g. speed

or position - up to evaluation.

The systems with integrated safety technology generally respond very quickly when the

permissible limit values are violated, e.g. position and velocity limit values. They can be of

decisive importance for the required monitoring result. The integrated safety technology can

directly access the power semiconductors in the drive controller without using

electromechanical switching devices in the power circuit. This helps reduce the susceptibility to

faults - and the integration also reduces the amount of cabling.

A combination of safety technology integrated in the system and drive can be used for each axis

at a machine tool (SINAMICS Basic Safety functions).

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

33

Brief description

3.2 Safety technology integrated in the system

3.2

Safety technology integrated in the system

SINUMERIK Safety Integrated

Using the SINUMERIK Safety Integrated function, for SINUMERIK 840D sl, for all power/

performance classes, integrated safety functions are available in conjunction with the SINAMICS

S120 drive system; these are used to monitor standstill (zero speed), velocity and position.

SINAMICS S120 is used in conjunction with 1FT6/1FK6/1FK7 three-phase servomotors and 1FN

linear motors for feed drives as well as 1FE and 1PH motors for main spindle drives.

The safety-related sensors and actuators are connected through distributed I/O via PROFIBUS DP,

PROFINET with the PROFIsafe profile, e.g. ET 200S, ET 200pro, ET 200eco, DP/AS-i F-Link.

This means that a complete digital system is available that is suitable for complex machining

tasks.

A two-channel, diverse system structure is formed on the basis of an existing multi-processor

structure.

VDIH

3/&

VDIH

VHQVRUV

DFWXDWRUV

63/ &'&

&URVVZLVH

&RPP &'&

'DWD FRPSDULVRQ

1&.

&URVVZLVH

$[LV &'&

'DWD FRPSDULVRQ

0HDVXUHG YDOXH

V\VWHP

'ULYH FRQWURO

6ZLWFK RII VLJQDO SDWKV

&URVVZLVH

'ULYH &'&

'DWD FRPSDULVRQ

%UDNH

0RWRU 0RGXOH

FRQWURO

0RWRU

6DIHW\ UHOHYDQW PRQLWRULQJ IXQFWLRQV

Figure 3-2

Evaluation/logic with monitoring functions

Safety Integrated (system-integrated)

34

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Brief description

3.3 Safety technology integrated in the drive

([WHUQDO

VDIH

VDIH

VDIH

VHQVRUV

ORJLF

DFWXDWRUV

'ULYH FRQWURO

6ZLWFK RII VLJQDO

'ULYH &'&

SDWK

%UDNH

0RWRU 0RGXOH

FRQWURO

0RWRU

6DIHW\ UHOHYDQW PRQLWRULQJ IXQFWLRQV

Figure 3-3

Safety functions integrated in the drive in conjunction with SINUMERIK

Features of the two-channel, diverse structure

A two-channel, diverse structure is characterized by the following features:

• Two-channel structure with at least 2 independent computers (i.e. computers with different

hardware and software).

• Crosswise result and data comparison with forced checking procedure for the purpose of

detecting internal errors even in functions that are not often used (dormant errors).

Detecting

In order to connect sensors and actuators in a safety-related fashion, their process signals must

be connected for further processing.

Evaluating

The two drive CPUs independently execute the safety-related functions. The CPUs cyclically and

mutually compare their safety-related data and results (crosswise data comparison). A test can

be carried out - initiated by the CPUs - to check the switch-off signal paths and actuators (forced

checking procedure).

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

37

Brief description

3.4 Comparison of the function names

Reacting

When the integrated safety-related functions respond, the drive processors can act on the

connected actuators in a safety-related fashion in-line with the actual situation. For example,

the appropriate stop responses for the drives can be initiated and/or the brakes activated.

3.3.1

Overview of the safety functions integrated in the drive

The safety functions are available in all modes and can communicate with the process using

safety-oriented input/output signals. They can be implemented for each individual axis and

spindle.

• Safe Torque Off (STO)

Drive pulses are canceled, resulting in safe electronic interruption of the energy supply

• Safe Brake Control (SBC)

The brake is directly controlled at the Motor Module ⇒ through two channels, and is

monitored

• Safe Stop 1 (SS1)

Braking along the OFF3 ramp, monitoring the stopping time and transition into STO

3.4

Comparison of the function names

SINUMERIK Safety Integrated functional name

Function name according to EN 61800-5-2

German

English

Abbr.

German

English

Abbr.

Safe standstill

Safe standstill

SH

Safe Torque Off

Safe Torque Off

STO

(STOP A)

(STOP A)

STOP B

STOP B

-

Safe Stop 1

Safe Stop 1

SS1

STOP C

STOP C

-

Safe Stop 2

Safe Stop 2

SS2

STOP D

STOP D

-

Safe Stop 2 ¹⁾

Safe Stop 2

SS2

STOP E

STOP E

-

Safe Stop 2 ²⁾

Safe Stop 2

SS2

Safe Acceleration

Safe Acceleration Moni-

SBR

-

-

-

Monitor

tor

Safe Operating Stop

Safe Operating Stop

SBH

Safe Operating Stop

Safe Operating Stop

SOS

Safely reduced speed

Safely reduced speed

SG

Safely-Limited Speed

Safely-Limited Speed

SLS

SG-specific setpoint

Safely reduced speed -

-

-

-

-

limiting

specific setpoint limit-

ing

Safe software limit

Safe software limit

SE

Safely Limited Position

Safely-Limited Position

SLP

switch

switch

Safe Brake Manage-

Safe Brake Manage-

SBM

-

-

-

ment

ment

Safe Brake Control

Safe Brake Control

SBC

Safe Brake Control

Safe Brake Control

SBC

Safe brake test

Safe Brake Test

SBT

-

-

-

Safe software cam or

Safe software cam, Safe

SN

Safe Cams

Safe Cams

SCA

cam track

Cam Track

Safety Integrated (system-integrated)

38

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Brief description

3.4 Comparison of the function names

SINUMERIK Safety Integrated functional name

Function name according to EN 61800-5-2

German

English

Abbr.

German

English

Abbr.

n < n_x

n < n_x

-

Safe Speed Monitor

Safe Speed Monitor

SSM

Safety-relevant input/

Safety-related I/O

SGE/SGA

-

-

-

output signals

F-DI/F-DO

Safe Programmable

Safe Programmable

SPL

-

-

-

Logic

Logic

Safe software relay

Safe software relay

-

-

-

-

1) For the drive-based safety functions of SINAMICS, this involves a delayed SOS

2) For the drive-based safety functions of SINAMICS, this involves a delayed SOS with previous initiation of ESR (extended

stopping and retraction)

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

39

System features

4

4.1

System requirements

• Software option "SINUMERIK Safety Integrated"

SI-Basic (including 1 axis/spindle, up to 4 SPL I/Os)

6FC5800-0AM63-0YB0

SI-Comfort (including 1 axis/spindle, up to 64 SPL I/Os)

6FC5800-0AM64-0YB0

SI-axis/spindle (in addition for each axis /spindle)

6FC5800-0AC70-0YB0

SI axis/spindle package (in addition, 15 axes/spindles)

6FC5800-0AC60-0YB0

SI-High Feature (including 1 axis/spindle to 192 SPL I/O)

6FC5800-0AS68-0YB0*

SI Connect (16 safe connections)

6FC5800-0AS67-0YB0

* only for NCU 720.x and NCU 730.x

• SINUMERIK 840D sl; software release:

From 1.3.1 for safety functions integrated in the drive (SH/SBC via terminals, Chapter 4)

From 1.3.2 for safety functions integrated in the system (Chapters 5 to 7)

• Step7, V5.5

WARNING

Firmware versions

In a system configuration, the firmware versions of the DRIVE-CLiQ components can only differ

from the versions on the CF card, if either

a) The automatic upgrade/downgrade (parameter p7826) is deactivated, or

b) components with a new firmware version can no longer be downgraded to the status of the

version available on the CF card.

Case a) is not permitted when Safety Integrated is used. The automatic upgrade/downgrade

must never be disabled when Safety Integrated is used. (automatic firmware update (p7826)

must be equal to 1)

Case b) is only permissible if this combination has been explicitly approved by the

manufacturer.

• SINUMERIK 840D sl; all NCU types can be used

• The measuring circuit cables must comply with the specifications of the SINAMICS S120.

• Safety-related devices/modules, that correspond to open-type devices according to UL 50,

may only be operated in enclosure-type housings/cabinets that have as a minimum degree

of protection IP54 in accordance with EN 60529. Further, chassis units with degree of

protection IP20 and IPXXB should be operated corresponding to EN 60529 in higher-level

enclosures.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

41

System features

4.2 Current information

4.2

Current information

Important note for maintaining the operational safety of your system.

WARNING

Plants and systems with the safety-relevant characteristics

Systems with safety-related characteristics are subject to special operational safety

requirements on the part of the operating company. The supplier is also obliged to maintain

certain measures regarding his product. For this reason, we publish a special newsletter

containing information on product developments and features that are (or could be) relevant

when operating safety-related systems. You should subscribe to the corresponding newsletter

in order to obtain the latest information and to allow you to modify your equipment

accordingly.

Go into the Internet at:

http://automation.siemens.com

Note

You have to register and log in if you want to subscribe to the newsletter. You will be led

automatically through the registration process.

To subscribe to the newsletter, please proceed as follows:

1. Select the desired language for the web page.

2. Click on the menu item "Support".

3. Click on the menu item "Newsletter".

4. Click on "Login" and log in with your access data. If you do not yet have a login and password,

select "Yes, I would like to register now".

You can subscribe to the individual newsletters in the following window.

5. Select the document type you wish to be informed about under "Select document type for

topic and product newsletters".

6. Under the "Product Support" heading on this page, you can see which newsletter is currently

available.

7. Open the subject area "Safety Engineering - Safety Integrated". You will now be shown which

newsletter is available for this particular subject area or topic. You can subscribe to the

appropriate newsletter by clicking on the box. If you require more detailed information on the

newsletters then please click on these. A small supplementary window is opened from where

you can take the appropriate information.

Your subscription should cover the following product areas:

• SINUMERIK Safety Integrated

• SINAMICS Safety Integrated

• SIMOTION Safety Integrated

• SIMATIC S7-300

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

43

System features

4.5 Safety information & instructions and residual risks

DANGER

Power Drive Systems

The control and drive components of a power drive system (PDS) are approved for industrial

and commercial use in industrial line supplies. Their use in public line supplies (public grids)

requires a different configuration and/or additional measures.

These components may only be operated in closed housings or in higher-level control cabinets

and when all of the protective devices and protective covers are used.

These components may only be handled by qualified and trained technical personnel who are

knowledgeable and observe all of the safety information and instructions on the components

and in the associated technical user documentation.

When carrying out a risk assessment of the machine in accordance with the EC Machinery

Directive, the machine manufacturer must consider the following residual risks associated with

the control and drive components of a Power Drive System.

1. Unintentional movements of driven machine components during commissioning,

operation, maintenance, and repairs caused by, for example:

- Hardware and/or software errors in the sensors, control system, actuators and

connection systems

- Response times of the control system and drive

- Operation and/or environmental conditions outside the specification

- Parameterization, programming, cabling, and installation errors

- Use of radio devices / cellular phones in the immediate vicinity of the control system

- External influences / damage

2. Exceptional temperatures as well as emissions of light, noise, particles, or gas caused by, for

example:

- Component malfunctions

- Software errors

- Operation and/or environmental conditions outside the specification

- External influences / damage

3. Hazardous touch voltages, e.g. as a result of:

- Component malfunctions

- Influence of electrostatic charges

- Induction of voltages in moving motors

- Operation and/or environmental conditions outside the specification

- Condensation/conductive contamination

- External influences / damage

4. Electrical, magnetic, and electromagnetic fields that can pose a risk to people with a

pacemaker and/or implants if they are too close.

5. Emission of pollutants if components or packaging are not disposed of properly.

For more information about residual risks, refer to the relevant chapters in the technical user

documentation.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

45

System features

4.5 Safety information & instructions and residual risks

4.5.2

Additional safety information & instructions and residual risks for Safety

Integrated

DANGER

Risk reduction for plants and machines

Safety Integrated can be used to minimize the level of risk associated with machines and plants.

Safe operation of the machine or plant with Safety Integrated is however only possible if the

machine manufacturer

• is familiar with and observes every aspect of this technical user documentation, including

the documented general conditions, safety information, and residual risks.

• Carefully constructs and configures the machine/plant. A careful and thorough acceptance

test must then be performed by qualified personnel and the results documented.

• Implements and validates all the measures required in accordance with the machine/plant

risk analysis by means of the programmed and configured Safety Integrated Functions or by

other means.

Depending on the risk assessment of the machine or plant, the safety information &

instructions and residual risks listed in this documentation must also be assigned, when

required, to a hazardous level other than that specified in this documentation.

The use of Safety Integrated does not replace the risk assessment of the machine or plant

to be performed by the machine manufacturer as specified in the EC machinery directive!

In addition to Safety Integrated, further risk reduction measures must be implemented.

Safety Integrated (system-integrated)

46

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

System features

4.5 Safety information & instructions and residual risks

As a result of the fault analysis, the machine manufacturer is in a position to define the residual

risk at his machine regarding Safety Integrated. The following residual risks are known.

WARNING

Additional residual risks

•

Safety Integrated is only activated if all of the system components are powered-up and have

been booted.

•

Faults in the absolute track (C-D track), cyclically interchanged phases of motor connections

(V-W-U instead of U-V-W) and a reversal in the control direction can cause an increase in the

spindle speed or axis motion. Category 1 and 2 Stop functions according to EN 60204-1

(defined as Stop B to E in Safety Integrated) that are provided, are however not effective due

to the fault.

Category 0 stop function according to EN 60204-1 (defined as STOP A in Safety Integrated)

is not activated until the transition or delay time set via machine data has expired. When SBR

is active, these errors are detected (STOP B/C) and the Category 0 stop function according

to EN 60204-1 (STOP A in Safety Integrated) is activated as early as possible irrespective of

this delay (see Chapter "Safe Acceleration Monitor (Page 133)"). Electrical faults (defective

components etc.) can also result in the response described above.

•

When incremental encoders are used, the functions "Safe software limit switches" (SE) and

"Safe software cams or cam tracks" (SN) can only be used after referencing has been

successfully completed.

•

When no user agreement has been given (see Chapter "User agreement (Page 92)", "User

agreement"), the safe software limit switches (SE) are not active; the safe software cams or

cam tracks (SN) are active, but are not safe in the sense of Safety Integrated.

•

The simultaneous failure of two power transistors (one in the upper and the other offset in

the lower inverter bridge) in the inverter may cause the axis to move briefly.

The maximum movement can be:

Synchronous rotary motors: Max. movement = 360° / no. of pole pairs

Synchronous linear motors: Max. movement = pole width

Example: Synchronous motor:

For a 6-pole synchronous motor, the axis can move by a maximum of 60 degrees. With a

ballscrew that is directly driven by, e.g. 20 mm per revolution, this corresponds to a

maximum linear motion of approximately 3.33 mm.

Example, synchronous linear motor:

For a synchronous linear motor, the movement can be a maximum of one pole width. This

corresponds to the following distances:

1FN1-07: 27 mm

1FN1-12/-18/-24: 36 mm

1FN3: 20 mm

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

47

System features

4.5 Safety information & instructions and residual risks

WARNING

Additional residual risks

•

The "Automatic restart" function of SINAMICS S120 must not be used in conjunction with

safety functions since this is prohibited in EN 60204-1, Chapter 9.2.5.4.2. (Deselecting a

safety shutdown function alone must not result in the machine restarting.)

•

Encoder faults are detected using various hardware and software monitoring functions. It

is not allowed to disable these monitoring functions and they must be parameterized

carefully. Depending on the fault type and which monitor responds, a Category 0 or

Category 1 stop function according to EN 60204-1 (defined as STOP A or B in SINUMERIK

Safety Integrated) is activated.

•

The Category 0 stop function according to EN 60204-1 (defined as STOP A in Safety

Integrated) means that the spindles/axes are not braked to zero speed, but coast to a stop

(this may take an appropriately long time depending on the level of kinetic energy involved)

or can even be accelerated by drawing/pulling loads. This must be integrated in the

protective door interlocking logic e.g. using logic operation n<n_x.

•

When a limit value is violated, the speed may exceed the set value briefly or the axis/spindle

may overshoot the setpoint position to a greater or lesser degree during the period between

error detection and system response. This depends on the dynamic response of the drive

and the parameters/machine data settings that have been entered (see Chapter, "System/

drive integrated safety functions").

•

A position-controlled axis may be forced out of the Safe Operating Stop state (SBH) by

mechanical forces that are greater than the maximum torque of the drive motor. In such

cases, a stop function, Category 1 according to EN 60204-1 (STOP B) is activated.

•

Safety Integrated is not capable of detecting parameterization and programming errors

made by the machine manufacturer. The required level of safety can only be assured by

careful acceptance testing.

•

Safety Integrated is not capable of detecting parameterization and programming errors

made by the machine manufacturer. The required level of safety can only be assured by

careful acceptance testing.

•

Motor modules and motors must always be replaced with the same equipment type. If this

is not the case, the parameters will no longer match the actual configuration - causing

Safety Integrated to respond incorrectly. When an encoder is replaced, the axis involved

must be re-calibrated.

•

If an internal or external fault occurs, none or only some of the parameterized safety

functions are available during the STOP-F response as a result of the fault. This must be

taken into account when a delay time between STOP F and STOP B is parameterized. This

applies in particular to vertical axes.

•

An additional residual risk is obtained as a result of the possible random hardware faults for

electronic systems, arising from their very principle, which is expressed using this PFH value.

Safety Integrated (system-integrated)

48

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

System features

4.5 Safety information & instructions and residual risks

WARNING

Additional residual risks

• If, for a 1-encoder system,

a) A single electrical fault in the encoder or

b) A broken encoder shaft (or loose encoder shaft coupling) - or a loose encoder housing will

cause a static state of the encoder signals (that is, they no longer follow a movement while

still returning a correct level), and prevent fault detection while the axis is in a stop state

(e.g. in SBH). Generally, the axis is held by the active closed-loop control. Especially for

vertical (suspended) axes, from a closed-loop control-related perspective, it is conceivable

that such an axis could move downwards without this being detected. The risk of an

electrical fault in the encoder as described under a) is only present for few encoder types

employing a specific principle of operation (for example, encoders with microprocessor-

controlled signal generation such as the Heidenhain EC/EQI series, Hübner HEAG 159/160,

AMO measuring systems with sin/cos output).

All of the faults described above must be included in the risk analysis of the machine

manufacturer. Additional safety measures have to be taken at suspended/vertical axes or for

handling pulling loads in order to exclude faults as described in a) for example:

- Use an encoder with analog signal generation or

- Use a 2-encoder system, and to rule-out the fault under b):

- Carry out an FMEA regarding encoder shaft breakage (or the encoder shaft coupling

slips) or if the encoder housing becomes loose and apply a fault exclusion process

according to e.g. EN 61800-5-2 or

- Use a 2-encoder system (in this case it is not permissible that the encoders are mounted

on same shaft).

A list of the Siemens encoders and motors permissible for Safety Integrated Functions can

be obtained from your local SIEMENS contact partner.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

49

Safety Functions integrated in the drive

5.1 General information about SINAMICS Safety Integrated

Switch-off signal paths

Two independent switch-off signal paths are available. All switch-off signal paths are low active.

This ensures that the system is always switched to a safe state if a component fails or in the event

of cable breakage.

If a fault is discovered in the switch-off signal paths, the "Safe Torque Off" function is activated

and a system restart inhibited.

Monitoring cycle

The safety-relevant drive functions are executed cyclically in the monitoring cycle.

The safety monitoring clock cycle is a minimum of 4 ms. Increasing the current controller cycle

(p0110[0]) also increases the safety monitoring clock cycle.

Crosswise data comparison

The safety-relevant data in the two monitoring channels are cyclically subject to a crosswise

comparison.

If any data is inconsistent, a stop response is triggered with any Safety function.

Overview of parameters (see SINAMICS S120/S150 List Manual)

• r9780 SI monitoring clock cycle (Control Unit)

• r9880 SI monitoring clock cycle (Motor Module)

Juxtaposition of function names

SINUMERIK

SINAMICS (acc. to EN 61800-5-2)

Abbreviation

Name

New abbrevi-

New name

ation

SH

Safe standstill

STO

Safe Torque Off

SGA

Safety-related output

F-DO

Failsafe Digital Output

SGE

Safety-related input

F-DI

Failsafe Digital Input

5.1.2

Supported functions

The functions listed here are in conformance with the IEC 61508, SIL2 standard, in the operating

mode with a high demand, Category 3 and Performance Level d acc. to ISO 13849-1 (2006) as

well as IEC 61800-5-2.

Safety Integrated (system-integrated)

52

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Safety Functions integrated in the drive

5.2 Safety instructions

• In defined cycles (e.g. every 8 hours).

• In the automatic mode, dependent on time or a specific event

5.2

Safety instructions

Safety notices

WARNING

System power-up and drive activation after changing or replacing hardware and/or

software

After hardware and/or software components have been modified or replaced, it is only

permissible for the system to run up and the drives to be activated with the protective devices

closed. It is not permissible that personnel are present within the danger zone.

Depending on the change made or what has been replaced, it may be necessary to carry-out

a partial or complete acceptance test.

Before personnel may re-enter the hazardous area, the drives should be tested to ensure that

they exhibit stable control behavior by briefly moving them in both the plus and minus

directions (+/-).

Please note the following when switching on:

The safety functions are only available and can only be activated after the system has

completely booted (powered-up).

WARNING

Drive coasts down with STO or STOP A

The Category 0 stop function according to EN 60204-1 (defined as STO in Safety Integrated)

means that the drives are not braked to zero speed, but coast to a stop (this may take some time

depending on the level of kinetic energy involved). This must be included in the protective door

interlocking logic, e.g. with the logic operation n < n_x.

WARNING

No detection of parameter assignment errors by Safety Integrated Functions

Safety Integrated is not capable of detecting parameterization errors made by the machine

manufacturer. The required level of safety can only be assured by thorough and careful

acceptance testing.

WARNING

Firmware update via p7826 = 1

The automatic firmware update via p7826 = 1 (upgrade and downgrade) must never be

deactivated under any circumstances when using Safety Integrated.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

57

Safety Functions integrated in the drive

5.3 Safe Torque Off (STO)

WARNING

Limited motion

If two power transistors in the power unit fail at the same time (one in the upper bridge and one

in the lower bridge of the inverter), this can cause brief, limited movement. The maximum

movement can be:

• Synchronous rotary motors: Max. movement = 180° / pole pair number

• Synchronous linear motors: Max. movement = pole width

CAUTION

"Automatic restart" function

The "automatic restart" function may not be used together with the safety functions STO/SBC

and SS1. The reason for this is that EN 60204-1 Chapter 9.2.5.4.2 does not permit this (merely

de-selecting a safety shutdown function must not cause the machine to restart).

Note

Deactivating all components, e.g. using p0105, with activated Safety functions is not permitted.

5.3

Safe Torque Off (STO)

In conjunction with a machine function or in the event of a fault, the "Safe Torque Off (STO)"

function is used to safely disconnect the torque-generating power feed to the motor.

After selecting the function, the drive device is in a "Safe state". The switching on inhibited

function prevents the drive unit from being restarted.

The two-channel pulse suppression function integrated in the Motor Modules / Power Modules

is the basis for this function.

Functional features of Safe Torque Off

• This function is integrated in the drive, i.e. a higher-level control is not required.

• The function is drive specific. This means that each drive has the function and it must be

individually commissioned.

• The function must be enabled using a parameter.

• When the Safe Torque Off function is selected, the following applies:

- The motor cannot be started accidentally.

- The safety-related pulse suppression safely disconnects the torque-generating energy

supply to the motor.

- the power unit and motor are not electrically isolated.

Safety Integrated (system-integrated)

58

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Safety Functions integrated in the drive

5.3 Safe Torque Off (STO)

• The selection/deselection of the STO function also acknowledges the safety faults when the

Basic Functions are used. The standard acknowledgment mechanism must also be

performed.

• The signals of the components connected at the terminals (e.g. pushbuttons, switches, ...)

can be debounced in order to prevent false tripping due to signal disturbances. The filter

times are set using parameters p9651 and p9851.

WARNING

Undesirable motor motion

Appropriate measures must be taken to ensure that the motor does not move once the motor

power supply has been disconnected ("coast down") (e.g. enable the "Safe Brake Control"

function for a vertical axis).

WARNING

Danger as a result of brief, limited motion

If two power transistors in the Motor Module fail at the same time (one in the upper and one

in the lower bridge of the inverter), this can cause brief, limited movement. The maximum

movement can be:

• Synchronous rotary motors: Max. movement = 180° / pole pair number

• Synchronous linear motors: Max. movement = pole width

• The status of the Safe Torque Off function is displayed using parameters.

Enabling the Safe Torque Off function

The Safe Torque Off function is enabled via the following parameters:

• STO via terminals:

- (p9601.0 = 1, p9801.0 = 1)

Selecting/deselecting Safe Torque Off

Safe Torque Off is selected as follows:

• Each monitoring channel triggers safe pulse suppression via its switch-off signal path.

• A motor holding brake is closed (if connected and configured).

Deselecting Safe Torque Off represents an internal safe acknowledgment. The following is

executed if the cause of the fault has been removed:

• Each monitoring channel cancels safe pulse suppression via its switch-off signal path.

• The safety prompt "Close motor holding brake" is canceled.

• Any active STOP F or STOP A commands are canceled (see r9772 / r9872).

• The messages in the fault memory must also be reset using the general acknowledgment

mechanism.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

59

Safety Functions integrated in the drive

5.4 Safe Stop 1 (SS1, time-controlled)

5.4.2

SS1 (time-controlled) with external stop

CAUTION

SS1 and controlled shutdown

In order to achieve stop Category 1 according to EN 60204-1 using function "SS1 (time-

controlled) with external stop (SS1E)", the higher-level control must facilitate a controlled

shutdown at the same time.

CAUTION

Any axis motion is possible

During the delay time (p9652), for "SS1 (time-controlled) with external stop", arbitrary axis

motion caused by the position controller is possible.

Differences between "Safe Stop 1 with OFF3 and with external stop"

"SS1 with OFF3" and "SS1 with external stop" have the following differences:

• In order to activate "SS1 with external stop", parameter p9653 must also be set = 1.

• When SS1 is selected, the drive is not braked along the OFF3 ramp, but after the delay time

has expired (p9652), only STO/SBC is automatically initiated.

5.4.3

Overview of important parameters

• p1135[0...n]

OFF3 ramp-down time

• p9652

SI Safe Stop 1 delay time (Control Unit)

• p9852

SI Safe Stop 1 delay time (Motor Module)

• r9772

SI status (Control Unit)

• r9773

SI status (Control Unit + Motor Module)

• r9774

SI status (group STO) / SI stat group STO

• r9872

SI status (Motor Module)

• p9653

SI Safe Stop 1 braking response integrated in the drive (only for "SS1

(time controlled) without OFF3"

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

63

Safety Functions integrated in the drive

5.5 Safe Brake Control (SBC)

5.5

Safe Brake Control (SBC)

Description

Safe Brake Control is used to control actuators that function according to the closed-circuit

principle (e.g. brake).

The command for releasing or applying the brake is transmitted to the Motor Module/Power

Module via DRIVE-CLiQ. The Motor Module then carries out the action and activates the outputs

for the brake.

Controlling the brake via the brake connection on the Motor Module is realized using a safety-

relevant, two-channel method.

Note

This function is only supported by chassis components that can be identified by the MLFB

ending ...xxx3. For this design, a Safe Brake Adapter is also needed.

To ensure that this function can be used for Blocksize Power Modules, a Safe Brake Relay must

be used. When the Power Module is configured automatically, the Safe Brake Relay is detected

and the motor holding brake type is preassigned (p1278 = 0).

WARNING

A brake fault was not detected

The Safe Brake Control function does not detect faults in the brake itself - such as e.g. brake

winding short-circuit, worn brakes and similar.

If a cable breaks, this is only recognized by the Safe Brake Control function when the status

changes, i.e. when the brake is closed/opened. An interrupted cable is not detected when using

SBA.

Functional features of Safe Brake Control (SBC)

• When Safe Torque Off is selected or when safety monitoring functions respond, SBC is

performed with safe pulse cancelation.

• Unlike conventional brake control, SBC is executed via p1215 through two channels.

• SBC is executed regardless of the brake control or mode set in p1215. However, SBC is not

recommended for p1215 = 0 or 3.

• The function must be enabled via parameter.

• When the state changes, electrical faults, such as e.g. a short-circuit in the brake winding or

wire breakage can be detected.

Safety Integrated (system-integrated)

64

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Safety Functions integrated in the drive

5.5 Safe Brake Control (SBC)

Enabling the Safe Brake Control (SBC) function

The Safe Brake Control function is enabled using the following parameters:

• p9602 "SI enable Safe Brake Control (Control Unit)"

• p9802 "SI enable Safe Brake Control (Motor Module)"

The Safe Brake Control function is only selected if at least one safety monitoring function is

enabled (i.e. p9601 = p9801 ≠ 0).

Two-channel brake control

Note

When the "Safe Brake Control" function is used, then it is not permissible that the brake is

controlled through a relay, as this can result in faults being triggered in the brake control.

Note

The brake cannot be directly connected to the Motor Module in the chassis format. The

connection terminals are only designed for 24 VDC with 150 mA; the Safe Brake Adapter is

required for higher currents and voltages.

The brake is controlled from the Control Unit. Two signal paths are available for applying the

brake.

&RQWURO WHUPLQDO

1&8 [

0RWRU 0RGXOH

3

'5,9(

7%

&ORVHG FLUFXLW EUDNH

&/L4

&RQWURO

%5

WHUPLQDO

%5

0RWRU

%UDNH GLDJQRVWLFV

7%

%5

0

0

%5

Figure 5-1

Two-channel brake control, booksize (example)

The Motor Module carries out a check to ensure that the "Safe Brake Control" function is working

properly and ensures that, if the Control Unit fails or is faulty, the brake current is interrupted,

therefore closing the brake.

The brake diagnostics can only reliably detect a malfunction in either of the switches (TB+, TB-)

when the status changes (when the brake is opened or closed).

If the Motor Module or Control Unit detects a fault, the brake current is switched off and the safe

status is reached.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

65

Safety Functions integrated in the drive

5.6 Control via terminals on the Control Unit and the power unit

• Different terminal strips depending on design

• Automatic ANDing of up to 8 digital inputs (p9620[0...]) on the Control Unit with parallel

configuration of power units in chassis format is not possible.

Terminals for STO, SS1 (time-controlled), SBC

The functions are separately selected/deselected for each drive using two terminals.

•

1. Control Unit switch-off signal path

The required input terminal for Safe Torque Off (STO) is selected via the BICO interconnection

(BI: p9620[0]).

Digital input DI 0 ... DI 7 on the Control Unit can be used as a signal source (NCU). NX modules

have DI 0 to DI 3.

•

2. Motor Module switch-off signal path

The input terminal is the "EP" ("Enable Pulses") terminal.

The EP terminal is periodically interrogated with a sampling time, which is rounded off to an

integer multiple of the current controller cycle; however, it is a minimum of 1 ms.

(Example: t_i = 400 µs, t_EP => 3 x t_i = 1.2 ms)

Both terminals must be energized simultaneously within the discrepancy time p9650/p9850,

otherwise a fault will be issued.

1&8 [

0RWRU 0RGXOH

'5,9( &/L4

'5,9( &/L4

%O

1&8 [

', [

S

U

[

0

'5,9( &/L4

*

0RQLWRULQJ FKDQQHO

&RQWURO 8QLW

[

[

8

0

9

7HPS

a

:

0RQLWRULQJ FKDQQHO

7HPS

0RWRU 0RGXOH

(3

9

%5

(3 0

%5

Figure 5-2

Terminals for "Safe Torque Off" - example for Motor Modules Booksize and NCU7x0

Grouping drives

To ensure that the function works for more than one drive at the same time, the terminals for the

corresponding drives must be grouped together as follows:

•

1. Control Unit switch-off signal path

By connecting the binector input to the joint input terminal on the drives in one group.

•

2. Motor Module switch-off signal path

By appropriately connecting the "EP" terminal for the individual Motor Modules belonging to

a group.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

67

Safety Functions integrated in the drive

5.6 Control via terminals on the Control Unit and the power unit

Note

The same grouping must be set in both monitoring channels.

If a fault in a drive results in a Safe Torque Off (STO), this does not automatically mean that the

other drives in the same group also switch to Safe Torque Off (STO).

The assignment is checked during the test for the switch-off signal paths. The operator selects

Safe Torque Off for each group. The check is drive-specific.

Example: Terminal groups

It must be possible to select/deselect the Safe Torque Off function separately for group 1 (drives

1 and 2) and group 2 (drives 3 and 4).

For this purpose, the same grouping for Safe Torque Off must be performed on both the Control

Unit and the Motor Modules.

6H

OHFWLQJ GHVHOHFWLQJ

*URXS

1&8 [

0

(3

0

0

0 (3

6HOHFWLQJ

'ULYH

(3

(3

GHVHOHFWLQJ

S

*URXS

'O

'ULYH

/LQH

6LQJOH

'RXEOH

6LQJOH

U

S

0RGXOHV

0RWRU

0RWRU

0RWRU

0

0RGXOHV

0RGXOHV

0RGXOHV

'ULYH

S

'O

;

'ULYH

U

S

0

'ULYH

'ULYH

'ULYH

*URXS

*URXS

Figure 5-3

Example: Grouping the terminals for Motor Modules, booksize format

5.6.2

Simultaneity and tolerance time of the two monitoring channels

The Safe Torque Off function must be selected and deselected simultaneously in both

monitoring channels using the input terminals and is only effective for the associated drive.

1 signal: Deselects the function

0 signal: Selects the function

Safety Integrated (system-integrated)

68

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Safety Functions integrated in the drive

5.6 Control via terminals on the Control Unit and the power unit

"Simultaneously" means:

The changeover must have been completed in both monitoring channels within the

parameterized tolerance time.

• p9650 SI SGE changeover tolerance time (Control Unit)

• p9850 SI SGE changeover tolerance time (Motor Module)

Note

To avoid incorrect triggering of fault messages, at these outputs the tolerance time must always

be set to be shorter than the shortest time between two switching events (ON/OFF, OFF/ON).

If the Safe Torque Off function is not selected/deselected within the tolerance time, this is

detected by the crosswise data comparison, and fault F01611 or F30611 (STOP F) is output. In

this case, the pulses have already been canceled as a result of the selection of Safe Torque Off in

one channel.

5.6.3

Bit pattern test

Bit pattern test of failsafe outputs

The converter normally responds immediately to signal changes in its failsafe inputs. This is not

desirable in the following case: Several control modules test their failsafe outputs using bit

pattern tests (on/off tests), in order to identify faults due to either short-circuit or cross-circuit

faults. If a failsafe input of the converter is interconnected with a failsafe output of a control

module, then the converter responds to these test signals.

,QSXW VLJQDOV

) ',

W

6DIHW\ IXQFWLRQ

$FWLYH

,QDFWLYH

W

Figure 5-4

Converter response to a bit pattern test

Note

If the test pulses lead to unintended triggering of the Safety Integrated Functions, a filtering

(p9651/p9851 SI STO/SBC/SS1 debounce time) of the terminal inputs must be parameterized.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

69

Safety Functions integrated in the drive

5.7 Commissioning the STO, SBC and SS1 functions

Series commissioning of the safety functions

1. A drive archive can be transferred to another drive unit, keeping the safety parameterization.

2. If the source and target devices have different firmware versions, it may be necessary to adapt

the reference checksums (p9799, p9899). This is indicated by the faults F01650 (fault value:

1000) and F30650 (fault value: 1000).

3. Once the project has been downloaded to the target device, an acceptance must be carried

out. This is indicated by fault F01650 (fault value: 2005).

Note

Once a project has been downloaded, it must be saved to the non-volatile memory card (copy

from RAM to ROM).

Replacement of Motor Modules with later firmware version

1. After a Motor Module fails, a more recent firmware version can be installed on the new Motor

Module.

2. If the old and new devices have different firmware versions, it may be necessary to adapt the

reference checksums (p9899). This is indicated by fault F30650 (fault value: 1000).

For 840D sl, checksums can be confirmed at the HMI in the "Commissioning" operating area

using the softkey "Confirm SI data" followed by power on. The data must be saved before power

on.

N

Parameter

Description and comments

o.

1

p0010 = 95

Sets the Safety Integrated commissioning mode

2

p9899 = “r9898”

Adapt the reference checksum on the Motor Module

3

p0010 = value not

Exit Safety Integrated commissioning mode

equal to 95

4

POWER ON

Carry out a power on

5.7.2

Sequence when commissioning STO, SBC and SS1

In the SINUMERIK environment, commissioning can be simplified by using the softkeys "Activate

drive commissioning" and "Deactivate drive commissioning".

With "Activate drive commissioning", p0010 is set to 95; the required functions can then be

enabled and the settings entered (see also following Table, Steps 3 to 9).

With "Deactivate drive commissioning" the checksums (p9799 = r9798, p9899 = r9898) are set

to the same value and p0010 is set to 0.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

71

Safety Functions integrated in the drive

5.7 Commissioning the STO, SBC and SS1 functions

Carry out the following steps to commission the STO, SBC and SS1 functions:

No.

Parameter

Description and comments

1

p0010 = 95

Sets the Safety Integrated commissioning mode

• The following alarms and faults are output:

A01698 (SI CU: Commissioning mode active)

• During first commissioning only:

F01650 (SI CU: Acceptance test required) with fault value = 130 (no Safety parameters exist for

the Motor Module).

F30650 (SI MM: Acceptance test required) with fault value = 130 (no Safety parameters exist for

the Motor Module).

For information on the acceptance test and certificate, see Step 15.

• The pulses are safely canceled and monitored by the Control Unit and Motor Module.

• The safety sign of life is monitored by the Control Unit and Motor Module.

• The function for exchanging stop responses between the Control Unit and Motor Module is

active.

• An existing and parameterized brake has already been closed.

• In this mode, fault F01650 or F30650 with fault value = 2003 is output after a Safety parameter

is changed for the first time.

This behavior applies for the entire duration of safety commissioning, which means that the STO

function cannot be selected/deselected while safety commissioning mode is active because this

would constantly force safe pulse cancellation.

2

p9761 = "Val-

Sets the safety password

ue"

When Safety Integrated is commissioned for the first time, the following applies:

• Safety password = 0

• Default setting for p9761 = 0

This means that the safety password does not need to be set during initial commissioning.

3

Enable Safe Torque Off function

p9601.0

STO via Control Unit terminals

p9801.0

STO via Motor Module terminals

• The parameters are not changed until the safety commissioning mode has been exited (i.e. when

p0010 is set ≠ 95).

• Both parameters are included in the crosswise data comparison and must therefore be set to

identical values.

4

Enables the Safe Brake Control function

p9602 = 1

Enables SBC on the Control Unit

p9802 = 1

Enables SBC on the Motor Module

• The parameters are not changed until the safety commissioning mode has been exited (i.e. when

p0010 is set ≠ 95).

• Both parameters are included in the crosswise data comparison and must therefore be set to

identical values.

• The Safe Brake Control function only becomes active if at least one safety monitoring function is

enabled (i.e. p9601 = p9801 ≠ 0).

Safety Integrated (system-integrated)

72

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Content      ..      1       2         ..

//////////////////////////////////////////