Content      ..     2      3      4      5     ..

SINUMERIK 840D sl. Service - Safety Integrated. Manual (2020) - page 4

Connecting sensors and actuators

8.3 Modular PROFIsafe I/O interface

63/ LQSXWV $B,16(

6ORW ) QHW GDWD VLJQDOV

6ORW 6XEVWLWXWH YDOXHV

Figure 8-20

Overlap of SPL input areas of an active and passive slot

If the SPL input areas of passive slots assigned using MD10388 $MN_PROFISAFE_IN_ASSIGN

overlap, then Alarm 27204 "PROFIsafe: Dual allocation MD %1[%2] - MD %3[%4]" is displayed.

8.3.2

PROFIsafe output modules

Activating a machine data set or a slot

A machine data set or slot for PROFIsafe communication and SPL interface of a PROFIsafe output

module are activated using:

MD13303 $MN_PROFISAFE_OUT_ENABLE_MASK[m], bit x = 1

The machine data set of a slot includes machine data:

• MD $MN_PROFISAFE_OUT_ADDRESS[n]

• MD $MN_PROFISAFE_OUT_FILTER[n]

• MD $MN_PROFISAFE_OUT_ASSIGN[n]

• MD $MN_PROFISAFE_OUT_NAME[n]

Slot mode

The following slot modes are obtained as a result of the possibility of activating or deactivating

a slot:

• Active

In the control, a PROFIsafe driver is active for the slot and the SPL outputs are output as F-net

data at the associated PROFIsafe output module.

• Inactive

In the control, there is no PROFIsafe driver active for the slot; the PROFIsafe master does not

address the corresponding PROFIsafe I/O module.

The following table shows the interrelationship between the machine data and the slot mode

obtained from this:

PROFISAFE_OUT_ENABLE_MASK[m], bit n

Slot mode

1

Active

0

Inactive

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

211

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

352),1(7

31

352),1(7

31

,(

) &38

) &38

'3

) &38

) &38

352),%86 '3

'3

352),%86 '3

'3

352),1(7 FDSDEOH &38 H J

) &38

6,180(5,.

'VO

) &38

6

&38

352),%86 FDSDEOH &38

) &38

6,180(5,.

'VO

6

&38

)B'3 FRPPXQLFDWLRQ

,0

)

Figure 8-21

F_DP communication options with SINUMERIK 840D sl

With SINUMERIK 840D sl, a maximum of sixteen safety-relevant send connections and sixteen

safety-relevant receive connections can be configured for each NCU (option "SI Connect").

Note

The diagram is an example - for I Device, the PN/PN coupler can be eliminated.

Note

SIMATIC F-CPUs that support the F_SENDDP/F_RCVDP blocks are suitable as communication

partner, e.g. IM151F.

Note

The chapter only describes the SINUMERIK-specific safety-related CPU-CPU communication to

couple plants and systems corresponding to the SIMATIC F_SENDDP/F_RCVDP protocol

specifications. SINUMERIK does not support SIMATIC S7 communication with F_SENDS7/

F_RCVS7.

Description

When configuring F-DP communication between two F-CPUs, an input and output range must

be defined via SIMATIC Step 7 via which the F-telegrams are exchanged. The start address

(logical basis address) can be freely selected. However, within an F-CPU it must be the same for

the input and output ranges. However, a different start address can be used in the two F-CPUs.

An F-DP communication always comprises a sender (F_SENDDP) and a receiver (F_RECVDP).

Only the sender (in the diagram F_SENDDP of the F-CPU1) transfers F-net data - in the F-net data

telegram - to the receiver (in the diagram F_RECVDP of F-CPU2). The receiver only acknowledges

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

213

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

the receipt of the F-net data telegram using an F-acknowledgment telegram. The F-

acknowledgment telegram does not contain any F-net data.

) &38

, 2 UDQJH

2 DGGUHVV

/HQJWK

bE\WHV

)B6(1''3

VHQGHU

, DGGUHVV

/HQJWK

E\WHV

) &38

, 2 UDQJH

2 DGGUHVV

/HQJWK

E\WHV

)B5(&9'3

UHFHLYHU

, DGGUHVV

/HQJWK

bE\WHV

1RWH

7KH , DQG 2 DGGUHVVHV XVHG

DUH RQO\ H[DPSOHV RI YDOXHV

Figure 8-22

Components of an F_DP communication relationship

F-net data telegram

The F_SENDDP of the F-CPU1 (sender) cyclically generates an F-net data telegram and writes it

to the output data area of the F-CPU. The F-net data telegram has the following structure that

is compatible to SIMATIC:

•

6 bytes F-net data

2 bytes Bool

2x2 bytes for 2 INT values

(Notice: is not evaluated for SINUMERIK 840D sl)

•

2 byte status word

•

2 byte sequence number

•

2 byte CRC

As a result of the F_DP communication relationship - configured in SIMATIC Step7 - the F-net data

telegram is transferred from the output range of the F-CPU1 into the input range of the F-CPU2.

Safety Integrated (system-integrated)

214

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

Figure 8-23

DP slave properties

The window to parameterize the logical basis addresses is opened by selecting "New ...". The

mode (F-master-slave send F-MS-S or F-master-slave receive F-MS-R) and the addresses (LADDR)

of the connection can now be set in this window.

Figure 8-24

DP slave - F-configuration properties

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

217

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

For the case that 16 SPL connections are parameterized, for each SPL connection, there is only

one SPL coupling available.

The following value range for system variables and machine data is obtained from this:

• System variable index: 1...n with n = 16

• Machine data index: 0...m with m = 15

6,180(5,.

' VO

) &38

ORJLFDO YLHZ

63/

63/ FRQQHFWLRQ

$B2876(

63/

63/ FRXSOLQJ

) QHW GDWD

WUDQVIHU

&RQQHFWLRQ

1XPEHU

6\VWHP YDULDEOH

)B6(1''3

)B5(&9'3

LQWHUIDFH

352),%86 '3

)B'3 FRPPXQLFDWLRQ UHODWLRQVKLS

352),1(7

Figure 8-25

Example of 1 SPL connection with 4 SPL couplings

3DUDPHWHUL]LQJ GDWD 1&.

01B6$)(B6'3B,'> P@

01B6$)(B6'3B1$0(> P@

$FWLYDWLRQ GDWD 1&.

01B6$)(B6'3B&211(&7,21B15> P@

01B6$)(B6'3B/$''5> P@

01B6$)(B6'3B(1$%/(B0$6.

01B6$)(B6'3B7,0(287> P@

01B6$)(B6'3B),/7(5> P@

01B6$)(B6'3B$66,*1> P@

2XWSXW GDWD 1&.

01B6$)(B6'3B(55B5($&> P@

$B)6'3B(5525> Q@

,QSXW GDWD 1&.

$B)6'3B68%6B21> Q@

)B6(1''3

$B)6'3B(55B5($&> Q@

$B)6'3B',$*> Q@

$B2876(

2XWSXW GDWD '%

01B35(9(17B6<1$&7B/2&.

)6'3>

@ (5525

,QSXW GDWD '%

)6'3>

@ 68%6B21

)6'3>

@ (55B5($&

)6'3>

@ ',$*

63/B'$7$B2876(3>

@

)6'3>

@ 5(79$/

63/B5($'<

)6'3>

@ 5(79$/

(UURU UHVSRQVHV

$ODUP

6723 ' (

Figure 8-26

Interface overview F_SENDDP

Activation data

Every parameterizing data set can be separately activated using the enable screen form.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

219

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

This MD is not incorporated in the checksum calculation; i.e. it can also be changed without

aligning the checksum.

MD13334 $MN_SAFE_SDP_LADDR: I/O start address

When generating the configuration in SIMATIC STEP7 HW Config, for each SPL connection a start

address must be defined for the I/O area, which is used for the F_SENDDP to exchange data with

the associated F_RECVDP. The start address must be the same for the input and output data

areas.

The user must enter the I/O start address of the SPL connection, defined in the configuration, in

MD $MN_SAFE_SDP_LADDR[0...m].

Rules to define the start addresses and address areas of an SPL connection:

• The start address must be identical in the input and output data areas

• Slot length: Input data area = 6 bytes, output data area = 12 bytes

• Consistency of the slot in the input and output data areas in both cases over the "complete

length"

The check is made on the PLC side within the scope of the cyclic F_DP communication by

evaluating the SFC14/SFC15 return values. For an error, Alarm 27354 "F_DP: %1

communication, connection %2 signals SFC%3 error %4" is displayed.

Parameterization of the F-net data transfer

The transfer of the SPL outputs in the F-net data is parameterized using the following NCK

machine data:

• $MN_SAFE_SDP_ASSIGN[0...m]

• $MN_SAFE_SDP_FILTER[0...m]

1&. 63/ 6*$

$B2876(>

@

>

@

>

@

> @

> @

63/ DVVLJQPHQW

VW 63/ FRQQHFW 0'

01B6$)(B6'3B$66,*1> @

QG 63/ FRQQHFW 0'

01B6$)(B6'3B$66,*1> @

%LW

%LW

%LW

%LW

) QHW GDWD ILOWHU

VW 63/ FRQQHFW 0'

01B6$)(B6'3B),/7(5> @

+

QG 63/ FRQQHFW 0'

01B6$)(B6'3B),/7(5> @

+

6XE VORW

6XE VORW

) QHW GDWD VLJQDOV IURP )B6(1''3

0'

01B6$)(B6'3B,'> @

'

0'

01B6$)(B6'3B/$''5> @

'

%LW

%LW

Figure 8-27

F-net data transfer F_SENDDP

MD13336 $MN_SAFE_SDP_ASSIGN: SPL assignment

For the SPL assignment, the SPL outputs ($A_OUTSE) are selected, which are assigned to the F-

net data signals via the F-net data filter. Only a contiguous area can be selected.

Safety Integrated (system-integrated)

222

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

3. Whether STOP D or STOP E is initiated as error response can be parameterized using:

NCK: $MN_SAFE_SPL_STOP_MODE

PLC: DB18.DBX36.1

4. The system variable $A_FSDP_ERR_REAC[1...n] is a part of the crosswise data comparison

SPL-CDC.

Note

Until the system variable is programmed for the first time, after the control boots, the value set

using MD $MN_SAFE_SDP_ERR_REAC is active.

Output data, F_SENDDP

System variable: Error signal, $A_FSDP_ERROR

System variable $A_FSDP_ERROR[1...n] is used to indicate that there is a communication error.

The specific cause, determined by F_SENDDP, is communicated using the diagnostics data

(system variable $A_FSDP_DIAG).

The system variable $A_FSDP_ERROR is cyclically compared with the corresponding PLC

variables FSDP[1...3].ERROR. If unequal, there is a system error and this is displayed using Alarm

27355 "F_DP: %1 communication, connection %2 reports a system error %3 (%4)".

System variable: Substitute value signal, $A_FSDP_SUBS_ON

System variable $A_FSDP_SUBS_ON[1...n] is used to signal that F_RECVDP has output substitute

values to the application.

The system variable $A_FSDP_SUBS_ON is cyclically compared with the corresponding PLC

variables FSDP[1...3].SUBS_ON. If unequal, there is a system error and this is displayed using

Alarm 27355 "F_DP: %1 communication, connection %2 reports a system error %3 (%4)".

System variable: diagnostics data, $A_FSDP_DIAG

System variable $A_FSDP_DIAG[1...n] is used to signal the cause of the communication error

determined by F_SENDDP.

The system variable $A_FSDP_DIAG is not cyclically compared with the corresponding PLC

variables FSDP[1...16].DIAG.

Comparison, NCK system variable / PLC variable

NCK system variable

PLC variable DB18

Inputs

$A_FSDP_ERR_REAC[1...n]

FSDP[1...3].ERR_REAC or FSDP_HF[4..16].ERR_REAC

$A_OUTSE

SPL_DATA_OUTSEP[1...64] or SPL_DATA.OUTSEP_HF[65..192]

$MN_PREVENT_LOCK

SPL_READY

Outputs

$A_FSDP_ERROR[1...n]

FSDP[1...3].ERROR or FSDP_HF[4..16].ERROR

$A_FSDP_SUBS_ON[1...n]

FSDP[1...3].SUBS_ON or FSDP_HF[4..16].SUBS_ON

Safety Integrated (system-integrated)

226

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

NCK system variable

PLC variable DB18

$A_FSDP_DIAG[1...n]

FSDP[1...3].DIAG or FSDP_HF[4..16].DIAG

--

FSDP[1...3].RETVAL14 or FSDP_HF[4..16].RETVAL14

--

FSDP[1...3].RETVAL15 or FSDP_HF[4..16].RETVAL15

8.4.3

Receiver F_RECVDP

In order to transfer SPL output data from an F-CPU to a SINUMERIK 840D sl using F-DP

communication, an SPL connection must be parameterized. This connection comprises the

following:

• F_DP communication relationship

The following F_DP communication parameters are defined using the F_DP communication

relationship:

- Identifier (DP_DP_ID) and connection name

- Communication parameters:

-

- I/O start addresses (LADDR)

-

- Monitoring time (TIMEOUT)

- Error response (ERR_REAC)

- Substitute values in the case of an error (SUBS)

• SPL coupling

The SPL coupling is used to define which F-data signals of the F-telegram are to be mapped

to which SPL inputs ($A_INSE). Several SPL couplings can be parameterized for one SPL

connection.

Note:

The interpretation and processing of the F-net data signals are realized via the PLC and NCK-

SPL, and are the exclusive responsibility of the user or SPL programmer.

• Connection number

A parameterizing data set is assigned to an SPL connection using the connection number.

An SPL connection is defined in a parameterizing data set. For SINUMERIK 840D sl, 16

parameterizing data sets are available for F_RECVDP; as a consequence, 16 different SPL

connections, designated using 16 identifiers (DP_DP_ID), can be parameterized in the F-DP

communication relationships. In case of an error, Alarm 27306 "F_DP: Max. number of active SPL

connections (%1) for %2 exceeded" is output

SPL input data ($A_INSE) can only be assigned to an SPL connection in the parameterizing data

of the SPL coupling as contiguous range. If the SPL input data, which are required for an SPL

connection, are not contiguous, then several SPL connections must be parameterized in the

parameterizing sets. These SPL connections are designated using identical F_DP communication

relationships and connection numbers, but different SPL couplings. The parameterization of one

SPL connection with several SPL couplings is designated as sub-slots within the framework of

PROFIsafe (see Chapter "parameterizing the SPL-SGE interface (Page 194)").

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

227

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

The number of SPL couplings per SPL connection can be freely parameterized within the

framework of the number of parameterizing data sets that are available. The following options

are available to parameterize SPL connections and SPL couplings for each SPL connection:

• SPL connections: 1 up to a maximum of 16

• SPL couplings per SPL connection: 1 up to a maximum of 16, whereby the sum of all SPL

couplings of all SPL connections can be a maximum of 16

For the case that 16 SPL connections are parameterized, for each SPL connection, there is only

one SPL coupling available.

The following value range for system variables and machine data is obtained from this:

• System variable index: 1...n with n = 16

• Machine data index: 0...m with m = 15

6,180(5,.

' VO

) &38

ORJLFDO YLHZ

63/

63/ FRQQHFWLRQ

$B,16(

63/

63/ FRXSOLQJ

) QHW GDWD

WUDQVIHU

&RQQHFWLRQ

1XPEHU

6\VWHP YDULDEOH

)B5(&9'3

)B6(1''3

LQWHUIDFH

352),%86 '3

)B'3 FRPPXQLFDWLRQ UHODWLRQVKLS

352),1(7

Figure 8-28

Example of 1 SPL connection with 4 SPL couplings

Safety Integrated (system-integrated)

228

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

Interface overview

3DUDPHWHUL]LQJ GDWD 1&.

$FWLYDWLRQ GDWD 1&.

01B6$)(B5'3B(1$%/(B0$6.

01B6$)(B5'3B,'> P@

01B6$)(B5'3B1$0(> P@

01B6$)(B5'3B&211(&7,21B15> P@

01B6$)(B5'3B/$''5> P@

01B6$)(B5'3B$66,*1> P@

01B6$)(B5'3B),/7(5> P@

01B6$)(B5'3B7,0(287> P@

2XWSXW GDWD 1&.

01B6$)(B5'3B(55B5($&> P@

$B)5'3B(5525> Q@

01B6$)(B5'3B68%6> P@

$B)5'3B68%6B21> Q@

$B)5'3B$&.B5(4> Q@

,QSXW GDWD 1&.

$B)5'3B',$*> Q@

)B5(&9'3

$B)5'3B(55B68%6> Q@

$B)5'3B6(1'02'(> Q@

$B,16(

$B)5'3B(55B5($&> Q@

&KDQQHOB UHVHW

2XWSXW GDWD '%

,QSXW GDWD '%

)5'3>

@ (5525

)5'3>

@ 68%6>

@

)5'3>

@ 68%6B21

)5'3>

@ (55B5($&

)5'3>

@ $6.B5(4

)5'3>

@ $&.B5(,

)5'3>

@ 6(1'02'(

6\VWHP UHVSRQVHV

)5'3>

@ ',$*

$ODUP

63/B'$7$B,16(3>

@

6723 ' (

)5'3>

@ 5(79$/

)5'3>

@ 5(79$/

Figure 8-29

Interface overview F_RECVDP

Activation data

Every parameterizing data set can be separately activated using the activation data.

Parameterizing data

The parameterizing data set of an SPL connection involves the following data areas:

• Identifier:

DP_DP_ID: MD1334: $MN_SAFE_RDP_ID

Name: MD13342 $MN_SAFE_RDP_NAME

• Connection number: MD13343 $MN_SAFE_RDP_CONNECTION_NR #

• Communication parameters:

I/O start address: MD13344 $MN_SAFE_RDP_LADDR #

Monitoring time: MD13345 $MN_SAFE_RDP_TIMEOUT #

• Net data parameters:

SPL assignment: MD13346 $MN_SAFE_RDP_ASSIGN:

F-net data filter: MD13347 $MN_SAFE_RDP_FILTER

• Error response:

Error response: MD13348 $MN_SAFE_RDP_ERR_RE

Substitute values: MD13349 $MN_SAFE_RDP_SUBS #

For SPL connections with the same identifier, all parameters identified with # must be identical.

In case of an error, Alarm 27305 "F_DP: Parameter MD %1[%2] < > MD %3[%4]" is output.

Input/output data

The input and output data provide the user or SPL programmer an interface compatible to the

SIMATIC F-application blocks using system variables.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

229

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

MD13344 $MN_SAFE_RDP_LADDR: I/O start address

When generating the configuration in SIMATIC STEP7 HW Config, for each SPL connection a start

address must be defined for the I/O area, which is used for the F_RECVDP to exchange data with

the associated F_SENDDP. The start address must be the same for the input and output data

areas.

The user must enter the I/O start address of the SPL connection, defined in the configuration, in

the MD $MN_SAFE_RDP_LADDR[0...m].

Rules to define the start addresses and address areas of an SPL connection:

• The start address must be identical in the input and output data areas

• Slot length: Input data area = 12 bytes, output data area: 6 bytes

• Consistency of the slot in the input and output data areas in both cases over the "complete

length"

The check on the PLC side is made within the scope of the cyclic F_DP communication by

evaluating the SFC14/SFC15 return values. For an error, Alarm 27354 "F_DP: %1

communication, connection %2 signals SFC%3 error %4" is displayed.

Parameterization of the F-net data transfer

The transfer of F-net data in the SPL inputs is parameterized using the following NCK machine

data:

• $MN_SAFE_RDP_ASSIGN[0...m]

• $MN_SAFE_RDP_FILTER[0...m]

1&. 63/ 6*( $B,16( >

@

>

@

>

@

> @

> @

63/ DVVLJQPHQW

VW 63/ FRQQHFW 0'

01B6$)(B5'3B$66,*1> @

QG 63/ FRQQHFW 0'

01B6$)(B5'3B$66,*1> @

%LW

%LW

%LW

%LW

) QHW GDWD ILOWHU

6XE VORW

6XE VORW

VW 63/ FRQQHFW 0'

01B6$)(B5'3B),/7(5> @

)+

QG 63/ FRQQHFW 0'

01B6$)(B5'3B),/7(5> @

)

+

) QHW GDWD VLJQDOV IURP )B5(&9'3

0'

01B6$)(B5'3B,'> @

'

%LW

%LW

0'

01B6$)(B5'3B/$''5> @

'

Figure 8-30

F-net data transfer F_RECVDP

MD13347 $MN_SAFE_RDP_FILTER F-net data filter

If, on the receiver side, only individual F-data signals of the F-telegram - which are not located

one after the other - are required within the SPL for further processing, then these can be

selected using the F-net data filter.

The F-net data filter is set using machine data $MN_SAFE_RDP_FILTER[0...m].

Example of an NCK parameterization (see the "Example for an NCK parameterization")

Safety Integrated (system-integrated)

232

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

Note

Until the system variable is programmed for the first time, after the control boots, the value set

using MD $MN_SAFE_RDP_ERR_REAC is active.

System variable: Substitute values, $A_FRDP_SUBS

Using the system variable $A_FRDP_SUBS[1...n], substitute values are specified, which, in the

case of an error, are output to the SPL input data parameterized using machine data

$MN_SAFE_RDP_ASSIGN. A change to the substitute values only becomes effective in the next

F_DP clock cycle - also during an error.

The system variable $A_FRDP_SUBS[1...n] is a part of the crosswise data comparison SPL-CDC.

Note

Until the system variables are programmed for the first time, after the control boots, the values

defined using MD $MN_SAFE_RDP_SUBS[1...n] are active.

System variable: User acknowledgment, interface signal: DB18.FRDP_ACK_Rei and

channel_1 reset

A user acknowledgment is always required after a communication error detected by F_RECVDP

(system variable $A_FRDP_ERROR = 1). Once the cause of the error has been removed and

F_SENDDP and F_RECVDP are again in cyclic communication, F_RECVDP sets the request for user

acknowledgment via the system variable $A_FRDP_ACK_REI = 1.

A user acknowledgment can be realized as follows:

• PLC: Interface signal DB18.FRDP_ACK_REI

• NCK: Channel_1 reset

Driver-specific interface signal: DB18.FRDP_ACK_REI

The user acknowledgment is realized with a 0/1 change of the interface signal level. The

interface signal must either be set or reset by the PLC user program. The applies to all F_RECVDP

drivers.

The driver-specific interface signals are single-channel signals and are therefore not part of the

crosswise data comparison SPL-CDC.

Note

The user acknowledgment via the interface signal only refers to acknowledging a

communication error. If an alarm is initiated when a communication error is detected, this is not

acknowledged, and neither the alarm nor the stop responses are reset.

Channel_1 reset

The user acknowledgment is internally realized in the system by initiating the channel_1 reset

by pressing the reset key on the machine control panel

Safety Integrated (system-integrated)

236

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

For SINUMERIK 840D sl, the deactivated safety mode corresponds to the SPL-commissioning

mode ($MN_PREVENT_SYNACT_LOCK = 0 or DB18DBX36.0 = 0).

System variable $A_FRDP_SENDMODE[1...n] is cyclically compared with the corresponding PLC

variables FRDP[1...n].SENDMODE. If unequal, there is a system error and this is displayed using

Alarm 27355 "F_DP: %1 communication, connection %2 reports a system error %3 (%4)".

Comparison, NCK system variable / PLC variable

NCK system variable

PLC variable DB18

Inputs

$A_FRDP_SUBS[1...n]

FRDP[1...3].SUBS[0...15] or FRDP_HF[4..16].SUBS[0..15]

$A_FRDP_ERR_REAC[1...n]

FRDP[1...3].ERR_REAC or FRDP_HF[4..16].ERR_REAC

--

FRDP[1...3].ACK_REI or FRDP_HF[4..16].ACK_REI

Outputs

$A_FRDP_ERROR[1...n]

FRDP[1...3].ERROR or FRDP_HF[4..16].ERROR

$A_FRDP_SUBS_ON[1...n]

FRDP[1...3].SUBS_ON or FRDP_HF[4..16].SUBS_ON

$A_FRDP_ACK_REQ[1...n]

FRDP[1...3].ACK_REQ or FRDP_HF[4..16].ACK_REQ

$A_FRDP_SENDMODE[1...n]

FRDP[1...3].SENDMODE or FRDP_HF[4..16].SENDMODE

$A_FRDP_DIAG[1...n]

FRDP[1...3].DIAG or FRDP_HF[4..16].DIAG

$A_INSE

SPL_DATA.INSEP[1...64] or SPL_DATA.INSEP_HF[65..192]

--

FRDP[1...3].RETVAL14 or FRDP_HF[4..16].RETVAL14

--

FRDP[1...3].RETVAL15 or FRDP_HF[4..16].RETVAL15

8.4.4

Mapping the SIMATIC blocks

The parameters of the F_SENDDP and F_RCVDP blocks to be programmed in a SIMATIC-F-CPU

and their corresponding mapping for SINUMERIK 840D sl are shown in the following:

F_SENDDP

SIMATIC block parameter

SINUMERIK parameters

F_SENDDP (FB223)

Inputs

SD_BO_00

$A_OUTSE[x] ¹⁾

SD_BO_15

$A_OUTSE[y] ¹⁾

SD_I_00

- - - ²⁾

SD_I_01

- - - ²⁾

DP_DP_ID

$MN_SAFE_SDP_ID

TIMEOUT

$MN_SAFE_SDP_TIMEOUT

LADDR

$MN_SAFE_SDP_LADDR

Safety Integrated (system-integrated)

238

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

SIMATIC block parameter

SINUMERIK parameters

F_SENDDP (FB223)

Outputs

ERROR

$A_FSDP_ERROR

SUBS_ON

$A_FSDP_SUBS_ON

RETVAL 14

Alarm 27354 ³⁾

RETAL 15

Alarm7354 ³⁾

DIAG

$A_FSDP_DIAG

1)

Assignment of the corresponding assign and filter machine data of the SPL connection.

2

) Transfer of integer values has not been implemented. Value in the F-telegram always 0.

3)

Description of the SFC(%3) under error code (%4), see Step7, online help

F_RECVDP

SIMATIC block parameter

SINUMERIK parameters

F_RCVDP (FB224)

ACK_REI

DB18.FRDP_ACK_REI

Inputs

SUBBO_00

$MN_SAFE_RDP_SUBS/$A_FRDP_SUBS, bit 0

SUBBO_15

$MN_SAFE_RDP_SUBS/$A_FRDP_SUBS, bit 15

SUBI_00

- - - ¹)

SUBI_01

- - - ¹⁾

DP_DP_ID

$MN_SAFE_SRP_ID

TIMEOUT

$MN_SAFE_SRP_TIMEOUT

LADDR

$MN_SAFE_SRP_LADDR

Outputs

ERROR

$A_FRDP_ERROR

SUBS_ON

$A_FRDP_SUBS_ON

ACK_REQ

$A_FRDP_ACK_REQ

SENDMODE

$A_FRDP_SENDMODE

RD_BO_00

$A_INSE[x] ²⁾

RD_BO_15

$A_INSE[y] ²⁾

RD_I_00

- - - ³⁾

RD_I_0I

- - - ³⁾

RETVAL 14

Alarm27354 ⁴⁾

RETVAL 15

Alarm27354 ⁴⁾

DIAG

$A_FRDP_DIAG

1)

Transfer of integer values has not been implemented. Substitute values not required for integer values.

2)

Assignment of the corresponding assign and filter machine data of the SPL connection.

3)

Transfer of integer values has not been implemented. The value possibly transferred from an F-CPU in

the F-telegram is not made available to the user.

4)

Description of the SFC(%3) under error code (%4), see Step7, online help

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

239

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

Reason:

• It is improbable that the run time of the PLC-F driver is delayed - in the OB40 context - by the

maximum time of 500 ms. The reason for this is that the interrupting organizational blocks

(OB8x) only have such long run times in extremely few cases.

• For the theoretical value, it would be necessary that two consecutive runs of the PLC-F_DP

layer in the OB40 context are delayed by the permitted maximum of 500 ms - this is extremely

improbable.

• The maximum time of 150 ms for the user program is not reached in any of the applications

relevant in practice.

PLC processing times

Times: T(FRDP - DB18)

Formula

2 * F_DP clock cycle + 1 * OB1

Maximum times

2 * 500 ms + 1 * 150 ms

1150 ms

Typical times ¹⁾

2 * 80 ms + 1 * 30 ms

10 ms

Times: T(DB18 - FSDP)

Formula

2 * F_DP clock cycle + 1 * OB1

Maximum times

2 * 500 ms + 1 * 150 ms

1150 ms

Typical times ¹⁾

2 * 80 ms + 1 * 30 ms

190 ms

Times:T(FRDP → FSDP)

Formula

4 * F_DP clock cycle + 2 * OB1

Maximum times

4 * 500 ms + 2 * 150 ms

2300 ms

Typical times ¹⁾

4 * 80 ms + 2 * 30 ms

30 ms

F_DP clock cycle = n * IPO; with n = 1, 2, 3, ...

1)

Typical times: IPO = 8 ms; n = 10 => F_DP clock cycle = 80 ms; OB1 = 30 ms

NCK processing times (F_DP clock cycle <= 2 * IPO)

Times: T(FRDP - DB18)

Formula

2 * F_DP clock cycle + 1 * IPO

Maximum times

2 * 500 ms + 1 * 8 ms

1008 ms

Typical times ¹⁾

2 * 16 ms + 1 * 8 ms

40 ms

Times: T(SPL-OUTSE - FSDP)

Formula

IPO + (0...m) * IPO + OB40_INT

Maximum times

8 + 500 ms + 50 ms

558 ms

Typical times ¹⁾

8 ms + 2 ms

10 ms

Times:T(FRDP → FSDP)

Formula

2 * F_DP clock cycle + 2 * IPO + (0...m) * IPO + OB40_INT

Maximum times

2 * 500 ms + 2 * 8 ms + 500 ms + 50 ms

1566 ms

Typical times ¹⁾

2 * 16 ms + 2 * 8 ms + 2 ms

50 ms

F_DP clock cycle = n * IPO; with n = 1, 2, 3, ...

1)

Typical times: IPO = 8 ms; n = 10 => F_DP clock cycle = 80 ms; OB40_INT = 2 ms ... 50 ms (maximum)

Safety Integrated (system-integrated)

242

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

NCK processing times (F_DP clock cycle > 2 * IPO)

Times: T(FRDP → SPL-INSE)

Formula

2 * F_DP clock cycle + 1 * IPO

Maximum times

2 * 500 ms + 1 * 8 ms

1008 ms

Typical times ¹⁾

2 * 80 ms + 1 * 8 ms

168 ms

Times: T(SPL-OUTSE→ FSDP)

Formula

IPO + (n - 2) * IPO + (0...m) * IPO + OB40_INT

Maximum times

8 ms + 8 * 8 ms + 500 ms + 50 ms

622 ms

Typical times ¹⁾

8 ms + 8 * 8 ms + 2 ms

74 ms

Times:T(FRDP → FSDP)

Formula

2 * F_DP clock cycle + F_DP clock cycle + (0...m) * IPO + OB40_INT

Maximum times

2 * 500 ms + 80 ms + 500 ms + 50 ms

1630 ms

Typical times ¹⁾

4 * 80 ms + 80 ms + 2 ms

242 ms

F_DP clock cycle = n * IPO; with n = 1, 2, 3, ...

1)

Typical times: IPO = 8 ms; n = 10 => F_DP clock cycle = 80 ms; OB40_INT = 2 ms ... 50 ms (maximum)

8.4.8

Boot behavior of the F_DP communication

When the control boots, then the F_DP communication, i.e. the F_DP communication

relationships of all parameterized SPL connections (F_SENDDP and F_RECVDP) automatically

boot and establish cyclic F-communication with their particular communication partner.

The boot state of the F_DP communication is represented in the output data of the user interface

(DB18) as follows:

• F_SENDDP (NCK)

- $A_FSDP_ERROR[1...n] = 0

- $A_FSDP_DIAG[1...n] = 0

- $A_FSDP_SUBS_ON[1...n] = 1

• F_SENDDP (PLC)

- FSDP[1..3] or FSDP_HF[4..16]

- .ERROR = FALSE

- .SUBS_ON = TRUE

- .DIAG = 0

- .RETVAL14 = 0

- .RETVAL15 = 0

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

243

Connecting sensors and actuators

8.4 Safety-related CPU-CPU communication (F_DP communication)

The evaluation of the status signals of the SPL connections and changing the system responses

in the case of an error must, if necessary, be additionally programmed in the SPL.

WARNING

Inverting status signals

Depending on the application, the user must invert the status signals of an F_SENDDP-/

F_RECVDP connection (e.g. $A_FSDP_ERROR[1...n], $A_FSDP_SUBS_ON[1...n],

$A_FRDP_ERROR[1...n], $A_FRDP_SUBS_ON[1...n], $A_FRDP_SENDMODE) when further

processing in the SPL. This is done in order to ensure a safe state in the case of incorrect

behavior/response of the PLC or NCK.

Example:

If $A_FRDP_SENDMODE is to be output as safety-related signal from the SPL to PROFIsafe, then

this signal must first be inverted. This is done in order that the failsafe value "0" also corresponds

to the safe state, i.e. it has the significance "deactivated safety mode".

8.4.15

Functionality of the SPL input/output data

Only the user (machinery construction OEM) defines the functionality of the SPL input/output

data within the scope of the F_DP communication.

The SPL programs of NCK-SPL and PLC-SPL are not executed synchronously (from a time

perspective). Brief differences in the output data of the two SPL programs (NCK: $A_OUTSE, PLC:

$A_OUTSEP) can occur due to the runtime differences in the SPL programs.

In order that PLC and NCK-F_SENDDP use identical F-net data when generating an F-telegram

through two channels, the SPL output data are exchanged alternating between the two

channels (PLC: $A_OUTSEP and NCK: $A_OUTSE) in each F_DP clock cycle and are then AND'ed

before the sender. For safety reasons, this is the reason that the user (machine OEM) must select

the functionality of SPL input/output data so that the value "0" corresponds to the safe state of

the functionality represented by this data. Only then can it be absolutely ensured that the

appropriate function is only activated on CPU2 (F_RECVDP) if the function is activated in both SPL

programs (PLC-SPL and NCK-SPL) of CPU1 (F_SENDDP).

WARNING

Safe state of SPL input/output data

For safety reasons, this is the reason that the functionality of an SPL input or output data is

selected so that the value "0" corresponds to the safe state of the functionality represented by

this data.

The synchronization of the SPL output data described above ensures that if it is intended to

simultaneously change several SPL output data in the SPL program, then these are also

consistently transferred (in time) in the F-net data telegram of the F_SENDDP. If, in a user

application, several SPL output data are interpreted as a contiguous bit pattern, it must therefore

be taken into account that intermediate values can briefly occur.

Example:

Safety Integrated (system-integrated)

252

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

Three SPL output data are considered to be contiguous. The value is changed from 101 to 110

in both SPL programs (NCK-SPL and PLC-SPL).

Values transferred from the F_SENDDP in the F-net data telegram:

NCK-SPL

AND

PLC-SPL

=

F-net data telegram

Output value

101

&

101

=

101

Possible inter-

110

&

101

=

100

mediate value

Final value

110

&

110

=

110

WARNING

Runtime differences

Due to runtime differences in the NCK-SPL and PLC-SPL, it cannot be guaranteed that these are

sent consistently (in time) by F_SENDDP in the F-net data telegram when several SPL output

data are simultaneously changed (NCK: $A_OUTSE, PLC: $A_OUTSEP).

8.4.16

Supplementary conditions

For SINUMERIK 840D sl, the following restrictions apply for the safety-related CPU-CPU

communication to couple plants and systems:

• The 2 integer values, defined in the F-net data area of the F-telegram, are not used or not

evaluated by the F_SENDDP and F_RECVDP realized for SINUMERIK.

• Axis specific SGE/SGA cannot be directly coupled to F_SENDDP and F_RECVDP.

• A maximum of 250 ms can be set for the F_DP clock cycle.

• The F-net data are automatically coupled to the SPL interface in DB18 by the basic PLC

program. It is not possible to couple them in a PLC user program.

8.5

Safe programmable logic

WARNING

Using safe programmable logic

Using "safe programmable logic" (outside the commissioning phase) is only possible if at least

one real axis is operated with enabled and active safety functionality.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

253

Connecting sensors and actuators

8.5 Safe programmable logic

8.5.1

Fundamentals

Fundamentals

Function

These signals must be logically combined (interlocked) in a safety-related, freely programmable

form in order to be able to flexibly process safety-related external process signals and safety-

related internal input and output signals. The "Safe Programmable Logic" (SPL) handles this task

as an integral system component.

Features:

• Logic operations implemented by the user are cyclically processed.

• Instructions are effective in all operating modes.

• The PLC program immediately starts to execute the instructions after the control has booted.

• The SGE/SGA must be supplied by the machine manufacturer - both in the drive monitoring

channel as well as in the NCK monitoring channel.

• The NCK-SPL is written as ASUB using the synchronized actions CNC function. The PLC-SPL is

written as PLC user program.

In order to check that the two SPLs (PLC and NCK) are functioning, the system program arranges

cyclic data comparison between the PLC and NCK.

6*(

6*$

1&. 63/

'LUHFW FRQQHFWLRQ RI PD[

VDIHW\

&RQQHFWLRQ RI PD[

UHODWHG VHQVRUV

VDIHW\ UHODWHG DFWXDWRUV

&URVVZLVH UHVXOW DQG GDWD

H J RSHUDWLQJ PRGH VZLWFK

FRPSDULVRQ

H J SURWHFWLYH GRRU LQWHUORFNLQJ

OLJKW EDUULHUV (PHUJHQF\ 6WRS

PRWRU EUDNHV

3/& 63/

6*(

6*$

Figure 8-31

Safe programmable logic

Safety Integrated (system-integrated)

254

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

([WHUQDO

,QWHUQDO

6*( 6*$

6*( 6*$

1&. VLJQDO SURFHVVLQJ

,QWHUIDFH

1&.

1&.

&RPSDUDWRU

63/

6*( 6*$

VLJQDOV

'DWD

0DFKLQH

1&. PRQLWRULQJ FKDQQHO

&RPP

63/

$[LV

&'&

&'&

&'&

'ULYH PRQLWRULQJ FKDQQHO

352),VDIH

&RPSDUDWRU

1& 3/&

RU

3/&

LQWHUIDFH

)B6(1''3

%XV

63/

$[LV VSLQGO

)B5(&9'3

H '%

'DWD

3/& VLJQDO SURFHVVLQJ

,QWHUIDFH

3URFHVV

6\VWHP

Figure 8-32

Integrating the SPL into the complete system

Crosswise data comparison

Data is cyclically exchanged between the PLC and NCK to check the correct functioning of the

two SPLs (PLC and NCK). Just the same as the comparison between the NCK and the drive, it

cross-checks the signals that the SPL receives, the safety-related signals generated by the SPL as

well as internal markers.

The discrepancy time for the crosswise data comparison of SPL variables is permanently set to

1 s (or 10 s $A_CMDSI).

The following signals are included in the crosswise data comparison between the NCK and the

PLC:

Table 8-2

Signals for crosswise data comparison

NCK-SPL data

Signal image of the PLC data

PLC-SPL data (DB18)

$A_INSE[1 ... 64]

$A_INSEP[1...64]

DBX38.0 ... DBX45.7

$A_OUTSE[1 ... 64]

$A_OUTSEP[1...64]

DBX46.0 ... DBX53.7

$A_INSI[1 ... 64]

$A_INSIP[1...64]

DBX54.0 ... DBX61.7

$A_OUTSI[1 ... 64]

$A_OUTSIP[1...64]

DBX62.0 ... DBX69.7

$A_MARKERSI[1 ... 64]

$A_MARKERSIP[1...64]

DBX70.0 ... DBX77.7

$A_FSDP_ERR_REAC[1...16]

--

DBW190, DBW200, DBW210

DBW448, DBW458, DBW468

-

DBW548, DBW558, DBW568

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

255

Connecting sensors and actuators

8.5 Safe programmable logic

NCK-SPL data

Signal image of the PLC data

PLC-SPL data (DB18)

$A_FRDP_SUBS[1...16]

--

DBW220, DBW232, DBW244

DBW578, DBW590, DBW602

--

DBW698, DBW710, DBW722

$A_FRDP_ERR_REAC[1...16]

--

DBW222, DBW234, DBW246

DBW580, DBW592, DBW604

--

DBW700, DBW712, DBW724

$A_INSE[65...192]

$A_INSEP[65...192]

DBX272.0 ...DBX287.7

$A_OUTSE[65...192]

$A_OUTSEP[65...192]

DBX288.0 ...DBX303.7

$A_INSI[65...192]

$A_INSIP[65...192]

DBX304.0 ...DBX319.7

$A_OUTSI[65...192]

$A_OUTSIP[65...192]

DBX320.0 ...DBX335.7

$A_MARKERSI[65...192]

$A_MARKERSIP[65...192]

DBX336.0 ...DBX351.7

$MN_PREVENT_SYNACT_LOCK

--

$MN_SAFE_SPL_STOP_MODE

--

$MN_SAFE_SPL_USER_DATA

--

DBD256, DBD260, DBD264,DBD268

If a difference is detected between the signals of both channels, this is indicated using Alarm

27090/27091 and the configured stop response (STOP D/E) is initiated if the SPL commissioning

phase has been defined to have been completed.

If the user attempts to acknowledge the initiated alarms and stop responses, without having

resolved the cause of the CDC error, then the stop response as well as the alarm are initiated

again.

To acknowledge a fault in the SPL-CDC, then the signal channel_1 reset (DB21.DBX7.7) must be

set for at least 100 ms. For PLC-controlled axes, the axis-specific reset must first be set up via

DB3x.DBX28.1 with a negative edge of the channel_1 reset.

The criterion "commissioning phase completed" is derived from the NCK-MD

$MN_PREVENT_SYNACT_LOCK[0,1] in the NCK. If one of the two field entries is not equal to 0,

"commissioning phase completed" is set by CDC internally. On the PLC side, this criterion is

entered using DB18.DBX36.0. If this bit is set to "1", then the commissioning phase is considered

to have been completed. An SPL-CDC error results in a stop response only after the SPL

commissioning phase has been completed.

The stop response for an SPL-CDC error is set in the NCK using NCK-MD $MN_SPL_STOP_MODE.

If the MD value is 3, for an SPL-CDC error, a STOP D is initiated - for an MD value of 4, a STOP E

is initiated. On the PLC side, this stop response is entered using DB18.DBX36.1. If this bit is set

to "1", for an SPL-CDC error, a STOP E is initiated - otherwise a STOP D.

Any changes to data on the NCK and PLC side do not take effect until after power on.

Clearing the external SPL outputs for SPL system errors

If communication between NCK and PLC is interrupted with reference to the SPL-CDC, then all

external SPL output signals ($A_OUTSE/$A_OUTSEP) are cleared with a 5 s delay.

This state occurs if data for crosswise data comparison is not exchanged between the NCK and

PLC for one second. This is due to the fact that

• the one second limit of the user cycle limit in the PLC (OB1 cycle) was exceeded.

• a system error has occurred. The NCK or PLC system software no longer runs due to a system

error - therefore interrupting communications.

Safety Integrated (system-integrated)

256

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

Users can save information in this MD that must be set the same as the corresponding data in

DB18 (DBD256, 260, 264, 268), e.g.

$%

))

0'

> @

01B6$)(B63/B86(5B'$7$> @

'% '%'

63/B86(5B'$7$> @

'%%

'%%

'%%

'%%

$%

))

0'

> @

01B6$)(B63/B86(5B'$7$> @

'% '%'

63/B86(5B'$7$> @

'%%

'%%

'%%

'%%

0'

> @

01B6$)(B63/B86(5B'$7$> @

$$%%&&''

'%%

'%%

'%%

'% '%'

63/B86(5B'$7$> @

'%%

$$

%%

&&

''

0'

> @

01B6$)(B63/B86(5B'$7$> @

'%%

'%%

'%%

'%%

'% '%'

63/B86(5B'$7$> @

Figure 8-33

Assignment between MD13312 and data block DB18

Differences between the NCK and PLC data are identified using the SPL-CDC and result,

corresponding to the parameterized stop response, in a STOP D/E on all safety-related axes.

Alarm 27090 "Error for crosswise Data comparison NCK-PLC" is output with a reference to the

machine data.

Further, system variable $A_STATSID, bit 27 = 1 is used to indicate to the SPL user that there is

an SPL-CDC error.

Changes to machine data or DB18 data only become effective after power on.

Changes to data are indicated using a corresponding alarm after restart.

8.5.4

NCK-SPL program

Description

The NCK-SPL program is written as an NC program (ASUB) with synchronized actions.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

259

Connecting sensors and actuators

8.5 Safe programmable logic

If NCK-SPL execution is interrupted for any reason or the SI system variables are changed by

another program, then this is detected by the cyclic crosswise data comparison with the PLC.

Table 8-3

Response to SPL errors

Event

MD11500 $MN_PREVENT_

MD11500 $MN_PREVENT_

SYNACT_LOCK[m,n] equal to 0

SYNACT_LOCK[m,n] not equal to 0

Crosswise data comparison

Alarm 27090 is triggered

Alarm 27090 is triggered and in addition,

STOP D/E is triggered

NCK-PLC identifies an error

SPL program file is to be changed (writ-

No response

Alarm 27093 is initiated

ten, deleted, re-named, edited)

WARNING

Protective mechanisms

The protective mechanisms that prevent changes to the NCK-SPL file and the NCK-SPL

instructions (statements) are only effective if MD $MN_PREVENT_SYNACT_LOCK[0,1] is not

equal to 0.

The machine OEM must ensure that the protective mechanisms are activated no later than after

the completion of the acceptance test and the values, set in MD

$MN_PREVENT_SYNACT_LOCK[0,1] are documented in the acceptance report.

After commissioning has been completed, the access rights to the SAFE.SPF file must be set to

the correct access level for writing/reading/deleting access operations (manufacturer or

service).

As long as the protective mechanisms for the NCK-SPL have not been activated

(MN_PREVENT_SYNACT_LOCK[0.1] equal to 0), Alarm 27095 is displayed when the crosswise

data comparison between the NCK and the PLC starts. This alarm can be acknowledged with the

NCK key so that the SPL can be commissioned.

Note

The SPL program must be addressed using upper case letters. Alarm 27097 is output if this is not

observed.

8.5.5

Starting the SPL

Preconditions

The NCK-SPL is active after the control has booted, if at least

1. The functions SBH/SG and "external STOPs" have been enabled for at least one axis using

$MA_/$MD_SAFE_FUNCTION_ENABLE,

2. one of the NCK-SPL interfaces is used.

This means that an axis-specific SGE/SGA was parameterized at one of the SPL interfaces

using its assignment MD.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

261

Connecting sensors and actuators

8.5 Safe programmable logic

• SAFE.SPF is edited until the program can be executed without any alarms with the restricted

language scope.

• MD $MC_PROG_EVENT_MASK, bit 5=1; SAFE.SPF is called when booting and is executed

error-free with the restricted language scope.

Starting the NCK-SPL via PROG_EVENT

Note

This function is an option, and is not included as standard in Safety Integrated.

The NCK-SPL can also be started using the PROG_EVENT mechanism.

The PROG_EVENT.SPF cycle (saved under manufacturer cycles ..\DH\CMA.DIR) is started when a

specific event occurs (event-controlled program call).

Using machine data MD 20108 $MC_PROG_EVENT_MASK, for this PROG_EVENT mechanism,

certain events are enabled on a specific channel-for-channel basis, which then start the cycle.

The start condition when booting (bit 3 ==1) must be active in order to start the NCK-SPL

(SAFE.SPL) via PROG_EVENT.SPF.

Note

When starting the NCK-SPL (SAFE.SPF), it is important that the PROG_EVENT mechanism was

started through channel 1. This must be taken into account when parameterizing the channel-

specific machine data MD20108 $MC_PROG_EVENT_MASK.

Using the system variable $P_PROG_EVENT, in PROG_EVENT.SPF it can be interrogated as to

which event activated the call:

• Part program start

$P_PROG_EVENT == 1

• Part program end

$P_PROG_EVENT == 2

• Operator panel reset

$P_PROG_EVENT == 3

• Booting

$P_PROG_EVENT == 4

For the PROG_EVENT.SPF cycle, MD11602 $MN_ASUP_START_MASK, PROG_EVENT.SPF and

the SAFE.SPF are taken into account, which can be used to set that stop reasons for the sequence

are ignored.

In order to be able to use $MC_PROG_EVENT_MASK and $MN_ASUP_START_MASK, the "Cross-

mode actions" option must be activated.

Example for PROG_EVENT.SPF

; -------------------------------------------------

; Event-controlled program call

; PROG_EVENT.SPF under \DH\CMA.DIR;

--------------------------------------------------------

; -------------------------------------------------

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

263

Connecting sensors and actuators

8.5 Safe programmable logic

MD20107 $MC_PROG_EVENT_IGN_INHIBIT, bit 3 or bit 5

In addition, it may be necessary to not display the processing of the event-controlled programs

via MD20192 $MC_PROG_EVENT_IGN_PROG_STATE, bit 3 or bit 5 on the OPI interface. This does

not influence executing the NCK-SPL, and is only used to visualize program execution in the HMI

context

Starting the PLC-SPL

The PLC-SPL in conjunction with FB4/FC9 has started if the FC9 has signaled successful execution

and has displayed that the end of SAFE.SPF has been reached. This is displayed using a signal in

SAFE.SPF (e.g. $A_PLCSIOUT variable, M function) or SPL status bit 13 (DB18.DBX137.5). Only

then may the PLC-SPL be started to ensure that both SPLs run in synchronism, and therefore the

axis-specific monitoring channels are synchronously supplied.

Parameterizing FB4

FB4 may only be started in the cyclic mode (OB1).

Signal

Type

Value range

Meaning

Reg

PIService

ANY

PI.ASUP

Assign interrupt

Unit

INT

1 to 10 [1]

Channel

WVar1

INT

[1]

Interrupt number

WVar2

INT

[1]

Priority

WVar3

INT

0/1 [0]

LIFTFAST

WVar4

INT

0/1 [0]

BLSYNC

Addr1

STRING

’/_N_CST_DIR/’

NCK-SPL path name

Addr2

STRING

’_N_SAFE_SPF’

NCK-SPL program name

[values in brackets are standard values required for the call]

Parameterizing FC9

Signal

In-

Type

Value range

Remark

put

or

out

put

Start

E

Bool

ChanNo

E

Int

1 to 10 [1]

No. of the NC channel

IntNo

E

Int

1 - 8 [1]

Interrupt No.

Active

A

Bool

1 = active

Done

A

Bool

1 = ASUB completed

Error

A

Boo

[values in brackets are standard values required for the call]

Safety Integrated (system-integrated)

266

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

Configuration

The function is activated using machine data 20108 $MC_PROG_EVENT_MASK, bit 5 = 1. An

existing SAFE.SPF call in a PROG_EVENT.SPF power on section or in an ASUB can be removed. If

the function is active, then only the restricted language scope is possible in a SAFE.SPF. If the

function is not active, then the complete language scope is permitted in a SAFE.SPF. If MD

$MC_PROG_EVENT_MASK, bit 5 = 0, then SAFE.SPF is not executed when the system boots and

errors are active.

Table 8-4

Permissible language commands for SAFE.SPF

Block structure

Nxxx

;Block number

XYZ:

;Labels

/

;Skip, block skip

;

;Comment characters

;Empty line

Beginning of the program

SAFE PROC

;First operation in the program

Attributes, which are programmed in the PROC line

SBLOF

;Single block skip

DISPLOF

;Skip, block display

ACTBLOCNO

;For DISPLOF, for an alarm output the number of the actual block

DISPLON

;Activate block display

SBLOF is always active, even if SBLOF is not programmed

Variable definition

DEF

;Creating DUDs

DEFINE

;Creating macros

Assignments

Values are assigned to variables with an = character. The value being assigned can either be a constant

or an algorithm If the value is a constant, the binary, hexadecimal or exponential notation is possible.

’B0000001’

;Binary notation

’H3C7F’

;Hexadecimal notation

4.1EX-3

;Exponential notation

Fields can be assigned with

REP

:Initialization with the same values

SET

;Initialization with value list

SETA

;Copying fields

Writing, i.e. the lefthand part of an assignment, is possible with these variables:

LUD

GUD

R parameters

$AC_PARAM[ ]

$AC_MARKER[ ]

$AA_ESR_TRIGGER

;Single axis, trigger ESR

$AA_ESR_TRIGGER

;Trigger ESR

Safety Integrated (system-integrated)

268

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

$AN_ESR_TRIGGER

;Trigger ESR

all Synact GUDs

Safety system variables that can be written to:

$A_OUTSE[ ]

$A_OUTSED[ ]

$A_OUTSI[ ]

$A_OUTSID[ ]

$A_MARKERSI[ ]

$A_MARKERSID[ ]

$A_TIMERSI[ ]

$A_CMDSI[ ]

$A_PLCSIOUT[ ]

$A_FSDP_ERR_REAC[ ]

$A_FRDP_SUBS[ ]

$A_FRDP_ERR_REAC[ ]

Reading the righthand part of an assignment is possible with all variables - i.e. also with all safety system

variables.

Arithmetic functions

+

;Addition

-

;Subtraction

*

;Multiplication

/

;Division

DIV

;Division, for variable type INT and REAL

MOD

;Modulo division

SIN( )

;Sine

COS( )

;Cosine

Tan( )

;Tangent

ASIN ()

;Arcsine

ACOS( )

;Arccosine

ATAN2( )

;Arctangent2

SQRT( )

;Square root

ABS( )

;Absolute value

POT( )

;2nd power (square)

TRUNC( )

;Integral number

ROUND( )

;Round to integer number

ROUNDUP( )

;Round up

LN( )

;Natural logarithm

EXP( )

;Exponential function

MINVAL( )

;Lower value of two variables

MAXVAL( )

;Larger value of two variables

BOUND( )

;Variable value within the defined value range

Predefined safety functions

SIRELIN( )

;Assign input quantities

SIRELOUT( )

;Assign output quantities

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

269

Connecting sensors and actuators

8.5 Safe programmable logic

SIRELTIME( )

;Assign times for timer

SIRELAY

;

Predefined functions and procedures

ITOR( )

;Conversion, integer to real

ITOB( )

;Conversion, integer to bool

RTOI( )

;Conversion, real to integer

RTOB( )

;Conversion, real to bool

BTOI( )

;Conversion, bool to integer

BTOR( )

;Conversion, bool to real

SETAL( )

;Set alarm

MSG(<<)

;Output message with contents of variables

Program jumps

GOTOB

;Jump instruction with jump destination towards the beginning of pro-

gram

GOTOF( )

;Jump instruction with jump destination towards the end of program

GOTO

;Jump instruction with jump destination search. The search

;is first made towards the end of the program, then towards the begin-

ning of the program.

GOTOC

;Same effect as for GOTO, with the difference that Alarm

;14080 "Jump designation not found" is suppressed.

An IF condition can be programmed in the block in front of the jump instruction.

Program branch

CASE(<expression>)

OF <constant_1>

GOTOF <jump destination_1>

<constant_2>

GOTOF<jump destina-

tion_2...>

DEFAULT GOTOF <jump desti-

nation n>

Program repetition

REPEAT LableA P=n

;Repeat program section

REPEAT LableA LableB P=n

;Repeat program section

REPEATB LableA P=n

;Repeat block

Control structures

IF, ELSE, ENDIF

;Program loop with alternative

LOOP, ENDLOOP

;Endless program loop

FOR, TO, ENDFOR

;Count loop

WHILE; ENDWHILE

;Program loop with condition at start of loop

REPEAT, UNTIL

;Program loop with condition at end of loop

Program flow

STOPRE

;Preprocessing stop

DELAYSTON

;Start of a stop delay area

DELAYSTOF

;End of a stop delay area

Comparison operators

Safety Integrated (system-integrated)

270

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

<>, ==, >=, <, >, <=

Bit-by-bit logic operators

B_END

B_OR

B_NOT

B_XOR

Logical operators

AND

OR

NOT

XOR

For the logic operations, the following applies to the BOOL, CHAR, INT and REAL data types: 0 corresponds

to FALSE; not equal to 0, corresponds to TRUE

Synchronized action

CANCEL

;Delete synchronized actions

IDS

;Static synchronized action

;no monitoring with respect to a number range

WHENEVER

;The action is cyclically executed in each IPO clock cycle,

;as long as the condition is fulfilled.

WHEN

;As soon as the condition has been fulfilled, the

action is executed once.

EVERY

;The action is initiated once when the condition is satisfied.

;The action is executed again if the condition transitions from

;the false state into the true state.

FROM

;If the condition has been fulfilled once, the action is executed cyclically

;in every interpolation clock cycle for as long

;as the synchronized action remains active.

DO

;Start of the action section

No subprograms, i.e. technology cycles can be called in the action section.

No axes can be traversed and no auxiliary functions can be output.

Values can be assigned to the following:

- R parameters

- $AC_PARAM[ ]

- $AC_MARKER[ ]

- all Synact GUDs

- all safety system variables and G functions that can be written to

G function

G70

;Inch dimensions (group 13) G71

G71

;Metric dimensions (group 13)

G700

;Inch dimensions also F (group 13)

G710

;Metric dimensions also F (group 13)

G04 F

;Dwell time (group 2)

End of program

ENDPROC

;End line of program with start line PROC

RET

;Without output to the PLC

;The RET command without parameter can now be programmed in a

;main program.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

271

Connecting sensors and actuators

8.5 Safe programmable logic

M17

;No output to the PLC

M02

;No output to the PLC

M30

;No output to the PLC

Note

All language commands, which are not listed in this table, result in NC alarms 15189 "Channel

%1 Block %2 Error when executing SAFE.SPF" and 15420 "Channel %1 Block %2 Instruction in

current mode not allowed".

Additional information on the complete NCK language scope can be found under:

References: Programming Manual Fundamentals, Chapter 16 "Tables".

8.5.7

Diagnostics/commissioning

The system variables $A_INSIP(D), $A_OUTSIP(D), $A_INSEP(D) and $A_OUTSEP(D), and

$A_MARKERSIP(D) are only used for diagnostics and commissioning the NCK-SPL. These system

variables represent the input data for crosswise data comparison on the PLC side. They are

updated every IPO cycle. They can also be used to access the CDC on the PLC side from the NC.

This helps when commissioning the SPL:

• Crosswise data comparison function can be temporarily bypassed

• NCK-SPL can be simulated to the process and to the NCK monitoring channel. To do this, the

relevant PLC images are written to the variables $A_OUTSED and $A_OUTSID as long as there

is no NCK-SPL. This means that the NCK-SPL can be commissioned step-by-step. This data may

only be accessed during the commissioning phase.

In order to allow the SPL to be commissioned without the crosswise data comparison function

constantly responding, the following "minimum NCK-SPL" can be installed in this phase:

; Simulate external SPL interface

IDS = 03 DO $A_OUTSED[1]

= $A_OUTSEPD[1]

IDS = 04 DO $AOUTSED[2]

= $A_OUTSEPD[2]

; Simulate internal SPL interface

IDS = 07 DO $A_OUTSID[1]

= $A_OUTSIPD[1]

IDS = 08 DO $A_OUTSID[2]

= $A_OUTSIPD[2]

; Emulate PLC markers (for all markers used in the PLC)

IDS = 09 DO

= $A_MARKERSIPD[1]

$A_MARKERSID[1]

IDS = 10 DO

= $A_MARKERSIPD[2]

$A_MARKERSID[2]

; End of program

M17

Safety Integrated (system-integrated)

272

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

8.5.8

Safe software relay

General

The standard SPL block "safety software relay" is designed to meet the requirements of an

Emergency Stop function with safe programmable logic. However, it can also be used to

implement other similar safety functions, e.g. to control a protective door.

25

4

4

$1'

$

$1'

70

&03

!

$

7LPHU

7LPH PHDVXUHPHQW IDOOLQJ

XS WR D ULVLQJ HGJH

(

$1'

W

$

(

W L

7LPHU

(B$1'

(

7,

$

7,

7LPHU

7,

6LJQDOV ZLWK VWDU

PHDQ ORZ DFWLYH

Figure 8-34

Function diagram of the safety relay

The description is provided in the following:

Three shutdown inputs

If one of these inputs is set to 0, then direct output A0 is set to 0. Outputs A1 to A3 switch with the

E1 to E3

delay of timer 1-3. If one of these inputs is not used, then it is internally set to "1" as static signal.

One of these inputs must also be used to initiate test operation of the safety relay (forced checking

procedure).

Two acknowledge inputs

Q1 must be supplied with the signal from the real acknowledge button.

Q1 and Q2

Q2 is only used for the forced checking procedure. The software relay itself does not have to be

subject to a forced checking procedure. However, if the Emergency Stop function is executed via

this, and if external actuators have to be subject to a forced checking procedure, if the relay drops-

out during the Emergency Stop test, then it can be acknowledged using Q2 (in a defined time

window, refer to TM1). This input must also be connected with a safety system variable (even if the

signal is not used) - preferably with a $A_MARKERSI - in order to detect that this acknowledge signal

is available as steady-state signal in the crosswise data comparison with the PLC. The associated

comparison data in the PLC must have a steady-state 0 signal level (error detection using different

states of the particular SPL marker for the PLC and NCK).

Safety Integrated (system-integrated)

274

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

Three timer initialization

The times after which outputs A1 to A3 are switched to 0 at a negative edge in output signal A0 are

values

defined here.

TI1 to TI3

One timer limit value TM1

Defines the maximum time that the shutdown inputs E1 to E3 may have been at a 0 signal level so

that they can still be acknowledged using Q2. Q2 should only be used for the internal safety relay

test. It is not permissible that Q2 is used to acknowledge a "real" shutdown.

Four output values A0 to

A0 supplies the result of ANDing E1 to E3 without any delay. Outputs A1 to A3 supply the same

A3

result for positive edges of A0; for negative edges, the results are delayed by the timer initialization

TI1 to TI3 (switch-out delay).

A0 to A3 do not produce a result after booting until an acknowledgment has been received via Q1.

Initialization in the part program

The connections for the function block are defined when initialized. The input and output

quantities of the function block are assigned to the required system variables ($A_MARKERSI,

$A_INSE, $A_OUTSE,...). The following functions must be called:

SIRELIN: This language command assigns the input quantities Q1, Q2, E1, E2 and E3 to the

safety relay x (x = 1...4). The return value contains the number of the first incorrect parameter;

a value of 0 indicates that the parameter assignment is correct.

Syntax: SIRELIN (x,status,”Q1”,”Q2”,”E1”,”E2”,”E3”)

The transfer parameters Q1 to E3 are strings and must therefore be entered in quotation marks

(" "). The following system variables are permissible as input quantities:

$A_MARKERSI[ ]

$A_INSE[ ]

$A_INSI[ ]

$A_OUTSE[

]$A_OUTSI[ ]

E2 and E3 are optional. If these parameters are not entered, the relevant inputs are set to "1"

(static signal).

SIRELOUT: This language command assigns the input quantities A0, A1, A2 and A3 to the safety

relay x (x = 1...4). The return value "status" contains the number of the first incorrect parameter;

a value of 0 indicates that the parameter assignment is correct.

Syntax: SIRELOUT (x,status,”A0”,”A1”,”A2”,A3”)

The transfer parameters A0 to A3 are strings and must therefore be entered in quotation marks

(" "). The following system variables are permissible as output quantities:

$A_MARKERSI[ ]

$A_OUTSE[ ]

$A_OUTSI[ ]

$A_PLCSIOUT[ ]

A1 to A3 are optional. If these parameters are not specified, then the corresponding outputs are

not supplied. However, if A1 is specified, the initialization value for timer 1 (TI1) must also be

parameterized via SIRELTIME. The same applies for A2 and timer 2 (TI2) and A3 and timer 3 (T!

3).

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

275

Connecting sensors and actuators

8.5 Safe programmable logic

SIRELTIME: This language command assigns the times - for the timers required - to safety relay

x (x=1..4). These include the timer limit value TM1 and the timer initialization values TI1, TI2 and

TI3. The return value contains the number of the first incorrect parameter; a value of 0 indicates

that the parameter assignment is correct.

Syntax: SIRELTIME (x,status,TM1,TI1,TI2,TI3)

Transfer parameters TM1 to TI3 are REAL numbers (times in seconds). TI1 to TI3 are optional. If

these parameters are not specified, the corresponding outputs A1 to A3 are not supplied.

However, if TI1 is specified, output A1 must also be parameterized via SIRELOUT. The same

applies for TI2 and A2 and TI3 and A3.

Note

• The initialization language commands must be directly included in the part program (e.g.

SAFE.SPF); they may not be used in synchronized actions! If this condition is violated, Alarm

12571, "Channel 1 Block %2 %3 not permitted in motion synchronizing action" is triggered.

• As described above, there is an interdependency between the number of the optional

parameters for the language commands SIRELTIME and SIRELOUT. This interdependency is

checked in the language command that comes later in the part program sequence. If, for

example, A2 is no longer parameterized in SIRELOUT, but TI2 is specified in SIRELTIME, then

this parameter is identified as being incorrect!

Cyclic sequence

The correctly timed call in the SPL is made using the language command SIRELAY. A calling

parameter is not required in the cyclic section except to select the required relay x (x = 1...4).

Initialization must be carried out beforehand. If this is not correctly done, then this is indicated

in the return value of the language command SIRELAY. The cyclic section must be integrated in

the synchronized actions of the SPL.

Syntax: status = SIRELAY(x)

The "status" variable must be defined as integer to correctly map the possible return values of the

function block. The following values are possible for status:

Return value

Meaning

status

1

The input quantity of the safety relay is either not parameterized or not correctly parameterized.

Remedy: Call SIRELIN with the correct parameterization

2

The output quantities of the safety relay are either not parameterized or not correctly parameter-

ized.

Remedy: Call SIRELOUT with the correct parameterization

3

The input and output quantities of the safety relay are either not parameterized or not correctly

parameterized.

Remedy: Call SIRELIN and SIRELOUT with the correct parameterization

4

The timers of the safety relay are either not parameterized or not correctly parameterized.

Remedy: Call SIRELTIME with the correct parameterization

5

The input quantities and timers of the safety relay are either not parameterized or not correctly

parameterized.

Remedy: Call SIRELIN and SIRELTIME with the correct parameterization

Safety Integrated (system-integrated)

276

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

Connecting sensors and actuators

8.5 Safe programmable logic

Return value

Meaning

status

6

The output quantities of the safety relay are either not parameterized or not correctly parameter-

ized.

Remedy: Call SIRELOUT and SIRELTIME with the correct parameterization

7

The initialization of the safety relay was either not carried out or not correctly carried out.

Remedy: Call SIRELIN, SIRELOUT and SIRELTIME with the correct parameterization

Note

1. The SIRELAY call must be made in the NCK-SPL (program SAFE.SPF), since the allocation of

the output quantities corresponds to the write access operations to safety system variables.

If the call comes from a different program, Alarm 17070 "Channel %1 Block %2 Data write-

protected" is output.

2. The SIRELAY call must be included in a synchronized action. If this condition is violated, Alarm

14091, "Channel %1 Block %2 function not permitted, Index: 6" is output.

3. If parameter x contains a value that lies outside the range 1 - 4, Alarm 20149 "Channel %1

Block %2 Motion synchronous action: Invalid index" is output.

Forced checking procedure

When the safety relay is tested, acknowledge input Q2 and one of the three disable inputs (E1,

E2 or E3) must be used. Q2 must be connected to a safety marker ($A_MARKERSI[ ]), and may

only be briefly set (< 1s) to 1.

One of the three inputs E1 to E3 can be used (e.g. from the PLC) with a short falling edge to check

that the safety relay has dropped out. The 0 signal level may not be present for longer than the

time parameterized in TM1. The maximum value for TM1 is 1s, as otherwise the crosswise data

comparison between NCK and PLC-SPL would detect an error.

Acknowledge input Q2 can only be used if the measured time t4 is shorter than TM1. This

prevents a queued shutdown operation being acknowledged externally via the test

acknowledge input. If A0 is 1 at the time of the falling edge of E_AND (= ANDing of E1, E2 and

E3), then time t4i is allocated the measured time t4. For additional measurements, while A0

remains at 0, t4i is only re-saved if the measured time t4 is greater than the old value of t4i.

Supplementary conditions

The language commands SIRELIN, SIRELOUT and SIRELTIME may not be used in synchronized

actions.

The language command SIRELAY may only be used in synchronized actions of the SPL

(SAFE.SPF). The connection must be specified beforehand using the language commands

SIRELIN, SIRELOUT and SIRELTIME.

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

277

Connecting sensors and actuators

8.5 Safe programmable logic

FirstRun: BOOL;

//

True by user after 1st start of SPL

END_VAR

The following table shows all formal parameters of the SI relay function:

Signal

Input or output

Type

Remark

In1

E

BOOL

Input 1

In2

E

BOOL

Input 2

In3

E

BOOL

Input 3

Ackn1

E

BOOL

Acknowledgment input 1

Ackn2

E

BOOL

Acknowledgment input 2

TimeValue1

E

TIME

Time value 1 for switch-off delay

TimeValue2

E

TIME

Time value 2 for switch-off delay

TimeValue3

E

TIME

Time value 3 for switch-off delay

Out0

A

BOOL

Output, instantaneous (no delay)

Out1

A

BOOL

Output, delayed by TimeValue1

Out2

A

BOOL

Output, delayed by TimeValue2

Out3

A

BOOL

Output, delayed by TimeValue3

FirstRun

E/A

BOOL

Activation of basic setting

The parameter FirstRun must be switched to the value TRUE using a retentive data (memory bit,

bit in data block) on the first run after the control has booted. This data can be preset, e.g. in

OB100. The parameter is reset to FALSE when FB10 is executed for the first time. Separate data

must be used for parameter FirstRun for each call with separate instance.

Note

The block must be called once by the user program (per SI relay) cyclically in the OB1 cycle from

when the SPL program starts. The user must provide an instance DB with any number for this

purpose. The call is multi-instance-capable.

8.5.9

System variables for SINUMERIK 840D sl

The following system variables can only be used in combination with SINUMERIK Safety

Integrated. They are used when programming the safe programmable logic (SPL).

For a detailed description of the system variables, also see Chapter "Description of the system

variables (Page 504)".

Table 8-5

Overview of system variables

System variable

Meaning

Value range

Data type

Possible access for

Part program

Synchronized action

r

w

r

w

Actual position

$VA_IS[axis]

Safe actual position NCK

DOUBLE

x

x

monitoring channel

Safety Integrated (system-integrated)

Function Manual, 10/2020, 6FC5397-4BP40-6BA2

279

Content      ..     2      3      4      5     ..