Content      ..     10      11      12      13     ..

SINUMERIK 840D sl. Service - Safety Integrated. Manual (2020) - page 12

Fundamental safety instructions

1

1.1

General safety instructions

WARNING

Danger to life if the safety instructions and residual risks are not observed

If the safety instructions and residual risks in the associated hardware documentation are not

observed, accidents involving severe injuries or death can occur.

• Observe the safety instructions given in the hardware documentation.

• Consider the residual risks for the risk evaluation.

WARNING

Malfunctions of the machine as a result of incorrect or changed parameter settings

As a result of incorrect or changed parameterization, machines can malfunction, which in turn

can lead to injuries or death.

• Protect the parameterization against unauthorized access.

• Handle possible malfunctions by taking suitable measures, e.g. emergency stop or

emergency off.

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

15

Introduction

2.2 About this documentation

Note

Carefully comply with the applicable standards and regulations

Depending on the application area, the SINUMERIK NCU, being part of plants and systems,

requires that special standards and regulations are carefully observed. It is absolutely crucial that

you observe the appropriate safety and accident prevention regulations, e.g. IEC 60204-1

(general requirements placed on the safety of machines).

Note

Important additional information

Note also the information in the SINAMICS S120 Safety Integrated Function Manual (https://

support.industry.siemens.com/cs/ww/en/view/109760403).

Note

Information for those switching over from "Safety Integrated (SPL)" to Safety Integrated

plus (F-PLC).

Additional information, which is relevant for users that previously worked with Safety Integrated

(system-integrated) is provided in Chapter "Switching over from SINUMERIK Safety Integrated

(Page 379)".

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

21

Fundamentals

3.2 Safety functions integrated in the drive

3.2

Safety functions integrated in the drive

Safety Integrated supports, through SINAMICS Integrated (as subcomponent of the SINUMERIK

control system), the SINAMICS Safety Integrated Functions (Page 79). These safety functions

integrated in the drive can communicate with the process via safety-related input/output

signals. They can be implemented for each individual axis and spindle.

Differentiation by scope

Based on the scope of the available functions and the licensing required, a distinction is made

between "Basic Functions" and "Extended Functions":

• Safety Integrated Basic Functions are always included as part of the standard scope of the

drive, and can be used without an additional license. These functions do not require an

encoder and/or do not place any special requirements on the encoder used.

• Safety Integrated Extended Functions require an additional license (Page 39). Extended

Functions with encoder require a safety-related encoder concept (Page 183).

Differentiation by application

Based on the specific application, safety functions integrated in the drive can be split up into

three main classes:

• Functions for safely stopping the drive, without having to disconnect the power from the line

supply

• Functions for safely monitoring the motion of a drive

• Functions for safely monitoring the position of a drive

Listing of all functions by application

Table 3-1

Functions for safely stopping the drive, without having to disconnect the power from the line supply

Safety Function

Scope

Brief description

Configuration via

Safe Torque Off

Basic/

Safe Torque Off is a safety function that prevents the drive from re-

STO (Basic/Exten-

(STO)

Extended

starting unexpectedly in accordance with EN- 60204-1. STO prevents

ded) (Page 91)

the supply of power to the motor, which can produce a torque. This is

equivalent to stop Category 0.

Safe Stop 1 (SS1,

Basic

Safe Stop 1 is based on the "Safe Torque Off" function. This means that

SS1 Basic

time-controlled)

a Category 1 stop in accordance with EN 60204-1 can be implemented.

(Page 80)

Safe Stop 1 (SS1,

Extended

SS1 Extended

time and accelera-

(Page 84)

tion controlled)

Safe Brake Control

Basic/

Safe Brake Control is used to safely control a holding brake.^{1) 2)}

SBC (Basic/Exten-

(SBC)

Extended

ded) (Page 97)

Safe Brake Test

Extended

The diagnostic function "Safe Brake Test" function (SBT) checks the

SBT (Page 160)

(SBT)

required holding torque of a brake (operating or holding brake). ³⁾

This function is in conformance with SIL 1 according to IEC 61508 and

to PLd/Cat. 2 according to EN ISO 13849-1.

Safe Stop 2 (SS2)

Extended

Safe Stop 2 is used to safely brake the motor with a subsequent tran-

SS2 (Page 104)

sition into the "Safe Operating Stop" state (SOS). This means that a

Category 2 stop in accordance with EN 60204-1 can be implemented.

Safety Integrated plus

24

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Fundamentals

3.2 Safety functions integrated in the drive

Safety Function

Scope

Brief description

Configuration via

Safe Stop 2 with ex-

Extended

The 'Safe Stop 2 with external stop' (SS2E) safety function is used to

SS2E (Page 107)

ternal stop (SS2E)

brake the motor safely. The drive does not automatically brake the

motor, but instead follows the specified speed setpoint.

Safe Stop 2 Exten-

Extended

The "Safe Stop 2 Extended Stop and Retract (SS2ESR)" safety function is

SS2ESR (Page 111)

ded Stop and Re-

used to brake the motor safely. The drive does not automatically brake

tract (SS2ESR)

the motor, but instead follows the specified speed setpoint. This can

also result in fast retraction motion. During the delay time p9554, the

brake ramp (SBR) and the acceleration (SAM) are not monitored, and

there is no standstill detection. SOS becomes active after delay time

p9554 has expired.

Safe Operating

Extended

Safe Operating Stop is used to protect against unintentional move-

SOS (Page 114)

Stop (SOS)

ment. The drive is in closed-loop control mode and is not disconnected

from the power supply.

1)

Note regarding Power/Motor Modules in the chassis format:

For the chassis format, SBC is only supported by Power/Motor Modules with the number 3 or higher at the last position of the

Article number. For this design, a Safe Brake Adapter is also required.

2)

Note regarding Power/Motor Modules in blocksize format:

blocksize Power Modules additionally require a Safe Brake Relay for this function.

3)

The Safe Brake Test is purely a diagnostic function, but for organizational reasons is included in the list of Safety Integrated

Extended Functions.

Table 3-2

Functions for safely monitoring the motion of a drive

Safety Function

Scope

Brief description

Configuration via

Safely-Limited

Extended

Safely-Limited Speed monitors that the drive does not exceed a preset

SLS (Page 118)

Speed (SLS)

speed/velocity limit.

Safely-Limited Ac-

Extended

Safely-Limited Acceleration monitors (the same as SLS) the accelera-

SLA (Page 175)

celeration (SLA)

tion, and intervenes when a limit value is violated.

Safe Speed Monitor

Extended

Safe Speed Monitor is used for safely identifying when a speed limit is

SSM (Page 131)

(SSM)

fallen below in both directions of motion, e.g. to identify zero speed. A

failsafe output signal is available for further processing.

Safe Direction (SDI)

Extended

Safe Direction is used to safely monitor the direction of motion.

SDI (Page 143)

Table 3-3

Functions for safely monitoring the position of a drive

Safety Function

Scope

Brief description

Configuration via

Safely-Limited Posi-

Extended

Safely-Limited Position ensures that a freely definable traversing range

SLP (Page 151)

tion (SLP)

is not left.

Transferring safe

Extended

The "Transfer safe position values (SP)" function enables you to transfer

SP (Page 156)

position values (SP)

a safe position to a higher-level control via PROFIsafe.

Safe cams (SCA)

Extended

Safe electronic cams enable a secure, axis-specific range detection or a

SCA (Page 172)

work zone / protection zone delimitation.

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

25

Fundamentals

3.4 Safety-relevant processing using NCU components

Details on internal processing of safety-related communication

1&8

) ',

&8

) '2

) 3/&

6DIHW\

3$(

SURJUDP

3$$

352),1(7 352),VDIH

'%

'%

352),%86 352),VDIH

6,& 6&&

7UDQVIHU

352),VDIH

,I UHTXLUHG DGGLWLRQDO

GLVWULEXWHG , 2 V\VWHPV

IDLOVDIH '3 VWDQGDUG

VODYHV

1&

7UDQVIHU

$;

$;

6,& 6&&

7UDQVIHU

352),VDIH

'5,9(

352),VDIH

$;

$;

,I UHTXLUHG

00

DGGLWLRQDO

$;

GULYHV

0RQLWRULQJ

'5,9( &/L4

$;

$;

Figure 3-1

Component diagram for processing safety-related information and data

Table 3-4

Subcomponents of the NCU

F-PLC

• Processing safety-related internal and external signals in the safety-related user

PROFIsafe host

program (safety program)

See: Safety program of the F-PLC (Page 45)

• Processing status and control signals (SIC/SCC) via the corresponding axis DB

(axis1 [DB31] ... axis 31 [DB61])

See: PLC user interface (DB3x) (Page 206), SIC/SCC (Page 205)

NC

• Transfers status and control information (SIC/SCC, axis DB) between the F-PLC

and DRIVE

• Transfers PROFIsafe telegrams (safety program, PAE/PAA) between F-PLC and

DRIVE

• Reads-in safety-related messages/signals from the message buffers of SINAM-

ICS Integrated into the NC alarm buffer

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

29

Fundamentals

3.4 Safety-relevant processing using NCU components

HMI

• Displays safety-related messages/alarms from the NCK alarm buffer

• Reads out and displays additional safety-related diagnostics information di-

rectly from the drive

• Displays a safety delete symbol for active safety messages

See: Diagnostics (Page 299)

DRIVE (SINAMICS

• Safety-related motion monitoring of NC-controlled drives (connected at the

Integrated)

DRIVE-CLiQ interface)

PROFIsafe slave

See: Safety functions integrated in the drive (Page 24)

• Executes fault response functions or user safety functions

Table 3-5

I/O and drives

F-I/O

The F-I/O guarantees the safety-related processing of information from the field

(sensors: e.g. EMERGENCY STOP pushbuttons, light barriers; actuators, e.g. mo-

PROFIsafe slave

tor controls). The safety function for the process itself can be implemented using

a user safety function - or a fault response function.

See: PLC user interface (DB3x) (Page 206), F-I/O for PROFIBUS DP (Page 32), F-

I/O for PROFINET IO (Page 32)

NC-controlled drives

For each individual axis and spindle, safety functions integrated in the drive can

be implemented, which can communicate via safety-related input/output signals

with the process.

See: Safety functions integrated in the drive (Page 24), Drive components

(Page 33)

Safety Integrated plus

30

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Fundamentals

3.5 Hardware components

3.5

Hardware components

Overview

The "SINUMERIK Safety Integrated plus (F-PLC)" safety solution places specific requirements on

the hardware components that are used.

Independent of the scope of the Safety Functions used, you can use failsafe SIMATIC and

standard I/O for PROFIBUS DP (Page 32) or PROFINET IO (Page 32) - as known from SIMATIC

Safety.

The drive system that you can use (Page 33) depends on whether a safety-related encoder is

used - and which axis type is to be used.

Hardware components

The following diagram shows an overview of a possible structure with failsafe hardware

components.

SRVVLEO\ RWKHU GLVWULEXWHG , 2

V\VWHPV IDLOVDIH , 2 VWDQGDUG

GHYLFHV '3 VWDQGDUG VODYHV

PROFINET/PROFIsafe

PROFIBUS/PROFIsafe

'LVWULEXWHG , 2

V\VWHP H J

(7

63

&8

ZLWK H[WHUQDO GULYH

Industrial Ethernet

SINUMERIK

Operator panel front with TCU

SINUMERIK control system

Figure 3-2

Configuration diagram: Hardware structure with Safety Integrated

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

31

Fundamentals

3.5 Hardware components

3.5.3

Drive components

The drive system that you can use depends on whether a safety-relevant encoder is used - and

which axis type is to be used.

Table 3-6

Supported axis types as a function of the drive type and the use of a safety-relevant encoder

Spindle

Rotary axis

Linear axis

Induction motor with encoder

Yes

Yes

Yes

Induction motor without encoder

Yes

No

No

Synchronous motor with encoder

Yes

Yes

Yes

Synchronous motor without en-

No

No

No

coder

SINAMICS HLA with encoder

No

No

Yes¹⁾

SINAMICS HLA without encoder

No

No

No

¹⁾ Not all Basic or Extended Functions are supported, see SINAMICS HLA (Page 36) or SINAMICS

HLA (Page 36).

3.5.3.1

Interconnecting DRIVE-CLiQ components

For Safety Integrated Functions, the general DRIVE-CLiQ rules apply as a basic principle. You will

find these rules in Chapter "Rules for connection with DRIVE-CLiQ" in the following Manual:

• "SINAMICS S120 Drive Functions" Function Manual (https://

support.industry.siemens.com/cs/ww/en/view/109771805)

Beyond this, the following rules also apply to Safety Integrated:

Rules for Safety Integrated Basic Functions

• Maximum of 4 drives per DRIVE-CLiQ line for control via PROFIsafe

Rules for Safety Integrated Extended Functions

• Maximum of 6 servo axes for default clock cycle settings (safety monitoring clock

cycle = 12 ms; current controller cycle = 125 μs); of which a maximum of 4 servo axes are in

one DRIVE-CLiQ line

• Maximum of 6 vector axes for the following clock cycle settings (safety monitoring

cycle = 12 ms; current controller cycle = 500 μs)

• One Double Motor Module corresponds to 2 DRIVE-CLiQ participants.

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

33

Fundamentals

3.5 Hardware components

• On Double Motor Modules, on the drive objects, different values for p9511 are not permitted,

even if the values in p0115[0] are different.

• You can operate a maximum of 4 Motor Modules with Safety Extended Functions on one

DRIVE-CLiQ line. The following condition applies in this regard: T_IReg (current controller

sampling time) = 125 μs for all axes. In addition to the 4 Motor Modules with Safety Extended

Functions, you can also operate the following modules on a DRIVE-CLiQ line:

- A Line Module if T_IReg (current controller sampling time) ≥ 250 μs

- A Motor Module if T_IReg (current controller sampling time) ≥ 125 μs

- A maximum of 7 Sensor Modules or DRIVE-CLiQ encoders

3.5.3.2

Drive monitoring with or without encoder

In the Safety Integrated system, encoderless safety operation is only supported for spindles with

induction motors.

If motors without a (safety-capable) encoder are being used, not all Safety Integrated Functions

can be used.

Note

Definition: "Without encoder"

When "without encoder" is used in this manual, then this always means that either no encoder

or no safety-capable encoder is being used.

In operation without encoder the actual speed values are calculated from the measured

electrical actual values. Therefore, speed monitoring is also possible during operation without

encoder.

The configuration of the Safety Integrated Functions and the selection of monitoring with or

without encoder is realized in the startup (commissioning) area of SINUMERIK Operate.

The safety functions integrated in the drive that are actually supported depends on the drive

components used (drive and axis type, and whether a safety-relevant encoder is used).

Table 3-7

Safety Integrated Functions in operation with or without encoder

Function

Basic

Extended

HLA

Electric drive

Brief description

With

With-

en-

out

coder

en-

coder

STO/SS1 Basic

x

-

x³⁾

x

x¹⁾

Safe Torque Off / Safe Stop according to

Stop Category 1 of DIN EN 60204-1.

Safe Torque Off/Safe Stop 1

STO Extended

-

x

x³⁾

x

x¹⁾

Safe Torque Off

Safe Torque Off

SBC

x

x

-

x

x¹⁾

Safe brake control

Safe Brake Control

SS1 Extended

-

x

x³⁾

x

x¹⁾

Safe Stop according to Stop Category 1

of DIN EN 60204-1.

Safe Stop 1

Safety Integrated plus

34

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Fundamentals

3.5 Hardware components

Function

Basic

Extended

HLA

Electric drive

Brief description

With

With-

en-

out

coder

en-

coder

SOS

-

x

x³

x

-

Safe monitoring of the standstill posi-

tion

Safe Operating Stop

SS2

-

x

x³

x

-

Safe stopping process in accordance

with stop Category 2

Safe Stop 2

SS2E

-

x

x³

x

x¹

SS2 with external stop

SS2 with external stop

SS2ESR

-

x

x³

x

x¹

Safe Stop 2 Extended Stop and Retract

Safe Stop 2 Extended Stop and Retract

SLS

-

x

x³⁾

x

x¹⁾

Safely-Limited Speed

Safely-Limited Speed

SSM

-

x

x³⁾

x

x¹⁾

Safe Speed Monitoring

Safe Speed Monitor

1, 2)

SAM

-

x

-

x

x

Safe Acceleration Monitoring

Safe Acceleration Monitor

SBR

-

x

-

x

x¹⁾

Safe brake ramp monitoring

Safe Brake Ramp

SDI

-

x

x³⁾

x

x¹⁾

Safe motion direction

Safe Direction

SLP/SP

-

x

x³⁾

x

x¹⁾

Safely-Limited Position/Safe Position

Safely-Limited Position/

Safe Position

SLA

-

x

x³⁾

x

x¹⁾

Safely-Limited Acceleration

Safely-Limited Acceleration

SBT (diagnostic function)

-

x

-

x

-

Safe Brake Test

Safe Brake Test

SBT is a pure diagnostic function - but

for organizational reasons is included

in the list of Safety Integrated Exten-

ded Functions.

SCA

-

x

x

x

-

Safe Cam

Safe Cam

¹⁾ Safety operation without encoder is only supported for spindles equipped with induction

motors, see also Table 3-6 Supported axis types as a function of the drive type and the use of a

safety-relevant encoder (Page 33).

²⁾ Only for the function setting "Safety without encoder with accel_monitoring".

³⁾ Encoderless Safety mode with SINAMICS HLA is not supported either for Basic Functions or for

Extended Functions, see also SINAMICS HLA (Page 36).

See also

Drive components (Page 33)

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

35

Fundamentals

3.6 Safety components and licensing

3.6

Safety components and licensing

3.6.1

Software components required

When configuring the system, the STEP 7 Safety Advanced option package is required. This

option package is integrated in package "SIMATIC STEP 7 Professional V16". The software can be

immediately used once the license for the option package has been installed.

Engineering system:

• TIA Portal V16 Update 2

• SIMATIC STEP 7 Professional V16 Update 2

- SIMATIC STEP 7 Safety Advanced V16 Update 2

• SINUMERIK 840D sl STEP 7 Toolbox V16 Update 2

CNC software:

• SINUMERIK CNC software V4.94

• SINUMERIK Operate V4.94

3.6.2

Licensing axes/spindles and F-PLC

To use Safety Integrated plus (F-PLC), you require in addition to the license for SIMATIC STEP 7

Safety Advanced (TIA Portal), the appropriate software options for the RT function:

Table 3-8

Software options for the use of Safety Integrated plus (F-PLC)

Software option

Article No.

Purpose

SINUMERIK 840D sl

6FC5800-0AS60-0YB0

Activate the F-PLC in SINUMERIK 840D sl in order to

process the failsafe sensors and actuators in an F-

Safety Integrated plus

program.

/SI logic

SINUMERIK 840D sl

6FC5800-0AK00-0YB0

Use the motion control functions of the SINAMICS

Safety Integrated plus

Safety Integrated in the SINUMERIK Safety Integra-

/ SI axis/spindle

ted plus (F-PLC) mode.

License for one axis/spindle, multiple licensing in

order to be able to use further axes/spindles.

SINUMERIK 840D sl

6FC5800-0AS61-0YB0

Use the motion control functions of the SINAMICS

Safety Integrated plus

Safety Integrated in the SINUMERIK Safety Integra-

/ SI multi-axis package

ted plus (F-PLC) mode.

License for any number of axes/spindles.

Depending on the functions used, you must license the appropriate software options and set in

the machine data:

• MD19500 $MN_SAFE_PLC_LOGIC: Safety Integrated plus /SI-Logic basic option

• MD19121 $MN_NUM_DRIVEBASED_SAFE_AXES: Number of axes/spindles in Safety

Integrated plus (F-PLC) mode

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

39

Fundamentals

3.7 Components and basic configuration in the TIA Portal

Marking failsafe components in the TIA Portal

2

1

①

The project tree shows which components of your project are F-components.

②

In the network view, device view or topology view, the Safety Integrated marking is on the NCU, representative for the

integrated components. External devices, e.g. NX, may have their own Safety Integrated marking.

③

Safety-related settings are marked in the "Properties" inspector window.

④

Folders and the devices themselves are marked in the hardware catalog. You can therefore see whether SINUMERIK

Safety Integrated is supported before inserting the device.

⑤

Failsafe devices are also marked in the information area of the hardware catalog.

Figure 3-3

Marking failsafe components in the TIA Portal

Safety Integrated plus

42

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Fundamentals

3.7 Components and basic configuration in the TIA Portal

EMERGENCY STOP button symbol when using Safety Integrated plus (F-PLC)

If you activate the "Safety Integrated plus (F-PLC)" mode and therefore use PROFIsafe telegrams,

all devices with failsafe modules (PROFIsafe telegrams) have an EMERGENCY STOP button

symbol in the network and topology view:

Figure 3-4

NCU with EMERGENCY STOP button symbol

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

43

Safety program of the F-PLC

4.1 Structure of the safety program

4.1

Structure of the safety program

Representation of program structure

The structure of a safety program (or an F-runtime group) of the PLC of a SINUMERIK 840D sl

(F-PLC S7-300) is schematically shown in the following diagram.

6WDQGDUG XVHU SURJUDP

) UXQWLPH JURXS LQ WKH VDIHW\ SURJUDP

,QVWUXFWLRQV WDVN FDUG

0DLQ VDIHW\ EORFN

) 6%V

,QVWUXFWLRQV

$XWRPDWLF

,QSXWV RI WKH

JHQHUDWHG

5&9'3

) , 2 DUH UHDG

) EORFNV

5&96

LQWR WKH SURFHVV

RSWLRQDO

&RPPXQLFDWLRQ

LPDJH RI WKH

HJ

LQSXWV

2%

) )%

) )& [\

*HQHUDO

(GLWLQJ RI WKH

%LW ORJLF RSHUDWLRQV

) EORFNV FUHDWHG

6DIHW\ IXQFWLRQV

RU DGGHG E\ WKH

7LPHUV

XVHU

&RXQWHUV

&RPSDUDWRU RSHUDWLRQV

0DWK IXQFWLRQV

0RYH

&RQYHUVLRQ RSHUDWLRQV

) '% [\

3URJUDP FRQWURO

:RUG ORJLF RSHUDWLRQ

(GLWLQJ RI

6KLIW DQG URWDWH

DXWRPDWLFDOO\

2SHUDWH

DGGHG ) EORFNV

IDXOW FRQWURO

) ,2

PHDVXUH

'% [\

6(1''3

6(1'6

&RPPXQLFDWLRQ

3URFHVV LPDJH

RSWLRQDO

RI RXWSXWV LV

) 6%V

ZULWWHQ WR

RXWSXWV RI ) , 2

$XWRPDWLF

JHQHUDWHG

) EORFNV

FDOOHG E\ XVHU

ZULWH UHDG

FDOOHG DXWRPDWLFDOO\

IURP ,QVWUXFWLRQV WDVN FDUG

Figure 4-1

Schematic structure of a safety program

Main safety block

The main safety block is the first F-block of the safety program that you program yourself. During

compiling, it is supplemented by additional invisible calls of F-system blocks.

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

47

Safety program of the F-PLC

4.1 Structure of the safety program

You must assign the main safety block to an F-runtime group (Page 60).

The main safety block is called in an F-CPU S7-300 from any block belonging to the standard user

program. We recommend a call from an OB 3x.

) )% _ ) )&

2%

)% _ )&

) )% _ ) )&

0DLQ VDIHW\ EORFN

Figure 4-2

Calling the main safety block

F-runtime group

To improve handling, a safety program comprises one F-runtime group. An F-runtime group is

a logical arrangement comprising several contiguous F-blocks, which are internally formed by

the F-system.

An F-runtime group is made up of the following components:

• Main safety block (F-FB/F-FC, which you assign to the calling OB)

• F-blocks that you generated yourself - or that you inserted:

- F-blocks from the project library or from global libraries

- Possibly other F-FBs/F-FCs, which you program with FBD/LAD - and that you call from the

main safety block

- Possibly one or several F-DBs

• Automatically added F-blocks:

- F-I/O DBs

- F-system blocks (F-SB)

- Automatically generated F-blocks

Block types and number ranges of the safety program

An F-runtime group together with the associated blocks is automatically created when you

activate the "SINUMERIK Safety Integrated plus (F-PLC)" mode:

• Calling block: CYC_INT5_RTG1 [OB35]

• Main safety block: Main_Safety_RTG1 [FB1010]

• I-DB for the main safety block: Main_safety_RTG1_DB [DB1010]

Number range reserved for SINUMERIK

In order to avoid assigning block addresses or numbers twice, the F-blocks are automatically

assigned a free number within a certain number range reserved for SINUMERIK. You can also

Safety Integrated plus

48

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.2 Fail-Safe Blocks

4.2

Fail-Safe Blocks

F-blocks of an F-runtime group

The following table shows the F-blocks that you use in an F-runtime group:

F-block

Function

Main safety block

For the integrated PLC of the SINUMERIK 840D sl (PLC 317F-3 PN/DP or PLC 319F-3 PN/DP), the main

safety block is a F-FC or F-FB (with instance DB), which is called by a standard block (recommendation:

OB 35) from the standard user program.

F-FB/F-FC

Both in the main safety block as well as additional F-FBs and F-FCs, you can perform the following:

• Program the safety program with the instructions available for F-blocks in FBD or LAD

• Call other created F-FBs/F-FCs for structuring the safety program

• Insert F-blocks from the project library or global libraries

F-DB

Optional failsafe data blocks that can be read- and write-accessed within the entire safety program.

F-I/O DB

An F-I/O DB is automatically generated for each F-I/O when it is configured. You can or you must access

the variables of the F-I/O DB in conjunction with F-I/O accesses.

F-global-DB

The F-shared DB is a failsafe data block that contains all of the shared data of the safety program and

additional information needed by the F-system.

Note

It is not permissible that you add, change or delete blocks in folder "System blocks". If this is not

complied with, then this can result in compilation errors or the F-PLC stopping.

Note

You are not permitted to insert F-system blocks from the "System blocks" folder in a main safety

block/F-FB/F-FC.

Additional information

Detailed information about the safety program blocks can be found at Procedure when defining

an F-runtime group (Page 60).

Safety Integrated plus

50

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.3 Safety Administration Editor

4.3

Safety Administration Editor

In mode "SINUMERIK Safety Integrated plus (F-PLC)", the "Safety Administration Editor" is

available in the project navigation.

Figure 4-3

Safety Administration Editor

The Safety Administration Editor supports you when carrying out the following tasks:

• Display of the safety program status

• Display of the collective signature

• Display of the safety mode status

• Creation/organization of F-runtime groups

• Display of information on the F-blocks

• Definition/change of the access protection

• Definition/change of the general settings for the safety program

The Safety Administration Editor is divided into the following sections:

• General

• F-runtime groups (Page 60)

• F-blocks

• Access protection

• Settings

Additional information

Additional information is provided in the help for SIMATIC STEP 7 Safety Advanced in Chapter

"Safety Administration Editor".

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

51

Safety program of the F-PLC

4.4 Restrictions in the programming languages FBD/LAD

4.4

Restrictions in the programming languages FBD/LAD

LAD and FBD programming languages

Generally, the user program in the F-PLC comprises a standard application program and a safety

program.

The standard user program is created using standard programming languages such as SCL, STL,

LAD, or FBD.

For the safety program, LAD or FBD may be used with certain restrictions in the instructions and

the applicable data types and operand areas.

Supported instructions

The instructions available depend on the F-PLC being used. SINUMERIK 840D sl supports all

F-CPU S7-300 instructions.

Note

Preconnection of enable input EN or evaluation of enable output ENO is not possible.

Supported data types and parameter types

Only the following data types are supported:

• BOOL

• INT

• WORD

• DINT

• DWORD

• TIME

Note

If the result of an operation lies outside the range permissible for the specific data type, then the

F-PLC can go into STOP. The cause of the diagnostic result is entered in the diagnostics buffer of

the F-PLC.

Additional information regarding the cause is available in the online help for the diagnostics

message. You must therefore ensure that the permitted range for the data type is observed

when creating the program or select a matching data type.

Safety Integrated plus

52

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.4 Restrictions in the programming languages FBD/LAD

Non-permitted data and parameter types

The following types are not permitted:

• All types not listed in the section "Supported data types and parameters types" (e.g. BYTE,

REAL)

• structured data types (e.g. STRING, ARRAY, STRUCT, PLC data type)

• Parameter types (e.g., BLOCK_FB, BLOCK_DB, ANY)

Supported operand areas

The system memory of an F-PLC is structured in the same operand area as that of a standard PLC.

You can access the operand areas listed in the table below from within the safety program.

Note that you can access data in the safety program only via the declared data type for the tag/

element of an F-compliant PLC data type:

• For the BOOL data type only bit by bit

• For the INT data type only word by word

• For the WORD data type only word by word

• For the DINT data type only double word by double word

• For the DWORD data type, only double word by double word

• For the TIME data type only double word by double word

Example: You can only access input channels, data type BOOL in the process image of the inputs

of F I/O via unit "Input (bit)".

Byte access to eight consecutive input channels of the BOOL data type is not allowed.

For reasons of clarity, you should always access operand areas in a safety program using

symbolic names.

Table 4-1

Supported operand areas

Operand area

Access via units of the fol-

S7 Nota-

Description

lowing size:

tion

Process image of the inputs

• Of F-I/O

Input (bit)

I

Only read-only access to input channels of F-I/O

is possible.

Input word

IW

Transfer to IN_OUT parameters of an F-FB or F-

Input double-word

ID

FC is therefore not valid either.

The process image of the inputs of F-I/O is up-

dated before the start of the main safety block.

• Of standard I/O

Input (bit)

I

Input channels of standard I/O can only be ac-

cessed read-only.

Input word

IW

Transfer to IN_OUT parameters of an F-FB or F-

Input double-word

ID

FC is therefore not valid either.

In addition, a process-specific validity check is

required.

See the STEP 7 help for the update times of the

process image of the inputs of standard I/O.

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

53

Safety program of the F-PLC

4.4 Restrictions in the programming languages FBD/LAD

Operand area

Access via units of the fol-

S7 Nota-

Description

lowing size:

tion

Process image of the outputs

• Of F-I/O

Output (bit)

Q

Only write-only access to output channels of F-I/

O is possible.

Output word

QW

Transfer to IN_OUT parameters of an F-FB or F-

Output double-word

QD

FC is therefore not valid either.

In the safety program, the values for the outputs

of the F-I/O are calculated and stored in the

process image of the outputs.

The process image of the outputs for F-I/O is

updated after the end of the main safety block.

• Of standard I/O

Output (bit)

Q

Output channels of standard I/O are write-only

channels.

Output word

QW

Transfer to IN_OUT parameters of an F-FB or F-

Output double-word

QD

FC is therefore not valid either.

In the safety program, the values for the outputs

of the standard I/O are also calculated and stor-

ed in the process image of the outputs, if nee-

ded.

See the STEP 7 help for the update times of the

process image of the outputs of standard I/O.

Bit memory

Bit memory (bit)

M

This area is used for data exchange with the

standard user program.

Memory word

MW

In addition, read access requires a process-spe-

Memory double word

MD

cific validity check.

A particular element of the bit memory can be

either read- or write-accessed in the safety pro-

gram.

Transfer to IN_OUT parameters of an F-FB or F-

FC is therefore not valid either.

Note that it is only permitted to use bit memory

for connecting the standard user program and

the safety program; it must not be used as a

buffer for F-data.

Data blocks

Safety Integrated plus

54

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.4 Restrictions in the programming languages FBD/LAD

Operand area

Access via units of the fol-

S7 Nota-

Description

lowing size:

tion

• F-DB

Data bit

DBX

Data blocks store information for the program.

They can either be defined as global data blocks

Data word

DBW

such that all F-FBs, F-FCs, or main safety blocks

Data double word

DBD

can access them or assigned to a particular F-FB

or main safety block (instance DB). A tag of a

shared DB can only be accessed from one F-run-

time group, and an instance DB only from the F-

runtime group in which the corresponding F-FB/

instruction is called.

• DB

Data bit

DBX

This area is used for data exchange with the

standard user program.

Data word

DBW

In addition, read access requires a process-spe-

Data double word

DBD

cific validity check.

For a tag of a DB, either read access or write

access is possible in the safety program.

Transfer to IN_OUT parameters of an F-FB or F-

FC is therefore not valid either.

Please note that the tags of a DB can only be

used for transferring data between the standard

user program and the safety program; DBs must

not be used as a buffer for F-data.

Non-permitted operand areas

Access via units other than those listed in the table above is not permitted. The same applies to

access to operand areas not listed, in particular:

• Data blocks that were automatically added

Exception: certain tags in the F I/O DB (Page 50) and in the F global DB (Page 64).

• I/O area: Inputs

• I/O area: Outputs

Boolean constants "0" or "FALSE" and "1" or "TRUE" (S7-300, S7-400)

If you require Boolean constants "0" or "FALSE" and "1" or "TRUE" in your safety program to assign

parameters during block calls, you can access the tags "VKE0" and "VKE1" in the F-shared DB

using fully qualified DB access ("F_GLOBDB".VKE0 or "F_GLOBDB".VKE1).

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

55

Safety program of the F-PLC

4.4 Restrictions in the programming languages FBD/LAD

Operand area of temporary local data: Particularities

Note

Note when using the operand area of temporary local data that the first access of a local data

element in a main safety block/F-FB/F-FC must always be a write access. This initializes the local

data element.

Make sure that the initialization of the local data element is not skipped over by JMP, JMPN. or

RET instructions (branching).

The "local data bit" should be initialized with the Assign ("=") (FBD) or ("--( )") (LAD) instruction.

Assign the local data bit a signal state of "0" or "1" as a Boolean constant.

Local data bits cannot be initialized with the Flip Flop (SR, RS), Set Output (S) or Reset Output (R)

instructions.

If this is not complied with, then the F-PLC can go into STOP. The cause of the diagnostic result

is entered in the diagnostics buffer of the F-PLC. You can find additional information on the cause

in the online help for diagnostic messages.

"Fully qualified DB access"

Access to tags of a data block in an F-FB/F-FC is "fully qualified DB access". This also applies to

initial access to tags of a data block after a jump label.

For F-PLCs S7-300/400, only the first access must be realized as "fully qualified DB access"

Alternatively, you can use the instruction "OPN".

Example of "fully qualified DB access":

Assign a name for the F-DB, e.g. "F_Data_1". Use the names assigned in the declaration of the

F-DB instead of the absolute addresses.

,17

)B'$7$B

9$/8(B$

)B'$7$B

5(68/7

,1

)B'$7$B

9$/8(B%

,1

Figure 4-4

Example with fully qualified access and symbolic names

Safety Integrated plus

56

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.5 Instructions for the safety program

4.5

Instructions for the safety program

When programming an F block, in task card "Operations" you can find all the operations that you

can use when programming an F block in LAD or FBD with the configured F-PLC. These

operations have a yellow backg12round, as is already the case for as a safety-relevant functions.

Figure 4-6

Task Card "Instructions"

In addition to the known operations, there are special safety functions, e.g. for two-hand

monitoring, discrepancy analysis, muting, E STOP, protective door monitoring and feedback

circuit monitoring.

Additional information

A detailed description of the instructions for the safety program provided in the Programming

and Operating Manual SIMATIC Safety - Configuring and Programming (https://

support.industry.siemens.com/cs/ww/en/view/54110126).

Alternatively, you can call up these descriptions directly in the TIA Portal by moving the tooltip

over a specific operation.

Safety Integrated plus

58

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.5 Instructions for the safety program

Figure 4-7

Tooltip of an instruction

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

59

Safety program of the F-PLC

4.6 F-runtime groups

Figure 4-8

Settings for STEP 7 Safety

Archiving the F-blocks

The automatically created F-blocks of the F-runtime group are in folder "Program blocks":

CYC_INT5_RTG1 [OB35], Main-Safety_RTG1 [FB1010] and Main-Safety_RTG1_DB [DB1010].

Figure 4-9

F runtime group blocks in the project navigator

Open the "F runtime group" work cell

If you wish to adapt the automatically created F runtime group or configure F runtime groups,

in the Safety Administration Editor, open the "F runtime group" work cell.

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

61

Safety program of the F-PLC

4.6 F-runtime groups

Figure 4-10

Displaying the "F runtime group" work cell

"F runtime group" work cell

Figure 4-11

Safety Administration Editor, "F runtime group" work cell

① Calling block

The default value is "CYC_INT5_RTG1 [OB35]", a cyclic interrupt OB.

Safety Integrated plus

62

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.7 Creating F-blocks

4.7

Creating F-blocks

Introduction

In order to create F-FBs, F-FCs, and F-DBs for the safety program, you should follow the same

basic procedure as for standard blocks. In the following, only the deviations from the procedure

for standard blocks are presented.

Creating F-FBs, F-FCs, and F-DBs

You create F-blocks in the same way as for standard blocks. Proceed as follows:

1. Double-click on "Add new block" under "Program blocks" in the project tree.

2. In the dialog that appears, specify the type, name, and language and select the "Create F-

block" check box. (If you do not select the check box, a standard block is created.)

3. After the dialog is confirmed, the F-block is opened in the Program editor.

Note the following

Note the following important instructions:

Note

The main safety block must not contain any parameters, as they cannot be provided with actual

values when the block is called.

Note

It is not permissible to edit the start values in instance DBs of F-FBs online and offline - and this

can result in the F-PLC going into STOP mode.

Note

It is not permitted to access static local data in single instances or multi-instances of other F-FBs.

Note

Outputs of F-FCs must always be initialized.

If this is not complied with, then the F-PLC can go into STOP. The cause of the diagnostic result

is entered in the diagnostics buffer of the F-PLC. You can find additional information on the cause

in the online help for diagnostic messages.

Note

If you wish to assign an operand from the data area (data block) to a formal parameter of an F-

FC as an actual parameter, you must use fully qualified DB access.

Safety Integrated plus

66

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.7 Creating F-blocks

Note

Note that access to the inputs in an F-FB/F-FC is read-only, while access to the outputs is write-

only.

Use an in/out if you wish to have both read and write access.

Note

For greater clarity, assign unique symbolic names to the F-blocks you have created. These

symbolic names appear in the project tree and in the block interface. Symbolic names are

assigned in the same way as for standard blocks.

Copying/pasting F-blocks

You can copy F-FBs, F-FCs, and F-DBs in exactly the same was as blocks of the standard user

program.

Exception:

You must not copy blocks from the folder "Program blocks > System blocks".

Nesting depth for F-FBs and F-FCs

We recommend that you do not exceed a nesting depth of 8 levels.

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

67

Safety program of the F-PLC

4.9 Safety-relevant communication

4.9

Safety-relevant communication

Options for safety-related communication

Safety-related communication

On subnet

Additional hardware

required

I-slave-slave communication

PROFIBUS DP

-

Safety-related CPU-CPU communication:

IO controller-IO controller communica-

PROFINET IO

PN/PN coupler

tion

Master-master communication

PROFIBUS DP

DP/DP coupler

IO controller-I-device communication

PROFINET IO

-

Master-I-slave communication

PROFIBUS DP

-

I-slave-I-slave communication

PROFIBUS DP

-

IO controller-I-slave communication

PROFINET IO and PROFIBUS DP

IE/PB link

Safety-related communication via S7

Industrial Ethernet

-

connections

IO controller-IO controller communica-

PROFINET IO

PN/PN coupler

tion for S7 Distributed Safety

Master-master communication for S7 Dis-

PROFIBUS DP

DP/DP coupler

tributed Safety

Safety-related communication to S7 Dis-

Industrial Ethernet

-

tributed Safety or S7 F Systems via S7

connections

Additional information

Additional information and configuration graphics are provided in the help for SIMATIC STEP 7

Safety Advanced in Chapter "Safety-relevant communication".

Safety Integrated plus

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

69

Safety program of the F-PLC

4.13 Data exchange between the standard user program and safety program

4.13

Data exchange between the standard user program and safety

program

You have the option of transferring data between the safety program and the standard user

program. Tags can be transferred using DBs, F-DBs and bit memory:

From the standard user program

From the safety program

Read access

Write access

Read access

Write access

Tag from DB

Permitted

Permitted

A tag from the DB can be read-accessed or write-

accessed

Tag from F-DB

Permitted

Not permitted

Permitted

Permitted

Bit memory

Permitted

Permitted

Bit memory can be read-accessed or write-ac-

cessed

You can also access the process image of the standard I/O and F-I/O:

From the standard user program

From the safety program

Read access

Write access

Read access

Write access

Process image

PII

Permitted

Permitted

Permitted

Not permitted

standard I/O

PIQ

Permitted

Permitted

Not permitted

Permitted

Process image

PII

Permitted

Not permitted

Permitted

Not permitted

F-I/O

PIQ

Permitted

Not permitted

Not permitted

Permitted

Decoupling of the safety program from the standard program in case of data transfer

For data exchange between standard user program and safety program, we recommend that

you define special data blocks (transfer blocks) in which the data to be exchanged is stored. This

action allows you to decouple the blocks of the standard and the safety program. The changes

in the standard program do not affect the safety program (and vice versa) provided these data

blocks are not modified.

Safety Integrated plus

74

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Safety program of the F-PLC

4.13 Data exchange between the standard user program and safety program

Process image of the outputs

You can write to the process image of the outputs (PIQ) of standard I/O in the safety program,

for example for display purposes. The PIQ must not be read in the safety program.

4.13.2

Data Transfer from Standard User Program to Safety Program

Overview

It is only permissible that failsafe data or failsafe signals from the F-I/O and other safety programs

(in other F-CPUs) are processed in the safety program, as all variables from the standard program

are not secured.

If you have to process variables from a standard user program in the safety program, then you

can either evaluate bit memories from the standard user program, variables from a standard DB

or the process image of the inputs (PII) from the standard I/O in the safety program (see also the

table of the supported operand areas in: Restrictions in the programming languages FBD/LAD

(Page 52)).

However, note that structural changes to standard DBs, which are used in the safety program,

can result in inconsistencies of the safety program so that the password is possibly queried as a

consequence. In this case, the F-collective signature after compilation corresponds to the

original one. To avoid this effect, use "Coupling data blocks" between the standard user program

and the safety program.

WARNING

Unexpected machine motion when using non-failsafe data

Bit memories from the standard user program, variables of a standard DB or the process image

of inputs (PAE) of the standard I/O are not failsafe data. Hazardous states can occur in the

machine if you evaluate non-failsafe data in the safety program. This can put people in

dangerous situations or cause material damage.

• Check the standard data in the safety program for plausibility.

• If you use standard data in both F-runtime groups, then separately check the plausibility in

both F-runtime groups.

To make checking easier, when printing out the safety program, all PLC variables from the

standard user program, which are evaluated in the safety program, are printed out.

Bit memory

In order to process variables of the standard user program in the safety program, you can also

read bit memory in the safety program. However, read bit memory must not be written in the

safety program itself.

Safety Integrated plus

76

Commissioning Manual, 10/2020, 6FC5397-1FP40-6BA4

Content      ..     10      11      12      13     ..