Content      ..     18      19      20      21     ..

SINUMERIK 840D sl. Service - Safety Integrated. Manual (2020) - page 20

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

4.2.2

Control possibilities

The following options are available for controlling Safety Integrated Extended Functions:

● PROFIsafe

● TM54F

● Onboard F-DI (CU310-2)

● Permanent selection (Safety Integrated Functions without selection)

Details on the control options can be found in Chapter "Control of the safety functions

(Page 207)".

4.2.3

Safe Torque Off (STO)

For the control options and the functionality for "Safe Torque Off" (STO), see Section "Safe

Torque Off (STO) (Page 76)".

4.2.4

Safe Stop 1 (SS1)

Definition according to EN 61800-5-2:

"The function SS1 brakes the motor, moni-

STO

v

tors the magnitude of the motor deceleration

within specified limits, and after a delay time

or violation of a speed threshold, initiates

the STO function."

∆t

t

Example of how the function can be used

Example

Possible solution

After an Emergency Stop button has been pressed,

● Wire the Emergency Stop button with a fail-

the drive must be braked as quickly as possible and

safe input.

brought into the STO state.

● Select SS1 via the fail-safe input.

● SS1 brakes the drive and then brings it into

the STO state.

A central Emergency Stop button ensures that sev-

● Evaluating an emergency stop pushbutton in

eral drives are braked as quickly as possible and

a central control.

brought into the STO state.

● Select SS1 via PROFIsafe.

● SS1 brakes the drives and then brings them

into the STO state.

Safety Integrated

50

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

How does SS1 function in detail?

Overview

6SHHG

0RQLWRULQJ

Using the SS1 function, the converter brakes

the motor and monitors the absolute speed.

672

If the motor speed is low enough or the delay

time has expired, the converter safely switches

W

'HVHOHFW 66

off the motor torque using STO .

) ', RU

352),VDIH

FRQWURO ZRUG

W

Select SS1

As soon as the converter identifies that SS1 has been selected via a failsafe input or via

PROFIsafe safe communication, the following happens:

● If the motor has already been switched off when selecting SS1 then the converter safely

switches off the motor torque (STO).

● If the motor is switched on when SS1 is selected, the converter brakes the motor with the

AUS3 ramp-down time.

Monitoring modes

For the Extended Functions with or without encoder, you can choose between 2 different

monitoring modes of the function SS1:

● Safe Brake Ramp (SBR)

● Safe Acceleration Monitor (SAM)

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

51

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

Brake ramp monitoring

Acceleration monitoring

(with or without encoder)

(with or without encoder)

6SHHG

6SHHG

6%5

6$0

6WDQGVWLOO

672

6KXWGRZQ

672

PRQLWRULQJ

VSHHG

W

6KXWGRZQ

'HOD\ WLPH IRU EUDNLQJ

VSHHG 66

W

'HVHOHFW

UDPS

66

66

GHVHOHFWLRQ

) ', RU

) ', RU

352),VDIH

W

352),VDIH

W

FRQWURO ZRUG

FRQWURO ZRUG

672

672 DFWLYH

DFWLYH

) '2 RU

) '2 RU

352),VDIH

352),VDIH

W

W

VWDWXV ZRUG

VWDWXV ZRUG

● Using the SBR (Safe Brake Ramp) function,

● The converter monitors the speed of the motor

the converter monitors whether the motor

with the SAM function.

speed decreases.

● The converter prevents the motor from accel-

● The gradient of the SBR function can be set via

erating again by having the monitoring function

the reference velocity and the ramp-down time.

continuously track the speed as it decreases.

The SBR function only starts after the "Delay

● The converter reduces the monitoring thresh-

for braking ramp".

old until the "Shutdown speed" has been

● The SBR function starts with the speed set-

reached.

point, which was present at the instant in time

● The converter safely switches off the motor tor-

that SS1 was selected.

que (STO), if one of the following conditions is

● If the converter detects that the speed has fall-

fulfilled:

en below the speed threshold (standstill moni-

- The speed has fallen below the shutdown

toring), it safely switches off the motor torque

speed SS1.

(STO).

- The maximum time until the torque is

switched off has expired.

Note

SS1 with external stop (SS1E)

If you use SS1E, neither of the two monitoring functions (SBR, SAM) is active. The drive must

be shut down in SS1E within the delay time, for example, by a user program of a CPU. STO

becomes active after the delay time expires.

Details and parameterization

For further details and information on how to parameterize this function, see Chapter "Safe

Stop 1 (SS1) (Page 103)".

Safety Integrated

52

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

4.2.5

Safe Operating Stop (SOS)

Definition according to EN 61800-5-2:

"This SOS function is used for safe monitor-

SOS

s

ing of the standstill position of a drive."

∆t

t

Example of how the function can be used

Example

Possible solution

A protective door must only be opened if a motor is in

● Select SOS

the safe standstill state.

● A higher-level controller brakes the axis (e.g.

position-controlled) down to standstill within

the configured time between the selection of

SOS and when it becomes active.

● Standstill is then safely monitored via the

SOS function.

How does SOS function in detail?

The protected machine areas can be entered without having to shut down the machine as long

as SOS is active.

After SOS has been selected it becomes active after the parameterizable delay time has

expired. The drive must be braked to standstill within this delay time (e.g. by the controller).

Drive stopping is monitored using an SOS tolerance window. At the instant this function

becomes active, the current actual position is stored as the comparison position until SOS is

deselected again. Any delay time is cleared after SOS is deselected and the drive can be

immediately moved.

The drive is stopped with SS1 when the standstill tolerance window is violated.

Note

Contrary to SS1 and SS2, SOS does not automatically brake the drive

The control still enters the setpoint.

This means that in the user program of the control system, the system must respond to the

"SOS selected" bit so that the control system brings the drive to a standstill within the delay time.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

53

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

2SHUDWRU DFWLRQV

;DFW

6HOHFW 626

'HVHOHFW 626

$FWXDO SRVLWLRQ

626

6WDQGVWLOO WROHUDQFH

W

626

'HOD\ WLPH 626

'LDJQRVWLFV

'HVHOHFW 626

626 DFWLYH

352),VDIH

626 DFWLYH

6WDWXV ZRUG ELW

W

Figure 4-1

Standstill tolerance

Details and parameterization

For further details and information on how to parameterize this function, see Chapter "Safe

Operating Stop (SOS) (Page 109)".

4.2.6

Safe Stop 2 (SS2)

Definition according to EN 61800-5-2:

"The function SS2 brakes the motor, moni-

SOS

v

tors the magnitude of the motor decelera-

tion, and after a delay time, initiates the SOS

function."

t

Safety Integrated

54

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

Example of how the function can be used

Example

Possible solution

A protective door must only be opened if a motor is in

● Select SS2 in the converter via a terminal or

the safe standstill state.

via PROFIsafe .

● After braking, the converter goes into the

SOS state. Only then may the protective

door be released.

How does SS2 function in detail?

The safety function SS2 monitors the

6SHHG

load speed and initiates the SOS function

0RQLWRULQJ

if the SS2 delay time has expired.

626

With SS2, braking is monitored on the

OFF3 ramp. A faulty acceleration is de-

W

'HVHOHFW 66

tected and the drive then shuts down with

) ', RU

STO.

352),VDIH

FRQWURO ZRUG

W

If you are operating the motor with closed-loop torque control, the converter switches to the

closed-loop speed control mode when SS2 is selected.

Note

SS2 with external stop (SS2E)

If you use SS2E, neither of the two monitoring functions (SBR, SAM) is active. The drive must

be shut down in SS2E within the delay time, for example, by a user program of a CPU. SOS

becomes active after the delay time expires.

Time response in detail

The failsafe logic (e.g. F-CPU) selects the SS2 safety function via a failsafe input or via the

PROFIsafe safe communication.

● If, when selecting SS2, the motor is already at a standstill, after a delay time, the converter

activates the Safe Operating Stop function (SOS).

● If the drive is not at standstill when SS2 is selected, it is braked along the OFF3 ramp.

Braking is monitored with one of the following functions, depending on the setting in p9506:

- "Safe Acceleration Monitor (SAM)"

A faulty acceleration is therefore detected.

- "Safe Brake Ramp (SBR)"

In this way, a violation of the braking ramp is detected.

After a delay time, the converter activates the Safe Operating Stop function (SOS). This

function monitors the safe standstill of the drive.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

55

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

Braking behavior

/RDG VSHHG

2SHUDWRU DFWLRQV

6HOHFW 66

'HVHOHFW 66

$FWXDO YDOXH

6$0

6$0 VSHHG OLPLW

626

W

626

'HOD\ WLPH 66

'LDJQRVWLFV

'HVHOHFW 66

66

DFWLYH

6$0 6%5 DFWLYH

626 DFWLYH

352),VDIH

66

DFWLYH

6WDWXV ZRUG ELW

626 DFWLYH

6WDWXV ZRUG ELW

W

Figure 4-2

Braking behavior and diagnostics of the safety function SS2 (example of SS2 with SAM)

Details and parameterization

For further details and information on how to parameterize this function, see Chapter "Safe

Stop 2 (SS2) (Page 111)".

4.2.7

Safely Limited Speed (SLS)

Definition according to EN 61800-5-2:

"The SLS function prevents the motor from

v

SLS

exceeding the specified speed limit."

t

Safety Integrated

56

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

Examples of how the function can be used

Example

Possible solution

The machine operator must be able to enter the ma-

● Select SLS in the converter via a fail-safe

chine after the protective door has been opened and

input or PROFIsafe .

slowly move a horizontal conveyor with an acknowl-

● The converter limits and monitors the veloci-

edgment button in the danger zone.

ty of the horizontal conveyor.

A spindle drive, depending on the selection of the

● Select SLS and the corresponding SLSlevel

cutting tool, must not exceed a specific maximum

in the converter via PROFIsafe.

velocity.

How does SLS function in detail?

1. The inverter recognizes the selection

'HOD\ WLPH 6/6

of SLS via a failsafe input or via the

6SHHG

6/6

PROFIsafe safe communication.

2. SLS allows a motor to reduce its pos-

sibly inadmissibly high speed within a

defined time.

W

SLS monitors the current speed.

The SLS setpoint limit can be trans-

ferred to the higher-level motion con-

6/6

troller (e.g. SIMOTION), where the

speed setpoint can be limited.

'HVHOHFW 6/6

) ', RU

352),VDIH

FRQWURO ZRUG

W

In addition, you can configure the setpoint limit provided by SLS as maximum speed in the

ramp-function generator. In this case, SLS limits the speed setpoint.

3. SLS monitors the absolute value of the current speed.

The SLS setpoint limit can be transferred to the higher-level motion controller (e.g. SIMO-

TION), where the speed setpoint can be limited.

In addition, you can configure the setpoint limit provided by SLS as maximum speed in the

ramp-function generator. In this case, SLS limits the speed setpoint.

Note

SLS without selection

As an alternative to controlling via terminals and/or PROFIsafe, there is also the option to

parameterize the SLS function without selection. In this case, the SLS function is permanently

active after POWER ON. Details are provided in Chapter "Safely-Limited Speed without

selection (Page 124)".

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

57

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

With braking ramp monitoring¹⁾

Without braking ramp monitoring

(only without encoder)

(with or without encoder)

6SHHG

'HOD\ WLPH IRU EUDNLQJ

6SHHG

'HOD\ WLPH IRU 6/6

UDPS

FKDQJHRYHU

6HWSRLQW

6HWSRLQW

6%5

6/6

6/6

/LPLWDWLRQ

/LPLWDWLRQ

W

'HVHOHFW 6/6

W

'HVHOHFW 6/6

) ', RU

) ', RU

352),VDIH FRQWURO

352),VDIH FRQWURO

ZRUG

ZRUG

W

W

6/6 DFWLYH

6/6 DFWLYH

) '2 RU

) '2 RU

352),VDIH VWDWXV

352),VDIH VWDWXV

ZRUG

ZRUG

W

W

● After the adjustable "delay time for the braking

● The converter monitors the load velocity after

ramp", using the SBR (Safe Brake Ramp) func-

the "delay time for SLS switchover" has ex-

tion, the converter monitors whether the veloc-

pired.

ity decreases.

● The converter switches from SBR to SLS as

soon as one of the following two conditions is

fulfilled:

- The SBR monitoring ramp has reached the

value of the SLS monitoring.

This case is shown in the diagram above.

- After the actual velocity has reached the

value of the SLS monitoring threshold, the

system again waits for the "delay time for

braking ramp" until SLS becomes active.

Advantages:

Advantage:

● Already when braking, the converter detects as

● Commissioning is simplified, because instead

to whether the load velocity decreases too

of the subfunction SBR or SAM of the alterna-

slowly.

tive brake ramp monitoring, you only have to

set the delay time.

● The feedback signal "SLS active" generally

comes earlier than without acceleration moni-

toring.

1)

The automatic reduction of the speed only takes effect when the ramp-function generator is

interconnected to the speed setpoint limitation.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

59

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

4.2.7.2

Selecting SLS at low velocities

Selecting SLS at low velocities

If the motor velocity when selecting SLS is less than the SLSlimit, then the drive responds as

follows:

9HORFLW\

'HOD\ WLPH 6/6

6/6

/LPLWLQJ

6HWSRLQW

W

'HVHOHFW 6/6

) ', RU

352),VDIH FRQWURO

ZRUG

W

6/6 DFWLYH

) '2 RU

352),VDIH VWDWXV

ZRUG

W

Deselecting SLS

If the higher-level controller deselects SLS , then the converter deactivates limiting and

monitoring.

4.2.7.3

Switching between monitoring thresholds

Switching over monitoring limits

When SLS is active, you can switchover between 4 different speed levels. An exception is "SLS

without selection": In this case, there is only one limit.

Safety Integrated

60

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

Switching to a lower speed level

With braking ramp monitoring¹⁾

Without braking ramp monitoring

(only without encoder)

(with or without encoder)

9HORFLW\

9HORFLW\

6/6

6/6

/LPLW OHYHO

6%5

/LPLW OHYHO

6/6

6/6

/LPLW OHYHO

/LPLW OHYHO

6HOHFW

W

6HOHFW

W

6/6 OHYHO

6/6 OHYHO

352),VDIH

/HYHO

352),VDIH

/HYHO

/HYHO

/HYHO

FRQWURO ZRUG

FRQWURO ZRUG

W

W

$FWLYH

$FWLYH

6/6 OHYHO

6/6 OHYHO

352),VDIH

352),VDIH

/HYHO

/HYHO

/HYHO

/HYHO

VWDWXV ZRUG

VWDWXV ZRUG

W

W

●

Once the "delay time for braking ramp" has

● The converter monitors the velocity with the

elapsed, the converter monitors the motor ve-

lower SLS level after the "delay time for SLS

locity using the function SBR (Safe Brake

changeover" has expired (this is the same de-

Ramp).

lay time that applies after selecting the function

SLS).

●

The converter switches over from SBR moni-

toring to level 2 of SLS monitoring as soon as

one of the following conditions is fulfilled:

- The SBR monitoring ramp has reached the

value of the SLS monitoring.

This case is shown in the diagram above.

- The load velocity has decreased down to

the value SLS monitoring and the "delay

time for braking ramp" has expired.

1)

The automatic reduction of the speed only takes effect when the ramp-function generator is

interconnected to the speed setpoint limitation.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

61

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

Switching to a higher speed level

If you switch over from a lower to a higher speed level, the converter immediately monitors the

actual velocity against the higher velocity.

6SHHG

6/6

/LPLW OHYHO

6/6

/LPLW OHYHO

6/6 OHYHO

W

VHOHFWLRQ

352),VDIH

/HYHO

/HYHO

FRQWURO ZRUG

W

$FWLYH

6/6 OHYHO

352),VDIH

/HYHO

/HYHO

VWDWXV ZRUG

W

Safety Integrated

62

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

4.2.8

Safe Speed Monitor (SSM)

Definition according to EN 61800-5-2:

v

"The SSM function supplies a safe out-

put signal to indicate whether the motor

speed is below a specified limit value."

1

0

t

Note

SSM is a pure signaling function

Contrary to other Safety Integrated functions, a violation of the SSM limit does not result in a

drive-based stop response.

Example of how the function can be used

Example

Possible solution

A centrifuge may only be filled below a velocity de-

● SSM is activated by configuring the Safety

fined by the user.

Integrated Extended Functions.

● The converter safely monitors the centrifuge

speed and enables the process to advance

to the next step using the "Status SSM" sta-

tus bit.

How does SSM function in detail?

Requirements

The safety function SSM cannot be selected or deselected using external control signals. SSM

is active when you have set a monitoring velocity > 0 for SSM .

Evaluating the speed

The converter compares the load speed with the speed limit and signals if the limit value is

undershot to the high-level control.

Parameterizable hysteresis

The parameterizable hysteresis ensures that the SSM output signal does not jump between the

values "0" and "1" in the limit range.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

63

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

6SHHG

660

+\VWHUHVLV

W

+\VWHUHVLV

660

6SHHG EHORZ OLPLW

YDOXH

) '2 RU

352),VDIH VWDWXV ZRUG

W

Figure 4-3

Time response of the safety function SSM (Safe Speed Monitor)

Details and parameterization

For further details and information on how to parameterize this function, see Section "Safe

Speed Monitor (SSM) (Page 127)".

Safety Integrated

64

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

4.2.9

Safe Direction (SDI)

Definition according to EN 61800-5-2:

"The SDI function prevents the motor shaft mov-

v

ing in the wrong direction."

t

SDI

Examples of how the function can be used

Example

Possible solution

A protective door must only be opened if a drive

● Select SDI in the converter using a fail-safe

moves in the safe direction (away from the operator).

input or PROFIsafe .

● Enable the locking mechanism of the protec-

tive doors via the PROFIsafe status bit of the

converter.

When replacing the pressure cylinders of the plates,

● Select SDI in the converter using a fail-safe

the drive must only move in the safe direction of ro-

input or PROFIsafe .

tation.

● In the converter, inhibit the direction of rota-

Once the protection against jamming has been trig-

tion that is not permitted.

gered, a roller shutter gate must only be able to start

moving in one direction.

At an operational limit switch, the trolley of a crane

must only be able to start in the opposite direction.

How does SDI function in detail?

SDI monitors the actual direction of rota-

6', GHOD\

WLPH

tion.

6SHHG

The SDI setpoint limit can be transmitted

to the higher-level motion controller (e.g.

6',

W

SIMOTION) to enable limitation of the ve-

locity setpoint there.

6', GHVHOHFW

In addition, you can configure the set-

) ', RU

point limit provided by SDI as maximum

352),VDIH

speed in the ramp-function generator. In

FRQWURO ZRUG

this case, SDI limits the speed setpoint to

W

the permissible direction.

You can select to block either the positive or the negative direction of rotation via 2 fail-safe

signals (F-DIs or PROFIsafe).

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

65

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

Selecting and deselecting SDI

As soon as the converter identifies that SDI has been selected via a failsafe input or via

PROFIsafe safe communication, the following happens:

●

You can also set a delay time, within which you can ensure that the converter moves in the

enabled (safe) direction.

●

You can also set a tolerance, within which the converter tolerates movement in the direction

that has not been enabled (unsafe). You can avoid the triggering of faults during braking

(overshoot) as well as in controlled standstill.

●

After the delay time has expired, the converter monitors the direction of rotation of the motor.

●

If the converter now moves in the blocked direction by more than the configured tolerance,

a message will be output and the defined stop response will be initiated.

6SHHG

'HOD\

6HWSRLQW

'HOD\

/LPLWDWLRQ WR

6',

VSHHGV

W

/LPLWDWLRQ WR VSHHGV

6',

!

6', GHVHOHFW

) ', RU

352),VDIH FRQWURO ZRUG

W

6', DFWLYH

) '2 RU

352),VDIH VWDWXV ZRUG

W

'HVHOHFW 6',

) ', RU

352),VDIH FRQWURO ZRUG

W

6', DFWLYH

) '2 RU

352),VDIH VWDWXV ZRUG

W

Figure 4-4

Time response of the safety function SDI (Safe Direction)

Note

SDI without selection

As an alternative to controlling via terminals and/or PROFIsafe, there is also the option of

parameterizing SDI without selection. In this case, SDI will be permanently active after

POWER ON. You will find details about this in Section "Safe Direction without selection

(Page 139)".

Details and parameterization

For further details and information on how to parameterize this function, see Section "Safe

Direction (SDI) (Page 134)".

Safety Integrated

66

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

4.2.10

Safely-Limited Acceleration (SLA)

Definition according to EN 61800-5-2:

a

"The SLA function prevents the motor from

SLA

exceeding the defined acceleration limit."

t

Examples of how the function can be used

Example

Possible solution

In the setup mode, it is not permissible that the drive

● Select SLA in the converter via PROFIsafe.

exceeds the permissible acceleration.

● The converter limits and monitors the accel-

eration of the machine.

Details and parameterization

For further details and information on how to parameterize this function, see Chapter "Safely

Limited Acceleration (SLA) (Page 140)".

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

67

Overview of Safety Integrated functions

4.2 Safety Integrated Extended Functions

4.2.11

Safe Brake Test (SBT)

The diagnostic function "Safe Brake Test" func-

0 V

tion (SBT) checks the required holding torque of

6%7

a brake (operating or holding brake).

W

How does the SBT function in detail?

You can test linear axes and rotary axes. The drive purposely generates a force/torque against

the applied brake. If the brake is operating correctly, the axis motion remains within a

parameterized tolerance. If, however, a larger axis motion is detected, it must be assumed that

the braking force/torque has deteriorated and maintenance is required.

The "Safe Brake Test" function allows a safe test of up to two brakes:

●

1 motor holding brake and 1 external brake

●

2 external brakes

●

1 motor holding brake

●

1 external brake

The "Safe Brake Test" (SBT) diagnostic function is suitable for safety functions up to Category 2

according to ISO 13849-1.

Details and parameterization

For further details and information on how to parameterize this function, see Chapter "Safe

Brake Test (SBT) (Page 144)".

Safety Integrated

68

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.3 Safety Integrated Advanced Functions

4.3.2

Safely-Limited Position (SLP)

Definition according to EN 61800-5-2:

s

"The SLP function prevents the motor shaft from

SLP

exceeding the specified position limit(s)."

t

The Safely-Limited Position function (SLP) is used to safely monitor the limits of two traversing

and/or positioning ranges, which are toggled between using a safe signal.

Examples of how the function can be used

Example

Possible solution

The drive must not exit the specified position ranges.

● Selection of SLP in the converter; inhibiting

the range that is not permitted.

● After the enabled range has been exited, a

parameterizable stop response is initiated.

Features

● Selection via terminals or PROFIsafe

●

2 position ranges, each defined by a limit switch pair

● Safe switchover between the two position ranges

● Settable stop response

● To run the motor out of the prohibited range, you must perform a special sequence (see

Chapter "Retraction (Page 185)").

Preconditions

● The function is only available with a suitable encoder.

● The drive has to be safely referenced (see Chapter "Safe referencing (Page 71)").

Details and parameterization

For further details and information on how to parameterize this function, see Section "Safely-

Limited Position (SLP) (Page 181)".

Safety Integrated

70

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Overview of Safety Integrated functions

4.3 Safety Integrated Advanced Functions

4.3.3

Transferring safe position values (SP)

The "Safe Position (SP)" function enables you to

transfer safe position values to the higher-level

SP

fail-safe controller (F-CPU) via PROFIsafe (tele-

gram 901 or 902).

How does the SP function in detail?

On the F-CPU side, you can also calculate the current speed from the change in position per

time. In telegram 902, the values are transferred in 32-bit format, in telegram 901, in 16-bit

format.

After parameter assignment, enabling and POWER ON, the function is automatically selected.

The drive transfers the value. Please observe the following:

● For use as the safe absolute position, the "Absolute position" must also be enabled and then

safely referenced.

● To allow the controller to continue using the transferred position, the actual position value

must be valid.

Using the time stamp that is also transferred, you can also calculate the velocity from the

position values. If you only want to calculate the speed, just enable the "Transfer of safe

position values" without the "Absolute position."

Details and parameterization

For further details and information on how to parameterize this function, see Chapter

"Transferring safe position values (SP) (Page 188)".

4.3.4

Safe referencing

The "safe referencing" function allows a safe absolute position to be defined. This safe position

is used for the following functions:

● Safely-Limited Position (SLP) (Page 70)

● Transferring safe position values (SP) (Page 71)

● Safe Cam (SCA) (Page 73)

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

71

Overview of Safety Integrated functions

4.3 Safety Integrated Advanced Functions

4.3.5

Safe Cam (SCA)

Definition according to EN

s

61800-5-2:

SCA 3

The function "Safe Cam" (SCA) safe

SCA 2

supplies a safety-related output sig-

SCA 1

t

nal to indicate whether the motor

shaft position is within a defined

1

range.

0

t

How does the SCA function in detail?

The "Safe Cam" function outputs a safe signal if the drive is within a specified position range.

It facilitates the realization of safe range detection for each individual axis.

Details and parameterization

For further details and information on how to parameterize this function, see Chapter "Safe

Cam (SCA) (Page 196)".

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

73

Description of Safety Integrated functions

5.1 Safety Integrated basic functions

5.1

Safety Integrated basic functions

Note

Basic Functions do not require an encoder

The Safety Integrated Basic Functions are functions for safely stopping the drive. You do not

require an encoder.

Note

Application of the Basic Functions

Basic Functions are available in all control modes with and without encoder for synchronous

and induction motors without any restrictions.

Note

Control via TM54F

If you want to control the Safety Integrated Basic Functions via TM54F, set p9601.6 = 1.

Note

PFH values

The PFH values of the individual SINAMICS S120 safety components can be found at:

PFH values (https://support.industry.siemens.com/cs/ww/en/view/76254308 )

5.1.1

Safe Torque Off (STO)

In conjunction with a machine function or in the event of a fault, the "Safe Torque Off" (STO)

function is used to safely disconnect the torque-generating energy supply to the motor.

A restart is prevented by the two-channel pulse suppression. The switching on inhibited

prevents an automatic restart after deselection of STO.

The two-channel pulse suppression function integrated in the Motor Modules / Power Modules

is the basis for this function.

Functional features of "Safe Torque Off"

● The function is completely integrated in the drive. It can be selected via terminals, TM54F

or PROFIsafe from an external source.

● The function is drive-specific, i.e. it is available for each drive and must be individually

commissioned.

● The function must be enabled via parameter.

Safety Integrated

76

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.1 Safety Integrated basic functions

● When the "Safe Torque Off" function is selected, the following applies:

- The motor cannot be started accidentally.

- The pulse suppression safely disconnects the torque-generating energy supply to the

motor.

- The power unit and motor are not electrically isolated.

● The selection/deselection of the STO function also acknowledges the safety faults when the

Basic Functions are used. The standard acknowledgment mechanism must also be

performed.

● Extended acknowledgement:

The selection/deselection of STO can also acknowledge the safety messages of the

extended safety functions. This requires that the extended message acknowledgement is

configured (p9507.0 = 1).

If in addition to the "Extended Functions", the "Basic Functions via terminals" are also

enabled, in addition to selection/deselection of STO via PROFIsafe or TM54F,

acknowledgement is also possible by selection/deselection of STO via terminals.

● The status of the "Safe Torque Off" function is displayed using parameters (r9772, r9872,

r9773 and r9774).

● Effect on the "Setpoint speed limit effective" (r9733[0...2]):

For STO (≙ STOP A), a setpoint of 0 is specified in r9733[0...2].

WARNING

Unplanned motor motion

After the energy feed has been disconnected (STO active) the motor can undesirably move

(e.g. the motor can coast down), therefore presenting risk to persons.

● Take suitable measures to prevent undesirable movement, e.g. by using a brake with

safety-relevant monitoring. For additional information, see Chapter "Safe Brake Control

(SBC) (Page 84)".

WARNING

Danger due to short, limited movements

If two power transistors simultaneously fail in the power unit (one in the upper and one in the

lower inverter bridge), then this can cause cause brief, limited movement.

The maximum movement can be:

● Synchronous rotary motors: Max. movement = 180° / no. of pole pairs

● Synchronous linear motors: Max. movement = pole width

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

77

Description of Safety Integrated functions

5.1 Safety Integrated basic functions

5.1.1.1

Safe Torque Off (STO) for SINAMICS HLA

For the HLA module, safe torque off (STO) corresponds to shutting off a safety-relevant shutoff

valve.

Special features of STO for HLA

●

The shutoff valve controls the infeed to the hydraulic circuit. The shutoff valve is controlled

via an F-DO of SINAMICS HLA.

●

For Safety Integrated Functions, it is absolutely necessary that a shutoff valve is connected

with the associated feedback signals.

●

You configure the feedback signal contacts of the shutoff valve using parameter p9626.

●

You can take into account the response times of the feedback signals using parameter

p9625.

●

The shutoff valve is safely closed by selecting STO. If the shutoff valve signals a safe state

via the feedback signal(s), the "STO active/Power removed" state is displayed, and is output

at the configured safety-related output (PROFIsafe feedback signal telegram, F-DO on

TM54F).

9 H[W

;

) '2

'LDJ '2

) '2

;

'LDJ '2

&RQWURO

6KXW RII YDOYH

;

0

)HHGEDFN

VLJQDOV

1& FRQWDFW 12 FRQWDFW

;

',

',

9

0

Figure 5-1

Interconnecting the shutoff valve (for an axis)

●

F-DO is dynamized each time that STO is selected/deselected: "Diag DO+" and "Diag DO-"

are checked when switching F-DO+ and F-DO-.

●

This makes it unnecessary to select forced checking procedure (test stop) explicitly.

●

If an error occurs in the forced checking procedure (test stop), the converter will issue fault

F01632 or F30632.

Safety Integrated

80

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.1 Safety Integrated basic functions

2-channel brake control

Note

Connecting the brake

The brake cannot be directly connected to the Motor Module in chassis format. A Safe Brake

Adapter is also required.

The brake is controlled from the Control Unit. Two signal paths are available for applying the

brake.

&RQWURO WHUPLQDO

&RQWURO 8QLW 0RWRU

0RGXOH 6DIH %UDNH

3

5HOD\

7%

&ORVHG FLUFXLW EUDNH

%5

&RQWURO

%5

WHUPLQDO

0RWRU

%UDNH GLDJQRVWLFV

7%

%5

0

0

%5

Figure 5-2

2-channel brake control, blocksize (example)

The Motor / Power Module carries out a check to ensure that the "Safe Brake Control" function

is working properly and ensures that, if the Control Unit fails or is faulty, the brake current is

interrupted and the brake applied.

The brake diagnosis can only reliably detect a malfunction in either of the switches (TB+, TB-)

when the status changes, i.e. when the brake is released or applied.

If the Motor Module or Control Unit detects a fault, the brake current is switched off. The brake

then closes and a safe state is reached.

Safety Integrated

86

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.1 Safety Integrated basic functions

5.1.3.3

Hardware required for SBC

● Safe Brake Relay

The command for releasing or applying the brake is transferred to the Motor Module / Power

Module via DRIVE-CLiQ. The Motor Module / Safe Brake Relay then carries out the action

and appropriately activates the outputs for the brake.

3RZHU 0RGXOH

30 ,) LQWHUIDFH

&DEOH KDUQHVV

6DIH %UDNH 5HOD\

H[W

%5

0

9

0

0

a

0

%5

&75/

Figure 5-3

Interconnecting the Safe Brake Relay using Blocksize as an example

● Safe Brake Adapter

The brake cannot be directly connected to the Motor Module in the chassis format. The

connection terminals are only designed for 24 V DC with 150 mA; the Safe Brake Adapter

is required for higher currents and voltages.

Note

Additionally required hardware for other formats

A Safe Brake Relay is also required for the "Safe Brake Control" in the blocksize format. With

the chassis format (article numbers ending ...3 or higher), a Safe Brake Adapter is required. The

Safe Brake Adapter is available for a 230 V AC brake control voltage.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

89

Description of Safety Integrated functions

5.1 Safety Integrated basic functions

Safe Brake Adapter

Motor Module /

SBA

Power Module

230 V AC

Control Interface

-X11

Module (CIM)

-X46

BR+

1

1

BR output+

BR- 2

Connecting cable

2

BR output-

FB+ 3

6SL3060-4DX04-0AA0

3

FB input+

LEDs

FB- 4

4

FB input-

230 V OK

P24 5

-X42

K1 ON

M

6

2

P24

K2 ON

3

M

-X15

External

AUX1

1

Fast

power supply

AUX2

2

de-

excitation

-X12

-X14

1

L

SBA_BR_L

1

230 V CA

2

N

SBA_BR_N

2

M

3 ~

Figure 5-4

Interconnecting the Safe Brake Adapter

Safety Integrated

90

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.1 Safety Integrated basic functions

5.1.4

Safety faults

The fault messages of the Safety Integrated Basic Functions are saved in the standard

message buffer and can be read out from there. By contrast, the fault messages of the Safety

Integrated Extended Functions are stored in a separate Safety message buffer (see Chapter

"Message buffer (Page 402)").

When faults associated with Safety Integrated Basic Functions occur, the following stop

responses can be initiated:

Table 5-1

Stop responses for Safety Integrated Basic Functions

Stop response

Triggered ...

Action

Effect

STOP A cannot

For all Safety faults with pulse

Trigger safe pulse suppression

The motor coasts to a standstill or is

be acknowl-

suppression that cannot be ac-

via the switch-off signal path for

braked by the holding brake.

edged

knowledged

the relevant monitoring channel.

During operation with SBC:

STOP A

For all acknowledgeable Safety

Apply motor holding brake.

faults

As a follow-up reaction of STOP

F

STOP A corresponds to Stop Category 0 in accordance with EN 60204-1.

With STOP A, the motor is switched directly to zero torque via the "Safe Torque Off (STO)" function.

A motor at standstill cannot be started again accidentally.

A moving motor coasts to standstill. This can be prevented by using external braking mechanisms, e.g.

holding or operating brake.

When STOP A is present, "Safe Torque Off" (STO) is active.

STOP F

If an error occurs in the data

Transition to STOP A.

Follow-up response STOP A

cross-check.

with adjustable delay (factory setting

without delay) if one of the safety

functions is selected

STOP F is permanently assigned to the data cross-check (DCC). In this way, errors are detected in the

monitoring channels.

After STOP F, STOP A is triggered.

When STOP A is present, "Safe Torque Off" (STO) is active.

WARNING

Uncontrolled movement of the axis.

With a vertical axis or a pulling load, there is a danger of uncontrolled movement of the axis

when STOP A/F if triggered.

This can cause serious injury or death to persons in the danger zone.

● If there is a hazard due to unwanted movement in your application, take measures to

counter it, for example, by using a brake with safe monitoring. For additional information,

see Chapter "Safe Brake Control (SBC) (Page 84)".

Safety Integrated

92

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

More detailed information on actual value acquisition without encoder can be found in Section

"Safe actual value sensing without encoder (Page 167)".

Note

Scope of functions

There are fewer Safety Integrated Extended Functions available "without encoder" than "with

encoder" (see Section "Drive monitoring with or without encoder (Page 40)").

Note

Safety Integrated Functions "without encoder" for group drives

The Safety Integrated Functions "without encoder" are also permissible for group drives

(multiple motors connected to one power unit).

"Parking" state for Safety Integrated Extended Functions with encoder

Note

Extended Functions with encoder and "parking"

When a drive object, for which Safety Integrated Extended Functions with encoder are enabled,

is switched to "Park" mode, the Safety Integrated software responds by selecting STO without

generating a separate message. This internal STO selection is displayed in parameter

r9772.19.

5.2.2.1

Specifics relating to Safety Integrated Functions "without encoder"

Basic Functions

● Basic Functions are available in all control modes with and without encoder for synchronous

and induction motors without any restrictions.

● A safety-related encoder is not required for Basic Functions.

● The Safety Integrated Functions "without encoder" are also permitted for group drives

(multiple motors connected to one power unit).

Extended Functions

Extended Functions SS1, SLS, SDI, and SSM "without encoder" do not require safety-related

speed actual value sensing. If an encoder is used for the drive control, this has no influence on

the sensorless safety functions. You can use Extended Functions "without encoder" with the

following motor types:

● Induction motor in all control modes

● SIMOTICS A-1FU synchronous motors (previously: SIEMOSYN) with U/f control

● Synchronous reluctance motors in vector control

Safety Integrated

98

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

●

Current limiting of the power unit

When the current limiting of the power unit responds, then it can be assumed that this will

result in errors in the encoderless safe actual value sensing and in turn with an associated

stop response.

Note

When engineering the drive and when the parameterizing the current and torque limits, it

must be ensured that the power unit current limiting does not respond.

●

Operation with pulling loads

It is not permissible that the converter is forced into regenerative operation as a result of

external forces.

Note

If a coupled drive comprises an electric drive that motors and one that regenerates (e.g. a

test stand), and the speeds of both drives are safely monitored, safety functions without

encoder can be used. This is because in the case of a fault, the motoring drive recognizes

when a limit value is violated. If, in this example, the motoring drive is an internal combustion

engine, which is not safely monitored, use of safety functions without an encoder for the

braking drive is not permissible.

Winders with a motoring and a braking drive can be assessed in the same way (both drives

are monitored).

●

Motor data identification

When using the measuring functions (stationary and rotating measurement) to determine

the motor data, then it can be assumed that the encoderless safe actual value sensing will

have an error.

Note

The motor data identification should always be performed before commissioning the Safety

Integrated Functions.

●

Data set switchover

The motor and drive data switchover can always be used for safety functions without

encoder. It is not possible to switch over between induction and synchronous motors (this

is interlocked). For several motor data sets it must be ensured that all motors have the same

number of pole pairs. If the number of pole pairs in r0313 is not the same value that was

taken into account when configuring the safe actual value sensing (gearbox), then the

calculated, safe actual speed no longer corresponds to the mechanical speed of the shaft.

When SLS is activated, the shaft can rotate faster than the configured limits.

●

Alternating acceleration/deceleration

For alternating acceleration and deceleration, it must be ensured that the following

conditions are maintained.

- Within 1 s, only one acceleration and one braking ramp are permitted.

Therefore, for a cycle 0 → +n_set → -n_set → 0 - one period of at least 2 s is required.

●

This also applies to positioning operation; it may be necessary that the position control

settings and traversing profiles must be adapted so that no overshoots occur in the speed

characteristic (e.g. reduce the dynamic response, use flatter braking ramps).

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

101

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

●

Flying restart

A flying restart should not be performed in operation with the Safety Integrated Functions

active.

Note

If you must use this function, then before the flying restart, you can deactivate the Safety

Integrated Functions, and then reactivate them again after the flying restart has been

completed.

In this case, the user must check as to whether it is permissible that the safety functions are

deactivated during the flying restart.

It is only permissible to activate and deactivate Safety Integrated Functions using failsafe

signals.

●

DC brake

When using this function, DC current is impressed to brake the drive: This can result in an

error in the encoderless, safe actual value sensing and in turn in an associated stop

response.

Note

If you must use this function, then before braking, you can deactivate the Safety Integrated

Functions, and then reactivate them again after braking has been completed.

In this case, the user must check as to whether it is permissible that the safety functions are

deactivated during braking.

It is only permissible to activate and deactivate Safety Integrated Functions using failsafe

signals.

●

Closed-loop controlled operation down to f = 0 Hz with test signal (see corresponding

chapter in the SINAMICS S120 Function Manual Drive Functions)

If you use Safety Integrated without encoder simultaneously with the function "Closed-loop

controlled operation down to f = 0 Hz with test signal", the drive may react with an undesired

safety message and a stop reaction. In this case, you cannot use the combination described.

Recommendations for stable operation with active Extended Functions without encoder

The following preconditions must be fulfilled to avoid fault messages from the safe actual value

sensing without encoder:

● The motor and the power unit are adequately dimensioned for this application.

● Motor and power unit should fulfill the following condition: The ratio between the rated power

unit current (r0207[0]) and rated motor current (p0305) should be less than 5.

● Before commissioning the safety functions, we recommend that the motor data are

identified at standstill and a rotating measurement is carried out.

● For the basic commissioning, i.e. before the safety commissioning, the closed-loop control

should be optimally set. The following effects should be avoided:

- speed overshoots

- current peaks and/or discontinuous/unsteady current actual value over time

- voltage peaks and/or discontinuous/unsteady voltage actual value over time

- the lowest possible amount of noise in the current and voltage

Safety Integrated

102

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

Safety Integrated Extended Functions without encoder for Control Unit Adapter CUA31 and CUA32

In the case of the Control Unit Adapters CUA31 and CUA32, the Safety Integrated Extended

Functions without encoder are available as follows:

Control

Article number

Safety Integrated without encoder

Unit

Not available for

Available for

Adapter

CUA31

6SL3040-0PA01-0AA1

Version (function states)

Version D or newer

A, B and C

CUA32

6SL3040-0PA01-0AA0

Version (function states)

Version C or newer

A and B

5.2.3

Safe Torque Off (STO)

For the control options and the functionality for "Safe Torque Off" (STO), see Section "Safe

Torque Off (STO) (Page 76)".

5.2.4

Safe Stop 1 (SS1)

5.2.4.1

Safe Stop 1 with encoder

For function SS1 of the Extended Safety Functions, braking monitoring is included.

● If p9506 = 0:

Braking is monitored with the "Safe Acceleration Monitor" function (see Chapter

"Description (Page 155)").

In this case, we also talk about "SS1 (time and acceleration controlled)".

● If p9506 = 2:

Here, also for SS1, the monitoring function "Safe Brake Ramp" is active (see Chapter "Safe

Brake Ramp (SBR) (Page 157)").

In this case, we also talk about "SS1 (speed controlled)".

The "Safe Stop 1" (SS1) function allows the drive to be stopped in accordance with EN 60204-1,

Stop Category 1. The drive brakes with the OFF3 ramp (p1135) once "Safe Stop 1" is selected

and switches to "Safe Torque Off" (STO) once the delay time has elapsed (p9556) or when the

shutdown speed is fallen below (p9560).

Functional features of Safe Stop 1 with encoder

● The delay time starts after the function has been selected. If SS1 is deselected within this

time, after the delay time has elapsed or after the velocity has fallen below the shutdown

speed, the STO function is selected and deselected again immediately; i.e. the SS1 function

is ended completely normally. It cannot be interrupted.

● Selection and monitoring of the acceleration (SAM) or the monitoring function "Safe Brake

Ramp" are implemented in two channels, but braking along the OFF3 ramp is only

implemented in one channel.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

103

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

Note

Interrupting the ramp function with OFF2 by the higher-level controller

Activating SS1 can mean that the higher-level controller (PLC, motion controller), which

specifies the speed setpoint, interrupts the ramp function (e.g. with OFF2). The device behaves

in this way as a result of a fault reaction triggered by OFF3 activation. This fault reaction must

be avoided by assigning appropriate parameters or configurations.

Note

No OFF2 with SS1 and EPOS

If you use SS1 together with EPOS, the fault reaction to F07490 (EPOS: enable withdrawn

while traversing) OFF2 is not permitted. The response to this error message (OFF1, OFF2 or

OFF3) can be configured via p2100/p2101.

● Effect on "Speed setpoint limit effective" (r9733[0...2]):

If SS1 (≙ STOP B), setpoint 0 is specified in r9733[0...2].

Commissioning

The delay time (SS1 time) is set by entering parameter p9556. The wait time until safe pulse

suppression (STO) can be shortened by specifying a shutdown speed in p9560.

To enable the drive to brake to standstill after selection, the time in p9556 must be selected to

be large enough for the drive to be able to brake along the OFF3 ramp (p1135) from any speed

of the work process to below the shutdown speed (p9560).

Note

Setting the delay time

To enable the drive to travel the entire OFF3 ramp and close any existing motor holding brake,

you must set the delay time as follows:

● Motor holding brake parameterized: Delay time ≥ p1135 + p1228 + p1217

● Motor holding brake not parameterized: Delay time ≥ p1135 + p1228

The shutdown speed defined in p9560 must be set in such a way that coasting down (due to the

subsequent STO function) does not represent any risk for man and machine.

Responses: System error

1. STOP F with subsequent STOP B, followed by STOP A

2. Safety message C01711

Safety Integrated

104

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

5.2.4.2

Safe Stop 1 without encoder

Two encoderless Safe Stop 1 (SS1) monitoring functions can be set with parameter p9506:

● p9506 = 3: Safe monitoring of acceleration (SAM) / delay time

The function is identical to "Safe Stop 1" with encoder, which was described in the previous

section.

In this case, we also talk about "SS1 (time and acceleration controlled)".

● p9506 = 1: Safe brake ramp monitoring (SBR)

In this case, there is no SS1 delay time active. The transition from SS1 to STO depends

entirely on the speed falling below the shutdown speed (p9560). You will find more

information on the function "Safe Brake Ramp (SBR)" in Chapter "Safe Brake Ramp (SBR)

(Page 157)." In this case, we also talk about "SS1 (speed controlled)".

Time sequence

6HOHFWLQJ WKH 66 UDPS

$FWLYDWLRQ RI 672

6WDUW GULYH 8VHU DFWLRQ

8VHU DFWLRQ

8VHU DFWLRQ

6HW 2))

21 VLJQDO

6HW 66

VLJQDO

1RQH

5HIHUHQFH

YHORFLW\

$FWLYDWLRQ RI 66 UDPS

'HVHOHFWLQJ WKH 66 UDPS

8VHU DFWLRQ

8VHU DFWLRQ

1RQH

5HVHW 66

VLJQDO

(QYHORSH

PRQLWRULQJ UDPS

6WDWRU

VSHHG

2)) UDPS

5RWRU

=HUR VSHHG

672

VSHHG

GHWHFWLRQ

6HWSRLQW

VSHHG

W

6%5 GHOD\ WLPH S

'LDJQRVWLFV

0RQLWRULQJ UDPS 'URSRXW WLPH

672 VHOHFWHG

672 DFWLYH

66 VHOHFWHG

66 DFWLYH

352),VDIH

66 DFWLYH

3RZHU UHPRYHG

W

Figure 5-5

Sequence for "Safe Stop 1" without encoder with SBR monitoring (p9506 = 1)

Safety Integrated

106

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

5.2.6

Safe Operating Stop (SOS)

This function serves for failsafe monitoring of the standstill position of a drive.

WARNING

Drive can be forced out of the SOS position by mechanical forces

A drive under position control can be forced out of the "Safe Operating Stop" (SOS) position

by mechanical forces that are greater than the maximum torque of the drive. This unwanted

drive movement then triggers a Category 1 Stop function according to EN 60204-1 (fault

response function STOP B). The alarms for SS1 and STO must be observed.

● If there is a hazard due to unwanted motion in your application, take measures to counter

it, for example, by using a brake with safe monitoring. For additional information, see

Chapter "Safe Brake Control (SBC) (Page 84)".

Note

In particular, the motor is energized while the SOS function is performing position control.

● Ensure that the motor cannot be touched while it is in the SOS state.

● Drive stopping is monitored using an SOS tolerance window (p9530).

● Effect on the "Setpoint speed limit effective" (r9733[0...2]):

If SOS is selected, setpoint 0 is specified in r9733[0...2].

Note

Size of the tolerance window

The size of the tolerance window should be slightly above the standard standstill monitoring

limit, otherwise the standard monitoring functions will no longer be effective.

Parameter r9731 displays the safe position accuracy (load side) that can be achieved as a

maximum, based on the acquisition of the actual value for the safe motion monitoring functions.

STOP B is the stop response after the standstill tolerance window has been violated.

When does SOS become effective

The SOS function comes into effect in the following cases:

● After SOS is selected and the delay time in p9551 has elapsed

The drive must be braked to standstill within this delay time (e.g. by the controller).

● As a consequence of SS2

● As a consequence of STOP C (corresponds to selection of SS2)

● As a consequence of STOP D (corresponds to selection of SOS)

● As a consequence of STOP E (corresponds to selecting SOS with additional activation of

the standard "Extended stop and retract (ESR)" function)

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

109

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

Responses

● Standstill tolerance violated in p9530

- STOP B with subsequent STOP A

- Safety message C01707

● System error

- STOP F

- Safety message C01711

Note

Deactivating SOS during an external STOP A

If "Deactivating SOS/SLS during an external STOP A" (p9501.23 = 1) is released and SOS is

selected, SOS is deactivated during a STOP A.

3RVLWLRQ YDOXHV RQ

S

ORDG VLGH

7ROHUDQFH

S

7ROHUDQFH

U

3XOVH FDQFHOODWLRQ

U

672 GHVHOHFWHG

U

672 DFWLYH

U

626 GHVHOHFWHG

U

626 DFWLYH

W

Figure 5-6

Signal flow: Deactivating SOS during an external STOP A

Function diagrams (see SINAMICS S120/S150 List Manual)

●

2819

SI Extended Functions - SS1, SS2, SOS, internal STOP B, C, D, F

Overview of important parameters (see SINAMICS S120/S150 List Manual)

● p9501

SI Motion enable safety functions (Control Unit)

● p9530

SI Motion standstill tolerance (Control Unit)

● p9551

SI Motion SLS(SG) switchover/SOS(SBH) delay time (CU)

● r9722.0...31

CO/BO: SI Motion drive-integrated status signals

● r9731

SI Motion safe positioning accuracy

Safety Integrated

110

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

5.2.7.1

SS2 with external stop (SS2E)

Selecting SS2E

WARNING

Unexpected axis motion

When function "Safe Stop 2 with external stop" (SS2E) is active, during the delay time (p9553)

the speed follows the setpoint issued from the higher-level control system. As a consequence,

unexpected axis motion is possible, which can lead to severe injury and death.

● Prevent persons from entering the danger zone of the machine or plant during the delay

time (p9553), for example, by keeping protective devices interlocked.

66 ( GHVHOHFWLRQ

W

6SHHG

W

S

66 ( DFWLYH

W

626 DFWLYH

W

6$0 6%5 DFWLYH

W

Figure 5-7

Selecting SS2E

With external stop, "Safe Stop 2" functions in principle exactly the same way as described in the

previous sections. Note, however, the following differences:

Differences between "Safe Stop 2 with OFF3" and "SS2 with external stop (SS2E)"

● If SS2 with external stop is selected, the drive does not brake the motor autonomously, but

follows the defined speed setpoint.

● During delay time p9553, the brake ramp (SBR) and the acceleration (SAM) are not

monitored and there is no standstill detection.

● SOS becomes active after the delay time p9553 expires.

When function SS2E is active, the higher-level control must issue the speed setpoint so that

at the latest after delay time p9553 expires, the motor has come to a complete standstill.

● In order to activate "Safe Stop 2 with external stop", set p9501.18 = 1.

● The PROFIsafe control word S_STW2.28 selects the SS2E function. PROFIsafe

S_STW2.28 is contained in telegrams 31, 901, 902, and 903.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

113

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

● The PROFIsafe status word S_ZSW2.28 indicates whether the SS2E function is active.

PROFIsafe status word S_ZSW2.28 is contained in telegrams 31, 901, 902 and 903. The

associated diagnostics parameter is r9722.28.

In the "Safety Info Channel", status word S_ZSW3B.11 indicates whether function SS2E is

active. The associated diagnostics parameter is r10234.11.

Diagnostic parameters p9722.28 and p10234.11 are also set during an internal STOP D.

● Effect on the "Setpoint speed limit effective" (r9733[0...2]):

For SS2E (≙ STOP D), setpoint 0 is specified in r9733[0...2].

Deselecting SS2E while SS2E is active

66 ( GHVHOHFWLRQ

W

6SHHG

S

W

66 ( DFWLYH

W

626 DFWLYH

W

6$0 6%5 DFWLYH

W

Figure 5-8

Deselecting SS2E while SS2E is active

After the function has been selected, the delay time starts to expire - even if the function is

deselected during this time. In this case, after the delay time has expired, the SOS function is

briefly active. Afterwards, the drive may accelerate the motor back to the speed setpoint.

Interrupting active SS2E with SS1 and SS2

'HVHOHFW 66 (

'HVHOHFW 66 (

W

W

'HVHOHFW 66

'HVHOHFW 66

W

W

6SHHG

6SHHG

2)) UDPS

2)) UDPS

W

W

S

S

S

66 ( DFWLYH

66 ( DFWLYH

W

W

66 DFWLYH

66

DFWLYH

W

W

672 DFWLYH

626 DFWLYH

W

W

6$0 6%5 DFWLYH

6$0 6%5 DFWLYH

W

W

Figure 5-9

Interrupting SS2E using SS1 (shown at the left) and SS2 (shown at the right)

When selecting SS1, the drive brakes the motor along the OFF3 ramp and monitors the speed

using the SAM function. Function STO becomes active when the motor is at a standstill.

Safety Integrated

114

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

When selecting SS2, the drive also brakes the motor along the OFF3 ramp and monitors the

speed using the SAM function. Function SOS becomes active after time p9552.

5.2.7.2

Safe Stop 2 Extended Stop and Retract (SS2ESR)

WARNING

Unexpected axis motion

When function SS2ESR is active, during the delay time (p9554) the speed follows the setpoint

issued from the higher-level control system. As a consequence, unexpected axis motion is

possible, which can lead to severe injury and death.

● Prevent persons from entering the danger zone of the machine or system during the delay

time (p9554), for example, by keeping protective devices closed and interlocked.

In principle, Safe Stop 2 Extended Stop and Retract (SS2ESR) functions in exactly the same

way as SS2 described in the previous sections. Note, however, the following differences.

Selecting SS2ESR

'HVHOHFW 66 (65

W

6SHHG

W

S

66 (65 DFWLYH

W

626 DFWLYH

W

6$0 6%5 DFWLYH

W

Figure 5-10

Selecting function SS2ESR

Differences between "Safe Stop 2 with OFF3" and SS2ESR

● If SS2ESR with external stop is selected, the drive does not brake the motor automatically,

but instead follows the defined speed setpoint: This can also result in fast retraction motion.

● During the delay time p9554, the brake ramp (SBR) and the acceleration (SAM) are not

monitored, and there is no standstill detection.

● SOS becomes active after the delay time p9554 has expired. If function SS2ESR is active,

the higher-level control system must define the speed setpoint such that the motor is

stopped no later than after the delay time p9554 has expired.

● To enable SS2ESR, set p9501.4 = 1.

● PROFIsafe control word S_STW2.29 selects function SS2ESR. PROFIsafe S_STW2.29 is

contained in telegrams 31, 901, 902 and 903.

Safety Integrated

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

115

Description of Safety Integrated functions

5.2 Safety Integrated Extended Functions

● PROFIsafe status word S_ZSW2.27 indicates whether function SS2ESR is active.

PROFIsafe status word S_ZSW2.27 is contained in telegrams 31, 901, 902 and 903. The

associated diagnostics parameter is r9722.27. In the "Safety Info Channel," status word

S_ZSW3B.12 indicates whether the SS2ESR function is active. The associated diagnostics

parameter is r10234.12.

● In addition, in the "Safety Info Channel", status word S_ZSW1B.14 = 1 is set. This bit

corresponds to diagnostic parameter r9734.14.

● You can use p0890[1] to interconnect to an ESR integrated in the drive.

● SS2ESR has no effect on the "Setpoint speed limit effective" (r9733[0...2]). If SS2ESR is

enabled in p9501.4, then also a STOP E has no effect on r9733[0...2].

Deselecting SS2ESR while SS2ESR is active

'HVHOHFW 66 (65

W

6SHHG

S

W

66 (65 DFWLYH

W

626 DFWLYH

W

6$0 6%5 DFWLYH

W

Figure 5-11

Deselecting SS2ESR while SS2ESR is active

After the function has been selected, the delay time starts to expire - even if the function is

deselected during this time. In this case, after the delay time has expired, the SOS function is

briefly active. Afterwards, the drive may accelerate the motor back to the speed setpoint.

Interrupting active SS2ESR with SS1 and SS2

'HVHOHFW 66 (65

'HVHOHFW 66 (65

W

W

'HVHOHFW 66

'HVHOHFW 66

W

W

6SHHG

6SHHG

2)) UDPS

2)) UDPS

W

W

S

S

S

66 (65 DFWLYH

66 (65 DFWLYH

W

W

66 DFWLYH

66

DFWLYH

W

W

672 DFWLYH

626 DFWLYH

W

W

6$0 6%5 DFWLYH

6$0 6%5 DFWLYH

W

W

Safety Integrated

116

Function Manual, 06/2020, 6SL3097-5AR00-0BP3

Content      ..     18      19      20      21     ..