SINUMERIK 840D sl. Service - Configuring Commissioning. Manual (2011-2020)

Diagnostics

8.4 General information about displaying and evaluating diagnostic information

8.4

General information about displaying and evaluating diagnostic

information

In operating mode Safety Integrated plus, safety-relevant monitoring functions are executed in

the drive itself. Diagnostic information is communicated and evaluated as follows:

● The status and control information (SIC/SCC) (Page 205) of the drive is communicated

between the integrated subcomponents of the NCU:

- As a consequence, the motion control in the NC is also linked (Page 321) to the safety

functions integrated in the drive, therefore avoiding unnecessary follow-on responses in

the NC.

- Some SIC status information is also saved to NC variables (OPI) (Page 343).

● SINAMICS Safety Integrated messages and alarms can be displayed as follows:

- Safety messages of the drive are displayed in SINUMERIK Operate in the alarm lists.

Note

Information for those switching over from a different system: Evaluating alarms using the

As Safety Integrated plus uses the safety functions integrated in the drive, the NC does

not suppress alarms, prioritize alarms or check alarm numbers of safety messages of the

drive (contrary to the Safety Integrated operating mode).

- The standard alarm of a drive can also include safety-relevant diagnostic information. In

order that these are displayed in SINUMERIK Operate, you must activate the alarm

buffer (Page 325).

- Display and acknowledgment (Page 327) of messages depend on the scope of the

Safety Integrated Functions (Page 25) used - and the use of the safety message buffer

(Page 324).

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

313

Diagnostics

8.5 Checksums

8.5

Checksums

Based on Safety Integrated checksums and signatures, you can compare the actual state of the

machine with the original state when delivered, which is documented in the acceptance report.

The checksums are displayed in SINUMERIK Operate in the Diagnostics area (Page 306).

● The individual F-blocks have signatures, and the safety program has an F-collective

signature. These checksums for the safety program are displayed in the TIA Portal as well

as in the safety printout.

● There are SINAMICS parameters with reference checksums (defined when commissioning)

- and actual checksums for CU, MM and motion monitoring functions, which are checked by

SINAMICS Safety Integrated when the system runs up. SINAMICS alarms 201650/230650

and/or 201680/230680 are output if the checksums differ.

See: SINAMICS checksums (Page 316)

● In SINUMERIK Operate, additional master checksums and global checksums are

displayed, which are calculated from the actual checksums listed above. The NCU does not

compare these higher-level checksums with reference checksums - and it does not save

them.

See: Calculating the global checksums/master checksums (Page 314)

The global checksums/master checksums are displayed in the diagnostics area of

SINUMERIK Operate, which means that it is easy to identify differences between the actual

and reference states.

See: SI checksums (Page 306)

8.5.1

Calculating the global checksums/master checksums

In addition to the checksums or signatures of the subcomponents SINAMICS Safety Integrated

and F-PLC, in SINUMERIK Operate global checksums and master checksums are displayed,

which are calculated from various actual checksums from the F-PLC and SINAMICS Safety

Integrated. The NCU does not compare these higher-level actual checksums with reference

checksums - and it does not save them.

By displaying these higher-level actual checksums, differences between the actual and

reference states can be easily and transparently identified.

The global checksums/master checksums are calculated as follows:

● The global checksum is the sum of the associated master checksums (see table).

● The master checksums comprise the sums of the values/parameters with actual checksums

for the calculation (see table).

If SINAMICS parameters are involved for the values being used as basis, then when making

the calculation, the sum over the following drives is generated:

- Drives, which do not have an assigned NC axis, and where the safety functions are

enabled in p9601: p9601 SI enable functions integrated in the drive (Control Unit) / SI

enable fct CU ! = 0

Safety Integrated plus

314

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Diagnostics

8.5 Checksums

Table 8-6

Calculating the global checksum and the associated master checksums

Global checksum

Master checksum

Values/parameters used for the calculation

Global safety engineering

F-CPU master checksum

● Signature of the safety program

checksum

Extended Safety master checksum

● r9728[0] SI Motion actual checksum SI parame-

(sum of all master checksums)

ters / SI Mtn act CRC

● r9728[1] SI Motion actual checksum SI parame-

ters / SI Mtn act CRC

Extended Safety MM master check-

● r9398[0] SI Motion actual checksum SI parameters

sum

(Motor Modules) / SI Mtn act CRC MM

Drive-based master checksum

● r9798 SI actual checksum SI parameters (Control

Unit) / SI act_checksum CU

● r9898 SI actual checksum SI parameters (Motor

Module) / SI act_checksum MM

Table 8-7

Calculating the master checksum "safety-relevant hardware checksum"

Master checksum

Parameters used for the calculation

Safety-relevant hardware

● r9728[2] SI Motion actual checksum SI parameters / SI Mtn act CRC

checksum

● r9398[1] SI Motion actual checksum SI parameters (Motor Modules) / SI Mtn act CRC MM

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

315

Diagnostics

8.5 Checksums

8.5.2

SINAMICS checksums

For each monitoring channel, the safety parameters include 2 parameters for the reference and

actual checksum.

During commissioning, the actual checksum must be transferred to the corresponding

parameter for the reference checksum. This can be done for all checksums of a drive object at

the same time using parameter p9701 - or using the corresponding SINUMERIK Operate

functionality.

● Basic Functions

● r9798

SI actual checksum SI parameters (Control Unit)

● p9799

SI reference checksum SI parameters (Control Unit)

● r9898

SI actual checksum SI parameters (Motor Module)

● p9899

SI reference checksum SI parameters (Motor Module)

● Extended Functions (contain also the following checksum parameters)

● r9398[0...1]

SI Motion actual checksum SI parameters (Motor Module)

● p9399[0...1]

SI Motion reference checksum SI parameters (Motor Module)

● r9728[0...2]

SI Motion actual checksum SI parameters

● p9729[0...2]

SI Motion reference checksum SI parameters

During each ramp-up procedure, the actual checksum is calculated via the Safety parameters

and then compared with the reference checksum.

If the actual and reference checksums are different, fault F01650/F30650 or F01680/F30680 is

output.

Safety Integrated plus

316

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Diagnostics

8.6 Stop responses

8.6

Stop responses

8.6.1

Overview

The stop responses that can be initiated depend on the scope of the Safety Integrated

Functions used:

● Stop responses that can be initiated for faults involving Safety Integrated Basic Functions

(Page 317)

● Stop responses that can be initiated for faults involving Safety Integrated Extended

Functions (Page 319)

Stop responses and safety functions can be dependent on a priority that has been assigned:

● No overall priority is assigned to individual safety functions.

● The various stop responses each have a certain priority (Page 322).

● For stop responses and Safety Integrated Extended Functions, there are

some dependencies regarding the priority (Page 322).

The motion control in the NC is linked (Page 321) to the safety functions integrated in the drive

and the associated stop responses, which means that no unnecessary follow-on responses are

initiated in the NC.

8.6.2

Basic Functions

When faults associated with Safety Integrated Basic Functions occur, the following stop

responses can be initiated:

Table 8-8

Stop responses for Safety Integrated Basic Functions

Stop response

Triggered ...

Action

Effect

STOP A cannot

For all Safety faults with pulse

Trigger safe pulse suppression

The motor coasts to a standstill or is

be acknowl-

suppression that cannot be ac-

via the switch-off signal path for

braked by the holding brake.

edged

knowledged.

the relevant monitoring channel.

During operation with SBC:

STOP A

For all acknowledgeable Safety

Apply motor holding brake.

faults

As a follow-up reaction of STOP

STOP A corresponds to Stop Category 0 in accordance with EN 60204-1.

With STOP A, the motor is switched directly to zero torque via the "Safe Torque Off (STO)" function.

A motor at standstill cannot be started again accidentally.

A moving motor coasts to standstill. This can be prevented by using external braking mechanisms, e.g.

holding or operating brake.

When STOP A is present, "Safe Torque Off" (STO) is active.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

317

Diagnostics

8.6 Stop responses

Stop response

Triggered ...

Action

Effect

STOP F

If an error occurs in the cross-

Transition to STOP A.

Follow-up response STOP A

wise data comparison.

with adjustable delay (factory setting

without delay) if one of the safety

functions is selected

STOP F is permanently assigned to the crosswise data comparison (CDC). In this way, errors are detected

in the monitoring channels.

After STOP F, STOP A is triggered.

When STOP A is present, "Safe Torque Off" (STO) is active.

WARNING

Uncontrolled axis motion when a STOP A/F is initiated

With a vertical axis or pulling load, there is a risk of uncontrolled axis movements when STOP

A/F is triggered. If present in the hazardous area, this can result in death or severe injury.

● Use the "Safe Brake Control (SBC)" and a holding brake (not a safety-relevant brake!) with

sufficient holding force to prevent these movements.

Safety Integrated plus

318

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Diagnostics

8.6 Stop responses

8.6.3

Extended Functions

Faults involving Safety Integrated Extended Functions and violation of limits can trigger the

following stop responses:

Table 8-9

Stop responses for Safety Integrated Extended Functions

Stop response

Triggered ...

Response of the initiating axis

Response of other axes or NC re-

or DRV response

sponse

STOP A¹⁾

● For all acknowledgeable

Immediate pulse suppression

All path axes: IPO rapid stop

(corresponds to

safety faults with pulse

All axes, with the exception of the

STO²⁾)

suppression

path axes and the initiating axis:

Effect:

Braking along a ramp (acceleration

● Subsequent response of

Drive coasts down

limit)

STOP B

● Configurable subsequent

stop p9563 for SLS

● Configurable subsequent

stop p9566 for SDI

● Configurable subsequent

stop p9562 for SLP

STOP B¹⁾

Examples:

Immediate input of speed set-

All path axes: IPO rapid stop

(corresponds to

point = 0 and start of timer t_{B .}

● Standstill tolerance viola-

All axes, with the exception of the

SS1³⁾)

Once t_B or n_act < n_shutdown has ex-

ted in p9530 (SOS)

path axes and the initiating axis:

pired, STOP A is triggered.

Braking along a ramp (acceleration

● Configurable subsequent

limit)

stop p9563 for SLS

Effect:

● Configurable subsequent

STOP B with subsequent

stop p9566 for SDI

STOP A.

● Configurable subsequent

The drive decelerates along

stop p9562 for SLP

the OFF3 ramp and then

● Subsequent response of

switches to STOP A.

STOP F

Note:

For "SS1 with external stop"

(SS1E), braking is not along

the OFF3 ramp (see

Section SS1 (Extended Func-

tions) with external stop

(Page 89))

STOP C¹⁾

● Configurable subsequent

Immediate input of speed set-

All path axes: IPO rapid stop

(corresponds to

stop p9563 for SLS

point = 0 and start of timer t_C.

All axes, with the exception of the

SS2⁴⁾)

● Configurable subsequent

Once t_C has elapsed, SOS is

path axes and the initiating axis:

selected.

Braking along a ramp (acceleration

stop p9566 for SDI

limit)

● Configurable subsequent

stop p9562 for SLP

Effect:

The drive decelerates along

the OFF3 ramp; SOS is then

selected.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

319

Diagnostics

8.6 Stop responses

Stop response

Triggered ...

Response of the initiating axis

Response of other axes or NC re-

or DRV response

sponse

STOP D¹⁾

● Configurable subsequent

Timer t_D is started.

Braking along the path (interpolatory

stop p9563 for SLS

No drive-integrated response,

braking)

but an NC response (see right).

● Configurable subsequent

stop p9566 for SDI

Once t_D has elapsed, SOS is

selected.

● Configurable subsequent

An automatic response is only

stop p9562 for SLP

triggered if the standstill toler-

ance window is violated in

SOS.

STOP E¹⁾

● Configurable subsequent

SOS triggered after the expiry

Fast retraction (ESR), which allows

stop p9563 for SLS

of p9554

the controlled axes to be retracted

● Configurable subsequent

stop p9566 for SDI

Effect:

● Configurable subsequent

Controlling the drive-integra-

stop p9562 for SLP

ted ESR functionality

STOP F¹⁾

If an error occurs in the cross-

Timer t_F1 (Basic Functions) or

NC start/traversing interlock

wise data comparison.

t_F2 (Extended Functions)

Follow-up response STOP B

No drive response

or STOP A

Effect:

If a safety function (SOS, SLS)

has been selected or if SSM

with hysteresis has been ena-

bled, transition to STOP A after

t_F1 (Basic Functions) has

elapsed or STOP B after t_F2

(Extended Functions) has

elapsed.

See also the following note "delayed pulse cancellation when the bus fails".

The behavior of the drive after STOP A is triggered corresponds (apart from the safety messages ) to the behavior after STO

is triggered. Note that the parameterization of STO applies equally for STOP A.

The behavior of the drive after STOP B is triggered corresponds (apart from the safety messages ) to the behavior after SS1

is triggered. Monitoring with the aid of SAM or SBR, for example, works in exactly the same way. Note that the

parameterization of SS1 applies equally for STOP B.

The behavior of the drive after STOP C is triggered corresponds (apart from the safety messages ) to the behavior after SS2

is triggered. Monitoring with the aid of SAM, for example, works in exactly the same way. Note that the parameterization of

SS2 applies equally for STOP C.

Safety Integrated plus

320

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Diagnostics

8.6 Stop responses

Note

Delayed pulse cancellation when the bus fails

For SLS and SDI, the stop responses are also available with delayed pulse cancellation when

the bus fails (in order that the drive does not immediately respond with pulse cancellation when

a communication error occurs):

● If p9580 ≠ 0 and SLS is active, in the event of communication failure, the parameterized ESR

reaction is only realized if, as SLS response, a STOP with delayed pulse cancellation when

the bus fails has been parameterized (p9563[0...3] ≥ 10).

● If p9580 ≠ 0 and SDI is active, in the event of communication failure, the parameterized ESR

reaction is only realized if, as SDI response, a STOP with delayed pulse cancellation when

the bus fails has been parameterized (p9566[0...3] ≥ 10).

● If p9580 ≠ 0 and SLP is active, in the event of communication failure, the parameterized ESR

reaction is only realized if, as SLP response, a STOP with delayed pulse cancellation when

the bus fails has been parameterized (p9566[0...3] ≥ 10).

The delay time (p9580) must not exceed 800 ms.

Note

Delay time between STOP F and STOP B

A delay time between STOP F and STOP B should only be set if an additional response is

initiated during this time when the "Internal Event" (r9722.7) message signal is evaluated.

Further, when using the delay time, a monitoring function should always be selected (e.g. SLS

with a high limit speed) or the hysteresis of SSM should be configured.

When hysteresis is activated for SSM, then this should be considered to be an activated

monitoring function.

On delays at the transition of the stop responses

● t_B: p9556

● t_C: p9552

● t_D: p9553

● t_F1: p9658

● t_F2: p9555

● n_shutdown: p9560

8.6.4

Connection and effects in the NC

The motion control in the NC is linked to the safety functions in the drive via the SIC status

signals. This avoids that subsequent responses are initiated in the NC as a result of safety stops

in the drive.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

321

Diagnostics

8.6 Stop responses

Example: The motion control in the NC responds to the drive STOP response by no longer

issuing additional setpoints for the path, for example. As a consequence, alarms to be

acknowledged are avoided, such as "Contour monitoring" or "Positioning monitoring".

The corresponding status bits from S_ZSW1 (or S_ZSW1B) are used to emulate the safety stop

responses in the NC.

See also

Safety Info Channel and Safety Control Channel (SIC/SCC) (Page 205)

8.6.5

Priorities

Table 8-10

Priorities of the stop responses

Priority classes

Stop response

Highest priority

STOP A

STOP B

STOP C

STOP D

STOP E

Lowest priority

STOP F

Priorities between stop responses and Extended Functions

The following table lists which stop response or safety function is set if a STOP is initiated when

a safety function is active.

Table 8-11

Priorities between stop responses and Extended Functions

Highest

Lowest

priority

Stop response/

Extended Function

STOP A

STOP B

STOP C

STOP D

STOP E

STOP F

Highest

STO

STOP A / STO

STO

priority

SS1

STOP A

STOP B / SS1

SS1

SS2

STOP A

STOP B

STOP C / SS2

SS2

SS2 / STOP B²⁾

Safety Integrated plus

322

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Diagnostics

8.6 Stop responses

SOS

STOP A¹⁾

STOP B¹⁾

SOS

STOP E/SOS

STOP B²⁾

Lowest

SLS

STOP A³⁾

STOP B³⁾

STOP C⁴⁾

STOP D⁴⁾

STOP E⁴⁾

STOP B²⁾

priority

The SOS monitoring function remains active, although the fault response in the event of a fault can no longer be triggered

because it is already present.

STOP B is the subsequent stop of STOP F, which is activated after a parameterizable time. STOP F alone does not have

any effect; the active safety function is still present.

The SLS monitoring function remains active, although the fault response in the event of a fault can no longer be triggered

because it is already present.

SLS remains active during the braking phase, after which the system switches to SOS.

Explanation of the table

No overall priority is assigned in the individual safety functions. SOS remains active, for

example, even if STO is requested.

● The safety functions that cause the drive to decelerate (SS1, SS2) are specified from top to

bottom in descending order of priority.

● The stop responses arranged here from left to right in descending order of priority (STOP A-

F).

If a field contains two entries, the stop responses and safety functions have the same priority.

● STOP A corresponds to selecting STO

● STOP B corresponds to selecting SS1

● STOP C corresponds to selecting SS2

● STOP D corresponds to selecting SOS

● STOP E corresponds to selecting SOS (for additional activation of the standard "Extended

stop and retract (ESR)" function)

● When the SS2 function is active, STOP F results in follow-up stop B. SS2 remains active.

Examples for illustrating the information in the table:

1. Safety function SS1 has just been selected. STOP A remains selected.

2. By selecting a STOP with a higher priority, STOPs that are present with a lower priority will

be replaced. This means that when SS1 is selected (≙ STOP B), any STOPs C-F that are

present will be replaced.

3. The SLS safety function is selected. This selection does not modify the function of STOP A-

D. A STOP F now triggers a STOP B because a safety function has been activated.

4. Stop response, STOP C is selected. If the STO or SS1 safety functions are active, this does

not have any effect. If SS2 is active, this brake ramp is retained. If SOS is active, SOS

remains effective, which is also the end status of STOP C. When SLS is selected, the drive

is decelerated with STOP C.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

323

Diagnostics

8.7 Using the fault buffer and safety message buffer

8.7

Using the fault buffer and safety message buffer

In addition to the standard fault buffer and the standard alarm buffer, SINAMICS Safety

Integrated has its own safety message buffer for safety-related messages for Safety Integrated

Extended Functions:

● Messages for Extended Functions are displayed in the safety message buffer.

● You must enable SIC/SCC for the appropriate axes in MD39750.

● For all messages in the safety message buffer, a specific reference is made in the HMI

to the fact that safety-relevant acknowledgment (Page 327) is required.

- In SINUMERIK Operate, in the "Safety Integrated diagnostics overview", reference

is made to active safety-relevant alarms (in addition to the standard alarm list).

- A safety delete symbol makes reference to active alarms that require a safety-rel-

evant acknowledgment.

● To acknowledge messages in the safety message buffer, safety-relevant acknowl-

edgment is required - and possibly also acknowledgment with PROFIdrive RESET

(Page 328).

● Messages for Basic Functions or for external drives without an NC axis assignment,

cannot be saved to the safety message buffer.

● When using external drives without NC axis assignment, then you must deactivate the

safety message buffer (Page 325).

● The response when saving safety-relevant messages relating to Basic Functions cor-

responds to the response for a deactivated safety message buffer (see below).

● If the safety message buffer is deactivated, then safety-relevant messages are saved in

the standard fault and/or alarm buffer.

● For safety-related messages in the fault and alarm buffer, in SINUMERIK Operate,

specific reference is not made to the safety-relevant acknowledgment required.

In SINUMERIK Operate, safety-relevant alarms are displayed in the standardalarm list

("MENU SELECT > Diagnostics > Alarms") - however, they require safety-relevant

acknowledgment.

● The messages require additional acknowledgment: For an entry in the fault buffer, in

addition alarm 25201 ("Drive fault") is output, and the drive message requires a safety-

relevant acknowledgment as well as also an acknowledgment via PROFIdrive

(Page 329).

Safety Integrated plus

324

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Diagnostics

8.8 Configuring the message buffer and alarm buffer

8.8

Configuring the message buffer and alarm buffer

8.8.1

Configuring the standard alarm buffer

The standard alarm buffer is automatically activated when you configure the safety mode.

This alarm buffer is required for safety-related standard warnings (Axxxx).

The display of safety-related standard warnings cannot be activated independently of the

display of other standard warnings.

The activation is entered in the following machine data:

● MD13150 $MN_SINAMICS_ALARM_MASK

- "bit 2: output faults of the drive controls"

- "bit 10: output alarms of the drive controls"

Alarms/warnings have to be evaluated.

Optionally, you can set additional bits in order to output faults or alarms of other DO groups.

8.8.2

Configuring the safety alarm buffer

The safety message buffer is activated in the factory setting, and is used for issuing safety-

relevant messages from Extended Functions.

In certain situations it can make sense to also deactivate the safety message buffer for

Extended Functions. This means that messages associated with Basic Functions and

Extended Functions can be saved in the fault and/or alarm buffer (e.g. if you are predominantly

using Basic Functions).

The setting to activate/deactivate the safety message buffer is a CU parameter (p3117). This

cannot be set for specific drives or axes - it is always applicable for all drives or axes of this CU.

The following drive parameter is relevant:

● p3117 Change safety message type / Ch SI mess type

Setting to re-parameterize all safety messages to faults and alarms.

Precondition

● Settings for drive parameters are protected with access level 2 (service).

Procedure

Proceed as follows to deactivate or activate the safety message buffer:

1. In SINUMERIK Operate, call the drive parameters using "MENU SELECT > Commissioning

> Machine data > Control Unit parameters".

2. Activate the CU commissioning state "Device configuration" with "p0009 = 1".

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

325

Diagnostics

8.8 Configuring the message buffer and alarm buffer

3. Set the required value in drive parameter p3117 Change safety message type / Ch SI mess

type:

- p3117 = 0: Safety messages of this CU are not reparameterized; this means that

messages associated with Extended Functions are entered in the safety message buffer.

- p3117 = 1: All safety messages of this CU are reparameterized, and entered in the

standard fault or alarm buffer.

4. Deactivate the CU commissioning state "Device configuration" with "p0009 = 0".

5. Confirm the setting with "Save/reset> Menu forward key> Reset (po)".

Safety Integrated plus

326

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Diagnostics

8.9 Acknowledgment

8.9

Acknowledgment

8.9.1

Overview

Most safety messages require safety-relevant acknowledgment.

Safety-relevant acknowledgment involves deleting safety-relevant messages of the drive-

integrated monitoring functions via safety-relevant communication. With the safety-related

acknowledgment, the fault case in the drive is marked as having been resolved (gone).

Safety-relevant acknowledgment is independent of the scope of the Safety Functions used

(Basic or Extended) - and is required in addition to actually removing the cause of the fault.

Depending on the drive type, different types of acknowledgment and/or safety-relevant

acknowledgment are possible:

Table 8-12

Permissible acknowledgment types for various drive types

Drive type

Permissible acknowledgment

Integrated drives

● Safety-relevant acknowledgment using PROFIsafe signal "IEACK"

(CU_I, CU_NX)

(Page 328)

● Acknowledgment by switching-off/switching-on (Page 329)

External NC drives

● Safety-relevant acknowledgment using PROFIsafe signal "IEACK"

(Page 328)

● Acknowledgment by deselecting STO or SS1 (Page 329)

● Acknowledgment by switching-off/switching-on (Page 329)

External SINAMICS drives

The safety message buffer is not supported and must be deactivated

without any assignment to an

(Page 325).

NC axis

The acknowledgment options correspond to those of external NC

drives (see above).

Depending on what has been configured, additional acknowledgments may be necessary:

● If you are using Basic Functions, or the safety message buffer is deactivated (p3117=1),

then you must additionally acknowledge (Page 329) all safety messages that are saved in

the standard fault buffer using a PROFIdrive RESET.

● In addition to a safety-relevant acknowledgment, various fault situations also require

an acknowledgment using a PROFIdrive RESET (Page 328).

WARNING

Unexpected restart for safety-related acknowledgment without MCP reset!

If a STOP response is acknowledged in a safety-related fashion by the machine operator, but

without PROFIdrive RESET acknowledgment, then the part program is not canceled and is

continued with the acknowledgment. When the machine restarts unexpectedly, this can put

people in dangerous situations or cause material damage.

● In the safety program logically combine safe acknowledgment (PROFIsafe IEACK) with a

RESET at the machine control panel (PROFIdrive RESET).

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

327

Diagnostics

8.9 Acknowledgment

8.9.2

Acknowledgment via PROFIsafe

You program a PROFIsafe acknowledgment in the safety program of the F-PLC by setting

signal "Internal Event ACK" separately for each drive object using the PROFIsafe telegram

(STW bit 7).

Faults in the drive objects (DOs) cannot be acknowledged by the F-PLC in the line-up, but must

instead be acknowledged separately for each individual drive object. A falling edge of the

"Internal Event ACK" signal resets the status "Internal Event" in the particular drive, and thus

acknowledges the fault.

8.9.3

Additional acknowledgment via PROFIdrive RESET

WARNING

Unexpected restart for safety-related acknowledgment without MCP reset!

If a STOP response is acknowledged in a safety-related fashion by the machine operator, but

without PROFIdrive RESET acknowledgment, then the part program is not canceled and is

continued with the acknowledgment. When the machine restarts unexpectedly, this can put

people in dangerous situations or cause material damage.

● In the safety program logically combine safe acknowledgment (PROFIsafe IEACK) with a

RESET at the machine control panel (PROFIdrive RESET).

In addition to a safety-relevant acknowledgment, various fault situations also require an

acknowledgment using a PROFIdrive RESET.

This applies to the following STOP responses or safety functions:

● Extended Safety Functions:

- All fault situations - or safety functions and STOP responses

● Basic Functions or inactive safety message buffer:

- Parameterizing SLS with STOP D or STOP E

If, in the case of a fault, the safety-relevant acknowledgment is realized without PROFIdrive

RESET, then although the part program remains in the stop state, the spindle continues to

operate.

A configuration such as this is not in conformance with standard IEC 61800-5-2. According to

the standard, a restart inhibit is mandatory for all STOP functions, and it is only permissible that

the spindle starts again after a RESET.

1. Therefore, in the safety program logically combine safe acknowledgment (PROFIsafe

IEACK) with a RESET at the machine control panel (PROFIdrive RESET).

2. This means that you should configure the machine control panel RESET (MCP reset or

channel/MODE GROUP RESET) so that when actuated, a PROFIdrive RESET as well as

a safety-relevant acknowledgment (e.g. PROFIsafe IEACK) are initiated.

Safety Integrated plus

328

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Diagnostics

8.9 Acknowledgment

8.9.4

Acknowledgment using POWER ON

Safety faults can also be acknowledged (as with all other faults) by switching the drive unit off

and then on again (POWER ON).

If this action has not eliminated the fault cause, the fault is displayed again immediately after

power-up.

8.9.5

Extended acknowledgment (deselecting STO/SS1)

For external drives, the extended alarm acknowledgment can be used as alternative to safety-

relevant acknowledgment. To do this, the extended alarm acknowledgment must be activated

in the safety configuration of the drive.

Extended alarm acknowledgment is not supported for integrated drives.

Basic procedure

If STO or SS1 is selected/deselected - and if p9507.0 is set = 1 - then the safety messages are

automatically withdrawn.

● Remove the cause of the fault.

● Deselect "Safe Torque Off" (STO) or "Safe Stop 1" (SS1).

● Acknowledge the fault.

If, in addition to the "Basic Functions via terminals", the "Extended Functions" are also enabled,

then acknowledgment is also possible by selecting/deselecting STO via PROFIsafe.

If the safety commissioning mode is exited when the safety functions are switched off (p0010 ≠

95 when p9601 = 0), then all safety faults can be acknowledged.

Once safety commissioning mode has been selected again (p0010 = 95), all the faults that were

previously present reappear.

8.9.6

Additional acknowledgment when the safety message buffer is inactive

If you are using Basic Functions, or the safety message buffer is deactivated (p3117=1), then

safety messages are saved in the standard fault buffer or in the standard alarm buffer. These

messages require a safety-relevant acknowledgment, even when the safety message buffer is

deactivated.

The safety messages in the standard fault buffer require, in addition to safety-relevant

acknowledgment, also acknowledgment using PROFIdrive signal "Acknowledge faults"

(PROFIdrive RESET). For NC axes, a PROFIdrive RESET corresponds to a machine control

panel RESET.

The required PROFIdrive RESET is displayed in SINUMERIK Operate with NC alarm 025201.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

329

Diagnostics

8.9 Acknowledgment

When the safety message buffer is deactivated, the following safety messages are saved in the

fault buffer, and therefore also additionally required a PROFIdrive RESET:

Table 8-13

Saving safety-relevant messages in the the fault buffer (when the safety message buffer is

deactivated)

Alarm number

Alarm text

201689

SI Motion: Axis re-configured

201700

SI Motion P1 (CU): STOP A initiated

201701

SI Motion P1 (CU): STOP B initiated

201708

SI Motion P1 (CU): STOP C initiated

201770

SI Motion P1 (CU): Discrepancy error of the failsafe digital inputs/outputs

When the safety message buffer is deactivated, all of the safety messages listed in the table are

saved in the standard alarm buffer.

Safety Integrated plus

330

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Acceptance test with SINUMERIK Operate

9.1

Purpose and requirements

An acceptance test has the objective to check that the parameterization and principle of

operation of the safety functions are correct, identify potential configuring errors and to

document the correctness of the configuration.

With the acceptance test, the limit values entered for all activated safety functions must be

exceeded (violated). This allows the correct execution of the function to be checked and

verified.

WARNING

Unwanted motion due to incorrect parameter changes

Changes to safety functions that have been accepted can result in faults and undesirable

motion - and in turn in death or severe injury.

● Perform a new acceptance test as soon as changes have been made to any of the safety

functions.

● Also create an appropriate acceptance report.

Responsibility for the acceptance test

This chapter provides recommendations for the content and scope of an acceptance test. The

machine manufacturer is responsible for carrying out and documenting an acceptance test.

It is not permissible to use the results of the acceptance test for other purposes!

The measured values obtained when executing the acceptance test (e.g. distance or time) and

the system response identified (e.g. initiation of a specific stop) are used to check the

plausibility of the configured safety functions. The values that are measured are typical and are

not worst-case values. They represent the behavior of the machine at the time of measurement.

These measurements cannot be used to derive real values (e.g. maximum distances for over-

travel distances).

Acceptance test in SINUMERIK Operate

A detailed description of the acceptance test in SINUMERIK Operate is provided in Function

Manual "SINUMERIK Operate Acceptance Test" (download (https://

support.industry.siemens.com/cs/ww/en/view/109761095)).

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

331

Component replacement (software/hardware)

10.1

Safety instructions

WARNING

Unsafe operating state after POWER ON

After a firmware update, the system generally requests a POWER ON. After a POWER ON,

an unsafe operating state can occur - and if persons are in the hazardous area, this can result

in death or severe injury.

● After each POWER ON, perform an acceptance test and create an acceptance report.

● Do not enter the danger zone of the motor until the acceptance test has been successfully

completed.

WARNING

Unwanted motion if components are replaced without a function test

After a component replacement, connections or functions can be defective so that death or

serious injury can result if a person enters the danger zone of the motors.

● Perform a POWER ON before resuming operation.

● After component replacement, always run a simplified function test.

You can find more detailed information in the chapters "AUTOHOTSPOT" and

"Acceptance test with SINUMERIK Operate (Page 331)".

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

333

Component replacement (software/hardware)

10.2 Software, F-CPU, F-I/O

10.2

Software, F-CPU, F-I/O

Replacement of software components

When replacing software components on your programming device or PC (e.g. with a new

version of STEP 7), you must adhere to the information regarding upward and downward

compatibility in the documentation and readme files for these products.

Replacement of hardware components

Hardware components for SIMATIC Safety (F-CPU, F-I/O, batteries, etc.) are replaced in the

same way as in standard automation systems.

Removing and inserting F-I/O during operation

It is possible to remove and insert F-I/O during operation, as with standard F-I/O. However, be

aware that replacing an F-I/O module during operation can cause a communication error in the

F-CPU.

You must acknowledge communication errors in your safety program at variables ACK_REI of

the F-I/O DB - or alternatively, using instruction "ACK_GL". Without an acknowledgment, the F-

I/O will remain passivated.

CPU firmware update

Check of the CPU operating system for F-approval: When using a new CPU operating system

(firmware update), you must check to see if the CPU operating system you are using is

approved for use in an F-system.

The minimum CPU operating system versions with guaranteed F-capability are specified in the

appendix of the Certificate. This information and any notes on the new CPU operating system

must be taken into account.

Firmware update for interface module

When using a new operating system for an interface module, e.g. IM 151-1 HIGH FEATURE

ET 200S (firmware update), you must observe the following:

If you have selected the "Activate firmware after update" option for the firmware update (see

Help on STEP 7, "Online & Diagnostics"), the IM will be automatically reset following a

successful download operation and will then run on the new operating system. Note that the

firmware update for interface modules during operation generates a communication error in the

F-CPU.

You must acknowledge communication errors in your safety program at variables ACK_REI of

the F-I/O DBs - or alternatively, using instruction "ACK_GL". Without an acknowledgment, the

F-I/O will remain passivated.

Safety Integrated plus

334

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Component replacement (software/hardware)

10.2 Software, F-CPU, F-I/O

Preventive maintenance (proof test)

The probability values for the certified F-system components guarantee a proof-test interval of

20 years for ordinary configurations.

Proof test for complex electronic components generally means replacement with unused

components.

PFD, PFH values

A complete list of the probability of failure values (PFD, PFH values) for F-CPUs is provided in

the Siemens web page Industry Online Support at the following address (https://

support.industry.siemens.com/cs/ww/en/view/109481784/80883060875):

There you can find a list for the following probability of failure values:

● PFD, PFH values for F-CPUs S7-300/400 - and the proof test intervals for components that

can be used in SIMATIC Safety

● PFD, PFH values for F-CPUs S7-1200/1500 for a usage time of 20 years and for a repair

time of 100 hours. Excerpt:

Operation in low demand mode

Operation in high demand or continuous mode

low demand mode

high demand/continuous mode

According to IEC 61508:2010:

PFD_avg = Average probability of a dangerous

PFH = Average frequency of a dangerous failure

failure on demand

[h^-1]

< 2E-05

< 1E-09

● PFD, PFH values for safety-relevant communication. Excerpt:

Operation in low demand mode

Operation in high demand or continuous mode

low demand mode

high demand/continuous mode

According to IEC 61508:2010:

PFD_avg = Average probability of a dangerous

PFH = Average frequency of a dangerous failure

failure on demand

[h^-1]

< 1E-05

< 1E-09*

* Note on S7-300/400 F-CPUs: The value is valid under the assumption that a maximum of 100 F-I/Os

are involved in a safety function. If more than 100 F-I/Os are used, you need to add 4E-12 for each F-

I/O for this safety function.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

335

Component replacement (software/hardware)

10.3 Motors, CU (SINAMICS Safety Integrated)

10.3

Motors, CU (SINAMICS Safety Integrated)

Overview

The faulty component was replaced according to safety regulations. The information relevant

from the perspective of Safety Integrated is provided in the following. For information about

component replacements, see "Example of component replacements" in the SINAMICS S120

Function Manual Drive Functions.

● Based on the NodeID and the saved CRC of the particular hardware component, the drive

identifies that a component has been replaced. You can take the responses of the drive and

the actions that have to be carried out from the following table:

Replaced

Control type

Drive re-

User action

Diagnostic

component

sponse

parameters

Fault acknowl-

Acknowledg-

Save³⁾

(fault)

edgment re-

ment is re-

quired¹⁾

quired that the

component has

been replaced²⁾

Basic

Control Unit

All

F01641.0 = 1

Yes

r9776.2 = 1

Functions Motor Module

All

F01641.1 = 1

Yes

r9776.2 = 1

Power Module

All

F01641.2 = 1

Yes

r9776.2 = 1

Safety Integrated plus

336

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Component replacement (software/hardware)

10.3 Motors, CU (SINAMICS Safety Integrated)

Replaced

Control type

Drive re-

User action

Diagnostic

component

sponse

parameters

Fault acknowl-

Acknowledg-

Save³⁾

(fault)

edgment re-

ment is re-

quired¹⁾

quired that the

component has

been replaced²⁾

Extended

Control Unit

All

F01641.0 = 1

Yes

r9776.2 = 1

Functions Motor Module

PROFIsafe,

F01641.1 = 1

Yes

r9776.2 = 1

OnBoard F-DI,

without selec-

tion

Power Module

All

F01641.2 = 1

Yes

r9776.2 = 1

Sensor

All

F01641.3 = 1

Yes

r9776.2 = 1

Module

(CPU 1)

Sensor

All

F01640.4 = 1

Yes

r9776.2 = 1

Module

r9776.3 = 1

(CPU 2)

Encoder⁴⁾

All

F01641.5 = 1

Yes

r9776.2 = 1

F01641.6 = 1

The fault must be acknowledged each time a component is replaced using a standard acknowledgment (e.g. using a 0/1

signal at p2103). However, even without acknowledgment the drive can still be operated.

The replacement of the components listed in the table must be acknowledged in order to ensure the new internal device

communications to be established. When replacing other components, acknowledgment is not required, as the new

communications to be established are automatically ensured.

To acknowledge a component replacement, perform the following sequence on all of the drive objects involved:

- Check whether the following preconditions are fulfilled:

- p0010 = 0

- It is not permissible for a firmware update to be active on the drive object.

- Set p9702 = 29 (= 1D hex)

The modified data must be saved after a component has been replaced:

- It is not permissible for a firmware update to be active on the drive object.

- Copy from RAM to ROM by setting p0977 = 1.

If the data is not saved, the fault is output again after the next POWER ON.

Only for encoders with serial number (e.g. EnDat)

Replacing motors for safety without encoder

When using safety functions without encoder, the motor pole pair number plays a decisive role.

If a motor is replaced, then the behavior depends on the pole pair number: If a motor with a

higher pole pair number is used (other than that configured), the mechanical speed is less than

that calculated by Safety Integrated. If a motor with a lower pole pair number is used (e.g. when

a motor is replaced), the mechanical speed is higher than that calculated by Safety Integrated.

● After a replacement such as this, perform a test by comparing the safe actual speed (r9714)

with the normal speed (r0063 or the output frequency), and if required, correct the

configured pole pair number.

See also

S_ZSW3B: Safety Info Channel status word 3 (Page 368)

11.6.2

PROFIsafe process data

Note

Supplementary information in function block diagrams

For the subsequent descriptions, a reference is generally made to a function block diagram.

You can find the specified function block diagram in the SINAMICS S120/S150 List Manual.

Safety Integrated plus

352

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

11.6.2.1

S_STW1: Safety control word 1

S_STW1 (Basic Functions)

Safety control word 1 (S_STW1)

S_STW1, output signals

see function chart [2806].

Table 11-19 Description of safety-control word1 (S_STW1)

Byte

Bit

Meaning

Remarks

STO

Deselect STO

Select STO

SS1

Deselect SS1

Select SS1

SS2

-¹⁾

SOS

-¹⁾

SLS

-¹⁾

Reserved

SLP

-¹⁾

Internal Event ACK

1/0

Acknowledgment

No acknowledgment

Reserved

Select SLS bit 0

-¹⁾

Select SLS bit 1

Reserved

SDI positive

-¹⁾

SDI negative

6, 7

Reserved

Signals not relevant for Basic Functions: Should be set to "0".

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

353

Data descriptions

11.6 Process data

S_STW1 (Extended Functions)

Safety control word 1 (S_STW1)

S_STW1, output signals

see function chart [2842].

Table 11-20 Description of safety-control word1 (S_STW1)

Byte

Bit

Meaning

Remarks

STO

Deselect STO

Select STO

SS1

Deselect SS1

Select SS1

SS2

Deselect SS2

Select SS2

SOS

Deselect SOS

Select SOS

SLS

Deselect SLS

Select SLS

Reserved

SLP

Deselect SLP

Select SLP

Internal Event ACK

1/0

Acknowledgment

No acknowledgment

Reserved

Select SLS bit 0

Selection of the speed limit for SLS (2 bits)

Select SLS bit 1

Reserved

SDI positive

Deselect SDI positive

Select SDI positive

SDI negative

Deselect SDI negative

Select SDI negative

6, 7

Reserved

Safety Integrated plus

354

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

11.6.2.2

S_ZSW1: Safety status word 1

S_ZSW1 (Basic Functions)

Safety status word 1 (S_ZSW1)

S_ZSW1, input signals

see function diagram [2806].

Table 11-21 Description of safety status word 1 (S_ZSW1)

Byte

Bit

Meaning

Remarks

STO active

STO not active

SS1 active

SS1 not active

SS2 active

-¹⁾

SOS active

-¹⁾

SLS active

-¹⁾

Reserved

SLP active

-¹⁾

Internal Event

Internal event

No internal event

Reserved

Active SLS level bit 0

-¹⁾

Active SLS level bit 1

SOS selected

-¹⁾

SDI positive active

-¹⁾

SDI negative active

-¹⁾

Reserved

SSM (speed below limit value)

-¹⁾

Signals not relevant for Basic Functions: Must not be evaluated.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

355

Data descriptions

11.6 Process data

S_ZSW1 (Extended Functions)

Safety status word 1 (S_ZSW1)

S_ZSW1, input signals

see function diagram [2842].

Table 11-22 Description of safety status word 1 (S_ZSW1)

Byte

Bit

Meaning

Remarks

STO active

STO not active

SS1 active

SS1 not active

SS2 active

SS2 not active

SOS active

SOS not active

SLS active

SLS not active

Reserved

SLP active

SLP not active

–

The status signal "SLP active" is not the same as

the diagnostic signal "SLP active" (r9722.6), but

is the AND logic operation of "SLP active"

(r9722.6) and "safely referenced" (r9722.23).

Internal Event

Internal event

No internal event

Reserved

Active SLS level bit 0

Display of the velocity limit for SLS (2 bits)

Active SLS level bit 1

SOS selected

SOS deselected

SDI positive active

SDI positive not active

SDI negative active

SDI negative not active

Reserved

SSM (speed)

SSM (speed below limit value)

SSM (speed higher than/equal to limit)

Safety Integrated plus

356

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

11.6.2.3

S_STW2: Safety control word 2

S_STW2 (Basic Functions)

Safety control word 2 (S_STW2)

S_STW2, output signals

see function diagram [2806].

Table 11-23 Description of safety-control word 2 (S_STW2)

Byte

Bit

Meaning

Remarks

STO

Deselect STO

Select STO

SS1

Deselect SS1

Select SS1

SS2

-¹⁾

SOS

-¹⁾

SLS

-¹⁾

Reserved

SLP

-¹⁾

Internal Event ACK

1/0

Acknowledgment

No acknowledgment

SLA active

-¹⁾

Select SLS bit 0

-¹⁾

Select SLS bit 1

Reserved

SDI positive

-¹⁾

SDI negative

-¹⁾

Reserved

SSM

-¹⁾

0 ... 2

Reserved

Select SLP position range

-¹⁾

4 ... 6

Reserved

SCA

-¹⁾

Select gearbox stage, bit 0

-¹⁾

Select gearbox stage, bit 1

-¹⁾

Select gearbox stage, bit 2

-¹⁾

Gearbox stage switchover

-¹⁾

SS2E

-¹⁾

5, 6, 7

Reserved

Signals not relevant to Basic Functions should be set to "0".

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

357

Data descriptions

11.6 Process data

S_STW2 (Extended Functions)

Safety control word 2 (S_STW2)

S_STW2, output signals

see function diagram [2843].

Table 11-24 Description of safety-control word 2 (S_STW2)

Byte

Bit

Meaning

Remarks

STO

Deselect STO

Select STO

SS1

Deselect SS1

Select SS1

SS2

Deselect SS2

Select SS2

SOS

Deselect SOS

Select SOS

SLS

Deselect SLS

Select SLS

Reserved

SLP

Deselect SLP

Select SLP

Internal Event ACK

1/0

Acknowledgment

No acknowledgment

Reserved

Select SLS bit 0

Selection of the speed limit for SLS (2 bits)

Select SLS bit 1

Reserved

SDI positive

Deselect SDI positive

Select SDI positive

SDI negative

Deselect SDI negative

Select SDI negative

6, 7

Reserved

0 ... 2

Reserved

Select SLP position range

Select SLP area 2 (SLP2)

Select SLP area 1 (SLP1)

4 ... 7

Reserved

Safety Integrated plus

358

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

Byte

Bit

Meaning

Remarks

Select gearbox stage, bit 0

Select gearbox stage (3 bits)

Select gearbox stage, bit 1

Select gearbox stage, bit 2

Gearbox stage switchover

With increased position tolerance

Without increased position tolerance

SS2E

Deselect SSE

Select SSE

5 ... 7

Reserved

11.6.2.4

S_ZSW2: Safety status word 2

S_ZSW2 (Basic Functions)

Safety status word 2 (S_ZSW2)

S_ZSW2, input signals

see function diagram [2806].

Table 11-25 Description of safety status word 2 (S_ZSW2)

Byte

Bit

Meaning

Remarks

STO active

STO not active

SS1 active

SS1 not active

SS2 active

-¹⁾

SOS active

-¹⁾

SLS active

-¹⁾

Reserved

SLP active

-¹⁾

Internal Event

Internal event

No internal event

SLA active

-¹⁾

Active SLS level, bit 0

-¹⁾

Active SLS level, bit 1

Reserved

SDI positive active

-¹⁾

SDI negative active

-¹⁾

Reserved

SSM (speed)

-¹⁾

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

359

Data descriptions

11.6 Process data

Byte

Bit

Meaning

Remarks

0 ... 2

Reserved

SLP active position range

-¹⁾

4, 5

Reserved

Safe position valid

-¹⁾

Safely referenced

-¹⁾

0 ... 2

F-DI 0 ... 2²⁾

-¹⁾

Reserved

SS2E active

-¹⁾

SOS selected

-¹⁾

SLP upper limit maintained

-¹⁾

SLP lower limit maintained

-¹⁾

Signals not relevant for Basic Functions: Must not be evaluated.

Only valid for CU310-2.

S_ZSW2 (Extended Functions)

Safety status word 2 (S_ZSW2)

S_ZSW2, input signals

see function diagram [2843].

Table 11-26 Description of safety status word 2 (S_ZSW2)

Byte

Bit

Meaning

Remarks

STO active

STO not active

SS1 active

SS1 not active

SS2 active

SS2 not active

SOS active

SOS not active

SLS active

SLS not active

Reserved

SLP active¹

SLP active

SLP not active

–

The status signal "SLP active" is not the same as

the diagnostic signal "SLP active" (r9722.6), but

is the AND logic operation of "SLP active"

(r9722.6) and "safely referenced" (r9722.23).

Internal Event

Internal event

No internal event

Safety Integrated plus

360

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

Byte

Bit

Meaning

Remarks

SLA active

SLA not active

Active SLS level bit 0

Display of the speed limit for SLS (2 bits)

Active SLS level bit 1

Reserved

SDI positive active

SDI positive not active

SDI negative active

SDI negative not active

Reserved

SSM (speed)

SSM (speed below limit value)

SSM (speed higher than/equal to limit)

0 ... 2

Reserved

SLP active position range¹⁾

SLP area 2 (SLP2) active

SLP area 1 (SLP1) active

The status signal "SLP active position range" al-

ways corresponds to the diagnostic signal "SLP

active position range" (r9722.19).

4, 5

Reserved

Safe position valid

Safe position invalid

Safely referenced

Safe position is applicable as "safely referenced"

Safe position is not applicable as "safely refer-

enced"

Signals not relevant for Extended Functions: Must not be evaluated.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

361

Data descriptions

11.6 Process data

Byte

Bit

Meaning

Remarks

F-DI 0²⁾

F-DI 0 inactive

F-DI 0 active

F-DI 1²⁾

F-DI 1 inactive

F-DI 1 active

F-DI 2²⁾

F-DI 2 inactive

F-DI 2 active

Reserved

SS2E active

SS2E not active

SOS selected

SOS deselected

SLP high limit maintained¹⁾

SLP: Upper limit maintained

SLP: Upper limit not maintained

–

The status signal "upper SLP limit maintained"

always corresponds to the diagnostic signal "up-

per SLP limit maintained" (r9722.30).

SLP low limit maintained¹⁾

SLP: Lower limit maintained

SLP: Lower limit not maintained

The status signal "lower SLP limit maintained"

always corresponds to the diagnostic signal "low-

er SLP limit maintained" (r9722.31).

Signals not relevant for Extended Functions: Must not be evaluated.

Only valid for CU310-2.

11.6.2.5

S_SLS_LIMIT_A: SLS limit value input

S_SLS_LIMIT_A

● PZD3 in telegrams 901 and 902, output signals

● SLS limit value input

● Value range 1 ... 32767; 32767 ≙ 100% of the 1st SLS level

11.6.2.6

S_SLS_LIMIT_A_ACTIVE: Active SLS limit value

S_SLS_LIMIT_A_ACTIVE

● PZD3 in telegrams 901 and 902, input signals

● Active SLS limit value

● Value range 1 ... 32767; 32767 ≙ 100%

● Must only be evaluated if SLS 1 active and p9501.24 = 1.

Safety Integrated plus

362

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

11.6.2.7

S_CYCLE_COUNT: Counter for the safety cycle

S_CYCLE_COUNT

● PZD4 in telegrams 901 and 902, input signals

● Counter for the safety cycle

● Value range -32768 ... +32767

● May only be evaluated if the transfer of safe position values is active (p9501.25 = 1) and the

position value is valid (r9722.22 = r9722.23 = 1).

11.6.2.8

S_XIST16: Current actual position value (16 bits)

S_XIST16

● PZD5 in telegram 901, input signals

● Current actual position value (16 bits)

● Value range ±32767

● Scaling using p9574

Note

Scaling

It is not permissible that the position value transferred in S_XIST16 exceeds the value range

that can be represented. This is the reason that the safe position value of the drive (r9713[0])

can be allocated a scaling factor. The position value is divided by this factor before transfer.

As a consequence, a wider value range can be transferred with a reduced accuracy.

Example: For a position of -29.999 mm signaled in r9708[0] and r9708[1] and a scaling

factor of p9x74 = 1000, a numerical value of -29 is signaled to the controller.

● May only be evaluated if the transfer of safe position values is active (p9501.25 = 1) and the

position value is valid (r9722.22 = r9722.23 = 1).

11.6.2.9

S_XIST32: Current actual position value (32 bits)

S_XIST32

● PZD5 and PZD6 in telegram 902, input signals

● Current actual position value (32 bits)

● Value range ±737280000

● Unit: 1 μm (linear axis), 0.001 ° (rotary axis)

● May only be evaluated if the transfer of safe position values is active (p9501.25 = 1) and the

position value is valid (r9722.22 = r9722.23 = 1).

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

363

Data descriptions

11.6 Process data

11.6.2.10

S_ZSW_CAM1

S_ZSW_CAM1, Safe Cam

see function diagram [2844].

Table 11-27 Description of Safety status word Safe Cam (S_ZSW_CAM1)

Byte

Bit

Meaning

Remarks

Position at cam 1

Position is at cam 1

Position is not at cam 1

Position at cam 2

Position is at cam 2

Position is not at cam 2

Position at cam 3

Position is at cam 3

Position is not at cam 3

Position at cam 4

Position is at cam 4

Position is not at cam 4

Position at cam 5

Position is at cam 5

Position is not at cam 5

Position at cam 6

Position is at cam 6

Position is not at cam 6

Position at cam 7

Position is at cam 7

Position is not at cam 7

Position at cam 8

Position is at cam 8

Position is not at cam 8

Position at cam 9

Position is at cam 9

Position is not at cam 9

Position at cam 10

Position is at cam 10

Position is not at cam 10

Position at cam 11

Position is at cam 11

Position is not at cam 11

Position at cam 12

Position is at cam 12

Position is not at cam 12

Position at cam 13

Position is at cam 13

Position is not at cam 13

Position at cam 14

Position is at cam 14

Position is not at cam 14

Position at cam 15

Position is at cam 15

Position is not at cam 15

Position at cam 16

Position is at cam 16

Position is not at cam 16

Safety Integrated plus

364

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

Byte

Bit

Meaning

Remarks

Position at cam 17

Position is at cam 17

Position is not at cam 17

Position at cam 18

Position is at cam 18

Position is not at cam 18

Position at cam 19

Position is at cam 19

Position is not at cam 19

Position at cam 20

Position is at cam 20

Position is not at cam 20

Position at cam 21

Position is at cam 21

Position is not at cam 21

Position at cam 22

Position is at cam 22

Position is not at cam 22

Position at cam 23

Position is at cam 23

Position is not at cam 23

Position at cam 24

Position is at cam 24

Position is not at cam 24

Position at cam 25

Position is at cam 25

Position is not at cam 25

Position at cam 26

Position is at cam 26

Position is not at cam 26

Position at cam 27

Position is at cam 27

Position is not at cam 27

Position at cam 28

Position is at cam 28

Position is not at cam 28

Position at cam 29

Position is at cam 29

Position is not at cam 29

Position at cam 30

Position is at cam 30

Position is not at cam 30

Safe Cam active

Safe Cam is active

Safe Cam is not active

Validity of the values of Safe Cam

Values of Safe Cam apply

Values of Safe Cam do not apply

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

365

Data descriptions

11.6 Process data

11.6.3

SIC/SCC (PROFIdrive) process data

11.6.3.1

S_STW1B: Safety Control Channel control word 1

S_STW1B

Safety Control Channel control word 1

Table 11-28 Description of S_STW1B

Bit

Meaning

Remarks

Parameter

0...7

Reserved

Extended Functions test stop/forced

Extended Functions test stop/forced checking pro-

r10251.8

checking procedure

cedure selected

Extended Functions test stop/forced checking pro-

cedure deselected

9...15

Reserved

11.6.3.2

S_ZSW1B: SI Motion / Safety Info Channel status word

S_ZSW1B

SI Motion Safety Info Channel status word

Table 11-29 Description S_ZSW1B

Bit

Meaning

Remarks

Parameter

STO active

r9734.0

STO not active

SS1 active

r9734.1

SS1 not active

SS2 active

r9734.2

SS2 not active

SOS active

r9734.3

SOS not active

SLS active

r9734.4

SLS not active

SOS selected

r9734.5

SOS deselected

SLS selected

r9734.6

SLS deselected

Internal event

r9734.7

No internal event

Reserved

Safety Integrated plus

366

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

Bit

Meaning

Remarks

Parameter

Active SLS level bit 0

Display of the velocity limit for SLS (2 bits)

r9734.9

Active SLS level bit 1

r9734.10

Reserved

SDI positive selected

r9734.12

SDI positive deselected

SDI negative selected

r9734.13

SDI negative deselected

ESR retract requested

r9734.14

ESR retract not requested

Safety message effective

r9734.15

No Safety message effective

11.6.3.3

S_ZSW2B: Safety Info Channel status word 2

S_ZSW2B

Safety Info Channel status word 2

Table 11-30 Description of S_ZSW2B

Bit

Meaning

Remarks

Parameter

0...3

Reserved

SLP selected position range

SLP area 2 selected

r9743.4

SLP area 1 selected

5, 6

Reserved

SLP selected and user agreement

SLP selected and user agreement set

r9743.7

SLP selected or user agreement not set

SDI positive

SDI positive selected

r9743.8

SDI positive deselected

SDI negative

SDI negative selected

r9743.9

SDI negative deselected

10, 11

Reserved

Test stop active

r9743.12

Test stop not active

Test stop required

r0743.13

Test stop not required

14, 15

Reserved

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

367

Data descriptions

11.6 Process data

11.6.3.4

S_STW3B: Safety Control Channel control word 3

S_STW3B

Safety Control Channel control word 3

Table 11-31 Description of S_STW3B

Bit

Meaning

Remarks

Parameter

Select brake test

Brake test selected

r10231.0

Brake test deselected

Start brake test

Start brake test requested

r10231.1

Start brake test not requested

Brake selection

Test brake 2 selected

r10231.2

Test brake 1 selected

Select direction of rotation

Negative direction selected

r10231.3

Positive direction selected

Select test sequence

Test sequence 2 selected

r10231.4

Test sequence 1 selected

Status of external brake

External brake closed

r10231.5

External brake open

6...15

Reserved

11.6.3.5

S_ZSW3B: Safety Info Channel status word 3

S_ZSW3B

Safety Info Channel status word 3

Table 11-32 Description of S_ZSW3B

Bit

Meaning

Remarks

Parameter

Brake test

Brake test selected

r10234.0

Brake test deselected

Setpoint input, drive/external¹⁾

Setpoint specification for the drive

r10234.1

Setpoint specification, external (controller)

Active brake

Test brake 2 active

r10234.2

Test brake 1 active

Brake test active

Test active

r10234.3

Test inactive

Brake test result

Test successful

r10234.4

Test error

Brake test completed

Test run

r10234.5

Test incomplete

Safety Integrated plus

368

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

Data descriptions

11.6 Process data

Bit

Meaning

Remarks

Parameter

External brake request

Close brake

r10234.6

Open brake

Current load sign

Negative sign

r10234.7

Positive sign

8...13

Reserved

Acceptance test SLP (SE) selected

r10234.14

Acceptance test SLP (SE) deselected

Acceptance test mode selected

r10234.15

Acceptance test mode deselected

Setpoint input for the drive: The speed setpoint is entered by the function SBT.

External setpoint input (open-loop control): The "normal" speed setpoint is effective.

11.6.3.6

S_V_LIMIT_B: Safety Info Channel setpoint velocity limiting

S_V_LIMIT_B

SLS speed limit with a 32-bit resolution with sign bit.

Table 11-33 Description S_V_LIMIT_B

Parameter

Meaning

r9733[2]

SLS speed limit

p2000

Scaling of the SLS velocity limit

S_V_LIMIT_B = 4000 0000 hex ≐ speed in p2000

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

369

Data descriptions

11.7 Interface signals: Axis/spindle signals

11.7

Interface signals: Axis/spindle signals

As PLC user interface, certain axis-specific signals are mapped from the SIC/SCC (Page 205)

in the axis DB (Page 206):

● DB31 … DB61, Safety Info Channel (SIC)

● DB31 … DB61, Safety Control Channel (SCC)

This means, for example, that you can perform the brake test via the PLC user program.

Additional information

List Manual "SINUMERIK 840D sl, NC Variables and Interface Signals".

Safety Integrated plus

370

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

System features

12.1

Latest information

Important note for maintaining the operational safety of your system:

Note

Requirements for operational safety

Systems with safety-related characteristics are subject to special operational safety

requirements on the part of the operating company. The supplier is also obliged to comply with

special product monitoring measures. For this reason, we publish a special newsletter

containing information on product developments and features that are (or could be) relevant

when operating safety-related systems.

● You should subscribe to the corresponding newsletter in order to obtain the latest

information and to allow you to modify your equipment accordingly.

Subscribing to the Safety Newsletter

1. Go to the following Internet address in your browser:

All Newsletters (https://www.industry.siemens.com/newsletter/public/AllNewsletters.aspx )

2. Select the desired language for the Web page.

3. You have to register and log in if you want to subscribe to any newsletters. Please proceed

as follows if you have still not registered:

- Click on "Login / registration".

- Login with your access data. If you do not yet have a login and password, select "Yes, I

would like to register now".

You can subscribe to the individual newsletters in the following window.

4. Activate the "All Newsletters" tab.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

371

System features

12.1 Latest information

5. In the list, open the "Products and solutions" topic.

You will now be shown which newsletter is available for this particular subject area or topic.

You can subscribe to the appropriate newsletter by clicking on the "Subscribe" entry. If you

require more detailed information on the newsletters, then please use the supplementary

function on the website.

Figure 12-1

Ordering the newsletter

6. Subscribe to the "Safety Integrated Internal News" Newsletter.

Safety Integrated plus

372

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

System features

12.2 Response times

12.2

Response times

The Basic Functions are executed in the monitoring cycle (p9780). PROFIsafe telegrams are

evaluated in the PROFIsafe scan cycle, which corresponds to twice the monitoring clock cycle

(PROFIsafe scan cycle = 2 · r9780).

Note for understanding the tables

The drive system is the component that provides the safety functions. The designation "fault-

free drive system" means that the component that provides the safety functions does not have

a defect itself:

● Worst case for a fault-free drive system

For faults outside the drive system, such as e.g. faulty setpoint input from a control system,

limit value violations as a result of the behavior of the motor, closed-loop control, load, etc.,

the "Worst case for a fault-free drive system" response time is guaranteed.

● Worst case when a fault exists

For a single fault within the drive system, such as a defect in a switch-off signal path of the

power unit, a defect in an encoder actual value measurement, a defect in a microprocessor

(Control Unit or Motor Module) etc., the "Worst case when a fault exists" response time is

guaranteed.

12.2.1

Controlling Basic Functions via terminals on the Control Unit and Motor Module

The following table lists the response times from the control via terminals until the response

actually occurs.

Table 12-1

Response times for control via terminals on the Control Unit and the Motor Module.

Function

Worst case for

Drive system has no fault

A fault is present

STO

2 · r9780 + t_E¹⁾

3 · r9780 + t_E¹⁾

SBC

4 · r9780 + t_E¹⁾

8 · r9780 + t_E¹⁾

SS1/SS1E (time-controlled)

Selection until STO is initiated

2 · r9780 + p9652 + t_E¹⁾

3 · r9780 + p9652 + t_E¹⁾

SS1/SS1E (time-controlled)

Selection until SBC is initiated

4 · r9780 + p9652 + t_E¹⁾

8 · r9780 + p9652 + t_E¹⁾

SS1 (time-controlled)

Selection until braking is initiated

3 · r9780 + 2 ms + t_E¹⁾

4 · r9780 + 2 ms + t_E¹⁾

The following applies for t_E (debounce time of the digital input being used):

p9651 = 0

t_E = 2 · p0799 (default = 4 ms)

p9651 ≠ 0

t_E = p9651 + p0799 + 1 ms

The minimum time for t_E is t_E_min = 2 ms.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

373

System features

12.2 Response times

12.2.2

Controlling the Basic Functions via PROFIsafe

The following table lists the response times¹⁾ from receiving the PROFIsafe Telegram in the

drive up to initiating the particular response.

Table 12-2

Response times when controlling via PROFIsafe

Function

Worst case for

Drive system has no fault

A fault is present

STO

5 · r9780 + t_E²⁾

SBC

6 · r9780 + t_E²⁾

10 · r9780 + t_E²⁾

SS1/SS1E (time-controlled)

Selection until STO is initiated

5 · r9780 + p9652 + t_K²⁾

SS1/SS1E (time-controlled)

Selection until SBC is initiated

6 · r9780 + p9652 + t_K²⁾

10 · r9780 + p9652 + t_K²⁾

SS1 (time-controlled)

Selection until braking is initiated

5 · r9780 + 2 ms + t_K²⁾

The specified response times involve internal SINAMICS response times. Program run times in the F-host and the

transmission time via PROFIBUS or PROFINET are not taken into account. When calculating the response times between

the F-CPU and the converter, you must take into account that faults in the communication can result in a safety function only

being selected after the PROFIsafe monitoring time (F_WD_Time) has expired. The PROFIsafe monitoring time

(F_WD_Time) must also be included in the calculation when an error occurs.

t_K is the time for internal communication within the SINAMICS module; t_K can be determined as follows:

t_K = To (for To, see parameter r2064[4])

12.2.3

Controlling the Extended Functions via PROFIsafe

The following table lists the response times^{1) 2)} from receiving the PROFIsafe Telegram in the

drive up to initiating the particular response.

Table 12-3

Response times when controlling via PROFIsafe

Function

Worst case for

Drive system has no fault

A fault is present

STO

5 · p9500⁸⁾ + r9780 + t_K⁶⁾

5 · p9500⁸⁾ + 2 · r9780 + t_K⁶⁾

SBC

5 · p9500⁸⁾ + 2 · r9780 + t_K⁶⁾

5 · p9500⁸⁾ + 6 · r9780 + t_K⁶⁾

SS1 (time controlled), SS1E, SS2E: Time from select-

ing up to starting the safe timer

SS1 (acceleration controlled), SS2: Time from select-

ing up to initiating braking

5 · p9500⁸⁾ + 2 ms + t_K⁶⁾

SOS: Time from selecting up to starting standstill mon-

itoring

SBR or SAM (limit value violation until STO active)

2 · p9500 + r9780

2.5 · p9500 + r9780 + t_ACT⁵⁾

SOS standstill tolerance window violated

1.5 · p9500 + 2 ms

3 · p9500 + 2 ms + t_ACT⁵⁾

SLS speed limit violated ³⁾

2 · p9500 + 2 ms

3.5 · p9500 + 2 ms + t_ACT⁵⁾

SSM⁴⁾

4 · p9500

4.5 · p9500 + t_ACT⁵⁾

SDI (limit value violation until braking is initiated)

1.5 · p9500 + 2 ms

3 · p9500 + 2 ms + t_ACT⁵⁾

Safety Integrated plus

374

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

System features

12.2 Response times

Function

Worst case for

Drive system has no fault

A fault is present

SLA ⁹⁾: Selection or deselection

5 · p9500⁸⁾ + t_K

3 · p9500 + 2 ms

4 · p9500 + 2 ms + t_act

SLA: Limit value violation

SLP (limit value violation until a response is initiated)

1.5 · p9500 + 2 ms

3 · p9500+ 2 ms + t_ACT⁵⁾

SCA: Time between violation of a cam start or end po-

sition and output of the feedback message in

3.5 · p9500

4 · p9500 + t_ACT⁵⁾

S_ZSW_CAM1

SP⁷⁾ with isochronous PROFIsafe telegram

3 · p9500

3 · p9500 + t_ACT⁵⁾

The specified response times are valid for Extended Functions with and without selection.

The specified response times involve internal SINAMICS response times. Program run times in the F-host and the

transmission time via PROFIBUS or PROFINET are not taken into account. When calculating the response times between

the F-CPU and the converter, you must take into account that faults in the communication can result in a safety function only

being selected after the PROFIsafe monitoring time (F_WD_Time) has expired. The PROFIsafe monitoring time

(F_WD_Time) must also be included in the calculation when an error occurs.

SLS: Specification of the response time required to initiate a braking response in the drive - or for the output of the "SOS

selected" message to the motion control system.

SSM: The data corresponds to the times between the limit value being undershot up to sending the information via

PROFIsafe.

t_ACT:

For p9511 ≠ 0

t_ACT = p9511

For p9511 = 0

t_ACT = PROFIBUS cycle

t_K is the time for internal communication within the SINAMICS module; t_K can be determined as follows:

t_K = To (for To, see parameter r2064[4])

SP: The data corresponds to the times between acquisition of the safe position and transfer of the safe position via

PROFIsafe.

For the best possible execution (relating to time) on the F-CPU this component is reduced from 5 · p9500 to 3 · p9500.

In SINUMERIK Operate, the settings for SLA can only be made via the parameter list.

Safety Integrated plus

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

375

Switchover from Safety Integrated (system-integrated)

13.2 Comparison of the safety functions

13.2

Comparison of the safety functions

13.2.1

Overview

The safety functions of SINUMERIK Safety Integrated - integrated in the system - use, in some

instances, their own function names. The names of the safety functions of Safety Integrated

plus, integrated in the system, correspond to the SINAMICS safety functions, and are therefore

orientated to DIN EN 60204-1.

These names are compared in this chapter.

For Safety Integrated plus, the drive-integrated safety functions available with Safety

Integrated (STO, SBC, SS1), belong to the Basic Functions - and are available with the same

function names. These are not listed here.

Table 13-1

Comparison of the system-integrated safety functions (Safety Integrated) and Extended Functions integrated in

the drive (Safety Integrated plus)

Safety Integrated

Safety Integrated plus

Additional information

External STOP A

Stop A/SH

Safe Torque Off

STO

(Safe Torque Off)

Safe Stop 1

SS1

(Safe stop in accordance with

stop Category 1)

Ext. STOP C

STOP C

Safe Stop 2

SS2

(Safe stop in accordance with

stop Category 2)

Ext. STOP D

STOP D

Safe Stop 2e

SS2e

Ext. STOP E

STOP E

--*

*Available as stop response when

SLS/SLP is exceeded (Page 379)

Safe operating stop

SBH

Safe Operating Stop

SOS

(Safe operating stop)

Safely-Limited Speed

Safely Limited Speed

SLS

(Safely-Limited Speed)

SG override

Override

SLS override

Enters the correction factor in the

for SG

safety program via PROFIsafe

(32 SG levels can be selected

(Page 380)

via SPL)

Safe Acceleration Monitoring

SBR

Safe Acceleration Monitor

SAM

(Safe Acceleration Monitoring)

Safe Brake Ramp

SBR

(Safe brake ramp monitoring)

Safety-relevant output signal

n<nx

Safe Speed Monitor

SSM

n<nx

(Safe Speed Monitor)

Safe Direction

SDI

(Safe motion direction)

Safe end positions

Safely-Limited Position

SLP

(Safely-Limited Position)

Safety Integrated plus

378

Commissioning Manual, 12/2019, 6FC5397-1FP40-6BA3

SINUMERIK 840D sl. Service - Configuring Commissioning. Manual (2011-2020) - page 91