Drive-integrated safety functions with SIMOTION D and SINAMICS S110/S120

The main functions of the SINAMICS S120 drive system are integrated into the SIMOTION D Motion Control System. The safety functions of the SINAMICS S120 integrated into the drive can therefore also be used in combination with SIMOTION D.

SIMOTION D and SINAMICS S110/S120 are characterized by a large number of integrated safety functions. In combination with the sensors and safety control generally required for the safety functionality, they ensure that highly-effective protection for persons and machines is implemented in a practice-oriented manner.

They comply with the requirements of the following safety categories:

• PL d and Category 3 according to EN ISO 13849-1
• SIL 2 according to IEC 61508 and IEC 61800-5-2

Note:

The Safe Brake Test (SBT) diagnostic function meets the requirements of Category 2 according to EN ISO 13849-1.

The Safety Integrated functions are generally certified by independent institutes. You can obtain the corresponding test certificates and manufacturer's declarations from your Siemens contacts.

Drive Safety Data Block (DSDB)

The safety functions of a SIMOTION-assigned drive are controlled via PROFIsafe or fail-safe digital inputs directly at the drive.
Depending on the safety function that is selected, it makes sense to respond appropriately to the selection of the function in the SIMOTION user program to avoid limit violations on the drive end.
Thus, for example, if the SLS function is selected, the speed of the affected drives must be controlled by SIMOTION in the available time, under the respective SLS limit value.
If SOS is selected, the relevant axes must be brought to a standstill and kept in that state.
The information about which safety function has been selected and which setpoint speed limit is currently in effect is transferred via the DSDB. As a rule, the information is transferred from the drive to the SIMOTION user program.
The selection of the SBT diagnostic function is transferred in the opposite direction from the user program to the drive.

The integrated safety functions that are currently available are described in the following. Their functional safety satisfies the requirements defined in the international standard IEC 61800-5-2 for variable-speed drive systems.

The safety functions integrated into the SINAMICS drive system can be roughly divided into four categories:

Functions for safely stopping a drive
• Safe Torque Off (STO)
• Safe Stop 1 (SS1)
• Safe Stop 2 (SS2)
• Safe Operating Stop (SOS)
Functions for safe brake management
• Safe Brake Control (SBC)
• Safe Brake Test (SBT) – (this diagnostic function exceeds the scope of IEC 61800-5-2)
Functions for safely monitoring the motion of a drive
• Safely-Limited Speed (SLS)
• Safe Speed Monitor (SSM)
• Safe Direction (SDI)
Functions for safely monitoring the position of a drive
• Safely-Limited Position (SLP)
• Safe Position (SP) – (this function exceeds the scope of IEC 61800-5-2))

Safe Torque Off (STO)

The STO function is the most common and basic drive-integrated safety function. It ensures that no torque-generating energy can continue to affect a motor and prevents unintentional start-ups.

Effect

This function is a mechanism that prevents the drive from restarting unexpectedly, in accordance with EN 60204-1, Section 5.4. The STO function disables the drive pulses (corresponds to Stop Category 0 according to EN 60204-1). The drive is reliably torque-free. This state is monitored internally in the drive.

Application

STO has the immediate effect that the drive cannot supply any torque-generating energy. STO can be used wherever the drive will naturally reach a standstill due to load torque or friction in a sufficiently short time or when coasting down of the drive will not have any relevance for safety.

STO makes it possible for persons to work safely when the protective door is open (restart interlock) and is used on machines/installations with moving axes, e.g. on handling or conveyor systems.

Customer benefits

The advantage of the integrated STO safety function compared to standard safety technology using electromechanical switchgear is the elimination of separate components and the effort that would be required to wire and service them. Because of the fast electronic switching times, the function provides a shorter reaction time than the conventional solution comprising electro-mechanical components.

Safe Stop 1 (SS1)

The SS1 function causes a motor to stop rapidly and safely and switches the motor to torque-free mode after the standstill by activating STO.

Effect

The SS1 function can safely stop the drive in accordance with EN 60204-1, Stop Category 1. When the SS1 function is selected, the drive brakes autonomously along a quick-stop ramp and automatically activates the Safe Torque Off and Safe Brake Control functions (if configured) when the parameterized safety delay time expires.

If the variant "SS1 with external stop (SS1E)" is parameterized, the drive does not brake autonomously when the function is selected. In this case, the higher-level control must bring the drive to a standstill within a parameterized STO transition time. The SBR (Safe Brake Ramp) and SAM (Safe Acceleration Monitor) functions are not active. SS1E is a useful function for drives that need to be stopped as a group by the Motion Control system in order to prevent potential damage to the machine or product.

Application

The SS1 function is used when, in the event of a safety-related incident, the drive must stop as quickly as possible with a subsequent transition into the STO state (e.g. EMERGENCY STOP). It is thus used to bring large centrifugal masses to a stop as quickly as possible for the safety of the operating personnel, or to brake motors at high speeds as quickly as possible. Examples of typical application are saws, grinding machine spindles, centrifuges, winders and storage and retrieval machines.

Customer benefits

The targeted stopping of a drive by means of SS1 reduces the risk of danger, increases the productivity of a machine, and allows safety clearances in a machine to be reduced. The principle is to bring the drive actively to a standstill, compared with just using the STO function. Complex mechanical brakes that are susceptible to wear are not normally required to brake the motor.

Safe Stop 2 (SS2)

The SS2 function brings the motor to a standstill quickly and safely and then activates the SOS function once the motor has stopped.

Effect

The Safe Stop 2 function can safely stop the drive in accordance with EN 60204-1, Stop Category 2. When the SS2 function is selected, the drive brakes autonomously along a quick-stop ramp. In contrast to SS1, the drive control remains operational afterwards, i.e. the motor can supply the full torque required to maintain zero speed. Standstill is safely monitored (Safe Operating Stop function).

Application

As with SS1, the SS2 function ensures the quickest possible deceleration of the motor. However, the motor power is not switched off. Instead, a control system prevents it from leaving the standstill position – even if it is affected by external forces. Typical applications for SS2 include machine tools, for example.

Customer benefits

The SS2 function ensures a rapid axis stop. Because the control remains active, after the safety function is deselected, productive operation can continue without referencing. This ensures short setup and standstill times and high productivity.

Safe Operating Stop (SOS)

With the SOS function, the stopped motor is kept in position and monitored by drive control.

Effect

The SOS function constitutes safe standstill monitoring. The drive control remains in operation. The motor can therefore deliver the full torque to hold the current position. The actual position is reliably monitored. In contrast to safety functions SS1 and SS2, the speed setpoint is not influenced autonomously. After SOS has been activated, the higher-level control must bring the drive to a standstill within a parameterized time and then hold the position setpoint.

Application

SOS is an ideal solution for all those applications for which the machine or parts of the machine must be at a safe standstill for certain steps, but the drive must also supply a holding torque. It is ensured that despite counter torque the drive remains in its current position. In contrast to SS1 and SS2, the drive does not brake autonomously in this case. It expects the higher-level controller to ramp down the relevant axes as a coordinated group within an adjustable delay time. This can be used to prevent any damage to the machine or product. Typical applications for SOS include winders, converting and packaging machines and machine tools.

Customer benefits

No mechanical components are necessary to keep the axis in position despite any counterforce that may occur. Due to the short switching times and the fact that the drive control always remains active, setup and downtimes are reduced. Recalibration of the axis after exiting the SOS function is not necessary. The axis can immediately be moved again after deactivation of the SOS function.

Safe Brake Control (SBC)

The SBC function permits the safe control of a holding brake. SBC is always activated in parallel with STO.

Effect

A holding brake which is active in a de-energized state is controlled and monitored using safe two-channel technology. Due to the two-channel control, the brake may still be activated in the event of an insulation fault in the control cable. Errors of this kind are detected early by means of test pulses.

Note

Safe Brake Control does not detect mechanical faults in the brake itself, such as worn brake linings. For Motor Modules in booksize format, the terminals for the motor brake are integrated. An additional Safe Brake Relay is required for Power Modules in blocksize format. An additional Safe Brake Adapter is necessary for Power Modules in chassis format.

Application

The SBC function is used in conjunction with the functions STO or SS1 to prevent the movement of an axis in the torque-free state, e.g. because of gravity.

Customer benfits

Again, the function saves the use of external hardware and the associated wiring.

Safe Brake Test (SBT)

The SBT diagnostic function carries out a brake function test at regular intervals or before personnel enter the danger zone.

Effect

A good way to check the proper functioning of brakes that have become worn is to apply a torque to the closed brake. Drive systems that have two brakes, e.g. motor brake and external brake, can be tested with different torque values.

Application

The SBT diagnostic function is suitable for implementing a safe brake in combination with the SBC function.

Customer benefits

The function detects faults or wear in the mechanical components of the brake. Automatically testing the effectiveness of brakes reduces maintenance costs and increases the safety and availability of the machine or plant.

Note:

The SBT function is not available for SINAMICS S110.

Safely-Limited Speed (SLS)

The SLS function monitors the drive to ensure that it does not exceed a preset speed or velocity limit.

Effect

The SLS function monitors the drive against a parameterized speed limit. Four different limit values can be selected. As in the case of SOS, the speed setpoint is not influenced independently. After SLS has been selected, the higher-level control must bring the drive down below the selected speed limit within a parameterizable time. If the speed limit is exceeded, a customizable drive-integrated fault reaction occurs.

A factor can be applied to SLS limit 1 that is transferred over PROFIsafe in 16-bit resolution. This allows an almost unlimited number of limits to be specified.
Note: This function is not available for SINAMICS S110.

Application

The SLS function is used if people are in the danger zone of a machine and their safety can only be guaranteed by reduced speed. Typical application cases include those in which an operator must enter the danger zone of the machine for the purposes of maintenance or setting up, such as a winder in which the material is manually threaded by the operator. To prevent injury to the operator, the roller may only spin at a safe reduced speed. SLS is often also used as part of a two-stage safety concept. While a person is in a less critical zone, the SLS function is activated, and the drives are only stopped in a smaller area with higher potential risk. SLS can be used not only for operator protection, but also for machinery protection, e.g. if a maximum speed must not be exceeded.

Customer benefits

The SLS function can contribute to a significant reduction in downtime, or greatly simplify or even accelerate setup. The overall effect achieved is a higher availability of the machine. Moreover, external components such as speed monitors can be omitted.

Safe Speed Monitor (SSM)

The SSM function warns when a drive is working below an adjustable speed limit. As long as it remains below the threshold, the function issues a safety-related signal.

Effect

If a speed value drops below a parameterized limit, a safety-related signal is generated. This can, for example, be processed in a safety controller to respond to the event by programming, depending on the situation.

Application

With the SSM function, in the simplest case, a safety door can be unlocked if the speed drops below a non-critical level. Another typical example is that of a centrifuge that may be filled only when it is operating below a configured speed limit.

Customer benefits

Unlike SLS, there is no drive-integrated fault reaction when the speed limit is exceeded. The safe feedback can be evaluated in a safety controller, allowing the user to respond appropriately to the situation.

Safe Direction (SDI)

The SDI function ensures that the drive can only move in the selected direction.

Effect

A deviation from the direction of motion currently being monitored is detected reliably and the configured drive-integrated fault reaction is initiated. It is possible to select which direction of rotation is to be monitored.

Application

The SDI function is used when the drive may only move in one direction. A typical application is to make a danger area accessible to the operator, provided the machine is moving in the safe direction, i.e. away from the operator. In this status, the operator can safely feed material into or remove it from the working area.

Customer benefits

The function saves the use of external components such as speed monitors and the associated wiring. The release of a danger zone while the machine is moving away from the operator increases productivity. Without the SDI function, the machine would have to be stopped safely while material is fed in or removed.

Safely-Limited Position (SLP)

The SLP function monitors the axis to ensure that it remains within the permissible traversing range.

Effect

When SLP is activated, the traversing range limited by the configured software limit switches is safely monitored. If the permitted traversing range is exited, a configurable fault reaction occurs. It is possible to toggle between two traversing ranges, even when the machine is in operation.

Application

SLP is used for applications in which machine operators have to enter a protection area, e.g. for feeding in and removing material. Safe monitoring of the axis position ensures that the axis cannot move into the protection area released for operators and so place them in danger, for example, on storage and retrieval machines, gantry cranes or machining centers.

Customer benefits

SLP can be used for highly-effective protection area monitoring. The function does away with the use of external components such as hardware limit switches and the associated wiring expense. Due to the short reaction time following a limit overshoot, safety clearances can be reduced.

Note:

The SLP function is not available for SINAMICS S110.

Safe Position (SP)

The SP function transfers the actual position values determined safely in the drive over safe PROFIsafe communication to a safety control.

Effect

In contrast to the SLP function that monitors the current actual position value against a limit and, in the case of an overshoot, activates a drive-integrated fault reaction, SP transfers the current actual position values to the safety control. Position monitoring is implemented in the safety program of the control. Extended PROFIsafe telegrams are available for transferring the position values. The position values can be transferred in 16-bit or 32-bit resolution, as required. A time stamp is also transferred with the position values.

Application

Tailor-made safety concepts can be created using the SP function. It is ideal for use on machines that require flexible safety functions. It is extremely versatile and can be used, for example, to implement safe, axis-specific range detection by means of safe cams. The SP function can also be used to implement multiaxis safety concepts, multi-dimensional protection areas and zone concepts.

Customer benefits

Position monitoring or speed monitoring is implemented in the safety program of the control, so the user has the flexibility for implementing tailor-made safety functions. The reaction to a limit overshoot must also be specified in the safety program. This means a higher initial programming outlay, but it does offer the opportunity for initiating different fault reactions.

Note:

The SP function is not available for SINAMICS S110.

Basic Functions and Extended Functions

The Safety Integrated functions for SIMOTION D and SINAMICS S110/S120 are grouped into Basic Functions and Extended Functions.
The Basic Functions are included in the standard scope ofsupply.
The Extended Functions must be activated by a license.

• Basic Functions
  • Safe Torque Off (STO)
  • Safe Brake Control (SBC)
  • Safe Stop 1 (SS1)
• Extended Functions
  • Safe Stop 1 (SS1) with SBR or SAM
  • Safe Stop 2 (SS2)with SBR or SAM
  • Safe Operating Stop (SOS)
  • Safely Limited Speed (SLS)
  • Safe Speed Monitor (SSM)
  • Safe Direction (SDI)
  • Safely Limited Position (SLP)
  • Safe Position (SP)
  • Safe Brake Test (SBT) diagnostic function

With the Extended Functions SS1 and SS2 with SAM, Safe Acceleration Monitoring (SAM) is performed during braking to ensure that a fault is detected already during the braking phase.

With SS1 and SS2, a Safe Brake Ramp (SBR) can be configured as an alternative.

The Basic Functions – activated via on-board terminals on the device, TM54F Terminal Module or via PROFIsafe – do not require an encoder.

Activation of the integrated safety functions

The integrated safety functions can be activated as follows:

Basic Functions:

• Over terminals on the SIMOTION D4x5-2 or CU320-2 Control Unit and on the power unit
• Over the safety-related digital inputs of the SIMOTION D410-2 or CU310-2/CU305 Control Unit
• Over the safety-related digital inputs of the TM54F Terminal Module
  (Note: the TM54F cannot be used on the CU305),
• Over PROFINET or PROFIBUS with PROFIsafe profile

Extended Functions:

• Over the safety-related digital inputs of the TM54F Terminal Module
  (Note: the TM54F cannot be used on the CU305),
• Over the safety-related digital inputs of the SIMOTION D410-2 or CU310-2/CU305 Control Unit
• Over PROFINET or PROFIBUS with PROFIsafe profile
• The SLS and SDI functions can also be parameterized to be permanently activated.
• The SBT diagnostic function cannot be activated via safety-related digital inputs or PROFIsafe, but it can be optionally activated via the
  • Safety Control Channel from the SIMOTION user program
  • BiCo signals
  • for test stop selection

PROFIsafe

SINAMICS drives support the PROFIsafe profile based on PROFINET as well as on PROFIBUS.

PROFIsafe is an open communications standard that supports standard and safety-related communication over the same communication cable (wired or wireless). A second, separate bus system is therefore not necessary. The telegrams that are sent are continually monitored to ensure safety-relevant communication.

Possible errors such as telegrams that have been lost, repeated or received in the incorrect sequence are avoided. This is done by consecutively numbering the telegrams in a safety-related fashion, monitoring their reception within a defined time and transferring an ID for transmitter and receiver of a telegram. A CRC (cyclic redundancy check) data security mechanism is also used.

SIMOTION I-Device F-Proxy

A typical PROFIsafe communication topology between a SIMATIC safety control and the integrated drives assigned to a SIMOTION D is shown in the diagram below based on the example of PROFINET. This topology is also possible with PROFIBUS as the basis (PROFIBUS not possible with configuration via SCOUT TIA).

In this case, the safety control must be configured as a PROFINET controller or a PROFIBUS master respectively .SIMOTION D is an I-Device or I-Slave here. SIMOTION D transfers the PROFIsafe telegrams to the drives via the F-Proxy mechanism.

Safety Integrated solution based on the example of SIMOTION D4x5-2: Control of the safety functions via PROFINET with PROFIsafe

This topology is also possible if the drives that are assigned to a SIMOTION D/C/P are connected via a CU3x0-2 Control Unit.

Safe speed/position sensing

Incremental encoders or absolute encoders can be used for safe sensing of the position values on a drive.

Safe actual value sensing relies on the redundant evaluation of the incremental channels A/B that supply sin/cos signals with 1 V_pp. Only encoders of the type whose A/B track signals are created and processed using purely analog techniques can be used.

HTL/TTL incremental encoders may also be used. In this case, safe actual value sensing is achieved by using two independent encoders. The minimum possible speed resolution must also be taken into account..

The encoder signals are read via Sensor Modules.

For information on the Sensor Modules, see the Industry Mall under Drive Technology/Converters/AC Low-voltage converters/High performance converters SINAMICS S/SINAMICS S120 built-in units/Supplementary system components/Encoder system connection or the Catalog D 21.4 SINAMICS S120 and SIMOTICS – Motion Control Drives.

As an alternative, motors with an integrated DRIVE-CLiQ interface can be used. The speed or position actual values are generated directly in the motor as safe values and are made available to the Control Unit over safe communication via DRIVE-CLiQ.

Certified built-on rotary encoders with DRIVE-CLiQ interface may also be used (see https://support.industry.siemens.com/cs/document/65402168).

The encoder must be mechanically attached in such a manner that the encoder shaft is unable to unplug or slide off. For notes on this, see IEC 61800-5-2: 2007, Table D.16.

A list of Siemens motors that fulfill the electrical and mechanical requirements is available at:
https://support.industry.siemens.com/cs/document/33512621

The following can be used for safe speed/position sensing:·

• Single-encoder systems or·
• Dual-encoder systems

Single-encoder system

Example: Single-encoder system

In a single-encoder system, the motor encoder is used exclusively for safe actual value sensing.

Dual-encoder system

Example: Dual-encoder system on a spindle

In the case of the dual-encoder system, the safe actual values for a drive are provided by two separate encoders. The actual values are transferred to the Control Unit over DRIVE-CLiQ. When motors without a DRIVE-CLiQ connection are used, a Sensor Module must be provided

HTL/TTL incremental encoders can be used as an alternative with a dual-encoder system. Either two HTL/TTL encoders, one dual-HTL/TTL encoder or one HTL/TTL encoder and one sin/cos encoder can be used.

Safe actual value sensing without encoder

The Extended Functions Safe Stop 1 (SS1) with SAM/SBR, Safely Limited Speed (SLS), Safe Speed Monitor (SSM) and Safe Direction (SDI) are also available for use without encoders (only in combination with asynchronous (induction) motors and SIEMOSYN motors).

An encoder that is used for the purposes of motor control has no significance for the safety function here.

Note:

The Safety Integrated Extended Functions "without encoder" must not be used if the motor can be accelerated by the load, e.g. if a vertical axis is under a load due to gravity.

The Safety Integrated Function Manual contains additional information about the encoderless safety functions.

http://support.automation.siemens.com/WW/view/en/27103700/133300

The safety functions are listed below with criteria for actual value sensing:

¹⁾ The use of this safety function without encoder is permitted for asynchronous (induction) motors or synchronous motors of the SIEMOSYN series..

²⁾ Only for the transmission of relative position values. An encoder is required to transmit absolute position values..

Licensing

The Safety Integrated Basic Functions do not require a license.

In the case of Safety Integrated Extended Functions, however, a license is required for each axis equipped with safety functions. It is of no consequence here which safety functions are used and how many.

The required licenses can be optionally ordered with the CompactFlash card.
For article numbers of the CompactFlash cards, see chapter SIMOTION D – Drive-based or the Catalog D 21.4 SINAMICS S120 and SIMOTICS – Motion Control Drives.