Siemens SINAMICS S120 Function Manual

SINAMICS Safety Integrated 1 System features 2 Basic Functions 3 Extended Functions 4 Control of the safety functions 5 Commissioning 6 Application examples 7 Acceptance test and acceptance report 8 Appendix A A SINAMICS S120 Safety Integrated Function Manual (FHS), 07/2007 6SL3097-2AR00-0BP0 Applies for: Firmware Version FW2.5 SP1

damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are graded according to the degree of danger. DANGER indicates that death or severe personal injury will result if proper precautions are not taken. WARNING indicates that death or severe personal injury may result if proper precautions are not taken. CAUTION with a safety alert symbol, indicates that minor personal injury can result if proper precautions are not taken. CAUTION without a safety alert symbol, indicates that property damage can result if proper precautions are not taken. NOTICE indicates that an unintended result or situation can occur if the corresponding information is not taken into account. If more than one degree of danger is present, the warning notice representing the highest degree of danger will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property damage. Qualified Personnel The device/system may only be set up and used in conjunction with this documentation. Commissioning and operation of a device/system may only be performed by qualified personnel. Within the context of the safety notes in this documentation qualified persons are defined as persons who are authorized to commission, ground and label devices, systems and circuits in accordance with established safety practices and standards. Prescribed Usage Note the following: WARNING This device may only be used for the applications described in the catalog or the technical description and only in connection with devices or components from other manufacturers which have been approved or recommended by Siemens. Correct, reliable operation of the product requires proper transport, storage, positioning and assembly as well as careful operation and maintenance. Trademarks All names identified by ® are registered trademarks of the Siemens AG. The remaining trademarks in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owner. Disclaimer of Liability We have reviewed the contents of this publication to ensure consistency with the hardware and software described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this publication is reviewed regularly and any necessary corrections are included in subsequent editions. Siemens AG Automation and Drives Postfach 48 48 90327 NÜRNBERG GERMANY Order number: 6SL3097-2AR00-0BP0 Ⓟ 08/2007 Copyright © Siemens AG . Technical data subject to change

5 Preface SINAMICS documentation The SINAMICS documentation is organized in 2 parts: ● General documentation / catalogs ● Manufacturer/service documentation A current overview of the documentation in the available languages is provided in the Internet: http://www.siemens.com/motioncontrol Select the menu items "Support" --> "Technical Documentation" --> "Overview of Publications." The Internet version of DOConCD (DOConWEB) is available on the Internet: http://www.automation.siemens.com/doconweb Information on the range of training courses and FAQs (Frequently Asked Questions) is available on the Internet: http://www.siemens.com/motioncontrol Follow the menu item "Support". Usage phases and their tools/documents (as an example) Table 1 Usage phases and the available documents/tools Usage phase Document/tool Orientation SINAMICS S Sales Documentation Planning/configuration • SIZER configuration tool • Configuration Manuals, Motors Decision/ordering SINAMICS S Catalogs Installation/assembly • SINAMICS S120 Equipment Manual for Control Units and Additional System Components • SINAMICS S120 Equipment Manual for Booksize Power Units • SINAMICS S120 Equipment Manual for Chassis Power Units • SINAMICS S120 Equipment Manual for AC Drives

Usage phase Document/tool Commissioning • STARTER parameterization and commissioning tool • SINAMICS S120 Getting Started • SINAMICS S120 Commissioning Manual • SINAMICS S120 CANopen Commissioning Manual • SINAMICS S120 Function Manual • SINAMICS S List Manual Usage/operation • SINAMICS S120 Commissioning Manual • SINAMICS S List Manual Maintenance/servicing • SINAMICS S120 Commissioning Manual • SINAMICS S List Manual References • SINAMICS S List Manual Target group This documentation is intended for machine manufacturers, commissioning engineers, and service personnel who use the SINAMICS S drive system. Benefits The Safety Integrated Function Manual covers all information, procedures and operations required for commissioning safety functions and servicing of SINAMICS S120. Search guides The following guides are provided to help you locate information in this manual: 1. Contents 2. List of abbreviations 3. Index Standard scope The scope of the functionality described in this document can differ from the scope of the functionality of the drive system that is actually supplied. ● Other functions not described in this documentation might be able to be executed in the drive system. However, no claim can be made regarding the availability of these functions when the equipment is first supplied or in the event of servicing. ● Functions can be described in the documentation that are not available in a particular product version of the drive system. The functionality of the supplied drive system should only be taken from the ordering documentation. ● Extensions or changes made by the machine manufacturer must be documented by the machine manufacturer. For reasons of clarity, this documentation does not contain all of the detailed information on all of the product types. This documentation cannot take into consideration every conceivable type of installation, operation and service/maintenance.

7 Preface FHS_Technical Support Technical Support In case of questions, please contact us through the following hotline: European and African time zones A&D Technical Support Tel.: +49 (0) 180 5050 - 222 Fax: +49 (0) 180 5050 - 223 Internet: http://www.siemens.de/automation/support-request America time zone A&D Technical Support Tel: +1 423 262 2522 Fax: +1 423 262 2289 Internet: http://www.siemens.de/automation/support-request Email: [email protected] Asia and Pacific time zones A&D Technical Support Tel: +89 1064 719 990 Fax: +86 1064 747 474 Internet: http://www.siemens.de/automation/support-request Email: [email protected] Note Country-specific telephone numbers for technical support are provided under the following Internet address: http://www.siemens.com/automation/service&support Questions on the manual Please send any questions about the technical documentation (e.g. suggestions for improvement, corrections) to the following fax number or E-Mail address: Fax: +49 (0) 9131 / 98 - 63315 Email: [email protected] Fax form: Refer to the reply form at the end of this manual Internet address for SINAMICS http://www.siemens.com/sinamics

Preface FHS_EC Declaration of Conformity EC Declaration of Conformity The EC Declaration of Conformity for the EMC Directive can be obtained from: ● Internet http://www.ad.siemens.de/csinfo Product/Order no: 15257461 ● Branch offices For the responsible regional offices of the A&D MC business division of Siemens AG. Notation The following notation and abbreviations are used in this documentation: Notation for parameters (examples): ● p0918 Adjustable parameter 918 ● r1024 Display parameter 1024 ● p1070[1] Adjustable parameter 1070, index 1 ● p2098[1].3 Adjustable parameter 2098, index 1, bit 3 ● p0099[0...3] Adjustable parameter 99 indices 0 to 3 ● r0945[2](3) Display parameter 945 index 2 of drive object 3 ● p0795.4 Adjustable parameter 795 bit 4 Notation for faults and alarms (examples): ● F12345 Fault 12345 ● A67890 Alarm 67890

9 ESD Notes CAUTION Electrostatic sensitive devices (ESD) are single components, integrated circuits or devices that can be damaged by electrostatic fields or electrostatic discharges. Regulations for the ESD handling: During the handling of electronic components, pay attention to the grounding of the person, workplace and packaging! Electronic components may be touched by persons only when • these persons are grounded using an ESD bracelet, or • these persons in ESD areas with a conducting floor wear ESD shoes or ESD grounding straps. Electronic components should be touched only when this is unavoidable. The touching is permitted only on the front panel or on the circuit board edge. Electronic components must not be brought into contact with plastics or clothing made of artificial fibers. Electronic components may only be placed on conducting surfaces (table with ESD coating, conducting ESD foamed material, ESD packing bag, ESD transport container). Electronic components may not be placed near display units, monitors or televisions (minimum distance from the screen > 10 cm). Measurements may be made on electronic components when the measuring unit is grounded (e.g. with a protective conductor) or prior to measuring with a potential-free measuring unit, the measuring head is briefly discharged (e.g. by touching a bare metal housing).

Safety instructions DANGER • Commissioning must not start until you have ensured that the machine in which the components described here are to be installed complies with Directive 98/37/EC. • SINAMICS devices and AC motors must only be commissioned by suitably qualified personnel. • The personnel must take into account the information provided in the technical customer documentation for the product, and be familiar with and follow the specified danger and warning notices. • When electrical equipment and motors are operated, the electrical circuits automatically conduct a dangerous voltage. • When the machine or system is operated, hazardous axis movements can occur. • All of the work carried-out on the electrical machine or system must be carried-out with it in a no-voltage condition. • SINAMICS devices with AC motors must only be connected to the power supply via an AC-DC residual-current-operated device with selective switching once verification has been provided that the SINAMICS device is compatible with the residual-current- operated device in accordance with EN 50178, Chapter 5.2.11.2. WARNING • The successful and safe operation of this equipment and motors is dependent on correct transport, proper storage, installation and mounting as well as careful operator control, service and maintenance. • For special versions of the drive units and motors, information and data in the Catalogs and quotations additionally apply. • In addition to the danger and warning information provided in the technical customer documentation, the applicable national, local, and plant-specific regulations and requirements must be taken into account. • Only protective extra-low voltages (PELV) that comply with EN60204-1 may be connected to all connections and terminals between 0 and 48 V. CAUTION • The motors can have surface temperatures of over +80 °C. • This is the reason that temperature-sensitive components, e.g. cables or electronic components may neither be in contact nor be attached to the motor. • When attaching the connecting cables, you must ensure that: – they are not damaged – they are not under tension – they cannot come into contact with any rotating parts

11 CAUTION • As part of routine tests, SINAMICS devices with AC motors undergo a voltage test in accordance with EN 50178. Before the voltage test is performed on the electrical equipment of industrial machines to EN 60204-1, Section 19.4, all connectors of SINAMICS equipment must be disconnected/unplugged to prevent the equipment from being damaged. • Motors should be connected-up according to the circuit diagram provided. otherwise they can be destroyed. Note When operated in dry operating areas, SINAMICS equipment with AC motors conforms to Low-Voltage Directive 73/23/EEC.

13 Table of contents Preface ...................................................................................................................................................... 5 1 General information about SINAMICS Safety Integrated ......................................................................... 15 1.1 Introduction ..................................................................................................................................15 1.2 Supported functions.....................................................................................................................16 1.3 Parameter, Checksum, Version, Password.................................................................................18 1.4 DRIVE-CLiQ rules for Safety Integrated Functions .....................................................................21 2 System features....................................................................................................................................... 23 2.1 Certification ..................................................................................................................................23 2.2 Probability of failure of the safety functions (PFH value).............................................................23 2.3 Safety instructions........................................................................................................................24 2.4 Residual risk.................................................................................................................................25 2.5 Response times ...........................................................................................................................28 3 Basic Functions ....................................................................................................................................... 29 3.1 Safe Torque Off (STO).................................................................................................................29 3.2 Safe Stop 1 (SS1, time controlled) ..............................................................................................32 3.3 Safe Brake Control (SBC)............................................................................................................33 3.4 Forced dormant error detection ...................................................................................................36 4 Extended Functions................................................................................................................................. 39 4.1 Safe Stop 1 (SS1, time and acceleration controlled)...................................................................39 4.2 Safe Stop 2 (SS2) ........................................................................................................................41 4.3 Safe Operational Stop (SOS).......................................................................................................42 4.4 Safely Limited Speed (SLS).........................................................................................................43 4.5 Safe Speed Monitor (SSM)..........................................................................................................46 4.6 Safe Acceleration Monitor (SBR).................................................................................................46 4.7 Response to fault/limit value violation..........................................................................................48 4.8 Safe actual value acquisition .......................................................................................................50 4.9 Forced dormant error detection ...................................................................................................53 5 Control of the safety functions ................................................................................................................. 57 5.1 Overview of F-DI/F-DOs and of their structure ............................................................................57 5.2 Control via terminals on the Control Unit and the power unit ......................................................58 5.3 Control by way of TM54F terminals .............................................................................................61 5.3.1 General information .....................................................................................................................61 5.3.2 Overview of the F-DIs ..................................................................................................................62 5.3.3 Overview of the F-DOs ................................................................................................................64

Safety Integrated 14 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 5.4 Configuring PROFIsafe............................................................................................................... 66 5.4.1 PROFIsafe user data .................................................................................................................. 66 6 Commissioning ........................................................................................................................................ 69 6.1 General commissioning information............................................................................................ 69 6.1.1 Introduction ................................................................................................................................. 69 6.1.2 Setting the sampling times.......................................................................................................... 69 6.2 Commissioning TM54F by means of STARTER/SCOUT........................................................... 70 6.2.1 Basic sequence of commissioning.............................................................................................. 70 6.2.2 Configuration start screen........................................................................................................... 71 6.2.3 TM54F configuration ................................................................................................................... 73 6.2.4 F-DI/F-DO configuration.............................................................................................................. 74 6.2.5 Control interface.......................................................................................................................... 76 6.3 PROFIsafe network transition with SIMOTION D ....................................................................... 77 6.4 Commissioning PROFIsafe by means of STARTER/HW Config................................................ 86 6.4.1 Procedure for configuring PROFIsafe communication ............................................................... 86 6.5 Commissioning a linear/rotary axis............................................................................................. 89 6.6 Information pertaining to component replacements.................................................................... 91 6.7 Information pertaining to series commissioning.......................................................................... 92 7 Application examples............................................................................................................................... 93 7.1 Safe Stop 1 (SS1, time-controlled) when protective door is locked, emergency stop switch-off ..................................................................................................................................... 93 8 Acceptance test and acceptance report................................................................................................... 97 8.1 General information..................................................................................................................... 97 8.2 Acceptance test procedure ....................................................................................................... 101 8.3 Acceptance report..................................................................................................................... 101 8.3.1 Plant description - Documentation part 1.................................................................................. 101 8.3.2 Description of safety functions - Documentation Part 2............................................................ 103 8.3.2.1 Introduction ............................................................................................................................... 103 8.3.2.2 Function table............................................................................................................................ 103 8.3.2.3 SI functions for each drive......................................................................................................... 103 8.3.2.4 Control of the SI functions by way of TM54F............................................................................ 104 8.3.2.5 Control of SI functions by way of PROFIsafe............................................................................ 104 8.3.2.6 Safety equipment ...................................................................................................................... 105 8.4 Acceptance tests....................................................................................................................... 105 8.4.1 Acceptance test for Safe Torque Off (STO).............................................................................. 105 8.4.2 Acceptance test for Safe Stop 1, time controlled (SS1)............................................................ 106 8.4.3 Acceptance test for "Safe Brake Control" (SBC) ...................................................................... 108 8.4.4 Acceptance test for Safe Stop 1, time and acceleration controlled .......................................... 109 8.4.5 Acceptance test for Safe Stop 2 (SS2) ..................................................................................... 111 8.4.6 Acceptance test for Safe Operational Stop (SOS).................................................................... 112 8.4.7 Acceptance test for Safely Limited Speed (SLS)...................................................................... 113 8.4.8 Acceptance test for Safe Speed Monitoring (SSM) .................................................................. 115 A Appendix A ............................................................................................................................................ 117 A.1 List of abbreviations .................................................................................................................. 117 Index...................................................................................................................................................... 129

15 General information about SINAMICS Safety Integrated 1 1.1 Introduction Safety Integrated The "Safety Integrated" functions enable the implementation of highly effective application- oriented functions for man and machine protection. This innovate safety technology offers the following benefits: ● Increased safety ● Increased profitability ● Greater flexibility ● Higher level of plant availability Standards and Directives The various standards and directives governing safety technology must be observed. Directives are considered binding to machine manufacturers and operators. Standards generally reflect the state-of-the-art and act as a basis for implementing safety concepts. Unlike directives, however, they are not binding. The list below provides a selection of standards and directives in the field of safety technology. ● EC Machinery Directive 98/37/EC This directive defines basic protection objectives in the field of safety technology. ● EN 292-1 Basic terminology and general principles of presentation ● EN 954-1/ISO 13 849-1 Safety-related parts of control systems ● EN 1050 Risk assessment ● IEC 60204-1 Safety of machinery - Electrical equipment of machines - Part 1: Electrical equipment of machinery - General requirements

1.2 Supported functions Safety Integrated 16 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 ● IEC 61508 Functional safety of electrical/electronic/programmable electronic safety-related systems This standard defines safety integrity levels (SIL) which not only describe a certain degree of integrity with regard to failsafe software but also defined, quantitative error probability ranges with regard to the hardware. ● IEC 61800-5-2 Adjustable-speed electrical power drive systems Part 5-2: Safety requirements - Functional Note In conjunction with certified components, the safety functions of the SINAMICS S120 drive system fulfill the following requirements: • Category 3 to EN 954-1. • Safety integrity level 2 (SIL 2) to IEC 61508. A list of certified components is available on request from your local Siemens office. 1.2 Supported functions Supported functions: The functions mentioned here are in compliance with IEC 61800-5-2. The following Safety Integrated (SI) functions are available: ● Safety Integrated basic functions These functions are part of the standard scope of the drive. – Safe torque off (STO) STO is a safety function that prevents the drive from restarting unexpectedly, in accordance with EN 60204-1, Section 5.4. Note When a drive object that has Safety Integrated functions released is switched to "Parking" mode, the Safety Integrated software responds by activating STOP without generating a separate message. – Safe Stop 1 (SS1, time controlled) Safe Stop 1 is based on the "Safe Torque Off" function. This means that a Category 1 stop in accordance with EN 60204-1 can be implemented. – Safe Brake Control (SBC) The SBC function permits the safe control of a holding brake.

1.2 Supported functions Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 17 SBC is not supported by chassis components. Power Modules Blocksize also require a Safe Brake Relay for this function. ● Safety Integrated extended functions – Safe Stop 1 (SS1, time and acceleration controlled) The SS1 function is based on the "Safe Torque Off" function. This means that a Category 1 stop in accordance with EN 60204-1 can be implemented. – Safe Stop 2 (SS2) The SS2 function brakes the motor safely with a subsequent transition to "Safe Operational Stop" (SOS). – Safe Operational Stop (SOS) "Safe Operational Stop" (SOS) protects against unintentional movements. The drive is in closed-loop control mode and is not disconnected from the power supply. – Safely Limited Speed (SLS) The "Safely Limited Speed" (SLS) protects against excessively high drive speeds. – Safe Speed Monitor (SSM) The SSM function reliably monitors the speed limit and issues a safe output signal, but without a response function. Prerequisites for the extended functions ● An appropriate license ● Activation via PROFIsafe or TM54F NOTICE Per single Control Unit, either control via PROFIsafe or TM54F is permitted. Mixed operation is not permitted. ● SINAMICS S120: FW version from 2.5 SP1 ● SIMOTION D4x5: FW version from V4.1.1 (SINAMICS S120 with FW version from V2.5 SP1 integrated) ● Safe actual value acquisition (see chapter "Safe actual value acquisition") ● An activated speed controller in the drive ● Overview of hardware components that support the Extended Functions: – Control Unit CU310 from order no.: 6SL3040-0LA00-0AA1/6SL3040-0LA01-0AA1 – Control Unit CU320 from order no.: 6SL3040-...-0AA1 and version C – SIMOTION CPU: D4x5 V4.1.1 (SINAMICS S120 with FW V2.5 SP1 integrated) D425 from 6AU1 425-0AA00-0AA0 HW release D D435 from 6AU1 435-0AA00-0AA1 HW release D D445 from 6AU1 445-0AA00-0AA0 HW release B – Motor Modules booksize from order no.: ...A3 or higher – Power Modules Blocksize – Control Unit Adapter 31 from order no.: 6SL3040-0PA00-0AA1

1.3 Parameter, Checksum, Version, Password Safety Integrated 18 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 1.3 Parameter, Checksum, Version, Password Properties of Safety Integrated parameters The following applies to Safety Integrated parameters: ● They are kept separate for each monitoring channel. ● During startup, a checksum (Cyclic Redundancy Check, CRC) over the safety parameters is generated and checked. The display parameters are not contained in the CRC. ● Data storage: The parameters are stored on the non-volatile CompactFlash card. ● Factory settings for safety parameters A reset of the safety parameters to the factory setting on a drive-specific basis using p0970 or p3900 and p0010 = 30 is only possible when the safety functions are not enabled (p9301 = p9501 = p9601 = p9801 = p10010 = 0). A complete reset of all parameters to the factory settings (p0976 = 1 and p0009 = 30 on the Control Unit) is possible even when the safety functions are enabled (p9301 = p9501 = p9601 = p9801 = p10010 ≠ 0). ● They are password-protected against accidental or unauthorized changes. NOTICE The following safety parameters are not protected by the safety password: • p9370 SI Motion acceptance test mode (Motor Module) • p9570 SI Motion acceptance test mode (Control Unit) • p9510 SI Motion isochronous PROFIBUS Master • p9533 SI Motion SLS Setpoint speed limitation • p9705 BI: SI Motion Test stop signal source Checking the checksum For each monitoring channel, the safety parameters include one parameter for the actual checksum for the safety parameters that have undergone a checksum check. During commissioning, the actual checksum must be transferred to the corresponding parameter for the specified checksum. This can be done for all checksums of a drive object at the same time with parameter p9701. Basic functions ● r9798 SI actual checksum SI parameters (Control Unit) ● p9799 SI reference checksum SI parameters (Control Unit) ● r9898 SI actual checksum SI parameters (Motor Module) ● p9899 SI reference checksum SI parameters (Motor Module) Extended Functions ● r9398[0...1] SI Motion actual checksum SI parameters (Motor Module) ● r9399[0...1] SI Motion specified checksum SI parameters (Motor Module)

1.3 Parameter, Checksum, Version, Password Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 19 ● r9728[0...1] SI Motion actual checksum SI parameters ● r9729[0...1] SI Motion specified checksum SI parameters During each ramp-up procedure, the actual checksum is calculated via the safety parameters and then compared with the specified checksum. If the actual and specified checksums are different, fault F01650/F30650 or F01680/F30680 is output and an acceptance test requested. Safety Integrated versions The safety software has a separate version ID for the Control Unit and Motor Module. For the basic functions ● r9770 SI version, drive-autonomous safety functions (Control Unit) ● r9870 SI version (Motor Module) For the extended functions ● r9590 SI Motion Version secure movement monitoring (Control Unit) ● r9390 SI Motion Version secure movement monitoring (Motor Module) ● r9890 SI version (Sensor Module) ● r10090 SI Version TM54F WARNING From FW2.5 the following applies: The upgrade/downgrade of DRIVE-CLiQ components is carried out automatically by the system if there is a difference between the firmware version on the components and the components firmware version on the CF card. This automatic upgrade/downgrade must not be disabled when Safety Integrated is used. Password The safety password protects the safety parameters against unauthorized write access. In commissioning mode for Safety Integrated (p0010 = 95), you cannot change safety parameters until you have entered the valid safety password in p9761 for the drives or p10061 for the TM54F. ● When Safety Integrated is commissioned for the first time, the following applies: – Safety password = 0 – Default setting for p9761 = 0 In other words: The safety password does not need to be set during initial commissioning. ● In the case of a series commissioning of Safety or in the case of spare part installation, the following applies: – The safety password is retained on the CF card and in the STARTER project. – No safety password is required in the case of spare part installation.

1.3 Parameter, Checksum, Version, Password Safety Integrated 20 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 ● Change password for the drives – p0010 = 95 Commissioning mode – p9761 = Enter "old safety password". – p9762 = Enter "new password". – p9763 = Confirm "new password". – The new and confirmed safety password is valid immediately. ● Change password for the TM54F – p0010 = 95 Commissioning mode – p10061 = Enter "Old TM54F Safety Password" (factory setting "0") – p10062 = Enter "new password" – p10063 = Acknowledge "new password" – The new and acknowledged safety password is valid immediately. If you need to change safety parameters but you do not know the safety password, proceed as follows: 1. Set the entire drive unit (Control Unit with all connected drives/components) to the factory setting. 2. Recommission the drive unit and drives. 3. Recommission Safety Integrated. Parameter overview for password (see SINAMICS S List Manual) ● p9761 SI password input ● p9762 SI password new ● p9763 SI password acknowledgement ● p10061 SI password input TM54F ● p10062 SI password new TM54F ● p10063 SI password acknowledgement TM54F

1.4 DRIVE-CLiQ rules for Safety Integrated Functions Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 21 1.4 DRIVE-CLiQ rules for Safety Integrated Functions Note The Safety Integrated Functions (Basic and Extended Functions) are generally governed by the same DRIVE-CLiQ rules as specified in the chapter "Rules for wiring with DRIVE-CLiQ" in References: /FH1/ SINAMICS S120 Function Manual. This specification also lists the exceptions for Safety Integrated components depending on the firmware version. The following rules are also valid particularly for the Safety Extended Functions: ● Maximum of 5 servo axes with Extended Functions for default cycle time settings (monitoring cycle: 12 ms; application cycle: 125 μs). ● Maximum of 2 vector axes with Extended Functions for default cycle time settings (monitoring cycle: 12 ms; application cycle: 250 μs). ● TM54F may not be connected in series with the Motor Modules. ● Maximum of 4 Motor Modules with Extended Functions in series.

23 System features 2 2.1 Certification The safety functions described in this manual were developed in accordance with requirements to IEC 61508, ISO 13849-1 (previously EN 954-1) and IEC 61800-5-2 standards. Certification procedures are in progress at an accredited test institute. The certificate and the list of certified components can be obtained from your local sales office after inspections have been concluded. 2.2 Probability of failure of the safety functions (PFH value) Probability of failures The probability of the failure of safety functions must be specified in the form of a PHF value (Probability of Failure per Hour) in accordance with IEC 61508, IEC 62061 and ISO 13849-1. The PFH value of a safety function depends on the safety concept of the drive unit and its hardware configuration, as well as on the PFH values of other components used for this safety function. Corresponding PFH values are provided for the SINAMICS S120 drive system, depending on the hardware configuration (number of drives, control type, number of encoders used, ...). The various integrated safety functions are not differentiated. The PHF values can be requested from your local sales office.

Safety Integrated 24 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 2.3 Safety instructions WARNING The Safety Integrated functions cannot be activated until the startup is completed. System startup is a critical operating state with increased risk. No personnel may be present in the immediate danger zone in this phase. The drives of vertical axes must be in torque state. A complete forced dormant error detection cycle is required after power on (refer to the chapter "Forced dormant error detection"). CAUTION The "automatic restart" function may not be used in parallel with the safety functions STO/SBC and SS1, as IEC 60204 Part 1 (1998), Chapter 9.2.5.4.2 does not allow this configuration. (Cancelation of a safety shutdown function should not lead to a machine restart) WARNING After hardware and/or software components have been modified or replaced, all protective equipment must be closed prior to system startup and drive activation. Personnel shall not be present within the danger zone. It may be necessary to carry out a partial or complete acceptance test (refer to the chapter "Acceptance test") after having made certain changes or replacements. Before allowing anybody to re-enter the danger zone, you should test steady control response by briefly moving the drives in forward and reverse direction (+/–). To observe during power on: The safety functions are only ready for activation after system startup was successfully completed.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 25 WARNING • Encoder faults within a single-encoder system are detected by means of various HW and SW monitoring functions. It is not allowed to disable these monitoring functions and they must be parameterized carefully. Depending on the fault type and on the responding monitoring function, either the Category 0 or the Category 1 stop function to EN 60204-1 is activated (fault reaction function STOP A or STOP B according to Safety Integrated). • The Category 0 stop function to EN 60204-1 (STO in Safety Integrated) means that the drives are coasted to a stop instead of being braked to zero speed; this may take longer depending on the decay of kinetic energy. This must be included in the logic of the protective door lock, for example, by means of logic operation of SSM ( n

Safety Integrated 26 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 WARNING • Faults in the absolute track (C-D track), cyclic interchange of the drive phases (V-W-U instead of U-V-W) and reversal of the control direction may cause acceleration of the drive. However, the fault prevents activation of the category 1 and 2 stop functions to IEC 60204-1 (fault reaction functions STOP B to E according to Safety Integrated). The category 0 stop function to IEC 60204-1 (fault reaction function STOP A according to Safety Integrated) is not triggered unless the transition or delay time set in the parameter has expired. These faults are detected (fault reaction function STOP B/C) if SBR is active. The Category 0 stop function to IEC 60204-1 (fault reaction functions STOP A according to Safety Integrated) is activated as early as possible irrespective of this delay. Electrical faults (defective components or similar) may also lead to the response stated above. • Simultaneous failure of two power transistors (one in the upper and the other offset in the lower inverter bridge) in the inverter may cause brief movement of the drive, depending on the number of poles of the motor. Maximum value of this movement: Synchronous rotary motors: max. movement = 180° / no. of pole pairs Synchronous linear motors: max. movement = pole width WARNING • Violation of limits may briefly lead to a speed higher than the speed setpoint, or the axis may pass the defined position to a certain extent, depending on the dynamic response of the drive and on parameter settings. • Mechanical forces greater than the maximum drive torque may force a drive currently operated in position control mode out of the Safe Operational Stop state (SOS) and trigger a category 1 stop function to IEC 60204-1 (fault reaction function STOP B).

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 27 WARNING Within a single-encoder system: a) a single electrical fault in the encoder b) a break of the encoder shaft (or loose encoder shaft coupling), or a loose encoder housing will cause a static state of the encoder signals (that is, they no longer follow a movement while still returning a correct level), and prevent fault detection while the drive is in stop state (for example, drive in SOS state). Generally, the drive is held by the active closed-loop control. Under the aspect of closed- loop control it is conceivable that particularly vertical (suspended) drives move downward and that this movement is not detected. The risk of an electrical fault in the encoder as described under a) is only given for few encoder types with specific function principle (for example, encoders with microprocessor controlled signal generation such as the Heidenhain EQI, Hübner HEAG 159/160, or AMO measuring systems with sin/cos signals). The risk analysis of the machine manufacturer must include all of the faults described above. Additional safety measures have to be taken at suspended/vertical drives or for handling dragging loads in order to exclude faults as described in a). For example: • Use of an encoder with analog signal generation • Use of a two-encoder system In order to exclude the fault described in b), for example: • An FMEA regarding encoder shaft breakage (or slip of the encoder shaft coupling), and a solution to prevent loose encoder housings, integration of a fault exclusion process to CDV IEC 61800-5-2, or • Implementation of a two-encoder system (the encoders may not be mounted on the same shaft).

Safety Integrated 28 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 2.5 Response times Control signals by way of terminals on the Control Unit and Motor Module Table 2-1 Response times with control signals by way of terminals on the Control Unit and Motor Module Function Standard Worst case STO 2 x r9780 + p0799 4 x r9780 + p0799 SBC 4 x r9780 + p0799 8 x r9780 + p0799 SS1 (time controlled) Call (until braking is initiated) 2 x r9780 + p0799 + 2 ms 4 x r9780 + p0799 + 2 ms Control by way of PROFIsafe Table 2-2 Response times with control by way of PROFIsafe Function Standard Worst case STO 4 x p9500 + r9780 4 x p9500 + 3 x r9780 SBC 4 x p9500 + 2 x r9780 4 x p9500 + 6 x r9780 SS1 (time and acceleration controlled), SS2 Call Speed limit violated 4 x p9500 + 2 ms 2 x p9500 + 2 ms 5 x p9500 + 2 ms 2.5 x p9500 + r9780 + t_DP1) SOS position tolerance violated 1.5 x p9500 + 2 ms 3 x p9500 + t_DP1) + 2 ms SLS speed limit violated 2) 2 x p9500 + 2 ms 3.5 x p9500 + t_DP1) + 2 ms SSM 4 x p9500 4.5 x p9500 + t_DP1) Control by way of TM54F Table 2-3 Response times with control by way of TM54F Function Standard Worst case STO 2.5 x p9500 + r9780 + 1.5 ms 3 x p9500 + 3 x r9780 + 2 ms SBC 2.5 x p9500 + 2 x r9780 + 1 ms 3 x p9500 + 6 x r9780 + 2 ms SS1 (time and acceleration controlled), SS2 Call Speed limit violated 2.5 x p9500 + 3 ms 2 x p9500 + 2 ms 4 x p9500 + 4 ms 2.5 x p9500 + r9780 + t_DP1) SOS position tolerance violated 1.5 x p9500 + 2 ms 3 x p9500 + t_DP1) + 2 ms SLS speed limit violated 2) 2 x p9500 + 2 ms 3.5 x p9500 + t_DP1) + 2 ms SSM 3 x p9500 3.5 x p9500 + t_DP1) Information on the tables: 1) t_DP = PROFIBUS cycle with isochronous PROFIBUS master, otherwise 1 ms 2) SLS: Specification of the response time required for initiation of a braking reaction in the drive, or for the output of the "SOS selected" message to the motion control system.

29 Basic Functions 3 Note The Basic Functions are also described in the following manual: Reference: /FH1/SINAMICS S120 Function Manual Drive Functions 3.1 Safe Torque Off (STO) General description In conjunction with a machine function or in the event of a fault, the "Safe Torque Off (STO)" function is used to safely disconnect the torque-generating motor power supply. When the function is selected, the drive unit is in a "safe status". The power-on disable function prevents the drive unit from being restarted. The two-channel pulse inhibit integrated in the Motor Modules / Power Modules is a basis for this function. Functional features of "Safe Torque Off" ● This function is integrated in the drive; this means that a higher-level controller is not required. ● The function is drive specific, that is, it must be commissioned individually on a drive-by- drive basis. ● Enable of the function using parameters required ● When the "Safe Torque Off" function is selected: – The motor cannot be started accidentally. – The pulse disable safely disconnects the torque-generating motor power supply. – The power unit and motor are not electrically isolated. WARNING Appropriate measures must be taken to ensure that the motor does not move once the motor power supply has been disconnected ("coast down") (e.g. enable the "Safe Brake Control" function with a vertical axis).

Safety Integrated 30 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 CAUTION If two power transistors in the power unit (one in the upper and one offset in the lower inverter bridge) fail at the same time, this can cause a momentary movement. The maximum movement can be: Synchronous rotary motors: max. movement = 180° / no. of pole pairs Synchronous linear motors: max. movement = pole width ● The status of the "Safe Torque Off" function is displayed using parameters. Enabling the "Safe Torque Off (STO)" function The "Safe Torque Off" function is enabled via the following parameters: NOTICE It is not possible to activate the control via TM54F and PROFIsafe at the same time. ● STO via terminals: – p9601.0 = 1, p9801.0 = 1 ● STO via TM54F (only with "Extended Functions" option): – p9601.2 = 1, p9801.2 = 1 – p9601.3 = 0, p9801.3 = 0 ● STO via PROFIsafe (only with "Extended Functions" option): – p9601.2 = 1, p9801.2 = 1 – p9601.3 = 1, p9801.3 = 1 Selecting/deselecting "Safe Torque Off" The following occurs when "Safe Torque Off" is selected: ● Each monitoring channel triggers safe pulse suppression via its switch-off signal path. ● A motor holding brake is applied (if connected and configured). The following occurs when "Safe Torque Off" is de-selected: ● Each monitoring channel cancels safe pulse suppression via its switch-off signal path. ● The safety prompt "Apply motor holding brake" is canceled. ● Any pending STOP F or STOP A commands are canceled (see r9772/r9872). Note If "Safe Torque Off" is de-selected and selected again through one channel within the time in p9650/p9850, the pulses are canceled but a signal is not output. If you want a message to be displayed in this case, however, you have to reconfigure N01620/N30620 via p2118 and p2119 as an alarm or fault.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 31 Restart after the "Safe Torque Off" function has been selected 1. Deselect the function in each monitoring channel via the input terminals. 2. Issue drive enable signals. 3. Revoke the closing lockout and switch the drive back on. – 1/0 edge at input signal "ON/OFF1" (cancel power-on inhibit) – 0/1 edge at input signal "ON/OFF1" (switch on drive) 4. Run the drives again. Status for "Safe Torque Off" The status of the "Safe Torque Off (STO)" function is displayed using the following parameters: Parameter overview (see List Manual) ● r9772 CO/BO: SI status (Control Unit) ● r9872 CO/BO: SI status (Motor Module) ● r9773 CO/BO: SI status (Control Unit + Motor Module) ● r9774 CO/BO: SI status (Safe Torque Off group) As an alternative, the status of the functions can be displayed using the configurable messages N01620 and N30620 (configured using p2118 and p2119). Response time with the "Safe Torque Off" function The following values can be specified for the response times when the function is selected/deselected via input terminals: ● Typical response time 2 x Safety monitoring cycle CU (r9780) + inputs/outputs sampling time (p0799) ● Max. response time in the event of a fault 4 x Safety monitoring cycle CU (r9780) + inputs/outputs sampling time (p0799) Examples, Booksize: Assumption: Safety monitoring clock cycle time CU (r9780) = 4 ms and inputs/outputs sampling time (r0799) = 4 ms tR_typ = 2 x r9780 (4 ms) + r0799 (4 ms) = 12 ms tR_max = 4 x r9780 (4 ms) + r0799 (4 ms) = 20 ms

Safety Integrated 32 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Parameter overview (see List Manual) ● p0799 CU inputs/outputs sampling times ● r9780 SI monitoring clock cycle (Control Unit) ● r9880 SI monitoring clock cycle (Motor Module) 3.2 Safe Stop 1 (SS1, time controlled) General description The "Safe Stop 1" function can be used to stop the drive in accordance with EN 60204-1, stop category 1. After "Safe Stop 1" has been selected, the drive brakes with the OFF3 ramp (p1135), and after the delay time set in p9652/p9852, changes to the status Safe Torque Off (STO). CAUTION When the SS1 (time-controlled) function has been activated through the parameterization of a delay in p9652/p9852, it is no longer possible to select STO via terminals. Functional features of "Safe Stop 1" SS1 is activated by p9652 and p9852 (delay time) not equal to "0" ● The function can only be activated in conjunction with "Safe Torque Off". ● When SS1 is selected, the drive is braked along the OFF3 ramp (p1135) and STO/SBC is automatically initiated after the delay time has expired (p9652/p9852). After the function has been activated the delay time runs - even if the function is de- selected during this time. In this case, after the delay time has expired, the STO/SBC function is selected and then again de-selected immediately. ● The selection is realized through two channels - however braking along the OFF3 ramp, only through one channel. Release of the SS1 function The function is enabled by entering the delay time in p9652 and p9852. Prerequisite The "Safe Torque Off" function must be enabled. In order that the drive can brake down to a standstill even when selected through one channel, the time in p9652/p9852 must be shorter than the sum of the parameters for the crosswise data comparison (p9650/p9850 and p9658/p9858). The time in p9652/9852 must be dimensioned so that after selection, the drive brakes down to a standstill.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 33 Status for "Safe Stop 1" The status of the "Safe Stop 1" function is displayed using the following parameters: ● r9772 CO/BO: SI status (Control Unit) ● r9773 CO/BO: SI status (Control Unit + Motor Module) ● r9774 CO/BO: SI status (Safe Torque Off group) ● r9872 CO/BO: SI status (Motor Module) Alternatively, the status of the functions can be displayed using the configurable messages N01621 and N30621 (configured using p2118 and p2119). Overview of key parameters (see SINAMICS S List Manual) ● see "Safe Torque Off" function ● p1135 OFF3 ramp-down time ● p9652 SI Safe Stop 1 delay time (Control Unit) ● p9852 SI Safe Stop 1 delay time (Motor Module) 3.3 Safe Brake Control (SBC) Description Safe brake control is used to activate holding brakes that function according to the standby current principle (e.g. motor holding brake). The command for releasing or applying the brake is transmitted to the Motor Module/Power Module via DRIVE-CLiQ. The Motor Module/Safe Brake Relay then carries out the action and activates the outputs for the brake. Brake activation via the brake connection on the Motor Module/Safe Brake Relay is carried out using a safe, two-channel method. Note Chassis components do not support this function. Note To ensure that this function can be used for Power Modules Blocksize, a Safe Brake Relay must be used (for more information, see the Equipment Manual). When the Power Module is configured automatically, the Safe Brake Relay is detected and the motor holding brake type is defaulted (p1278 = 0).

Safety Integrated 34 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 WARNING "Safe Brake Control" does not detect faults in the brake itself, such as brake winding short- circuit, worn brakes, etc. If a cable breaks, this is only recognized by the "Safe Brake Control" function when the status changes, i.e. when the brake is applied/released. Functional features of "Safe Brake Control" (SBC) ● When "Safe Torque Off" is selected or when safety monitors are triggered, "SBC" is performed with safe pulse cancelation. ● Unlike conventional brake control, SBC is executed via p1215 through two channels. ● SBC is executed regardless of the brake control or mode set in p1215. SBC is not recommended, however, when 1215 = 0 or 3. ● The function must be enabled via parameter. ● Each time "Safe Torque Off" is selected, the holding brake is applied immediately with forced dormant error detection. Enabling the "Safe Brake Control (SBC)" function The "Safe Brake Control" function is enabled via the following parameters: ● p9602 SI enable safe brake control (Control Unit) ● p9802 SI enable safe brake control (Motor Module) The "Safe Brake Control" function is not active until at least one safety monitoring function has been enabled (i.e. p9601 = p9801 ≠ 0). Two-channel brake control The brake is controlled from the Control Unit. Two signal paths are available for applying the brake.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 35 &RQWURO WHUPLQDO %UDNHGLDJQRVLV 6WDQGE\FXUUHQWEUDNH 0RWRU 7% &RQWURO8QLW0RWRU 0RGXOH6DIH%UDNH 5HOD\ &RQWUROWHUPLQDO %5 %5 3 %5 %5 0 0 7% Figure 3-1 Two-channel brake control, booksize The Motor Module carries out a check to ensure that the "Safe Brake Control" function is working properly and ensures that, if the Control Unit fails or is faulty, the brake current is interrupted and the brake applied. The brake diagnosis can only reliably detect a malfunction in either of the switches (TB+, TB-) when the status changes (when the brake is released or applied). If the Motor Module or Control Unit detects a fault, the brake current is switched off and the safe status is reached. Response time with the "Safe Brake Control" function The following values can be specified for the response times when the function is selected/deselected via input terminals: ● Typical response time 4 x Safety monitoring cycle CU (r9780) + inputs/outputs sampling time (p0799) ● Max. response time in the event of a fault 8 x Safety monitoring cycle CU (r9780) + inputs/outputs sampling time (p0799) Examples: Assumption: Safety monitoring clock cycle time CU (r9780) = 4 ms and inputs/outputs sampling time (r0799) = 4 ms tR_typ = 4 x r9780 (4 ms) + r0799 (4 ms) = 20 ms tR_max = 8 x r9780 (4 ms) + r0799 (4 ms) = 36 ms

Safety Integrated 36 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Parameter overview (see SINAMICS S List Manual) ● p0799 CU inputs/outputs sampling times ● r9780 SI monitoring clock cycle (Control Unit) ● r9880 SI monitoring clock cycle (Motor Module) 3.4 Forced dormant error detection Forced dormant error detection or test for the switch-off signal paths The forced dormant error detection function at the switch-off signal paths is used to detect software/hardware faults at both monitoring channels in time and is automated by means of activation/deactivation of the "Safe Torque Off" function. To fulfill the requirements of EN 954-1 regarding timely error detection, the two switch-off signal paths must be tested at least once within a defined time to ensure that they are functioning properly. This functionality must be implemented by means of forced dormant error detection function, triggered either in manual mode or by the automated process. A timer ensures that forced dormant error detection is carried out as quickly as possible. ● p9659 SI timer for the forced dormant error detection Forced dormant error detection must be carried out at least once during the time set in this parameter. Once this time has elapsed, an alarm is output and remains present until forced dormant error detection is carried out. The timer returns to the set value each time the STO function is deactivated. When the appropriate safety devices are implemented (e.g. protective doors), it can be assumed that running machinery will not pose any risk to personnel. For this reason, only an alarm is output to inform the user that a forced dormant error detection run is due and to request that this be carried out at the next available opportunity. This alarm does not affect machine operation. The user must set the time interval for carrying out forced dormant error detection to between 0.00 and 9000.00 hours depending on the application (factory setting: 8.00 hours). When to carry out forced dormant error detection: ● When the drives are at a standstill after the system has been switched on. ● When the protective door is opened. ● At defined intervals (e.g. every 8 hours). ● In automatic mode (time and event dependent).

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 37 NOTICE The timer of the Basic Functions will be reset if the associated forced dormant error detection is executed and the Extended Functions are used simultaneously. The corresponding alarm of the Basic Functions is not triggered. Discrepancy is not checked at the terminals used to select the Basic Functions as long as STO is set by the Extended Functions. That is, the test stop of Basic Functions always has to be executed without simultaneous selection of STO or SS1 by the Extended Functions. It is otherwise not possible to verify the correct control through the terminals.

39 Extended Functions 4 4.1 Safe Stop 1 (SS1, time and acceleration controlled) General description The "Safe Stop 1" function can be implemented to stop the drive in accordance with IEC 60204-1, stop category 1. After "Safe Stop 1" is set at the OFF3 ramp (p1135), the drive brakes and changes to the Safe Torque Off (STO) status on expiration of the delay time (p9356/p9556), or after having reached the shutdown speed (p9360/p9560). D6KXWGRZQVSHHGLVUHDFKHGEHIRUHWKHGHOD\ WLPHKDVH[SLUHG E6KXWGRZQVSHHGLVUHDFKHGDIWHUWKHGHOD\WLPH KDVH[SLUHG 'HOD\WLPH 3XOVHFDQFHODWLRQ SS 3XOVHFDQFHODWLRQ 6KXWGRZQVSHHG 3XOVHFDQFHODWLRQ USP $GGLWLRQDO3RZHUBUHPRYHG $GGLWLRQDO3RZHUBUHPRYHG 66BDFWLYH 66BDFWLYH 666723% D E D E QBDFW S S W Figure 4-1 Sequence with SS1 selection Functional features of "Safe Stop 1" ● If SS1 is selected, the drive is brought to a stop along the OFF3 ramp (p1135) and STO/SBC is automatically triggered on expiration of the delay time (p9356/p9556), or after having reached the shutdown speed (p9360/p9560). After the function has been activated the delay time runs - even if the function is de- selected during this time. In this case, after the delay time has expired, the STO/SBC function is selected and then again de-selected immediately. ● The selection is realized through two channels - however braking along the OFF3 ramp, only through one channel.

Safety Integrated 40 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 ● The Safe Acceleration Monitor (SBR) function is active in the ramp down phase (refer to the chapter "Safe Acceleration Monitor"). Commissioning The function is activated by entering the delay time in p9356 and p9556, or the shutdown speed in p9360 and p9560. In order to enable the deceleration of the drive to a standstill, the time set in p9360/p9560 must be of sufficient length to allow deceleration of the drive by means of the OFF3 ramp (p1135) below the shutdown speed set in p9356/p9556. The shutdown speed setting in p9356/p9556 must exclude any risk to man and machine as of this speed and with subsequent coasting down by means of pulse inhibit signal. Responses Speed limit violated (SBR): ● STOP A ● Safety message C01706/C30706 System errors: 1. STOP F with subsequent STOP A 2. Safety message C01711/C30711 Prerequisite The time set in p9356/9556 must be dimensioned so that after selection, the drive brakes down to a standstill. Status for "Safe Stop 1" The status of the "Safe Stop 1" function is displayed using the following parameters: ● r9722.1 CO/BO: SI motion status signals, SS1 active ● r9722.0 CO/BO: SI motion status signals, STO active (power removed) Overview of key parameters (see SINAMICS S List Manual) ● p1135 OFF3 ramp-down time ● p9301 SI motion enable safety functions (Motor Module) ● p9501 SI motion enable safety functions (Control Unit) ● p9348 SI motion SBR actual speed tolerance (Motor Module) ● p9548 SI motion SBR actual speed tolerance (Control Unit) ● p9356 SI motion pulse cancelation delay time (Motor Module) ● p9556 SI motion pulse cancelation delay time (Control Unit) ● p9360 SI motion pulse cancelation shutdown speed (Motor Module)

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 41 ● p9560 SI motion pulse cancelation shutdown speed (Control Unit) ● r9722 CO/BO: SI motion, status signals 4.2 Safe Stop 2 (SS2) Description The Safe Stop 2 (SS2) function is used to safely brake down the drive along the OFF3 ramp (p1135), with transition to the SOS state (refer to the chapter Safe Operational Stop) on expiration of the delay time (p9352/p9552). The delay time set must allow for the drive to brake down to a standstill within this time. The standstill tolerance (p9330/p9530) may not be violated after this time. After the braking operation is completed, the drives remain in speed control mode (speed setpoint n = 0). The drive is not disconnected from hazardous voltage. The default setpoint (e.g from the setpoint channel, or from a higher-level control) remains inhibited as long as SS2 is selected. The Safe Acceleration Monitor (SBR) function is active within the ramp down phase. 66DFWLYDWLRQ 626DFWLYDWLRQ 0D[GHOD\WLPH SS Q W Figure 4-2 Sequence with SS2 selection Responses Speed limit violated (SBR): ● STOP A ● Safety message C01706/C30706 Standstill tolerance violated in p9330/p9530 (SOS): ● STOP B with subsequent STOP A ● Safety message C01707/C30707 System errors: ● STOP F with subsequent STOP A

Safety Integrated 42 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 ● Safety message C01711/C30711 Overview of important parameters (refer to the List Manual) ● p1135 OFF3 ramp-down time ● p9301 SI motion enable safety functions (Motor Module) ● p9501 SI motion enable safety functions (Control Unit) ● p9330 SI motion standstill tolerance (Motor Module) ● p9530 SI motion standstill tolerance (Control Unit) ● p9348 SI motion SBR actual speed tolerance (Motor Module) ● p9548 SI motion SBR actual speed tolerance (Control Unit) ● p9352 SI motion transition time STOP C to SOS (Motor Module) ● p9552 SI motion transition time STOP C to SOS (Control Unit) ● r9722 CO/BO: SI motion, integrated drive status signals 4.3 Safe Operational Stop (SOS) Description This function serves for failsafe monitoring of the standstill position of a drive. Personnel can enter the protected machine areas without having to shut down the machine as long as SOS is active. Drive standstill is monitored by means of an SOS tolerance window (p9330 and p9530). The SOS function is activated on expiration of the delay time set in p9351/p9551 after SOS is selected. The drive must be ramped down to a standstill within this delay time. Any delay time is cleared after SOS is canceled and the drive can start up immediately. 6WDQGVWLOOWROHUDQFHZLQGRZ 6WDQGVWLOOWROHUDQFH SS ;DFW ;DFW 1HJDWLYH 'LUHFWLRQRI URWDWLRQ 3RVLWLYH 'LUHFWLRQRI URWDWLRQ 3RVLWLRQDW 626DFWLYDWLRQ Figure 4-3 Standstill tolerance Responses Standstill tolerance violated in p9330/p9530: ● STOP B with subsequent STOP A

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 43 ● Safety message C01707/C30707 System errors: ● STOP F ● Safety message C01711/C30711 Features ● The drive remains in the closed-loop control mode ● A programmable standstill tolerance window is available ● STOP B is the stop response after SOS has responded Note The range of the tolerance window should be oriented on the default standstill monitoring limit and be slightly higher than this limit. Activation of the default monitoring functions may otherwise not be possible. Note that safe position monitoring within a single-encoder system only works at a rough resolution (4 x pulses per revolution) (refer to the chapter "Safe actual value acquisition". Overview of parameters ● p9301 SI motion enable safety functions (Motor Module) ● p9501 SI motion enable safety functions (Control Unit) ● p9330 SI motion standstill tolerance (Motor Module) ● p9530 SI motion standstill tolerance (Control Unit) ● p9351 SI motion SLS changeover delay time (Motor Module) ● p9551 SI motion SLS(SG) changeover delay time (Control Unit) ● r9722 CO/BO: SI motion integrated drive status signals 4.4 Safely Limited Speed (SLS) Description The "Safely Limited Speed" (SLS) function is used to protect a drive against unintentional high speed. This is achieved by monitoring the current drive speed up to a switched speed limit. SLS is used to prevent any unintentional movements outside the valid high limit. Limits must be specified based on results of the risk analysis. It is possible parameterize up to 4 different speed values. The speed limit is activated after SLS is selected and on expiration of the delay time (p9351/p9531). The drive must be braked down to a speed below the new limit within this

Safety Integrated 44 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 delay time if a lower speed limit is selected. A delay time is not set if a higher speed limit is selected. Delay time %UDNLQJWLPH 6/6LVDFWLYH 6/6LVDFWLYH 6/6VHOHFWLRQ 6/6VHOHFWLRQ SS v1 v v t 2 S>@S>@ S>@S>@ Figure 4-4 Delay time SLS phase changeover A speed setpoint limit can be set as percentage in p9533. This value is used to calculate a speed setpoint limit r9733, depending on the selected speed limit p9531[x]. By contrast to SI limit parameters, this parameter specifies limits on the motor side instead of limits on the load side. ● r9733[0] = p9531[x] * p9533; x = selected SLS stage ● r9733[1] = - p9531[x] * p9533; x = selected SLS stage Responses Speed limit exceeded: ● Configured subsequent stop STOP A / B / C / D by means of p9363/p9563 ● Safety message C01714/C30714 System errors: ● STOP F ● Safety messages C01711/C30711 Features ● 4 programmable limits p9331[0...3] and p9531[0...3] ● Programmable stop response by means of p9363/p9563 Changeover of speed limits The changeover is controlled by means of binary signals from two F-DIs. The speed selection status can be checked at the r9720.9/r9720.10 parameters. Parameters r9722.9 and r9722.10 indicate the actual speed limit, bit r9722.4 must carry a "1" signal.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 45 Table 4-1 Changeover of speed limits: F-DI for bit 0 (r9720.9) F-DI for bit 1 (r9729.10) Speed limit 0 0 p9331[0]/p9531[0] 0 1 p9331[1]/p9531[1] 1 0 p9331[2]/p9531[2] 1 1 p9331[3]/p9531[3] The changeover from a lower to a higher speed limit takes effect without any delay. The changeover from a higher to a lower limit triggers a delay time which can be set at the corresponding parameter (p9351 and p9551). In order to reach the reduced speed that is below the new limit value, the drive must be decelerated accordingly within the delay time. However, if the actual speed is higher than the new limit value and the time has expired, an appropriate alarm with the configured stop response will be generated. Overview of important parameters (refer to the List Manual) ● p9301.0 SI motion enable safety functions (Motor Module), enable SOD/SLS ● p9501.0 SI motion enable safety functions, enable SOS/SLS ● p9331 SI motion SLS limits (Motor Module) ● p9531 SI motion SLS(SG) limits (Control Unit) ● p9533 SI motion speed setpoint limit (Control Unit) ● p9351 SI motion SLS changeover delay time (Motor Module) ● p9551 SI motion SLS changeover delay time (Control Unit) ● p9363 SI motion stop response SLS (Motor Module) ● p9563 SI motion SLS(SG)-specific stop response (Control Unit) ● r9720 CO/BO: SI motion integrated drive control signals ● r9722 CO/BO: SI motion integrated drive status signals ● r9733 CO: SI motion effective speed setpoint limiting

Safety Integrated 46 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 4.5 Safe Speed Monitor (SSM) Description The SSM function is used to safely indicate undershoot of a speed limit (example: for standstill detection) in both rotary directions. A failsafe output signal is available for further processing. The function is activated automatically as soon as the Extended Functions are enabled with p9301.0 = p9501.0 = 1. NOTICE The speed limit of the SSM function (p9346/p9546) is also used as shutdown limit for the SBR function (safe acceleration monitoring). The SBR is deactivated if the speed is below this limit. The effect of the SSM safety function is therefore heavily limited if a relatively high SSM/SBR speed limit is set and the SS1 and SS2 stop functions are activated. Features ● Safe monitoring of the speed limit specified in p9346 and p9546 ● Failsafe output signal ● No stop response Overview of important parameters (refer to the List Manual) ● p9346 SI motion velocity limit n_x (Motor Module) ● p9546 SI motion velocity limit n_x ● r9722 CO/BO: SI motion PROFIsafe status signals 4.6 Safe Acceleration Monitor (SBR) Description The "Safe Acceleration Monitor (SBR)" function is used for safe monitoring of acceleration. This safety function is not autarkic and is part of the SS1 (time and acceleration controlled) and SS2 (or STOP B and STOP C) safety functions. A STOP A is generated if any drive acceleration within the ramp-down phase exceeds the tolerance defined in p9348/p9548. The monitoring function is activated after SS1 (or STOP B) and SS2 (or STOP C) are set and is deactivated after the speed drops below the value set in p9346/p9546.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 47 NOTICE The speed limit set at the SSM function (p9346/p9546) is also used as shutdown limit for the SBR function (safe acceleration monitoring). The SBR is deactivated if the speed is below this limit. The effect of the SSM safety function is therefore heavily limited if a relatively high SSM/SBR speed limit is set and the SS1 and SS2 stop functions are activated. 9HORFLW\ WROHUDQFH S S DFWXDO Q[ W Q 6KXWGRZQOLPLW 7ULJJHU6723%& 0RQLWRULQJF\FOHFORFN SS Figure 4-5 Characteristics of the shutdown limit for SBR Calculating SBR tolerance of the actual speed The following rules are valid for the parameterization of SBR tolerance: The maximum speed increase after STOP B/C was triggered is derived from the effective acceleration and the duration of the acceleration phase. The duration of the acceleration phase is equivalent to one monitoring clock cycle (p9300/p9500) MC (delay from detecting a STOP B/C until nset = 0): SBR tolerance Actual speed SBR = acceleration * acceleration duration The following setup rule is derived thereof: At linear axes: SBR tolerance [mm/min] = a [m/s2] * MC [s] * 1000 [mm/m] * 60 [s/min] At rotary axes: SBR tolerance [rev/min] = a [rev/s2] * MC [s] * 60 [s/min] Recommendation: The SBR tolerance value entered should be approx. 20% higher than the calculated value.

Safety Integrated 48 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Responses Speed limit violated (SBR): ● STOP A ● Safety message C01706/C30706 System errors: ● STOP F with subsequent STOP A ● Safety message C01711/C30711 Features ● Element of the SS1 (time and acceleration controlled) and SS2 functions ● Programmable minimum shutdown speed to be monitored Overview of important parameters ● p9346 SI motion velocity limit n_x (Motor Module) ● p9560 SI motion velocity limit n_x (Control Unit) ● p9348 SI motion SBR actual speed tolerance (Motor Module) ● p9548 SI motion SBR actual speed tolerance (Control Unit) 4.7 Response to fault/limit value violation Stop response Faults in Safety Integrated and violation of limits may trigger the following stop response: Table 4-2 Stop response overview Stop response Action Effect STOP A Immediate pulse cancelation Drive coasts down STOP B Immediate input of speed setpoint = 0 and start of timer tB STOP A is triggered on expiration of tB or if nis < nshutdown. The drive brakes down along the OFF3 ramp and then goes into STOP A state STOP C Immediate input of speed setpoint = 0 and start of timer tC SOS is activated on expiration of tC. The drive brakes down along the OFF3 ramp, SOS is then activated STOP D Timer tD starts No drive-integrated response SOS is activated on expiration of tD. The drive must be braked down by the higher-level control (within the drive group)! SOS is activated on expiration of the time tD. An automatic response is only triggered if the standstill tolerance window is violated in SOS.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 49 Stop response Action Effect STOP E (in preparation) (in preparation, current behavior similar to STOP D) (in preparation, current behavior similar to STOP D) STOP F Timer tF1 (Basic Functions) or tF2 (Extended Functions) No drive response If a safety function (SOS, SLS) is active, transition to STOP A state on expiration of tF1 (Basic Functions), or to STOP B state on expiration of tF2 (Extended Functions). On delays at the stop response transitions ● tB: p9356/p9556 ● tC: p9352/p9552 ● tD: p9353/p9553 ● tF1: p9658/p9858 ● tF2: p9355/p9555 ● nshutdown: p9360/p9560 Stop response priorities Table 4-3 Stop response priorities Priority classes Stop response Highest priority STOP A ..... STOP B ... STOP C .. STOP D . STOP E (in preparation) Lowest priority STOP F

Safety Integrated 50 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 4.8 Safe actual value acquisition Supported encoder systems Safety functions used to monitor movements (e.g. SS2, SOS, SLS and SSM) require safe actual value acquisition. This function is required for safe acquisition of the actual speed. The following encoder type is supported: ● Optoelectronic encoder with sin/cos signal Single-encoder system Encoders within single-encoder systems are used to generate the failsafe actual values of the drive. The safety-relevant actual values are generated either directly in the encoder or in the Sensor Module and are transferred without retroaction to the Control Unit by way of failsafe communication via DRIVE-CLiQ. Special feature in the case of linear motors: The motor encoder (linear scale) of linear motors also acts as load measuring system. Only one measuring system is required for this reason. The system is connected by way of a Sensor Module, or directly via DRIVE–CLiQ. NOTICE When specifying the standstill tolerance window, observe that failsafe position monitoring within a single-encoder system only works at a rough resolution with 4 pulses per revolution. 0DFKLQHWDEOH /RRVH ( (QFRGHU 0 0RWRU 0 '5,9(&/L4 ( Figure 4-6 Example of a single-encoder system

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 51 Two-encoder system The failsafe actual values for a drive are provided by two separate encoders. The safety- relevant actual values are generated either directly in the encoders or in the Sensor Modules and are transferred without retroaction to the Control Unit by way of failsafe communication via DRIVE-CLiQ. Each measuring system requires a separate connection or a separate Sensor Module. 0DFKLQHWDEOH /RRVH /LQHDUVFDOH ( (QFRGHU 0 0RWRU 0 '5,9(&/L4 ( ( Figure 4-7 Example of a two-encoder system on a linear axis via ball bearing spindle ( (QFRGHU 0 0RWRU '5,9(&/L4 ( ( 0 Figure 4-8 Example of a two-encoder system on a rotary axis

Safety Integrated 52 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Actual value synchronization 'HYLDWLRQEHWZHHQ DFWXDOSRVLWLRQYDOXHVLVQRW JUHDWHUWKDQWKHVOLS LQHDFK.'9F\FOHS U 6DIHDFWXDOSRVLWLRQYDOXH RQORDGVLGH .'9F\FOH U $FWXDOSRVLWLRQ YDOXH 6HQVRU $FWXDOSRVLWLRQ YDOXH 6HQVRU W Figure 4-9 Example diagram of actual value synchronization The mean value of the actual values of both encoders is calculated cyclically after actual value synchronization (p9301.3 = p9501.3 = 1) was activated. The maximum slip defined in p9349/p9549 is monitored within the crosswise comparison clock cycle (r9724). If "actual value synchronization" is not enabled, the value parameterized in p9342/p9542 is used as tolerance value for the crosswise comparison. Overview of important parameters (refer to the List Manual) ● p9301.3 SI motion enable safety functions (Motor Module), actual value synchronization ● p9501.3 SI motion enable safety functions (Control Unit), actual value synchronization ● p9302 SI motion axis type (Motor Module) ● p9502 SI motion axis type (Control Unit) ● p9317 SI motion linear scale, grid division (Motor Module) ● p9517 SI motion linear scale, grid division (Control Unit) ● p9318 SI motion encoder pulses per revolution (Motor Module) ● p9518 SI motion encoder pulses per revolution (Control Unit) ● p9319 SI motion fine resolution Gn_XIST1 ● p9519 SI motion fine resolution G1_XIST1 (Control Unit) ● p9320 SI motion spindle pitch ● p9520 SI motion spindle pitch (Control Unit) ● p9321[0...7] SI motion gearbox encoder/load denominator (Motor Module) ● p9521[0...7] SI motion gearbox encoder/load denominator (Control Unit) ● p9322[0...7] SI motion gearbox encoder/load numerator (Motor Module) ● p9522[0...7] SI motion gearbox encoder/load numerator (Control Unit)

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 53 ● p9326 SI motion encoder assignment (Motor Module) ● p9526 SI motion encoder assignment second channel ● p9342 SI motion actual value comparison tolerance (crosswise) (Motor Module) ● p9542 SI motion actual value comparison tolerance (crosswise) (Control Unit) ● p9349 SI motion slip velocity tolerance (Motor Module) ● p9549 SI motion slip velocity tolerance (Control Unit) ● r9713 SI motion diagnostics actual position (MAKSIP) ● r9724 SI motion crosswise comparison clock cycle 4.9 Forced dormant error detection Forced dormant error detection and function test through test stop The proper function of the two shutdown signal paths must be tested at least once within a defined time in order to meet requirements as per EN 954-1 in terms of timely fault detection. This functionality must be implemented by means of test stop triggering either in cyclic manual mode or by the automated process. The test stop cycle is monitored. On expiration of the programmed timer, the alarm A01697: "SI motion: Test of motion monitoring required" is generated and a status bit is set which can be transferred to an output or to a PZD bit via BICO. This alarm does not affect machine operation. The test stop must be initiated application-specific and be executed at a time which suits application requirements. This functionality is implemented by means of a single-channel parameter p9705 which can be wired via BICO either to an input terminal on the drive unit (CU), or to an IO-PZD in the drive telegram. ● p9559 SI motion forced dormant error detection timer (Control Unit) ● p9705 BI: SI motion test stop signal source ● r9723.0 CO/BO: SI motion PROFIsafe diagnostics signals, dynamic response required A test stop does not require POWER ON. The acknowledgment is set by canceling the test stop request. It can be assumed that a running machine will not pose any risk to personnel if appropriate safety equipment (e.g. protective doors) is installed. For this reason, only an alarm is output to inform the user that a forced dormant error detection run is due and to request that this be carried out at the next available opportunity. Examples of when to carry out forced dormant error detection: ● When the drives are at a standstill after the system has been switched on. ● Before the protective door is opened. ● At defined intervals (e.g. every 8 hours). ● In automatic mode (time and event dependent)

Safety Integrated 54 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Forced dormant error detection F-DI/F-DO of TM54F through test stop An automatic test stop function is available for forced dormant error detection within the F-DI/DO test. In order to be able to utilize the TM54F test stop function, all F-DIs used must be interconnected as shown in the wiring example in the SINAMICS S120 GH1 Equipment Manual. The digital inputs of F-DI 0 to F -DI 4 must be connected to the "L1+" power supply. The digital inputs of F-DI 5 to F -DI 9 must be connected to the "L2+" power supply.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 55 0 0 0 0 0 0 0 0  3 3B       9 0 0  0  0 0  0    9 0 0  0  0 ',      ',  ',  ',   ',   ',  /     ',  ',  ',   ',  ',   ',    0  ',   ',  ',   0 )',  )',  )',  )',  )',     ',  '2  '2  ',      ',  ',  ',   ',   ',  /     ',  ',  ',   ',  ',   ',    0     ',   ',  ',   0 )', )', )', )', )', ',  '2  '2     ',  '2  '2     ',  '2  '2    / 0          7HUPLQDO0RGXOH70) ; ; 7KHLQYHUVLRQ FDQEHSDUDPHWHUL]HG ; ; ; ; ; ; ; ; ; ; ; '5,9(&/L4VRFNHW '5,9(&/L4VRFNHW 0 9 )B'2 0 9 )B '2 0 9 )B'2 0 9 )B'2 0 0 0 / (OHFWURQLFV  0 0 0 0 Figure 4-10 Example of the TM54F wiring The F-DIs must be registered for the test stop by means p10041.

Safety Integrated 56 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 CAUTION The F-DI states are frozen for the duration of the test (approx. 100 ms)! In order to be able to use the test stop function, interconnect the F-DO used in accordance with the example of the wiring in the SINAMICS S120 GH1 Equipment Manual and wire the forced feedback signals of the two relays to the corresponding digital input (DI 20 to DI 23). The corresponding DIs must be registered for the test stop by means of p10046. NOTICE F-DOs which are not registered for evaluation by means of p10046 are set to "0" for the duration of the test stop ("failsafe values"). Maximum test stop period: 19 * p10000 + 2 * 20 ms + 6 * p10001 WARNING If the connected devices do not support the test stop function for specific F-DIs or F-DOs, the relevant F-DI/F-DO must be operated dynamically, e.g. by means of switch operation, or through specific machine functions. The test stop must be executed at a suitable time. That is, it must be initiated application- specific. This functionality is implemented by means of a parameter p10007 which can be wired via BICO either to an input terminal on the drive unit (CU), or to an IO-PZD in the drive telegram. The test stop cycle is monitored. On expiration of the programmed timer, the alarm A35014: "TM54F: Test stop required" is output. ● p10001 SI waiting time for test stop at F-DO 0 ... 3 ● p10003 SI Forced dormant error detection timer ● p10007 BI: SI input terminal forced dormant error detection F-DO 0 ... 3 ● p10041 SI F-DI test enable ● p10046 SI test sensor feedback input DI 20-23 A test stop does not require POWER ON. The acknowledgment is set by canceling the test stop request.

57 Control of the safety functions 5 5.1 Overview of F-DI/F-DOs and of their structure Description The failsafe input and output signals (F-DI and F-DO) interface the internal Safety Integrated functionality with the process. F-DI signals (Failsafe Digital Inputs) control active monitoring of the activation/deactivation of safety functions. This function also depends on the status of sensors (e.g. switches). F-DO signals (Failsafe Digital Outputs) are feedback information of the safety functions. They are also suitable for the failsafe control of actuators (e.g. line contactor). Dual-channel processing of I/O signals A dual-channel structure is available for data input/output and for processing failsafe I/O signals. All requests and feedback signals for failsafe functions should be entered or tapped using both monitoring channels. The following options are available for controlling Safety Integrated functions: ● Control by way of terminals on the Control Unit and Motor Module (only STO, SS1 (time controlled) and SBC). ● Control by way of TM54F terminals ● Control by way of PROFIsafe Only one of the two control modes can be selected for each drive object, that is, either TM54F or PROFIsafe. Control by way of terminals on the Control Unit and Motor Module can be activated alongside with one of the other two options. NOTICE Each Control Unit must be controlled either by way of PROFIsafe, or by way of TM54F. A mixed mode is not allowed.

5.2 Control via terminals on the Control Unit and the power unit Safety Integrated 58 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 5.2 Control via terminals on the Control Unit and the power unit Features ● Only for the STO, SS1 (time-controlled) and SBC functions ● Dual-channel structure via two digital inputs (Control Unit/power unit) ● Different terminal strips depending on design ● Automatic ANDing of up to 8 digital inputs (p9620[0...7]) on the Control Unit with parallel configuration of chassis type power units Overview of the safety function terminals for SINAMICS S120 The different power unit formats of SINAMICS S120 have different terminal designations for the inputs of the safety functions. These are shown in the following table. Table 5-1 Inputs for safety functions 1. Switch-off signal path (p9620[0]) 2. Switch-off signal path Control Unit CU320 X122.1....4 / X132.1...4 (on the CU320) digital input 0 to 7 (see Motor Modules / Power Modules) Single Motor Module Booksize (see CU320) X21.3 and X21.4 (on the Motor Module) Single Motor Module Chassis (see CU320) X41.1 and X41.2 (on the CIB) Double Motor Module Booksize (see CU320) X21.3 and X21.4 (motor connection X1)/X22.3 and X22.4 (motor connection X2) (on the Motor Module) Power Module Blocksize with CUA31 (see CU320) X210.3 and X210.4 (on the CUA31) Power Module Blocksize with CU310 X121.1...4 (on the CU310) digital input 0 to 3 X120.7 and X120.8 (on the CU310) Power Module Chassis with CU310 X121.1...4 (on the CU310) digital input 0 to 3 X41.1 and X41.2 (on the CIB) For further information about the terminals, see the Equipment Manuals. Terminals for STO, SS1 (time-controlled), SBC The functions are separately selected/deselected for each drive using two terminals. ● 1. Switch-off signal path (CU310/CU320) The desired input terminal is selected via BICO interconnection (BI: p9620[0]). ● 2. Switch-off signal path (Motor Module/Power Module/CUA31) The input terminal is the "EP" ("Enable Pulses") terminal. Both terminals must be operated simultaneously, otherwise a fault will be issued.

5.2 Control via terminals on the Control Unit and the power unit Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 59 0RWRU0RGXOH &RQWURO8QLWPRQLWRULQJFKDQQHO 0RWRU0RGXOHPRQLWRULQJFKDQQHO     [   ; *  0 a [   ; %, 0 ',[ %5 %5 9 8 (39 (30 ;; '5,9(&/L4 &RQWURO8QLW 7HPS 7HPS : '5,9(&/L4 '5,9(&/L4 U[ S Figure 5-1 Terminals for "Safe Torque Off", example for Motor Modules Booksize and CU320 Grouping drives (not for CU310) To ensure that the function works for more than one drive at the same time, the terminals for the corresponding drives must be grouped together as follows: ● 1. Switch-off signal path (CU320) By connecting the binector input to the joint input terminal on the drives in one group. ● 2. Switch-off signal path (Motor Module/CUA31) By appropriately connecting-up the terminals for the individual Motor Modules/Power Modules belonging to the group with CUA31. Note The grouping must be identical in both monitoring channels. If a fault in a drive results in a "Safe Torque Off (STO)", this does not automatically mean that the other drives in the same group also switch to "Safe Torque Off (STO)". The assignment is checked during the test for the switch-off signal paths. The operator selects "Safe Torque Off" for each group. The check is drive-specific. Example: Terminal groups It must be possible to select/deselect "Safe Torque Off" separately for group 1 (drive 1 and 2) and group 2 (drive 3 and 4). For this purpose, the same grouping for "Safe Torque Off" must be performed on both the Control Unit and the Motor Modules.

5.2 Control via terminals on the Control Unit and the power unit Safety Integrated 60 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 0 'ULYH  0 0 0 (3 (3 (3  *URXS  *URXS (3 6HOHFWLRQ GHVHOHFWLRQ *URXS 6HOHFWLRQ GHVHOHFWLRQ *URXS 'ULYH  'ULYH  'ULYH 'ULYH 'ULYH 'ULYH /LQH 0RGXOH 6LQJOH 0RWRU 0RGXOH 6LQJOH 0RWRU 0RGXOH 'RXEOH 0RWRU 0RGXOH U U S S S ', ', 0 0 ; ; &RQWURO8QLW S Figure 5-2 Grouping terminals with Motor Modules Booksize and CU320 Information on the parallel connection of chassis type Motor Modules When Motor Modules of chassis type are connected in parallel, a safe AND element is created on the parallel drive object. The number of indexes in p9620 corresponds to the number of parallel chassis components in p0120. Simultaneity and tolerance time of the two monitoring channels The "Safe Torque Off" function must be selected/deselected simultaneously in both monitoring channels using the input terminals and is only effective for the associated drive. 1 signal: Deselecting the function 0 signal: Selecting the function "Simultaneously" means: The changeover must be complete in both monitoring channels within the parameterized tolerance time. ● p9650 SI tolerance time F-DI changeover (Control Unit) ● p9850 SI tolerance time F-DI changeover (Motor Module) If the "Safe Torque Off" function is not selected/deselected within the tolerance time, this is detected by the crosswise comparison, and fault F01611 or F30611 (STOP F) is output. In this case, the pulses have already been canceled as a result of the selection of "Safe Torque Off" on one channel.

5.3 Control by way of TM54F terminals Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 61 5.3 Control by way of TM54F terminals 5.3.1 General information Description Terminal Module TM54F is a terminal expansion module for snap-on rail mounting to DIN EN 60715. The TM54F features failsafe digital I/O for controlling the Safety Integrated functions. Each Control Unit can be assigned only one TM54F which is connected via DRIVE-CLiQ. NOTICE The TM54F may not be interconnected in series with the Motor Modules and must be operated on a separate DRIVE-CLiQ segment (separate port on the Control Unit). It is allowed to connect other TMs and Sensor Modules to this SQ segment. TM54F features the following terminals: Table 5-2 Overview of the TM54F interfaces Type Number Failsafe digital outputs (F-DO) 4 Failsafe digital inputs (F-DI) 10 Sensor 1) power supplies, dynamic response supported 2) 2 Sensor1) power supply, no dynamic response 1 Digital inputs for checking the F-DO with activated forced dormant error detection 4 1) Sensors: Failsafe devices for command operations and status logging, for example emergency stop pushbuttons, safety locks, position switches and light arrays / light curtains. 2) Dynamic response: The sensor power supply is cycled on and off when forced dormant error detection is active for the sensors, cable routing and the evaluation electronics of TM54F. The TM54F provides 4 failsafe digital outputs and 10 failsafe digital inputs. A failsafe digital output consists of a 24 V DC/M switching output plus a digital input for reading back the switching state. A failsafe digital input consists of two digital inputs. Note You have the following options of acknowledging TM54F faults after troubleshooting: • A rising edge at one of the binector inputs p2103, p2104 or p2105 at the two drive objects TM54F_MA and TM54F_SL. • Acknowledgment in STARTER • POWER ON

5.3 Control by way of TM54F terminals Safety Integrated 62 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 5.3.2 Overview of the F-DIs Description Failsafe digital inputs (F-DI) consist of two digital inputs. The cathode of the optocoupler is routed to the second digital input in order to allow the connection of an M-switching F-DO output (the anode must be wired to 24 V DC). Parameter p10040 is used to determine whether an F-DI is operated as NC/NC or NC/NO contact. The status of DI can be read at parameter r10051 for the drive objects TM54F_MA and TM54F_SL. The same bits of both drive objects are logically linked by AND operation and return the status of the relevant F-DI. The signal states at the two associated digital inputs (F-DI) must assume the same status configured in p10040 within the monitoring time set in p10002. IN order to enable forced dormant error detection, connect the digital inputs of F-DI 0 ... 4 with the dynamic voltage supply L1+ and the digital inputs with F-DI 5 ... 9 to L2+ (for additional information on forced dormant error detection, refer to the corresponding function description in the chapter "Extended Functions"). DI 0 p10040.0 DI 1- DI 3+ X521.2 X521.6 X521.5 DI 1+ X521.3 L1+ X521.1 X521.4 & DI 2 X521.7 DI 3- DI 5+ X522.2 DI 5- X522.7 DI 4 X522.1 p10040.2 & p10040.1 & DI 7+ X522.4 DI 7- X522.8 DI 6 X522.3 p10040.3 & DI 9+ X522.6 DI 9- X522.9 DI 8 X522.5 p10040.4 & M1 X522.10 F-DI 0 X521.8 M1 F-DI 1 F-DI 2 F-DI 3 F-DI 4 F35151 F35151 F35151 F35151 F35151 p10002 1 0 1 1 0 1 1 0 1 1 0 1 1 0 1 r10051.1 (MA) r10051.2 (MA) r10051.3 (MA) r10051.4 (MA) r10051.0 (SL) r10051.0 (MA) r10051.1 (SL) r10051.2 (SL) r10051.3 (SL) r10051.4 (SL) M1 M1 M1 M1 M1 T 0 T 0 =1 =1 T 0 =1 T 0 =1 T 0 =1 Figure 5-3 Overview of F-DI 0 ... 4

5.3 Control by way of TM54F terminals Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 63 DI 10 p10040.5 DI 11- DI 13+ X531.2 X531.6 X531.5 DI 11+ X531.3 L2+ X531.1 X531.4 & DI 12 X531.7 DI 13- DI 15+ X532.2 DI 15- X532.7 DI 14 X532.1 p10040.7 & p10040.6 & DI 17+ X532.4 DI 17- X532.8 DI 16 X532.3 p10040.8 & DI 19+ X532.6 DI 19- X532.9 DI 18 X532.5 p10040.9 & M1 X532.10 F-DI 5 X531.8 M1 F-DI 6 F-DI 7 F-DI 8 F-DI 9 F35151 F35151 F35151 F35151 F35151 p10002 1 0 1 1 0 1 1 0 1 1 0 1 1 0 1 r10051.6 (MA) r10051.7 (MA) r10051.8 (MA) r10051.9 (MA) r10051.5 (SL) r10051.5 (MA) r10051.6 (SL) r10051.7 (SL) r10051.8 (SL) r10051.9 (SL) M1 M1 M1 M1 M1 T 0 T 0 =1 =1 T 0 =1 T 0 =1 T 0 =1 Figure 5-4 Overview of F-DI 5 ... 9 F-DI features ● Failsafe configuration with two digital inputs per F-DI ● Configurable connection of NC/NC or NC/NO contacts by means of parameter p10040 ● Status parameter r10051 ● Adjustable time window for monitoring discrepancy at both digital inputs by means of parameter p10002 for all F-DIs ● 2. Digital input with additional tap of the optocoupler cathode for connecting an M-switching output of a failsafe controller. Overview of important parameters (refer to the List Manual) ● p10002 SI discrepancy monitoring time ● p10040 SI F-DI input mode ● r10051 CO/BO: SI status of digital inputs

5.3 Control by way of TM54F terminals Safety Integrated 64 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 5.3.3 Overview of the F-DOs Description Failsafe digital outputs (F-DO) consist of two digital outputs plus one digital input that checks the switching state for forced dormant error detection. The first digital input switches 24 V DC, and the second switches M of the X514 voltage supply. The status of each F-DO can be read at parameter r10052. The status of the associated DI can be read at parameter r10053 for the drive objects of the slave (TM54F_SL). In order to enable forced dormant error detection, connect the corresponding digital input for the forced feedback signals of the relays (for additional information on forced dormant error detection, refer to the corresponding function description in the "Extended Functions" chapter). X522.10 M1 DO 3+ X535.2 X535.3 DO 3- +24 V F-DO 3 DI 23 M1 M 1 DO 2+ X533.2 X533.1 X533.3 DO 2- F-DO 2 DI 22 X535.1 +24 V M1 M1 M1 X532.10 DO 1+ DO 1- +24 V F-DO 1 DI 21 M1 M1 X520.1 L3+ DO 0+ DO 0- F-DO 0 DI 20 +24 V M1 M1 X525.2 X525.1 X523.2 X523.1 X523.3 X525.3 r10052.0 r10052.1 r10052.2 r10052.3 r10053.3 r10053.2 r10053.1 r10053.0 M1 M1 M1 M1 Figure 5-5 F-DO overview (without description of the main contacts of the relays) F-DO signal sources A drive group contains several drives with similar characteristics. The groups are parameterized at the p10010 and p10011 parameters. The following signals are available for interconnecting (p10043) each one of the four drive groups with the F-DO: ● Power removed (STO active) ● SS1 active ● SS2 active ● SOS active ● SLS active

5.3 Control by way of TM54F terminals Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 65 ● SSM feedback active ● Safe state The following signals can be requested by means of p10039[0...3] for each drive group (index 0 corresponds with drive group 1 etc.): – Power removed (STO active) – SS1 active – SS2 active – SOS active – SLS active 3XOVHFDQFHOHG 66DFWLYH 66DFWLYH 626DFWLYH 6/6DFWLYH 'ULYHJURXS[ 6DIHVWDWH S>[@       S>[@ Figure 5-6 Safe state selection The same signals (high-active) of each drive or drive group are logically linked by means of AND operation. The different signals selected through p10039 are logically linked by means of OR operation. Result of these logic operations is the "Safe State" for each drive group. ● SOS selected ● Internal event (no active safety fault) Each F-DO supports the interconnection of up to 6 signals by way of indexing (p10042[0...5] to p10045[0...5]) and their output as logical AND operation. F-DO features ● Each F-DO with failsafe configuration consisting of two digital outputs plus one digital input for reading back the switching state for forced dormant error detection ● Status parameters r10052/r10053 Function diagrams (refer to List Manual) ● 2853 TM54F (F-DO 0 ... F-DO 3, DI 20 ... DI 23) ● 2856 TM54F Safe State selection ● 2857 TM54F assignment (F-DO 0 ... F-DO 3)

5.4 Configuring PROFIsafe Safety Integrated 66 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Overview of important parameters (refer to the List Manual) ● p10042[0..5] SI F-DO 0 signal sources ● ... ● p10045[0..5] SI F-DO 3 signal sources ● r10052 CO/BO: SI status of digital outputs ● r10053 CO/BO: SI status of digital inputs 20 ... 23 (only at slave object, TM54F_SL) 5.4 Configuring PROFIsafe 5.4.1 PROFIsafe user data Introduction Drives with PROFIsafe configuration in the drive unit represent PROFIsafe slaves (failsafe slave) featuring failsafe PROFIBUS communication with the failsafe host. The drive unit is equipped with dual-channel PROFIsafe communication functions, that is, with one channel in the Control Unit and one in the Motor Module. The failsafe values are activated and STO is set immediately if a PROFIsafe communication error is detected. All parameters used to control PROFIsafe communication are protected against unintentional changes by password and checksum. The telegrams are configured using the configuration tool (e.g. HW Config + F-Configuration Pack) on the failsafe host. A separate PROFIsafe telegram (PROFIsafe slot) is created for each drive. Control via PROFIsafe is enabled by setting p9601.3 = p9801.3 = 1. It is not possible to enable parallel control via TM54F. Control of the Basic Functions via the Control Unit and Motor Module (p9601.0/p9801.0) terminals may be enabled in parallel. This setup allows you to select the STO and SBC functions both on PROFIsafe and by way of the on-board terminals of the Control Unit and Motor Module. PROFIsafe STW Refer to the function diagram [2840]. Table 5-3 Description of the PROFIsafe STW Bit Meaning Remarks BICO 1 STO deactivation 0 STO 0 STO activation r9720.0 1 SS1 deactivation 1 SS1 0 SS1 activation r9720.1 2 SS2 1 SS2 deactivation r9720.2

5.4 Configuring PROFIsafe Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 67 Bit Meaning Remarks BICO 0 SS2 activation 1 SOS deactivation 3 SOS 0 SOS activation r9720.3 1 SLS deactivation 4 SLS 0 SLS activation r9720.4 5 Reserved - - - 6 Reserved - - - 1/0 Acknowledgment 7 Internal Event ACK 0 No acknowledgment r9720.7 - - 8 Reserved - - - 9 SLS limit select bit 0 - r9720.9 10 SLS limit select bit 1 - Selection of the speed limit for SLS (2-bit counter) r9720.10 11...15 Reserved - - - PROFIsafe status word Refer to the function diagram [2840]. Table 5-4 Description of the PROFIsafe status word (ZSW) Bit Meaning Remarks BICO 1 STO active 0 Power removed (STO active) 0 STO deactivated r9722.0 1 SS1 active 1 SS1 active 0 SS1 deactivated r9722.1 1 SS2 active 2 SS2 active 0 SS2 deactivated r9722.2 1 SOS active 3 SOS active 0 SOS deactivated r9722.3 1 SLS active 4 SLS active 0 SLS deactivated r9722.4 5 Reserved - - - 6 Reserved - - - 1 Internal Event 7 Internal Event 0 no Internal Event r9722.7 - - 8 Reserved - - - 9 SLS limit bit 0 - r9722.9 10 SLS limit bit 1 - Selection of the speed limit for SLS (2-bit counter) r9722.10 1 SOS selected 11 SOS selected 0 SOS deactivated r9722.11

5.4 Configuring PROFIsafe Safety Integrated 68 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Bit Meaning Remarks BICO 12...14 Reserved - - - 1 SSM (n below limit) 15 SSM 0 SSM (n higher than/equal to limit) r9722.15

69 Commissioning 6 6.1 General commissioning information 6.1.1 Introduction The safety functions are commissioned using the screen forms in the STARTER. These functions are available for each drive at "Functions" -> "Safety Integrated". The password "0" is set by default. Information pertaining to operation with isochronous PROFIBUS NOTICE Always set parameter p9510 = 1 if a PROFIdrive controller exchanges isochronous process data with the Control Unit. This setting is also required if the drive itself does not exchange process data in isochronous mode. Refer to parameter p0092. 6.1.2 Setting the sampling times Terminology The software functions installed in the system are executed cyclically at different sampling times (p0115, p0799 and p4099). Safety functions are executed within the monitoring clock cycle (p9300/p9500) and TM54F is executed within the sampling time (p10000). Communication on PROFIBUS is handled cyclically by means of the communication clock cycle. Rules for setting the sampling times: ● The monitoring clock cycle (p9300/p9500) on isochronous PROFIBUS must be an integer multiple of the communication clock cycle. ● The monitoring clock cycle must be an integer multiple of 1 ms if isochronous PROFIBUS is not used.

Safety Integrated 70 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 ● The communication clock cycle must be executed at least with factor 4 to the current controller clock cycle (with isochronous PROFIBUS) or 1 ms (with non-isochronous PROFIBUS). ● The monitoring clock cycle can be set within the limits from 4 ms to 25 ms. However, the calculation time required for the Extended Functions in the Control Unit depends on the monitoring clock cycle, that is, shorter clock cycles extend the calculation time. The availability of a specific monitoring clock cycle therefore depends on calculation time resources of the Control Unit. Calculation time resources on the Control Unit are influenced primarily by the number of drives, the number of drives with enabled Extended Functions, the connected DRIVE- CLiQ components, the selected DRIVE-CLiQ topology, the use of CBE20 and by the selected technological functions. ● A sampling time of 125 µs or 250 µs can be set at the current controller (p0115[0]). ● The sampling time set at the TM54F must be equivalent to the monitoring clock cycle (p10000 = p9300/p9500). ● The PROFIsafe scan cycle is set permanently to 2 x p9300/p9500. Overview of important parameters (refer to the List Manual) ● p9300 SI motion monitoring clock cycle (Motor Module) ● p9500 SI motion monitoring clock cycle (Control Unit) ● p10000 SI sampling time (TM54F) 6.2 Commissioning TM54F by means of STARTER/SCOUT 6.2.1 Basic sequence of commissioning The following conditions must be met before you can configure the TM54F: ● Concluded initial commissioning of all drives Table 6-1 Configuration sequence Step Execution 1 Insert the TM54F 2 Configure the TM54F and generate the drive groups 3 Configure the drive groups 4 Configure the inputs 5 Configure the outputs 6 Copy the parameters to the second drive object (TM54F_SL) 7 Activate the configuration by selecting "Activate settings" 8 Save the project in STARTER 9 Save the project in the drive by selecting "Copy RAM to ROM"

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 71 Step Execution 10 Execute POWER ON 11 Acceptance test 6.2.2 Configuration start screen Description The following functions can be selected in the start screen: ● Configuration Opens the "Configuration" screen ● Inputs Opens the "Inputs" screen ● Outputs Opens the "Outputs" screen ● Drive group 1 ... 4 Opens the corresponding screen of drive group 1 to 4 ● Copy parameters Copy the configuration to the second drive object (TM54F_SL) after having edited the configuration and pressed the "Change settings" button. ● Change/activate settings – Change settings You can select this button and enter the TM54F password in order to edit the configuration data. The button function changes to "Activate settings". – Activate settings This function activates your parameter settings and initiates calculation of the actual CRC and the corresponding transfer to the target CRC. The parameters are activated after restart, and you are requested to carry out the acceptance test. A message is output requesting you to save the project and then restart the system. It is also required to carry out an acceptance test. ● Change password (p10061 ... p10063) In order to change the password, enter the old password (factory setting: 0) and then enter and confirm the new password.

Safety Integrated 72 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Figure 6-1 Configuration start screen TM54F

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 73 6.2.3 TM54F configuration Configuration screen of TM54F for Safety Integrated Figure 6-2 TM54F configuration Functions of this screen: ● Drive objects assignment (p10010) Selection of a drive object to be assigned to a drive group. ● Drive groups (p10011) Each configured safety drive can be assigned to a drive group using a drop-down list box. The list box displays the drives and their names. ● Safety clock cycle (p10000) The safety clock cycle corresponds to the sampling time of TM54F. – Enter the safety clock cycle in this input box Note The safety clock cycle (p10000) set at the TM54F must be equivalent to the monitoring clock cycle set in p9300/p9500. ● Discrepancy time (p10002) The signal states at the two terminals of an F-DI are monitored in order to determine whether these have assumed the same logical state within the discrepancy time. ● F-DO dynamization test cycle (p10003) Failsafe I/O must be tested at defined intervals in order to validate their failsafe state (test stop, or forced dormant error detection). The TM54F module is provided with a function block which is selected by way of a BICO source to execute this forced dormant error

Safety Integrated 74 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 detection (e.g. switch the L1+ and L2+ sensor power supply). Each selection triggers a timer in order to monitor the test cycle. An alarm is set on expiration of the monitored time. ● F-DI selection (p10006) The Extended Functions enter a safety alarm in a special alarm buffer upon the detection of internal errors or violation of limits. This alarm must be acknowledged safely. You can assign an F-DI terminal pair for safe acknowledgment. ● Function mode selection (in preparation) 6.2.4 F-DI/F-DO configuration Inputs screen F-DI Figure 6-3 Inputs screen NC/NO contact (p10040) Terminal property F-DI 0-9 (p10040.0 = F-DI 0, ... p10040.9 = F-DI 9). Configure only the property of the second (lower) digital input. Always connect an NC contact to digital input 1 (upper). Digital input 2 can be configured as NO contact.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 75 Activate test mode (p10041) A check mark at an F-DI defines whether the pair of digital inputs is to be integrated in the forced dormant error detection test of the assigned power supply (L1+ or L2+) (for additional information, refer to the chapter "Forced dormant error detection", under Extended Functions). LED in F-DI screen The LED downstream of the AND element indicates the logical state (inactive: gray, active: green, discrepancy error: red). Outputs screen F-DO Figure 6-4 Outputs screen Signal source for F-DO (p10042 - p10045) An AND element with 6 inputs is interconnected with each output terminal pair of an F-DO; the signal sources for the AND inputs can be selected: ● No signal source (input set to logical HIGH; default) ● Status signals of the drive of drive group 1 to 4 For additional information on status signals, refer to the chapter "F-DO overview" in the "Control by means of TM54F terminals". Test selection F-DO (p10046 [0..3]) The test stop for forced dormant error detection can be activated for each F-DO by means of a pull-down menu (for additional information, refer to the chapter "Forced dormant error detection", under Extended Functions).

Safety Integrated 76 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 LED in the F-DO screen The LED downstream of the AND element indicates the logical state (inactive: gray, active: green). The LED of the digital inputs DI20 to DI23 indicate the status of the digital input (inactive: gray, active: green). 6.2.5 Control interface Control interface screen Figure 6-5 Control interface screen TM54F Functions of this screen: ● Selection of an F-DI for the STO, SS1, SS2, SOS and SLS functions and for SLS speed limits (bit coded) (p10022 to p10028). A separate screen is available for each drive group. An F-DI can be assigned several functions in several drive groups. ● Configuration of the "Safe State" signal (p10039) A failsafe output signal "Safe State" is generated for each drive group based on the following status signals:

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 77 – PWR_removed (STO active) – SS1 active – SS2 active – SOS active – SLS active The status signals with the same function and of different drives of a drive group are logically linked by AND operation. The status signals of individual functions (PWR_removed, SS1 active etc.) are logically linked by OR operation. The "Safe State" signals can be assigned to an F-DO. 6.3 PROFIsafe network transition with SIMOTION D The next sections deal with the configuration of PROFIsafe communication via PROFIBUS between the integrated drive unit SINAMICS S120 of a SIMOTION D or CX32 and a higher- level SIMATIC F-CPU. The configuration and operation of failsafe communication (named F-communication in the following, F = failsafe) is based on the following software and hardware requirements: Software packages to be installed on the programming device: ● STEP7 V5.4 + SP2 ● S7 F Configuration Pack V5.5 SP3 ● S7 Distributed Safety Programming V5.4 SP3 ● SIMOTION SCOUT V4.1.1 Hardware: ● The components which are compatible with PROFIsafe are listed in the chapter "Supported functions", under "Prerequisites for Extended Functions". Topology (network view of the project) The basic topology of components which participate in PROFIsafe communication via PROFIBUS is structured as follows (SIMATIC-F-CPU and D4x5 with integrated SINAMICS S120 or CX32):

Safety Integrated 78 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 0 0 0 352),%86'3 352),%86'3 ,QWHJUDWHG '3PDVWHU '3PDVWHU '3VODYH '3VODYH 6,0$7,& )&38 6,027,21'[ 352),VDIH QHWZRUNWUDQVLWLRQ 352),VDIH 6,1$0,&6 LQWHJUDWHG 'ULYH REMHFW 'ULYH REMHFW 6,1$0,&6 &; 'ULYH REMHFW '3VODYH Figure 6-6 Topology PROFIsafe, SIMATIC-F-CPU and D4x5 with integrated SINAMICS S120 or CX32 The drive unit (SINAMICS) and the SIMATIC F-CPU are located on different PROFIBUS subnets. This structure requires configuration of a PROFIsafe network transition to SIMOTION D. Configuring PROFIsafe communication The next sections describe the configuration of PROFIsafe communication between a SIMATIC F-CPU and a drive object of an integrated SINAMICS drive unit of a SIMOTION D. The procedure for configuring PROFIsafe communication between a SIMATIC F-CPU and a drive unit of a CX 32 is basically the same and is not covered separately. 1. Create an F-CPU or a CPU 317F-2 and a SIMOTION-D4x5 PLC (with integrated SINAMICS S120) in HW Config in accordance with the hardware installed. 2. Define a SIMOTION CPU for operation as DP slave and the F-CPU as associated DP master. 3. Configure the SINAMICS drive unit in SIMOTION SCOUT/STARTER in accordance with your hardware configuration.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 79 4. Create a PROFIsafe slot in the "Configuration" dialog box of the SINAMICS drive unit. Select the PROFIBUS message frame tab, select the drive object which is to communicate with the SIMATIC F-CPU via PROFIsafe, click "Insert line" and then select "PROFIsafe". Figure 6-7 Inserting a PROFIsafe slot Figure 6-8 PROFIBUS message frame 5. Transfer the new PROFIsafe slot to HW Config by clicking the "Transfer to HW Config" button. 6. Open HW Config of the F-CPU and interconnect the SIMOTION station with a PROFIBUS segment of the F-CPU. 7. The F-communication parameters are displayed in the DP slave (SIMOTION CPU) properties, "F Configuration" tab.

Safety Integrated 80 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 DP partner (F I/O): Properties of the SINAMICS drive. local: Properties of the SIMOTION CPU. Enter the logical start address for F-communication of the SIMOTION CPU in the "Address" row. The send and receive safety message frames are assigned an address space of 6 bytes which must be located outside the process image of the SIMOTION-CPU ( >= 64). Master (safety program): SIMATIC F-CPU properties. Select the "Address" (LADDR) row and enter the logical start address for F-communication of the SIMATIC F-CPU. The send and receive safety message frames are assigned an address space of 6 bytes which must be located within the process image of the SIMATIC F-CPU. This address can be used in the safety program of the SIMATIC F-CPU to access the PROFIsafe STW or ZSW. Figure 6-9 Master-slave coupling in PROFIsafe 8. Open HW Config of the SIMOTION CPU.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 81 Figure 6-10 SIMOTION D configuration 9. Double-click the icon of the SINAMICS drive unit and select the "Details" tab in the "Configuration" tab. Figure 6-11 PROFIsafe configuration for SINAMICS drive unit 10. Click "PROFIsafe…" and then define the F parameters which are important to F-communication. If the "PROFIsafe…" button is grayed out you can click on "Activate..." in order to enable the button function.

Safety Integrated 82 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Figure 6-12 Setting F parameters Setting F parameters: The top five failsafe parameters in this list are configured by default and cannot be edited. The following range of values is valid for the two remaining parameters: F_Dest_Add: 1-65534 F_Dest_Add determines the PROFIsafe destination address of the drive object. Any value within the range is allowed, however, it must be entered once again in the safety configuration of the drive in the SINAMICS drive unit. The F_Dest_Add value must be set in p9610 (CU) and in p9810 (Motor Module). Note The failsafe addresses (F-Dest_Add and F-Source_Add) are checked in terms of redundancy after you close the "PROFIsafe properties" dialog box. This function is only available if a master-slave link between the SIMOTION CPU and the SIMATIC F-CPU exists. F_WD_Time: 10- 65535 A valid current safety message frame must be received from the F-CPU within the monitoring time. The drive will otherwise go into safe state. Select a monitoring time of sufficient length to let the communication functions tolerate message frame delays, however, make allowances for appropriate short fault reaction times (e.g. to interruption of communications). For additional information on failsafe parameters, refer to the online help of the "PROFIsafe properties" dialog box ("Help" button). Compile HW Config of the SIMOTION CPU. Compile the F-CPU configuration data in HW Config.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 83 Note For information about the creation of a safety program and access to PROFIsafe user data (e. g STW and ZSW) within the safety program, refer to the "SIMATIC, S7 Distributed Safety - Configuring and Programming" Programming and Operating Manual. Safety configuration (online) in the SINAMICS drive 1. Call the configuration for Safety Integrated by selecting "Functions" at the SINAMICS drive entry in the tree structure. 2. Click "Change settings". Enter the default safety password "0" and then select the "Motion monitoring via PROFIsafe" setting in the screen. Figure 6-13 Motion monitoring via PROFIsafe

Safety Integrated 84 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Figure 6-14 Activating PROFIsafe settings 3. Enable the SOS and SLS functions, click the "Configuration" button and then enter the PROFIsafe address of the drive in hexadecimal notation at the already defined parameter F_Dest_Add in the configuration screen (refer to the chapter "Configuring PROFIsafe communication", item 10). Figure 6-15 PROFIsafe configuration, PROFIsafe address for the drive 4. Click "Copy parameters" and then click "Activate settings". Click "Entire project" to save your settings.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 85 Figure 6-16 Copying PROFIsafe parameters Figure 6-17 Activating PROFIsafe settings and saving the entire project 5. The following settings have to be made in the drive expert list and additional steps have to be taken in order to transfer the safety parameters: ● Set drive parameter p10 = 95 (commissioning mode). Enter the currently valid password by way of p9761. Set p9510 = 1 (isochronous PROFIBUS). In order to enable confirmation of your changes to data in the safety parameters (identical actual and target checksum), parameter p9701 = 172 (hex: AC) must be set. Reset p10 to zero. ● Execute "Copy RAM to ROM" for the SINAMICS project. ● Perform a POWER ON. The safety configuration data are now active in the drive.

Safety Integrated 86 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Acceptance inspection After having successfully completed configuring and commissioning, conduct an acceptance test of the drive's safety functions (refer to chapter 8). Observe the information with regard to the acceptance of PROFIsafe communication provided in the "SIMATIC, S7 Distributed Safety - Configuring and Programming" Programming and Operating Manual. In addition to the required printed copies of the inspection log files of the SIMATIC F-CPU, you should also generate a printed copy of the hardware configuration data of your SIMOTIOM CPU. Select "Station -> Print" in HW Config of the SIMOTION CPU. Check the failsafe parameters of the SINAMICS slave (particularly F-WD_TIME) based on this hardcopy. The signatures in the footer of all hardcopies should be identical in order to guarantee consistency of the printed copies. Archive the hardcopy alongside the inspection log files of the SIMATIC F-CPU and of the STEP7 project. Note The global signature of the safety program of the SIMATIC F-CPU changes if changes are made in HW Config to the failsafe parameters of the SINAMICS drive. The global signature therefore allows you to identify changes to safety-relevant settings in the F-CPU or in HW Config of the SIMOTION CPU (failsafe parameters of the SINAMICS slave). However, this global signature does not cover changes to failsafe drive parameters configured in SCOUT. 6.4 Commissioning PROFIsafe by means of STARTER/HW Config 6.4.1 Procedure for configuring PROFIsafe communication Example configuration The next sections deal with a sample configuration of PROFIsafe communication between a SINAMICS S120 drive unit and higher-level SIMATIC F-CPU operating as PROFIBUS master. The configuration and operation of failsafe communication (F-communication) is based on the following software and hardware requirements: Necessary software packages: ● STEP 7 V5.4 SP2 or higher ● S7 F Configuration Pack V5.5 SP3 or higher ● S7 Distributed Safety Programming V5.4 SP3 or higher ● STARTER V4.1.1 + Drive ES-Basic or SCOUT V4.1.1 Hardware: ● SIMATIC F-CPU e.g. CPU 317F-2

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 87 Topology (network view of the project) Components participating in F-communication via PROFIBUS are basically wired as follows: )+RVW )6ODYH 352),VDIH 6,0$7,& )&38 0 0 6,1$0,&6 &8 'ULYH REMHFW 'ULYH REMHFW Figure 6-18 Example of a PROFIsafe topology Configuring PROFIsafe communication The next sections describe the configuration of PROFIsafe communication between a SIMATIC F-CPU and a drive unit. Create an F-CPU such as CPU 317F-2 and a SINAMICS S120 in HW Config in accordance with the hardware installed. 1. Set up the SINAMICS S120 for operation as a DP slave and the connected F-CPU as associated DP master. 2. The PROFIsafe slots can be inserted by selecting "Insert object" in the DP slave properties, "Configuration" tab and must be configured by means of the PROFIsafe option. 3. The message frame configuration for F-communication is displayed in the DP slave properties (SINAMICS S120), "Configuration" tab.

Safety Integrated 88 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Figure 6-19 Example: PROFIsafe configuration (HW Config) 4. Double-click the icon of the SINAMICS drive unit and select the "Details" tab in the "Configuration" tab. 5. Click "PROFIsafe…" and then define the F parameters which are important to F- communication. Setting F parameters: Figure 6-20 PROFIsafe properties (HW Config) The top five failsafe parameters in this list are configured by default and cannot be edited. The following range of values is valid for the two remaining parameters:

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 89 F_Dest_Add: 1-65534 F_Dest_Add determines the PROFIsafe destination address of the drive object. Any value within the range is allowed, however, it must be entered once again in the safety configuration of the drive in the SINAMICS drive unit. The F_Dest_Add value must be set in p9610 (Control Unit) and in p9810 (Motor Module). You can handle these settings quite comfortably using the PROFIsafe STARTER screen (see the picture below) Figure 6-21 PROFIsafe STARTER configuration F_WD_Time: 10- 65535 A valid current safety message frame must have been received from the F-CPU within the monitoring time. The drive will otherwise go into safe state. Select a monitoring time of sufficient length to let the communication functions tolerate message frame delays, however, make allowances for appropriate short fault reaction times (e.g. to interruption of communications). For additional information on failsafe parameters, refer to the online help of the "PROFIsafe properties" dialog box ("Help" button). Compile the F-CPU configuration data in HW Config. 6.5 Commissioning a linear/rotary axis The section below outlines commissioning of the safety functions of a linear/rotary axis using a TM54F. 1. Go online in the STARTER, select the required drive object from the project tree of the STARTER and then select "Functions -> Safety Integrated" to open the start screen for the configuration of Safety Integrated. Click "Change settings". The commissioning mode is selected. You are only allowed to edit safety parameters in commissioning mode for Safety Integrated (p0010 = 95) after having entered the valid password in an input dialog box (parameter p9761 for drives or p10061 for TM54F).

Safety Integrated 90 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Figure 6-22 Safety commissioning of a linear/rotary axis 2. Select "Motion monitoring via TM54F" from the "Control selection" drop-down list box. 3. Enable the SOS, SLS function (p9501) by selecting it from the "Enables SOS, SLS" drop- down list box. Click the "Configuration" button. 4. The safety configuration screen of the drive opens. Figure 6-23 Safety drive configuration 5. Set the same monitoring clock cycle (safety clock cycle) as set at the TM54F (refer to the chapter "TM54 Configuration"). 6. Select the required drive type (linear/rotary axis) from the corresponding drop-down list box (p9502). Continue at item 12 if you have not changed the selected drive type.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 91 7. Close the screen. Click "Copy parameters" and then click "Activate settings" (exit commissioning mode, p0010=0). 8. Execute the "Copy RAM to ROM" function for the entire project by clicking the "Entire project" button. 9. Perform a POWER ON. The new parameterization is now active. 10. Go online again. The alarms indicate that safety commissioning was not completed (different actual and target checksum) can be ignored. 11. Upload the project to the programming device. The display of parameter units (rotary/linear axis) will be updated accordingly in STARTER. 12. Set up further configurations and update the parameters in accordance with currently required monitoring limits, timers or encoder settings. 6.6 Information pertaining to component replacements Replacing components For information about component replacements, refer to the chapter "Example of component replacements" in the SINAMICS S120 Function Manual FH1. WARNING Observe the instructions with regard to changes to software components or to changes to these in the chapter "Safety instructions"! 1. The faulty component was replaced in accordance with safety regulations. 2. Make sure that everybody has cleared the danger zone and then power up the machine. 3. Error F35150 (communication error, after replacement of a Motor Module) or F30711 is output with fault value 1031 (data transfer error after replacement of a Sensor Module). 4. With STARTER: – Click "Acknowledge hardware replacement" in the start screen of safety functions. 5. Without STARTER: – Start the copying function for Node Identifier (p9700 = 1D hex) – Confirm the hardware CRC on the drive object (p9701 = EC hex) Carry out these two tasks after having replaced a Sensor Module at drive object servo or vector, and after having replaced a Motor Module at drive object TM54F_MA (if installed). 6. Backup all parameters to the CompactFlash card 7. Perform a POWER ON at all components. 8. The alarms F01650/F30650 (acceptance test required) are output. 9. Before anyone is allowed to enter the danger zone again and before operation is resumed, select the STO function once and briefly move the drives affected by the

Safety Integrated 92 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 component replacement in plus and minus direction (+/-) with activated safety monitoring function (SLS, if parameterized) in order to verify proper functionality. 6.7 Information pertaining to series commissioning A commissioned project which has been uploaded to STARTER can be transferred to another drive unit including the existing safety parameterization. 1. Download the STARTER project to the drive unit. 2. The alarms F01650/F30650 (acceptance test required) are output. You can acknowledge these fault alarms as a complete acceptance test is not required if no changes were made to safety function parameters. 3. Click "Acknowledge hardware replacement" in the start screen of safety functions. 4. Backup all parameters to the CompactFlash card. 5. Perform a POWER ON at all components. 6. Before anyone is allowed to enter the danger zone again and before operation is resumed, select the STO function once and briefly move the drives affected by the component replacement in plus and minus direction (+/-) with activated safety monitoring function (SLS, if parameterized) in order to verify proper functionality.

93 Application examples 7 7.1 Safe Stop 1 (SS1, time-controlled) when protective door is locked, emergency stop switch-off ',66672 &8 (3  (3 0 (3  (3 0 (3  (3 0 $ < < < < <      < < < < 3( $      7. $ < < < < <      < < < < 3( $      7. /HDGLQJ FORVLQJFRQWDFW W!PV 'LJLWDOLQSXWV 'LJLWDORXWSXWV ',2)) ',/LQH 0RGXOH2)) '2 672DFWLYH '2'ULYH >Q@S '2'ULYH >Q@S 2Q 2II 0DLQV 0DLQ FLUFXLW EUHDNHU 4 6WDQGDUG 3/& <<PXVWEHRSHQRWKHUZLVHQRVZLWFKRQPRQLWRULQJRI6< (PHUJ VWRS RSHQ FORVH 0DLQ FLUFXLWEUHDNHU 4 0RWRU 0RGXOH 'ULYH 0RWRU 0RGXOH 'ULYH 6 2Q   6 6 3 &RQWURO 8QLW /LQH 0RGXOH 0 0 89 : 8 9 : 89 : 3 '2 '2 '2 '2 '2 ', ', ', ', ', ', ', ', 0 6 < 6 6 6 $ $ Figure 7-1 Application example

Safety Integrated 94 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 S 6DIHW\,QWHJUDWHG6DIH7RUTXH2IIDFWLYHLQJURXS 6DIHW\,QWHJUDWHGVLJQDOVRXUFHIRU 6DIH7RUTXH2II&RQWURO8QLW >QBDFW@6SHHGWKUHVKROGYDOXH /LQHFRQQHFWLRQ ,QIHHGUHDG\ 'ULYH 6LJQDOIORZLGHQWLFDOWRWKDWIRUGULYH 'ULYH 212))  2))2)) ,QIHHGUHDG\IURP/LQH0RGXOH b9 H[WHUQDO >[[[[@)XQFWLRQGLDJUDPQXPEHU $VRXWSXWV S  S  $VRXWSXW S  / / / 6DIHW\,QWHJUDWHGVLJQDOVRXUFHIRU6DIH7RUTXH2II0RWRU0RGXOH (39 (30 0 0 ','2 ','2 ','2 ದ   ದ $FWLYH/LQH0RGXOH 0RWRU0RGXOH a 0 a 0 0RWRU0RGXOH /LQH0RGXOH ', ', ', 0 0   ; ; ; ; ; ; ; ; ; ; ; ; >@ >@ U U U S  S  S  >@ >@ >@ S  >@ S  S >@ >@ >@ >@ >@ S  U U >@ >@ >@ U S  S  >@ >@ >@ >@ U ; ; (39 (30 ;  ; (39 (30 ; ; Figure 7-2 Safety Integrated signal flow application example Note This example illustrates implementation options. The solution required for the machine must be suitable for the machine function, which means that parameters and control commands are defined individually. NOTICE The fault responses and output functions (e.g. inversion or simulation) must not be changed or activated with respect to the factory setting.

Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 95 Description of functions With two SIGUARD safety combinations for emergency stop and the protective door, as well as a standard PLC, the system can be configured according to EN 954-1, category 3, and EN1037. The drives are brought to a standstill in accordance with stop category 1 to EN 60204-1. ● The "Safe Torque Off" safety function, which is integrated in the drive, complies with category 3 to EN 954-1 and SIL 2 to IEC 61508. The non-safe message "Safe Torque Off active" is sufficient. ● Safety combinations for emergency stop and protective door monitoring comply with category 4 (instantaneous enable circuits). ● The electric circuits for emergency stop and protective door monitoring are monitored for cross-circuits on two channels. ● Switches S4, S5, and S6 are positively-opening position switches corresponding to EN 1088. ● Being a higher-level circuit with contacts, the "Safe Stop 1 (SS1)" function also works if the PLC malfunctions or fails. ● I/O communication via the digital interface between the drive and PLC can also be replaced by non-safe standard communication (e.g. PROFIBUS). ● This application example is based on the basic functions "Safe Torque Off" (STO) and "Safe Stop 1" (SS1). The speed ramps and speed thresholds are monitored in non-safe mode. Note In order to implement the Emergency Stop function (stopping in an emergency - emergency stop) it is not absolutely necessary to electrically isolate the drive converter from the line supply using electromechanical switching devices according to EN 60204-1 (1998) and IEC60204-1 (2005). When work is carried-out on the motor or drive converter, the voltage must be disconnected via a main circuit-breaker (that can be locked-out). Other Standards (e.g. NFPA79-2002 / USA) specify additional requirements regarding the EMERGENCY STOP function. For the EMERGENCY SWITCHING-OFF function (switching-off in an emergency) according to EN 60204-1 (1998) and IEC 60204-1 (2005), the supply voltage to the equipment must be disconnected through an electromechanical switching device. The risk analysis to be carried-out by the machinery construction OEM must determine which emergency functions (emergency operations) are actually required for a specific application. Behavior for Emergency Stop An emergency stop is triggered by the S3 button ("Emergency stop"). The drive is brought to a standstill in accordance with stop category 1 of EN 60204-1. ● Open the safe enable contacts of the safety combination A1. This activates the "Safe Stop 1" drive function on two channels via terminal X122.2 (DI 1) on the Control Unit and terminals X21.3 (EP +24 V) and X21.4 (EP M) on the Motor Module. "Safe Torque Off" is selected after the set SS1 delay time (p9852, p9652) has elapsed. When all the grouped drives have reached the "Safe Torque Off active" status, this is signaled back via terminal X122.10 (DO 10: STO group active). ● The confirmation from the safety combination and the drive is monitored in the PLC to ensure that it is plausible.

Safety Integrated 96 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Behavior when the protective door is opened To issue a request to open the protective door, press the S2 button ("OFF"). The drive is brought to a standstill in accordance with stop category 1 of EN 60204-1. ● Resetting the PLC output DO 2 will trigger an SS1 at terminal X122.2 on the CU (DI 1) and at the EP terminals of the Motor Modules. The drives are immediately braked via the speed ramp (p1135). The speed ramp is not monitored for SS1. The pulses are safely canceled after the safe SS1 delay time (p9852, p9652) has elapsed. ● When all drives have executed the safe pulse cancelation, the feedback "STO in group active" (DO 10) is issued from the CU to the PLC. In addition, a request is made via the PLC (PLC: DI 7 and DI 8) if the drives have fallen below the preset speed threshold (D0 8 and DO 9: |n|

97 Acceptance test and acceptance report 8 8.1 General information Requirements for acceptance tests are derived from the EC Machinery Directive. IEC 22G WG 10 is currently working on a "Functional safety" standard which includes a detailed description of acceptance test requirements. The machine manufacturer (OEM) is committed accordingly ● to carry out an acceptance test for safety-related functions and machine parts ● to issue an "Acceptance certificate" which describes the test results. The acceptance test for systems with Safety Integrated Extended Functions (SI functions) is focused on validating the functionality of Safety Integrated monitoring and stop functions implemented in the drive system. The test objective is to verify proper implementation of the defined safety functions and of test mechanisms (forced dormant error detection measures) and to examine the response of specific monitoring functions to the explicit input of values outside tolerance limits. The test must cover all drive-specific Safety Integrated motion monitoring functions and global Safety Integrated functionality of Terminal Module TM54F (if used). Note A new acceptance test must be carried out if any changes were made to SI function parameters and must be logged in the acceptance report. Note The acceptance test is used to qualify the parameterization of safety functions. The measured values are used to check the plausibility of the configured safety functions. The measured values are typical but no worst case values. They represent the behavior of the machine at the time of measurement. These measurements cannot be used, for example, to derive maximum ramp-down values. Authorized person, acceptance report The test of each SI function must be carried out by an authorized person and logged in the acceptance report. The report must be signed by the person who carried out the acceptance test. The acceptance report must be kept in the logbook of the relevant machine. Access rights to SI parameters must be protected by password and be recorded accordingly in the acceptance report. In this context this is a person who is authorized by the machine manufacturer and who has adequate professional training and knowledge of the safety functions in order to conduct the acceptance test in a proficient manner.

8.1 General information Safety Integrated 98 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Note • Observe the information in the chapter "Procedures for initial commissioning". • The acceptance report presented below is both an example and recommendation. • An acceptance report template in electronic format is available at your local sales office. Necessity of an acceptance test A complete acceptance test (as described in this chapter) is required after initial commissioning of Safety Integrated functionality on a machine. An acceptance test, possible with reduced scope, is always required after safety-related functions were extended, after the transfer of commissioned objects to other series machines, after changes were made to the hardware and after software upgrades. A summary of conditions which determine the necessary test scope or proposals in this context is provided below. In order to define a partial acceptance test, it is necessary in the first instance to specify the acceptance test objects, and in the second instance to define logical groups which represent the elements of the acceptance test. The acceptance test must be carried out separately for each individual drive (as far as the machine allows). Prerequisites for the acceptance test ● The machine is properly wired. ● All safety equipment such as protective door monitoring devices, light barriers or emergency-off switches are connected and ready for operation. ● Commissioning of the open-loop and closed-loop control should be concluded, as the ramp-down path may otherwise change as a result of changed dynamic response of the drive controller, for example. These include, for example: – Configuration of the setpoint channel – Position control in the higher-level controller – Drive control Information on the acceptance test mode (p9370/p9570) The acceptance test mode can be activated by setting corresponding parameters (p9370/p9570). Safety alarms which must be reset by means of POWER ON and which are generated after activation can be acknowledged as usual. The acceptance test mode also allows operation of the drive beyond SOS limits (p9331/p9531). Activation of the acceptance test mode is therefore only useful in conjunction with the test of SOS and SLS functions with stop response STOP A or STOP B. The SOS can be selected either directly, or by way of SS2 (with deactivated acceptance test mode). Deactivate the SS2 brake ramp in SS2 state in active acceptance test mode in order to enable drive movements after having triggered a violation of standstill limits.

8.1 General information Safety Integrated Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 99 Content of the complete acceptance test Documentation Documentation of the machine and of safety functions 1. Machine description (with overview) 2. Specification of the controller (if this exists) 3. Configuration diagram 4. Function table Active monitoring functions depending on the operating mode, the protective doors and other sensors. This table should reflect the objective or results of project engineering. 5. SI functions for each drive 6. Information about safety equipment Function test Part 1 General function test, including a check of the wiring/programming 1. Test of shutdown paths (Test of forced dormant error detection at the inputs and outputs) 2. Test of the SS1 and SS2 stop functions 3. Test the forced dormant error detection of the inputs and outputs (only if a TM54F module is used) 4. Test of the emergency stop function and of safety circuits 5. Changeover test of SI functions Function test Part 2 Detailed function test and valuation of SI functions used. 1. Test of the SI function "Safe Operational Stop" (SOS) (with evaluated measurement diagram or measured values) 2. Test of the SI function "Safely Limited Speed" (SLS) (with evaluated measurement diagram or measured values) 3. Test of the SI function "Safe Speed Monitor" (SSM) (with evaluated measurement diagram or measured values) Conclusion of the report Report of the commissioning status tested and countersignatures 1. Inspection of SI parameters 2. Logging of checksums (for each drive) 3. Assigning and logging the Safety password (do not disclose in the report!) 4. RAM to ROM backup and upload of project data to the STARTER and backup of the project 5. Countersignature

8.1 General information Safety Integrated 100 Function Manual, (FHS) , 07/2007 Edition, 6SL3097-2AR00-0BP0 Appendix Effect of the acceptance test on specific measures Table 8-1 Scope of the acceptance test depending on specific measures Measure Documentation Function test Part 1 Function test Part 2 Conclusion of the report Replacement of the encoder system No No Test of failsafe actual value acquisition Supplementation New checksums and countersignature as required Replacement of an SMC/SME Module Supplementation of hardware data/configuration/ software version data No Test of failsafe actual value acquisition Supplementation New checksums and countersignature Replacement of a motor with DRIVE- CLiQ Supplementation of hardware data/configuration/ software version data No Test of failsafe actual value acquisition Supplementation New checksums and countersignature Replacement of the Control Unit power unit - hardware Supplementation of hardware data/configuration/ software version data No Partially, if the system scan cycle times or the dynamic response were changed (drive- specific) Supplementation New checksums and countersignature as required Replacement of SI- relevant distributed I/O devices Supplementation of hardware data/configuration/ software version data Yes, with comment restriction to replaced components No No Firmware - upgrade(CU/power unit/ Sensor Modules) Supplementation Version data yes, including a note informing of the time of implementation of the new functionality yes, if the system scan cycle times or the dynamic response were changed or test of the new functionality Supplementation New checksums and countersignature as required Change to a single limit (e.g. SLS limit) Supplementary SI function per drive No Partially, test of the changed limit Supplementation New checksums and countersignature Enhancement of functions (e.g. additional actuator, additional SLS stage) Supplementary SI functions per drive or function table yes, with note restriction to adapted parts as required Partially, test of any additional limits No if data are identical (check of checksums) Transfer of project data to other machines via series commissioning Possibly supplement to the machine description (check of the firmware version) Yes, with note No, if no changes were made to SI parameters No, if data are identical (check of checksums)