Siemens SINAMICS S120 Function Manual

(FHS), 07/2016 6SL3097-4AR00-0BP6 Preface Fundamental safety instructions 1 General information about SINAMICS Safety Integrated 2 Overview of Safety Integrated functions 3 Description of Safety Integrated functions 4 Control of the safety functions 5 Commissioning 6 Acceptance test 7 System features 8 Maintenance 9 Standards and regulations 10 Appendix A

Postfach 48 48 90026 NÜRNBERG GERMANY Document order number: 6SL3097-4AR00-0BP6 Ⓟ 06/2016 Subject to change Copyright © Siemens AG 2008 - 2016. All rights reserved Legal information Warning notice system This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are graded according to the degree of danger. DANGER indicates that death or severe personal injury will result if proper precautions are not taken. WARNING indicates that death or severe personal injury m ay result if proper precautions are not taken. CAUTION indicates that minor personal injury can result if proper precautions are not taken. NOTICE indicates that property damage can result if proper precautions are not taken. If more than one degree of danger is present, the warning notice representing the highest degree of danger will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property damage. Qualified Personnel The product/system described in this documentation may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with these products/systems. Proper use of Siemens products Note the following: WARNING Siemens products may only be used for the applications described in the catalog and in the relevant technical documentation. If products and components from other manufacturers are used, these must be recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance are required to ensure that the products operate safely and without any problems. The permissible ambient conditions must be complied with. The information in the relevant documentation must be observed. Trademarks All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owner. Disclaimer of Liability We have reviewed the contents of this publication to ensure consistency with the hardware and software described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this publication is reviewed regularly and any necessary corrections are included in subsequent editions.

5 Preface SINAMICS documentation The SINAMICS documentation is organized in the following categories: ● General documentation/catalogs ● User documentation ● Manufacturer/service documentation Additional information You can find information on the following topics at the following address (https://support.industry.siemens.com/cs/de/en/view/108993276): ● Ordering documentation/overview of documentation ● Additional links to download documents ● Using documentation online (find and search in manuals/information) Please send any questions about the technical documentation (e.g. suggestions for improvement, corrections) to the following e-mail address (mailto:[email protected]). Siemens MySupport/Documentation At the following address (https://support.industry.siemens.com/My/ww/en/documentation), you can find information on how to create your own individual documentation based on Siemens' content, and adapt it for your own machine documentation. Training At the following address (http://www.siemens.com/sitrain), you can find information about SITRAIN (Siemens training on products, systems and solutions for automation and drives). FAQs You can find Frequently Asked Questions in the Service&Support pages under Product Support (https://support.industry.siemens.com/cs/de/en/ps/faq). SINAMICS You can find information about SINAMICS at the following address (http://www.siemens.com/sinamics).

Usage phases and their documents/tools (as an example) Table 1 Usage phases and the available documents/tools Usage phase Document/tool Orientation SINAMICS S Sales Documentation Planning/configuration • SIZER Engineering Tool • Configuration Manuals, Motors Deciding/ordering SINAMICS S120 catalogs • SIMOTION, SINAMICS S120 and Motors for Production Machines (Catalog PM 21) • SINAMICS and Motors for Single-axis Drives (Catalog D 31) • SINUMERIK & SINAMICS Equipment for Machine Tools (Catalog NC 61) • SINUMERIK 840D sl Type 1B Equipment for Machine Tools (Catalog NC 62) Installation/assembly • SINAMICS S120 Manual for Control Units and Additional System Components • SINAMICS S120 Manual for Booksize Power Units • SINAMICS S120 Manual for Booksize Power Units C/D Type • SINAMICS S120 Manual for Chassis Power Units, Air-cooled • SINAMICS S120 Manual for Chassis Power Units, Liquid-cooled • SINAMICS S120 Manual for AC Drives • SINAMICS S120 Manual Combi • SINAMICS S120M Manual Distributed Drive Technology • SINAMICS HLA System Manual Hydraulic Drive Commissioning • STARTER Commissioning Tool • SINAMICS S120 Getting Started with STARTER • SINAMICS S120 Commissioning Manual with STARTER • SINAMICS S120 CANopen Commissioning Manual • SINAMICS S120 Function Manual Drive Functions • SINAMICS S120 Safety Integrated Function Manual • SINAMICS S120/S150 List Manual • SINAMICS HLA System Manual Hydraulic Drive • Startdrive commissioning tool1) • SINAMICS S120 Getting Started with Startdrive1) • SINAMICS S120 Commissioning Manual with Startdrive1) Usage/operation • SINAMICS S120 Commissioning Manual with STARTER • SINAMICS S120/S150 List Manual • SINAMICS HLA System Manual Hydraulic Drive • SINAMICS S120 Commissioning Manual with Startdrive1)

7 Usage phase Document/tool Maintenance/servicing • SINAMICS S120 Commissioning Manual with STARTER • SINAMICS S120/S150 List Manual • SINAMICS S120 Commissioning Manual with Startdrive1) References • SINAMICS S120/S150 List Manual 1) available as of Startdrive V14 release Target group This documentation is intended for machine manufacturers, commissioning engineers, and service personnel who use the SINAMICS drive system. Benefits This manual provides all of the information, procedures and operator actions required for the particular usage phase. Standard scope The scope of the functionality described in this document can differ from that of the drive system that is actually supplied. ● Other functions not described in this documentation might be able to be executed in the drive system. However, no claim can be made regarding the availability of these functions when the equipment is first supplied or in the event of service. ● The documentation can also contain descriptions of functions that are not available in a particular product version of the drive system. The functionality of the supplied drive system should only be taken from the ordering documentation. ● Extensions or changes made by the machine manufacturer must be documented by the machine manufacturer. For reasons of clarity, this documentation does not contain all of the detailed information on all of the product types, and cannot take into consideration every conceivable type of installation, operation and service/maintenance. Technical Support Country-specific telephone numbers for technical support are provided in the Internet at the following address (https://support.industry.siemens.com/sc/ww/en/sc/2090) in the "Contact" area.

Notation The following notation and abbreviations are used in this documentation: Notation for faults and alarms (examples): • F12345 Fault 12345 • A67890 Alarm 67890 • C23456 Safety message Notation for parameters (examples): • p0918 Adjustable parameter 918 • r1024 Display parameter 1024 • p1070[1] Adjustable parameter 1070, index 1 • p2098[1].3 Adjustable parameter 2098, index 1 bit 3 • p0099[0...3] Adjustable parameter 99, indices 0 to 3 • r0945[2](3) Display parameter 945, index 2 of drive object 3 • p0795.4 Adjustable parameter 795, bit 4

9 Table of Contents Preface................................................................................................................. 5 1 Fundamental safety instructions ................................................................................... 15 1.1 Fundamental safety instructions ..................................................................................... 15 1.1.1 General safety instructions ............................................................................................. 15 1.1.2 Industrial security .......................................................................................................... 16 1.2 Fundamental safety instructions for Safety Integrated ...................................................... 17 1.3 Residual risk ................................................................................................................. 21 2 General information about SINAMICS Safety Integrated ....................................................... 23 2.1 Drive products with integrated safety functions ................................................................ 23 2.2 Supported functions....................................................................................................... 24 2.3 Supported functions: HLA module................................................................................... 27 2.4 Examples of how the safety functions can be applied....................................................... 30 2.5 Drive monitoring with or without encoder ......................................................................... 32 3 Overview of Safety Integrated functions .......................................................................... 33 3.1 Safety Integrated Basic Functions................................................................................... 33 3.1.1 Safe Torque Off (STO)................................................................................................... 34 3.1.2 Safe Stop 1 (SS1) ......................................................................................................... 35 3.1.3 Safe Brake Control (SBC) .............................................................................................. 36 3.1.3.1 Hardware required for SBC ............................................................................................ 37 3.2 Safety Integrated Extended Functions............................................................................. 39 3.2.1 Preconditions for the Safety Extended Functions ............................................................. 39 3.2.2 Control possibilities........................................................................................................ 40 3.2.3 Safe Torque Off (STO)................................................................................................... 40 3.2.4 Safe Stop 1 (SS1) ......................................................................................................... 40 3.2.5 Safe Operating Stop (SOS) ............................................................................................ 43 3.2.6 Safe Stop 2 (SS2) ......................................................................................................... 45 3.2.6.1 How does SS2 function in detail? ................................................................................... 45 3.2.7 Safely Limited Speed (SLS) ........................................................................................... 47 3.2.8 Safe Speed Monitor (SSM)............................................................................................. 53 3.2.9 Safe Direction (SDI)....................................................................................................... 55 3.2.10 Safely-Limited Position (SLP) ......................................................................................... 57 3.2.11 Safe referencing ............................................................................................................ 58 3.2.12 Transferring safe position values (SP)............................................................................. 59 3.2.13 Safe Brake Test ............................................................................................................ 60 4 Description of Safety Integrated functions ........................................................................ 61 4.1 Safety Integrated basic functions .................................................................................... 62 4.1.1 Safe Torque Off (STO)................................................................................................... 62 4.1.1.1 Safe Torque Off (STO) for SINAMICS HLA ..................................................................... 66

Safety Integrated 10 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.1.2 Safe Stop 1 (SS1, time controlled)...................................................................................68 4.1.2.1 SS1 with OFF3...............................................................................................................68 4.1.2.2 SS1 with external stop ....................................................................................................69 4.1.2.3 Function diagrams and parameters .................................................................................70 4.1.3 Safe Brake Control (SBC) ...............................................................................................71 4.1.3.1 SBC for Motor Modules in the chassis format ...................................................................73 4.1.3.2 Function diagrams and parameters .................................................................................75 4.1.4 Safety faults ...................................................................................................................76 4.1.5 Forced dormant error detection (test stop) .......................................................................78 4.1.6 Function diagrams and parameters .................................................................................79 4.2 Safety Integrated Extended Functions .............................................................................80 4.2.1 License for Extended Functions ......................................................................................80 4.2.2 Differences between Extended Functions "with encoder" and "without encoder" .................80 4.2.3 Restrictions for Safety Integrated Functions "without encoder" ..........................................82 4.2.4 Safe Torque Off (STO) ...................................................................................................86 4.2.5 Safe Stop 1 (SS1) ..........................................................................................................87 4.2.5.1 Safe Stop 1 with encoder ................................................................................................87 4.2.5.2 Safe Stop 1 without encoder ...........................................................................................89 4.2.5.3 Safe Stop 1 with external stop .........................................................................................90 4.2.5.4 Function diagrams and parameters .................................................................................91 4.2.6 Safe Brake Control (SBC) ...............................................................................................91 4.2.7 Safe Operating Stop (SOS).............................................................................................92 4.2.8 Safe Stop 2 (SS2) ..........................................................................................................94 4.2.8.1 Interaction with EPOS.....................................................................................................95 4.2.8.2 SS2 with external stop (SS2E) ........................................................................................96 4.2.8.3 Overview of important parameters ...................................................................................98 4.2.9 Safely-Limited Speed (SLS) ............................................................................................99 4.2.9.1 Safely Limited Speed (SLS) .......................................................................................... 100 4.2.9.2 Safely Limited Speed without encoder ........................................................................... 103 4.2.9.3 Safely-Limited Speed without selection .......................................................................... 105 4.2.9.4 Function diagrams and parameters ............................................................................... 106 4.2.9.5 EPOS and safe setpoint velocity limitation ..................................................................... 107 4.2.10 Safe Speed Monitor (SSM) ........................................................................................... 108 4.2.10.1 Safe Speed Monitor with encoder .................................................................................. 109 4.2.10.2 Safe Speed Monitor without encoder ............................................................................. 111 4.2.10.3 Function diagrams and parameters ............................................................................... 114 4.2.11 Safe Direction (SDI) ..................................................................................................... 115 4.2.11.1 Safe Direction with encoder .......................................................................................... 115 4.2.11.2 Safe Direction without encoder...................................................................................... 117 4.2.11.3 Safe Direction without selection..................................................................................... 119 4.2.11.4 Function diagrams and parameters ............................................................................... 120 4.2.12 Safely-Limited Position (SLP) ........................................................................................ 121 4.2.12.1 Retraction .................................................................................................................... 124 4.2.12.2 Function diagrams and parameters ............................................................................... 126 4.2.13 Safe referencing........................................................................................................... 127 4.2.14 Transferring safe position values (SP) ........................................................................... 129 4.2.15 Safe Brake Test (SBT).................................................................................................. 132 4.2.15.1 Communication via SIC/SCC ........................................................................................ 139 4.2.15.2 Function diagrams and parameters ............................................................................... 141 4.2.16 Safe Acceleration Monitor (SAM)................................................................................... 142 4.2.17 Safe Brake Ramp (SBR) ............................................................................................... 144

Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 11 4.2.18 Safe actual value acquisition .........................................................................................147 4.2.18.1 Notes regarding safe actual value sensing using an encoder system ...............................147 4.2.18.2 Notes regarding setting parameters for safe actual value sensing without encoder ...........154 4.2.19 Safe gearbox stage switchover ......................................................................................157 4.2.20 Forced dormant error detection (test stop)......................................................................160 5 Control of the safety functions ................................................................................... 167 5.1 Control possibilities.......................................................................................................167 5.2 Control signals by way of terminals on the Control Unit and Motor / Power Module ...........168 5.2.1 Simultaneity and tolerance time of the two monitoring channels.......................................171 5.2.2 Bit pattern test ..............................................................................................................173 5.3 Activation via PROFIsafe ..............................................................................................174 5.3.1 Enabling of the control via PROFIsafe............................................................................175 5.3.2 Selecting a PROFIsafe telegram....................................................................................176 5.3.3 Telegram format ...........................................................................................................177 5.3.4 Process data ................................................................................................................179 5.3.4.1 S_STW1 and S_ZSW1 (Basic Functions) .......................................................................179 5.3.4.2 S_STW2 and S_ZSW2 (Basic Functions) .......................................................................181 5.3.4.3 S_STW1 and S_ZSW1 (Extended Functions) .................................................................183 5.3.4.4 S_STW2 and S_ZSW2 (Extended Functions) .................................................................185 5.3.4.5 Additional process data.................................................................................................188 5.3.5 Function diagrams and parameters................................................................................189 5.4 Control via TM54F ........................................................................................................190 5.4.1 Fault acknowledgment ..................................................................................................191 5.4.2 Overview of the F-DIs ...................................................................................................191 5.4.3 Overview of the F-DOs .................................................................................................193 5.5 Response for a communication failure via PROFIsafe or to the TM54F ............................196 5.5.1 STOP B as response to communication failure with PROFIsafe control ............................196 5.5.2 Initiating ESR for a communication failure ......................................................................197 5.6 Control of the Extended Functions via F-DI (for CU310-2) ...............................................199 5.6.1 Overview of the F-DIs ...................................................................................................200 5.6.2 Function of the F-DO ....................................................................................................202 5.7 Motion monitoring without selection ...............................................................................205 5.8 Safety Info Channel and Safety Control Channel ............................................................207 5.8.1 Safety Info Channel (SIC) .............................................................................................207 5.8.2 Safety Control Channel (SCC).......................................................................................207 5.8.3 Possible telegram configuration (700, 701).....................................................................207 5.8.4 Configuring ..................................................................................................................209 5.8.5 Applications .................................................................................................................210 5.8.6 Send data for SIC and SCC ..........................................................................................213 5.8.7 Receive data for SCC ...................................................................................................216 5.8.8 Overview of important parameters .................................................................................217 6 Commissioning..................................................................................................... 219 6.1 Safety Integrated firmware versions ...............................................................................219 6.2 Parameters, checksum, version.....................................................................................220 6.3 Handling the Safety password .......................................................................................222

Safety Integrated 12 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 6.4 DRIVE-CLiQ rules for Safety Integrated Functions.......................................................... 224 6.5 Forced dormant error detection (test stop) ..................................................................... 226 6.6 Commissioning Safety Integrated functions.................................................................... 229 6.6.1 General information ...................................................................................................... 229 6.6.2 Prerequisites for commissioning the Safety Integrated functions...................................... 231 6.6.3 Default settings for commissioning Safety Integrated functions without encoder ............... 232 6.6.4 Setting the sampling times ............................................................................................ 236 6.7 Commissioning: Basic procedure .................................................................................. 238 6.7.1 Basic Functions............................................................................................................ 238 6.7.1.1 Commissioning via direct parameter access................................................................... 238 6.7.1.2 Commissioning with STARTER ..................................................................................... 240 6.7.2 Commissioning of the Extended Functions with STARTER ............................................. 246 6.7.2.1 Extended Functions with encoder .................................................................................. 247 6.7.2.2 Extended Functions without encoder ............................................................................. 266 6.8 Commissioning CU310-2 using STARTER/SCOUT ........................................................ 282 6.8.1 Configuration start screen ............................................................................................. 283 6.8.2 F-DI/F-DO configuration................................................................................................ 284 6.8.3 Control interface of the drive ......................................................................................... 287 6.8.4 Forced dormant error detection (test stop) of the CU310-2 .............................................. 288 6.8.4.1 Test mode 1: Evaluation of internal diagnostic signal (passive load) ................................ 290 6.8.4.2 Test mode 2: Read back F-DO in DI (relay circuit) .......................................................... 291 6.8.4.3 Test mode 3: Read back F-DO into the DI (actuator with feedback signal) ....................... 292 6.8.4.4 Test stop mode parameters .......................................................................................... 293 6.9 Commissioning TM54F by means of STARTER/SCOUT................................................. 294 6.9.1 Basic sequence of commissioning ................................................................................. 294 6.9.2 Configuration start screen ............................................................................................. 295 6.9.3 Function diagrams and parameters ............................................................................... 296 6.9.4 TM54F configuration..................................................................................................... 297 6.9.5 F-DI/F-DO configuration................................................................................................ 300 6.9.6 Control interface of the drive group ................................................................................ 303 6.9.7 Forced dormant error detection (test stop) of the TM54F................................................. 305 6.9.7.1 Test mode 1: Evaluation of internal diagnostic signal (passive load) ................................ 307 6.9.7.2 Test mode 2: Read back F-DO in DI (relay circuit) .......................................................... 308 6.9.7.3 Test mode 3: Read back F-DO into the DI (actuator with feedback signal) ....................... 309 6.9.7.4 Parameter forced dormant error detection (test stop) ...................................................... 310 6.10 PROFIsafe communication ........................................................................................... 311 6.10.1 PROFIsafe via PROFIBUS ........................................................................................... 312 6.10.1.1 Configuring PROFIsafe via PROFIBUS ......................................................................... 312 6.10.2 PROFIsafe via PROFINET............................................................................................ 322 6.10.2.1 Assigning the IP address and the name ......................................................................... 322 6.10.2.2 Configuring PROFIsafe via PROFINET.......................................................................... 322 6.10.3 PROFIsafe configuration with STARTER ....................................................................... 330 6.10.3.1 Selecting a PROFIsafe telegram ................................................................................... 331 6.11 Commissioning a linear/rotary axis ................................................................................ 333 6.12 Modular machine concept Safety Integrated................................................................... 335 6.13 Information pertaining to series commissioning .............................................................. 336 6.14 Application examples.................................................................................................... 338

Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 13 7 Acceptance test .................................................................................................... 341 7.1 General information about the acceptance test ...............................................................344 7.2 Safety logbook .............................................................................................................346 8 System features.................................................................................................... 347 8.1 Latest information .........................................................................................................347 8.2 Certification ..................................................................................................................349 8.3 Probability of failure of the safety functions (PFH value) ..................................................350 8.4 Response times ...........................................................................................................351 8.4.1 Control of Basic Functions via terminals on the Control Unit and Motor Module (CU310-2 and CU320-2) ...............................................................................................352 8.4.2 Control of Basic Functions via PROFIsafe (CU310-2 and CU320-2).................................353 8.4.3 Control of Basic Functions via TM54F ............................................................................354 8.4.4 Control of Extended Functions with encoder via PROFIsafe (CU310-2 and CU320-2) .......355 8.4.5 Control of Extended Functions with encoder via TM54F (CU310-2 and CU320-2).............356 8.4.6 Control of Extended Functions with encoder via terminals (only CU310-2) .......................357 8.4.7 Control of Extended Functions without encoder via PROFIsafe (CU310-2 and CU320-2) .....................................................................................................................358 8.4.8 Control of Extended Functions without encoder via terminals (only CU310-2) ...................359 8.4.9 Control of Extended Functions without encoder via TM54F (CU310-2 and CU320-2) ........360 9 Maintenance........................................................................................................ 361 9.1 Information pertaining to component replacements .........................................................361 9.2 Note regarding firmware update ....................................................................................364 9.3 Safety faults .................................................................................................................365 9.3.1 Stop responses ............................................................................................................365 9.3.2 Stop response priorities ................................................................................................368 9.3.3 Acknowledging safety faults ..........................................................................................370 9.4 Message buffer ............................................................................................................371 10 Standards and regulations........................................................................................ 373 10.1 General information ......................................................................................................373 10.1.1 Aims ............................................................................................................................373 10.1.2 Functional safety ..........................................................................................................374 10.2 Safety of machinery in Europe.......................................................................................375 10.2.1 Machinery Directive ......................................................................................................375 10.2.2 Harmonized European Standards ..................................................................................376 10.2.3 Standards for implementing safety-related controllers .....................................................377 10.2.4 DIN EN ISO 13849-1 (replaces EN 954-1) .....................................................................379 10.2.5 EN 62061.....................................................................................................................380 10.2.6 Series of standards IEC 61508 (VDE 0803)....................................................................381 10.2.7 Risk analysis/assessment .............................................................................................382 10.2.8 Risk reduction ..............................................................................................................384 10.2.9 Residual risk ................................................................................................................384 10.2.10 EC declaration of conformity .........................................................................................384

Safety Integrated 14 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 10.3 Machine safety in the USA ............................................................................................ 385 10.3.1 Minimum requirements of the OSHA.............................................................................. 385 10.3.2 NRTL listing ................................................................................................................. 385 10.3.3 NFPA 79...................................................................................................................... 386 10.3.4 ANSI B11 .................................................................................................................... 386 10.4 Machine safety in Japan ............................................................................................... 387 10.5 Equipment regulations .................................................................................................. 388 10.6 Other safety-related issues ........................................................................................... 389 10.6.1 Information sheets issued by the Employer's Liability Insurance Association .................... 389 10.6.2 Additional references .................................................................................................... 389 A Appendix ........................................................................................................... 391 A.1 List of abbreviations ..................................................................................................... 391 A.2 Documentation overview............................................................................................... 401 A.3 Acceptance tests (recommendations) ............................................................................ 403 A.3.1 Contents and depth of the acceptance test .................................................................... 403 A.3.1.1 Content of the complete acceptance test ....................................................................... 403 A.3.1.2 Content of the partial acceptance test ............................................................................ 405 A.3.1.3 Test scope for specific measures .................................................................................. 407 A.3.1.4 Relevant checksums for the acceptance ........................................................................ 408 A.3.2 Acceptance reports ...................................................................................................... 409 A.3.2.1 Plant description - Documentation part 1........................................................................ 409 A.3.2.2 Description of safety functions - Documentation Part 2 ................................................... 411 A.3.3 Acceptance tests.......................................................................................................... 420 A.3.3.1 Acceptance tests – Basic Functions............................................................................... 422 A.3.3.2 Acceptance tests for Extended Functions (with encoder) ................................................ 426 A.3.3.3 Acceptance tests for Extended Functions (without encoder) ............................................ 481 A.3.3.4 Acceptance test for the transfer of F-DIs via PROFIsafe ................................................. 504 A.3.4 Completion of certificate ............................................................................................... 505 A.4 Stop variants................................................................................................................ 507 Index ................................................................................................................ 509

15 Fundamental safety instructions 1 1.1 Fundamental safety instructions 1.1.1 General safety instructions WARNING Danger to life if the safety instructions and residual risks are not observed If the safety instructions and residual risks in the associated hardware documentation are not observed, accidents involving severe injuries or death can occur. • Observe the safety instructions given in the hardware documentation. • Consider the residual risks for the risk evaluation. WARNING Danger to life or malfunctions of the machine as a result of incorrect or changed parameterization As a result of incorrect or changed parameterization, machines can malfunction, which in turn can lead to injuries or death. • Protect the parameterization (parameter assignments) against unauthorized access. • Respond to possible malfunctions by applying suitable measures (e.g. EMERGENCY STOP or EMERGENCY OFF).

1.1 Fundamental safety instructions Safety Integrated 16 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 1.1.2 Industrial security Note Industrial security Siemens provides products and solutions with industrial security functions that support the secure operation of plants, solutions, machines, equipment and/or networks. They are important components in a holistic industrial security concept. With this in mind, Siemens’ products and solutions undergo continuous development. Siemens recommends strongly that you regularly check for product updates. For the secure operation of Siemens products and solutions, it is necessary to take suitable preventive action (e.g. cell protection concept) and integrate each component into a holistic, state-of-the-art industrial security concept. Third-party products that may be in use should also be considered. For more information about industrial security, visit this address (http://www.siemens.com/industrialsecurity). To stay informed about product updates as they occur, sign up for a product-specific newsletter. For more information, visit this address (http://support.automation.siemens.com). WARNING Danger as a result of unsafe operating states resulting from software manipulation Software manipulation (e.g. by viruses, Trojan horses, malware, worms) can cause unsafe operating states to develop in your installation which can result in death, severe injuries and/or material damage. • Keep the software up to date. You will find relevant information and newsletters at this address (http://support.automation.siemens.com). • Incorporate the automation and drive components into a holistic, state-of-the-art industrial security concept for the installation or machine. You will find further information at this address (http://www.siemens.com/industrialsecurity). • Make sure that you include all installed products into the holistic industrial security concept. WARNING Danger to life due to software manipulation when using exchangeable storage media Storing files onto exchangeable storage media amounts to an increased risk of infection, e.g. with viruses and malware. As a result of incorrect parameterization, machines can malfunction, which in turn can lead to injuries or death. • Protect files stored on exchangeable storage media from malicious software by taking suitable protection measures, e.g. virus scanners.

1.2 Fundamental safety instructions for Safety Integrated Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 17 1.2 Fundamental safety instructions for Safety Integrated Note Malfunctions as a result of withdrawing and inserting components Malfunctions can occur when components are withdrawn or inserted that are used for Safety Integrated. However, this does not mean that the fail-safe state is exited. For example, PROFIsafe communication is not reestablished after this event. • Withdrawing and inserting components used for Safety Integrated (power units, Sensor Modules, TM54F) during operation and in the deactivated state is not permissible. Activating the components always requires a POWER ON (see section "Modular machine concept Safety Integrated (Page 335)"). Additional safety instructions and residual risks Additional safety information and residual risks not specified in this section are included in the relevant sections of this Function Manual. DANGER Risk minimization through Safety Integrated Safety Integrated can be used to minimize the level of risk associated with machines and plants. Machines and plants can only be operated safely in conjunction with Safety Integrated, however, when the machine manufacturer: • Precisely knows and observes this technical user documentation - including the documented limitations, safety information and residual risks. • Carefully constructs and configures the machine/plant. A careful and thorough acceptance test must then be performed by qualified personnel and the results documented. • Implements and validates all the measures required in accordance with the machine/plant risk analysis by means of the programmed and configured Safety Integrated functions or by other means. The use of Safety Integrated does not replace the machine/plant risk assessment carried out by the machine manufacturer as required by the EC machinery directive. In addition to using Safety Integrated functions, further risk reduction measures must be implemented. NOTICE Danger to life as a result of inactive Safety Integrated functions after powering up The Safety Integrated functions are only activated after the system has completely powered up. System startup is a critical operating state with increased risk. When accidents occur, this can result in death or severe injury. • Make sure that the machine is safe during the system start-up.

1.2 Fundamental safety instructions for Safety Integrated Safety Integrated 18 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 WARNING Regulations from EN 60204-1 The Emergency Stop function must bring the machine to a standstill according to stop category 0 or 1 (STO or SS1). The machine must not restart automatically after EMERGENCY STOP. When individual safety functions (Extended Functions) are deactivated, an automatic restart is permitted under certain circumstances depending on the risk analysis (except when Emergency Stop is reset). An automatic start is permitted when a protective door is closed, for example. WARNING System power-up and drive activation after changing or replacing hardware and/or software After hardware and/or software components have been modified or replaced, it is only permissible for the system to run up and the drives to be activated with the protective devices closed. Personnel shall not be present within the danger zone. It may be necessary to carry out a partial or complete acceptance test or a simplified functional test after having made certain changes or replacements. Before personnel may re-enter the hazardous area, the drives should be tested to ensure that they exhibit stable control behavior by briefly moving them in both the plus and minus directions (+/–). Please note the following during switch-on: The Safety Integrated functions are only available and can only be selected after the system has completely powered up. WARNING Danger to life when the drive coasts down for an STO or STOP A The category 0 stop function in accordance with EN 60204-1 (STO or STOP A to Safety Integrated) means that the drives are not decelerated but instead coast to standstill (the time required to coast to standstill depends on the kinetic energy). • Carefully take this response into account when designing the protective door interlocking logic. • For safety without encoder, you must apply other measures to ensure that the protective door remains locked until the drive has come to a standstill.

1.2 Fundamental safety instructions for Safety Integrated Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 19 WARNING Danger to life as a result of a malfunction due to an acceptance test that has not been carried out after changes to parameters have been made Safety Integrated functions cannot detect parameter changes made by the machine builder (OEM). Incorrect parameter changes for SI functions can result in accidents leading to death or severe injury. • After making a change to a parameter, always carry out an acceptance test and document the values in an acceptance report. • Only use the system or machine after the acceptance test has been successfully completed. WARNING Danger to life as a result of different responses of the Safety Integrated functions when replacing a Motor Module or a motor Motor Modules or the motor must be replaced with a device of the same type, as the parameter settings will otherwise lead to an incorrect response of the Safety Integrated functions. Functionality that has been modified can result in accidents leading to death or severe injury. • Always replace a component by an identical component of precisely the same type. • Readjust the drive involved when replacing an encoder. • Carefully test the functionality after replacement. WARNING Danger to life as a result of parameterized safety functions, which are only available to a restricted extent, when an internal or external fault occurs If an internal or external fault occurs, none or only some of the parameterized safety functions are available during the STOP F response triggered by the fault. • Carefully take this into account when parameterizing a delay time between STOP F and STOP B. This is especially true for vertical axes. WARNING Parameterizing the encoder system Encoder faults are detected using different hardware and software monitoring functions. • It is not permissible to disable these monitoring functions (i.e. the encoder monitoring in the Sensor Module) and they must be parameterized carefully. Depending on the fault type and the responding monitoring function, stop function category 0 or 1 in accordance with EN 60204-1 (fault response functions STOP A or STOP B to Safety Integrated) is selected (see table "Overview of stop responses" in Section "Safety Integrated Extended Functions", in the section "Safety faults").

1.2 Fundamental safety instructions for Safety Integrated Safety Integrated 20 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Note EDS switchover for safe motion monitoring An encoder which is used for safety functions must not be switched over when a drive data set (DDS) is switched over. The safety functions check the safety-relevant encoder data for changes when data sets are switched over. If a change is detected, fault F01670 is displayed with a fault value of 10, which results in a non-acknowledgeable STOP A. • The safety-relevant encoder data in the various data sets must therefore be identical. WARNING Converter operation despite active messages With activated safety functions, there are a number of system messages that still permit the drive to be traversed. In these cases, you must ensure that the causes of the messages are corrected immediately. These messages include, among others, the following: • A01774 SI Motion CU: Test stop required A01697 SI Motion: Motion monitoring test required Perform the required test stop. • A13000 Insufficient license. Purchase the license required for the operation of the Extended Functions. • A01669 (F, N) SI Motion: Unsuitable combination of motor and power unit. The motor / power unit combination can result in decreased robustness (incorrect detection of errors) in the system when operating with SI Motion.

1.3 Residual risk Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 21 1.3 Residual risk The fault analysis enables machine manufacturers to determine the residual risk at their machine with regard to the drive unit. The following residual risks are known: WARNING Residual risk through possible hardware faults: PFH value Due to the intrinsic potential of hardware faults, electrical systems are subject to additional residual risk, which can be expressed by means of the PFH value. • Take into account these residual risks when designing your machine and where necessary apply suitable countermeasures. WARNING Danger to life due to uncontrolled acceleration of the drive Faults in the absolute track (C-D track), cyclic interchange of the drive phases (V-W-U instead of U-V-W) and reversal of the control direction may cause acceleration of the drive. Category 1 and 2 stop functions according to EN 60204-1 (fault response functions Stop B to D according to Safety Integrated) that are provided are however not effective due to the fault. • Category 0 stop function according to EN 60204-1 (fault response function Stop A according to Safety Integrated) is not activated until the transition or delay time set in the parameter has expired. These faults are detected when SAM is selected (fault reaction functions STOP B/C) and stop function category 0 according to EN 60204-1 (fault reaction function STOP A according to Safety Integrated) is triggered as early as possible regardless of this delay. Electrical faults (defective components or similar) may also lead to the response stated above. WARNING Danger to life due to short, limited movements of the motor. Simultaneous breakdown of 2 power transistors in the power unit can cause a short, limited movement. This can cause accidents resulting in serious injuries or death. • If there is a hazard due to unwanted movement in your application, take measures to counter it, for example, by using a brake with safe monitoring. Further information can be found in Section "Safe Brake Control (SBC) (Page 71)". WARNING Danger to life due to higher speeds of short duration when the limit value is exceeded Violation of limits may briefly lead to a speed higher than the speed setpoint, or the axis may pass the defined position to a certain extent, depending on the dynamic response of the drive and on parameter settings. • Take into account this situation when designing your machine and where necessary apply suitable countermeasures.

1.3 Residual risk Safety Integrated 22 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 WARNING Residual risk for a single-encoder system Within a single-encoder system: a) A single electrical fault in the encoder b) A break of the encoder shaft (or loose encoder shaft coupling), or a loose encoder housing will cause the encoder signals to remain static (that is, they no longer follow a movement while still returning a correct level), and prevent fault detection while the drive is in stop state (for example, drive in SOS state). Generally, the drive is held by the active closed-loop control. Especially for drives with suspended load, from a closed-loop control perspective, it is conceivable that drives such as these move without this being detected. The risk of an electrical fault in the encoder as described under a) is only present for few encoder types employing a specific principal of operation. • All of the faults described above must be included in the risk analysis of the machine manufacturer. Additional safety measures have to be taken for drives with suspended/vertical or pulling loads - e.g. in order to exclude faults under a): – Use of an encoder with analog signal generation – Use of a two-encoder system • In order to exclude the fault described in b), for example: – Perform an FMEA regarding encoder shaft breakage (or slip of the encoder shaft coupling) as well as loose encoder housings and use a fault exclusion process according to IEC 61800-5-2, or – Implementation of a two-encoder system (the encoders must not be mounted on the same shaft).

23 General information about SINAMICS Safety Integrated 2 2.1 Drive products with integrated safety functions

2.2 Supported functions Safety Integrated 24 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 2.2 Supported functions All of the Safety Integrated functions available under SINAMICS S120 are listed in this section. SINAMICS makes a distinction between Safety Integrated Basic Functions and Safety Integrated Extended Functions. The safety functions listed here conform to: ● Safety Integrity Level (SIL) 2 according to IEC 61508 ● Category 3 according to DIN EN ISO 13849-1 ● Performance level (PL) d according to DIN EN ISO 13849-1 The safety functions correspond to the functions according to DIN EN 61800-5-2 (under the assumption that they are defined there). Safety Integrated Basic Functions These functions are part of the standard scope of the drive and can be used without requiring an additional license. These functions are always available. These functions do not require an encoder and/or do not place any special requirements on the encoder used. ● Safe Torque Off (STO) Safe Torque Off is a safety function to avoid unexpected startup in accordance with EN 60204-1. STO prevents the supply of power to the motor, which can produce a torque. This is equivalent to stop category 0. ● Safe Stop 1 (SS1, time-controlled) Safe Stop 1 is based on the "Safe Torque Off" function. This means that a Category 1 stop according to EN 60204-1 can be implemented. ● Safe Brake Control (SBC) Safe Brake Control is used to safely control a holding brake.1) 2) 1) Note regarding Power/Motor Modules in the chassis format: For the chassis format, SBC is only supported by Power/Motor Modules with article number ...3 or higher. A Safe Brake Adapter is also needed for this format. 2) Note regarding Power/Motor Modules in the blocksize format: Blocksize Power Modules also require a Safe Brake Relay for this function. Safety Integrated Extended Functions These functions require an additional safety license. Extended Functions with encoder require an encoder with safety capability (see Section "Notes regarding safe actual value sensing using an encoder system (Page 147)"). ● Safe Torque Off (STO) Safe Torque Off is a safety function to avoid unexpected starting in accordance with EN 60204-1. ● Safe Stop 1 (SS1, time and acceleration controlled) Safe Stop 1 is based on the "Safe Torque Off" function. This means that a Category 1 stop in accordance with EN 60204-1 can be implemented.

2.2 Supported functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 25 ● Safe Brake Control (SBC) Safe Brake Control is used to safely control a holding brake.1) 2) ● Safe Operating Stop (SOS) Safe Operating Stop is used to protect against unintentional movement. The drive is in closed-loop control mode and is not disconnected from the power supply. ● Safe Stop 2 (SS2) Safe Stop 2 is used to safely brake the motor with a subsequent transition into the "Safe Operating Stop" state (SOS). This means that a Category 2 stop in accordance with EN 60204-1 can be implemented. ● Safely Limited Speed (SLS) Safely Limited Speed monitors that the drive does not exceed a preset speed/velocity limit. ● Safe Speed Monitor (SSM) Safe Speed Monitor is used for safely identifying when a speed limit is undershot in both directions of motion, e.g. to identify zero speed. A fail-safe output signal is available for further processing. ● Safe Direction (SDI) Safe Direction is used to safely monitor the direction of motion. ● Safely Limited Position (SLP) Safely Limited Position ensures that a freely definable traversing range is not left. ● Transferring safe position values (SP) The "Transfer safe position values (SP)" function enables you to transfer a safe position to the higher-level control via PROFIsafe. ● Safe gearbox stage switchover The "Safe gearbox stage switchover" function facilitates reliable switching between different gearbox stages. The switchover is only possible via PROFIsafe. ● Safe Brake Test (SBT) The diagnostic function "Safe Brake Test" function (SBT) checks the required holding torque of a brake (operating or holding brake). 1) Note regarding Power/Motor Modules in the chassis format: For the chassis format, SBC is only supported by Power/Motor Modules with article number ...3 or higher. A Safe Brake Adapter is also needed for this design. 2) Note regarding Power/Motor Modules in the blocksize format: Blocksize Power Modules also require a Safe Brake Relay for this function. Note Parallel use of Safety Integrated Functions All Safety Integrated Functions can be used simultaneously. Exception: If SOS and SLS are activated simultaneously, SOS has higher priority and overrides the SLS reaction.

2.2 Supported functions Safety Integrated 26 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6

2.3 Supported functions: HLA module Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 27 2.3 Supported functions: HLA module SINAMICS HLA and Safety Integrated SINAMICS HLA supports the following Safety Integrated functions: ● Basic Functions These functions are part of the standard scope of the drive and can be used without requiring an additional license. These functions are always available. These functions do not require an encoder and/or do not place any special requirements on the encoder used. – Safe Torque Off (STO) Safe Torque Off is a safety function to avoid unexpected startup in accordance with EN 60204-1. STO prevents the supply of power to the valve, which can produce a force. It is equivalent to stop category 0. – Safe Stop 1 (SS1, time-controlled) Safe Stop 1 is based on the "Safe Torque Off" function. This means that a Category 1 stop in accordance with EN 60204-1 can be implemented. ● Extended Functions Note Only Safety Integrated with encoder is possible SINAMICS HLA only supports Safety Integrated Extended Functions with encoder. These functions require an additional safety license. Extended Functions with encoder require an encoder with safety capability. Note Encoder types for SINAMICS HLA The following encoder types are permissible for SINAMICS HLA: • Single-encoder systems – DRIVE-CLiQ encoder with safety capability – sin/cos encoder connected via SME20/25, SME120/125 or SMC20 (1Vss, pure analog signal processing) • 2-encoder systems – Encoders with DRIVE-CLiQ connection – sin/cos encoder connected via SME20/25, SME120/125 or SMC20 (1Vss, pure analog signal processing) – HTL/TTL encoder connected via SMC30 (not in connection with SINUMERIK) – TTL encoder connected via the onboard interface of the HLA module (not in connection with SINUMERIK) – Safe Torque Off (STO) Safe Torque Off is a safety function that prevents the drive from restarting unexpectedly according to EN- 60204-1.

2.3 Supported functions: HLA module Safety Integrated 28 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 – Safe Stop 1 (SS1, time and acceleration controlled) Safe Stop 1 is based on the "Safe Torque Off" function. This means that a Category 1 stop in accordance with EN 60204-1 can be implemented. – Safe Operating Stop (SOS) Safe Operating Stop provides protection against unwanted movements. The drive is in closed-loop control mode and is not disconnected from the power supply. – Safe Stop 2 (SS2) Safe Stop 2 is used to safely brake the valve with a subsequent transition into the "Safe Operating Stop" state (SOS). This means that a Category 2 stop in accordance with EN 60204-1 can be implemented. – Safely Limited Speed (SLS) Safely Limited Speed ensures that the drive does not exceed a preset speed limit. – Safe Speed Monitor (SSM) Safe Speed Monitor is used for safely identifying when a speed limit is undershot in both directions of motion, e.g. to identify zero speed. A fail-safe output signal is available for further processing. – Safe Direction (SDI) Safe Direction is used to safely monitor the direction of motion. – Safely Limited Position (SLP) Safely Limited Position ensures that a freely definable traversing range is not left. – Transferring safe position values (SP) The "Transfer safe position values (SP)" function enables you to transfer a safe position to a higher-level control via PROFIsafe. Note Only "linear" axis type permitted For SINAMICS HLA, only the "linear" axis type is permitted.

2.3 Supported functions: HLA module Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 29 Commissioning in STARTER The Safety Integrated functions of SINAMICS HLA can be commissioned in STARTER as follows: Expert list STARTER screen forms Basic Functions Yes No Extended Functions Yes Yes Note Comparison, description of electric ↔ hydraulic drives In the Safety Integrated Function Manual, Safety Integrated functions are described from the perspective of an electric drive. However, these descriptions essentially also apply in the same way for hydraulic systems. You will find parameters and messages for the drive object HLA in the SINAMICS S120/S150 List Manual.

2.4 Examples of how the safety functions can be applied Safety Integrated 30 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 2.4 Examples of how the safety functions can be applied Safety function Application examples Possible solution STO It is only permissible to open a protective door if the motor torque has been switched off. • Select STO in the converter via a terminal or via PROFIsafe. • The pulses are suppressed and the motor coasts to a standstill. A central Emergency Stop button ensures that several drives cannot unintentionally start. Evaluating the Emergency Stop button in a cen- tral controller, selecting STO in the converter via PROFIsafe. SS1 The drive must brake as quickly as possible after the Emergency Stop button has been pressed. It is not permissible that the stationary motor undesira- bly accelerates. Select SS1 in the converter using a fail-safe input or via PROFIsafe . SBC Safe control of a motor holding brake must be guaranteed to guarantee the motor is at a stand- still. SBC is (if configured) initiated together with STO. The Motor Module / Safe Brake Relay / Safe Brake Adapter then carries out the action and safely controls the outputs for the brake. SOS The standstill position of the motor must be moni- tored and ensured. Select SOS, e.g. through SS2, in order to monitor the standstill position of the motor after braking. SS2 The drive must brake as quickly as possible after the stop button has been pressed. The standstill position of the motor must be monitored and en- sured. Select SS2in the converter using a fail-safe input or via PROFIsafe. SLS The machine operator must be able to enter the machine after the protective door has been opened and slowly move a horizontal conveyor with an acknowledgment button in the danger zone. Selecting SLS in the converter. The converter limits and monitors the velocity of the horizontal conveyor. A spindle drive, depending on the selection of the cutting tool, must not exceed a specific maximum speed. Selecting SLS and the corresponding SLS level in the converter via PROFIsafe. SSM A centrifuge may only be filled below a velocity defined by the user. If the Extended Functions are enabled, SSM is always 1). The function does not have to be se- lected. The converter safely monitors the centrifuge speed and enables the process to advance to the next step using the "SSM status" bit. 1) Exception: Motion monitoring without selection (Page 205) SDI A protective door must only be opened if a drive moves in the safe direction (away from the opera- tor). Selecting SDI in the converter; enable the protec- tive doors via status bit (PROFIsafe) of the con- verter. When replacing the pressure cylinders of the plates, the drive must only move in the safe direc- tion of rotation. Selecting SDI in the converter. Disabling the hazardous direction of rotation. Once the protection against jamming has been triggered, a roller shutter gate must only be able to start moving in one direction. At an operational limit switch, the trolley of a crane must only start in the opposite direction.

2.4 Examples of how the safety functions can be applied Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 31 Safety function Application examples Possible solution SLP The drive may not exit the specified position rang- es. Selection of SLP in the converter; inhibits the range that is not permitted. SP It is necessary to transmit a "safe position," for example, in the following use cases. • Safe cam sequencer • Calculation of the safe velocity • Safety concepts across axes – Multi-dimensional protection areas • Zone concepts – Safe response depending on the position of the axes – Different reaction to sensors The selection of SP in the converter enables you to transfer a safe position (i.e. absolute or relative position) to the higher-level controller via PROFIsafe. SBT The effect of a brake is reduced through wear. The diagnostic function "Safe Brake Test SBT" detects whether a brake is achieving the required braking effect. Safe gearbox stage switchover For a machine equipped with selector gearbox it must be ensured that the switchover is actually performed. The "Safe gearbox stage switchover" function ensures safe switchover between the gearbox stages.

2.5 Drive monitoring with or without encoder Safety Integrated 32 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 2.5 Drive monitoring with or without encoder If motors without a (safety-capable) encoder are being used, not all Safety Integrated functions can be used. Note Definition: "Without encoder" When "without encoder" is used in this manual, then this always means that either no encoder or no safety-capable encoder is being used. In operation without encoder the actual speed values are calculated from the measured electrical actual values. Therefore, speed monitoring is also possible during operation without encoder. Table 2- 1 Overview of Safety Integrated functions Functions Abbr. With encoder Without encoder Brief description Basic Functions Safe Torque Off STO Yes Yes Safe torque off Safe Stop 1 SS1 Yes Yes Safe stopping process according to stop category 1 Safe Brake Control SBC Yes Yes Safe brake control Extended Functions Safe Torque Off STO Yes Yes1) Safe torque off Safe Stop 1 SS1 Yes Yes1) Safe stop according to stop category 1 Safe Brake Control SBC Yes Yes1) Safe brake control Safe Operating Stop SOS Yes No Safe monitoring of the standstill position Safe Stop 2 SS2 Yes No Safe stop according to stop category 2 Safely Limited Speed SLS Yes Yes1) Safe monitoring of the maximum speed Safe Speed Monitor SSM Yes Yes1) Safe monitoring of the minimum speed Safe Direction SDI Yes Yes1) Safe monitoring of the direction of motion Safely Limited Position SLP Yes No Safely limited position Safe referencing SR Yes No Safe referencing Transferring safe position values SP Yes Yes1) Transferring safe position values Safe Brake Test SBT Yes No Safe test of the required holding torque of a brake Safe Acceleration Monitor SAM Yes Yes1) Safe monitoring of drive acceleration Safe Brake Ramp SBR Yes Yes1) Safe braking ramp Safe gearbox stage switch- over – Yes No – 1) The use of this safety function without encoder is permitted only for induction motors or synchronous motors of the SIEMOSYN series. The configuration of the Safety Integrated functions and the selection of monitoring with or without encoder is realized in the safety screens of the STARTER or SCOUT tools.

33 Overview of Safety Integrated functions 3 3.1 Safety Integrated Basic Functions Note Basic functions do not require an encoder The Safety Integrated Basic Functions are functions for safely stopping the drive. You do not require an encoder. Note Application of the Basic Functions The Basic Functions are available without any restrictions in all control modes, with and without an encoder, for synchronous, induction, and reluctance motors. Note Control via TM54F If you want to control the Safety Integrated Basic Functions via TM54F, set p9601.6 = 1. This chapter should provide first users with a quick overview of the principle mode of operation of safety functions. The entry into the description of the safety functions is based on the definition according to standard EN 61800-5-2 and some simple examples for using the function. The description of the functions is simplified, as far as possible to clearly shown essential properties and setting options. More information about the functions can be found in the following sections, e.g.: "Safety Integrated basic functions (Page 62)".

3.1 Safety Integrated Basic Functions Safety Integrated 34 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 3.1.1 Safe Torque Off (STO) Definition according to EN 61800-5-2: "The STO function prevents energy from being supplied to the motor, which can generate a torque." Examples of how the function can be used Example Possible solution It is only permissible to open a protective door if the motor torque has been switched off. • Select STO in the converter. • The pulses are suppressed and the motor coasts to a standstill. How does STO function in detail? The converter recognizes the selection of STO via a fail-safe input or via the safe communi- cation PROFIsafe. The converter then safely switches off the torque of the connected motor. Details and parameterization For further details and information on how to parameterize this function, refer to Chapter "Safe Torque Off (STO) (Page 62)".

3.1 Safety Integrated Basic Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 35 3.1.2 Safe Stop 1 (SS1) Definition according to EN 61800-5-2: "The function SS1 brakes the motor and trips the function STO after a delay time." Example of how the function can be used Example Possible solution After an Emergency Stop button has been pressed, the drive must be braked as quickly as possible and brought into the STO state. • Wire the Emergency Stop button with a fail-safe input. • Select SS1 via the fail-safe input. A central Emergency Stop button ensures that sev- eral drives are braked as quickly as possible and brought into the STO state. • Evaluating an emergency stop pushbutton in a central control. • Select SS1 via PROFIsafe. How does SS1 function in detail? Overview The drive decelerates once "Safe Stop 1" has been selected, and goes into the "Safe Torque Off" state once the delay time has expired. Select SS1 As soon as the converter identifies that SS1 has been selected via a terminal or via the PROFIsafe safe communication, the following happens: ● If, when selecting SS1, the motor is already switched off, then until the SS1 delay time expires, there is no response. STO becomes active after the time expires. ● If the motor is switched on when SS1 is selected, the inverter brakes the motor with the OFF3 ramp-down time. After the delay time, STO is triggered automatically.

3.1 Safety Integrated Basic Functions Safety Integrated 36 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Details and parameterization For further details and information on how to parameterize this function, see Section "Safe Stop 1 (SS1, time controlled) (Page 68)". 3.1.3 Safe Brake Control (SBC) Definition according to EN 61800-5-2: "The SBC function supplies a safe output signal to control a holding brake." Safe Brake Control (SBC) Example of how the function can be used Example Possible solution The safe control of a motor holding brake must be guaranteed in order to guarantee the motor is at a standstill. SBC is (if configured) initiated together with STO. The Motor Module / Safe Brake Relay / Safe Brake Adapter then carries out the action and safely controls the outputs for the brake. How does SBC function in detail? The converter recognizes the selection of STO via a fail-safe input or via the safe communi- cation PROFIsafe. The converter then safely switches off the torque of the connected motor. SBC is (if configured) initiated together with STO. The Motor Module / Safe Brake Relay / Safe Brake Adapter then car- ries out the action and safely controls the outputs for the brake. Details and parameterization For further details and information on how to parameterize this function, see Section "Safe Brake Control (SBC) (Page 71)".

3.1 Safety Integrated Basic Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 37 3.1.3.1 Hardware required for SBC Hardware required for SBC ● Safe Brake Relay The command for releasing or applying the brake is transferred to the Motor Module / Power Module via DRIVE-CLiQ. The Motor Module / Safe Brake Relay then carries out the action and appropriately activates the outputs for the brake. Image 3-1 Interconnecting the Safe Brake Relay using Blocksize as an example The brake cannot be directly connected to the Motor Module in the chassis format. The connection terminals are only designed for 24 VDC with 150 mA; the Safe Brake Adapter is required for higher currents and voltages. Note Additionally required hardware for other formats A Safe Brake Relay is also required for the "Safe Brake Control" in the blocksize format. With the chassis format (article numbers ending ...3 or higher), a Safe Brake Adapter is required. The Safe Brake Adapter is available for a 230 V AC brake control voltage.

3.1 Safety Integrated Basic Functions Safety Integrated 38 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Image 3-2 Interconnecting the Safe Brake Adapter

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 39 3.2 Safety Integrated Extended Functions This chapter should provide first users with a quick overview of the principle mode of operation of safety functions. The entry into the description of the safety functions is based on the definition according to standard EN 61800-5-2 and some simple examples for using the function. The description of the functions is simplified, as far as possible to clearly shown essential properties and setting options. More information about the functions can be found in the following sections, e.g.: "Safety Integrated Extended Functions (Page 80)". 3.2.1 Preconditions for the Safety Extended Functions ● For operation of the Safety Integrated Extended Functions, one license is required for each axis. ● An activated current controller in the drive ● Overview of hardware components that support the Extended Functions: – Control Unit CU320-2 – Control Unit CU310-2 – Motor Modules Booksize Compact – Motor Modules Booksize with an article number ending: -...3 or higher – Motor Modules Chassis with an article number ending: -...3 or higher – Motor Modules Cabinet with an article number ending: -...2 or higher – Power Modules Blocksize – Control Unit Adapter CUA31 as of article number: 6SL3040-0PA00-0AA1 – Control Unit Adapter CUA32 as of article number: 6SL3040-0PA01-0AA0 – For the safety functions with encoder: Motors with sin/cos encoder and encoder evaluation with DRIVE-CLiQ interface or via Sensor Module SMC20, SME20/25/120/125 The list of approved encoders can be found on the Internet at: http://support.automation.siemens.com Enter the number 33512621 there as search term or contact your local Siemens office.

3.2 Safety Integrated Extended Functions Safety Integrated 40 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 3.2.2 Control possibilities The following options are available for controlling Safety Integrated Extended Functions: ● PROFIsafe ● TM54F ● Onboard F-DI (CU310-2) ● Permanent selection (Safety Integrated functions without selection) 3.2.3 Safe Torque Off (STO) For the control options and the functionality for "Safe Torque Off" (STO), see Section "Safe Torque Off (STO) (Page 62)". 3.2.4 Safe Stop 1 (SS1) Definition according to EN 61800-5-2: "The function SS1 brakes the motor, moni- tors the magnitude of the motor decelera- tion within specified limits, and after a delay time or violation of a speed threshold, initi- ates the STO function." Example of how the function can be used Example Possible solution After an Emergency Stop button has been pressed, the drive must be braked as quickly as possible and brought into the STO state. • Wire the Emergency Stop button with a fail- safe input. • Select SS1 via the fail-safe input. • SS1 brakes the drive and then brings it into the STO state. A central Emergency Stop button ensures that several drives are braked as quickly as possible and brought into the STO state. • Evaluating an emergency stop pushbutton in a central control. • Select SS1 via PROFIsafe. • SS1 brakes the drives and then brings them into the STO state.

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 41 How does SS1 function in detail? Overview Using the SS1 function, the converter brakes the motor and monitors the absolute speed. If the motor speed is low enough or the delay time has expired, the converter safely switches off the motor torque using STO. Select SS1 As soon as the converter identifies that SS1 has been selected via a fail-safe input or via PROFIsafe safe communication, the following happens: ● If the motor has already been switched off when selecting SS1 then the converter safely switches off the motor torque (STO). ● If the motor is switched on when SS1 is selected, the converter brakes the motor with the AUS3 ramp-down time. Monitoring modes For the Extended Functions with or without encoder, you can choose between 2 different monitoring modes of the function SS1: ● Safe Brake Ramp (SBR) ● Safe Acceleration Monitor (SAM)

3.2 Safety Integrated Extended Functions Safety Integrated 42 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Brake ramp monitoring (with or without encoder) Acceleration monitoring (with or without encoder) • Using the SBR (Safe Brake Ramp) function, the converter monitors whether the motor speed decreases. • The gradient of the SBR function can be set via the reference velocity and the ramp-down time. The SBR function only starts after the "Delay for braking ramp". • The SBR function starts with the speed set- point, which was present at the instant in time that SS1 was selected. • If the converter detects that the speed has fallen below the speed threshold (standstill monitoring), it safely switches off the motor torque (STO). • The converter monitors the speed of the motor with the SAM function. • The converter prevents the motor from accel- erating again by having the monitoring function continuously track the speed as it decreases. • The converter reduces the monitoring thresh- old until the "Shutdown speed" has been reached. • The converter safely switches off the motor torque (STO), if one of the following conditions is fulfilled: – The speed has fallen below the shutdown speed SS1. – The maximum time until the torque is switched off has expired. Note SS1 with external stop (SS1E) If you use SS1E, neither of the two monitoring functions (SBR, SAM) is active. The drive must be shut down in SS1E within the delay time, for example, by a user program of a CPU. STO becomes active after the delay time expires. Details and parameterization For further details and information on how to parameterize this function, see Section "Safe Stop 1 (SS1) (Page 87)".

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 43 3.2.5 Safe Operating Stop (SOS) Definition according to EN 61800-5-2: "This SOS function is used for safe monitor- ing of the standstill position of a drive." Example of how the function can be used Example Possible solution A protective door must only be opened if a motor is in the safe standstill state. • Select SOS • A higher-level controller brakes the axis (e.g. position- controlled) down to standstill within the configured time be- tween the selection of SOS and when it becomes active. • Standstill is then safely monitored via the SOS function. The protected machine areas can be entered without having to shut down the machine as long as SOS is active. After SOS has been selected it becomes active after the parameterizable delay time has expired. The drive must be braked to standstill within this delay time (e.g. by the controller). Drive stopping is monitored using an SOS tolerance window. At the instant this function becomes active, the current actual position is stored as the comparison position until SOS is deselected again. Any delay time is cleared after SOS is deselected and the drive can be immediately moved. The drive is stopped with SS1 when the standstill tolerance window is violated. Note Contrary to SS1 and SS2, SOS does not automatically brake the drive The control still enters the setpoint. This means that in the user program of the control system, the system must respond to the "SOS selected" bit so that the control system brings the drive to a standstill within the delay time.

3.2 Safety Integrated Extended Functions Safety Integrated 44 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Image 3-3 Standstill tolerance Details and parameterization For further details and information on how to parameterize this function, see Section "Safe Operating Stop (SOS) (Page 92)".

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 45 3.2.6 Safe Stop 2 (SS2) Definition according to EN 61800-5-2: "The function SS2 brakes the motor, moni- tors the magnitude of the motor decelera- tion, and after a delay time, initiates the SOS function." Example of how the function can be used Example Solution A protective door must only be opened if a motor is in the safe standstill state. • Select SS2 in the converter via a terminal or via PROFIsafe . • After braking, the converter goes into the SOS state. Only then may the protective door be released. 3.2.6.1 How does SS2 function in detail? Overview The safety function SS2 monitors the load speed and initiates the SOS function if the SS2 delay time has expired. With SS2, braking is monitored on the OFF3 ramp. A faulty acceleration is de- tected and the drive then shuts down with STO. If you are operating the motor with closed-loop torque control, the converter switches to the closed-loop speed control mode when SS2 is selected.

3.2 Safety Integrated Extended Functions Safety Integrated 46 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Detailed description The fail-safe logic (e.g. F-CPU) selects the SS2 safety function via a fail-safe input or via the PROFIsafe safe communication. ● If, when selecting SS2, the motor is already at a standstill, after a delay time, the converter activates the Safe Operating Stop function (SOS). ● If the drive is not at standstill when SS2 is selected, it is braked along the OFF3 ramp. Braking is monitored with one of the following functions, depending on the setting in p9506: – "Safe Acceleration Monitor (SAM)" A faulty acceleration is therefore detected. – "Safe Brake Ramp (SBR)" In this way, a violation of the braking ramp is detected. After a delay time, the converter activates the Safe Operating Stop function (SOS). This function monitors the safe standstill of the drive. Braking behavior Image 3-4 Braking behavior and diagnostics of the safety function SS2 (example of SS2 with SAM)

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 47 Note SS2 with external stop (SS2E) If you use SS2E, neither of the two monitoring functions (SBR, SAM) is active. The drive must be shut down in SS2E within the delay time, for example, by a user program of a CPU. SOS becomes active after the delay time expires. Details and parameterization For further details and information on how to parameterize this function, see Section "Safe Stop 2 (SS2) (Page 94)". 3.2.7 Safely Limited Speed (SLS) Definition according to EN 61800-5-2: "The SLS function prevents the motor from exceeding the specified speed limit." Examples of how the function can be used Example Possible solution The machine operator must be able to enter the machine after the protective door has been opened and slowly move a horizontal conveyor with an ac- knowledgment button in the danger zone. • Select SLS in the converter via a fail-safe input or PROFIsafe . • The converter limits and monitors the velocity of the horizontal conveyor. A spindle drive, depending on the selection of the cutting tool, must not exceed a specific maximum velocity. • Select SLS and the corresponding SLSlevel in the converter via PROFIsafe.

3.2 Safety Integrated Extended Functions Safety Integrated 48 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 How does SLS function in detail? Overview 1. The inverter recognizes the selection of SLS via a fail-safe input or via the PROFIsafe safe communication. 2. SLS allows a motor to reduce its possibly inadmissibly high speed within a defined time. 3. SLS monitors the absolute value of the actual velocity. The SLS setpoint limit can be transferred to the higher-level motion controller (e.g. SIMOTION), where the velocity setpoint can be limited. In addition, you can configure the setpoint limit provided by SLS as maximum speed in the ramp- function generator. In this case, SLS limits the speed setpoint. Note SLS without selection As an alternative to controlling via terminals and/or PROFIsafe, there is also the option to parameterize the SLS function without selection. In this case, the SLS function is permanently active after POWER ON. You can find details about this in Section "Safely- Limited Speed without selection (Page 105)". Selecting SLS when the motor is switched on As soon as the converter detects the selection of SLS via a fail-safe input or via PROFIsafe safe communication, the following happens: ● To avoid a limit value being violated, the setpoint limit can be transferred to the higher- level motion controller (e.g. SIMOTION). The higher-level motion controller can then limit the velocity setpoint. ● If the speed setpoint limitation is interconnected to the ramp-function generator, the converter limits the speed to a value below the SLS monitoring. ● For SLS without encoder, you can select whether the converter monitors motor braking using the function SBR (Safe Brake Ramp) or not. For SLS with encoder, the SBR function cannot be selected.

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 49 With braking ramp monitoring1) (only without encoder) Without braking ramp monitoring (with or without encoder) • After the adjustable "delay time for the brak- ing ramp", using the SBR (Safe Brake Ramp) function, the converter monitors whether the velocity decreases. • The converter switches from SBR to SLS as soon as one of the following two conditions is fulfilled: – The SBR monitoring ramp has reached the value of the SLS monitoring. This case is shown in the diagram above. – After the actual velocity has reached the value of the SLS monitoring threshold, the system again waits for the "delay time for braking ramp" until SLS becomes active. • The converter monitors the load velocity after the "delay time for SLS switchover" has ex- pired. Advantages: • Already when braking, the converter detects as to whether the load velocity decreases too slowly. • The feedback signal "SLS active" generally comes earlier than without acceleration moni- toring. Advantage: • Commissioning is simplified, because instead of the subfunction SBR or SAM of the alterna- tive brake ramp monitoring, you only have to set the delay time. 1) The automatic reduction of the speed only takes effect when the ramp-function generator is inter- connected to the speed setpoint limitation.

3.2 Safety Integrated Extended Functions Safety Integrated 50 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Selecting SLS at low velocities If the motor velocity when selecting SLS is less than the SLSlimit, then the drive responds as follows: Deselecting SLS If the higher-level controller deselects SLS , then the converter deactivates limiting and monitoring. Switching over the monitoring limits When SLS is active, you can switchover between 4 different speed levels. An exception is "SLS without selection": In this case, there is only one limit.

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 51 Switching to a lower speed level With braking ramp monitoring1) (only without encoder) Without braking ramp monitoring (with or without encoder) • Once the "delay time for braking ramp" has elapsed, the converter monitors the motor ve- locity using the function SBR (Safe Brake Ramp). • The converter switches over from SBR moni- toring to level 2 of SLS monitoring as soon as one of the following conditions is fulfilled: – The SBR monitoring ramp has reached the value of the SLS monitoring. This case is shown in the diagram above. – The load velocity has decreased down to the value SLS monitoring and the "delay time for braking ramp" has expired. • The converter monitors the velocity with the lower SLS level after the "delay time for SLS changeover" has expired (this is the same de- lay time that applies after selecting the func- tion SLS). 1) The automatic reduction of the speed only takes effect when the ramp-function generator is inter- connected to the speed setpoint limitation.

3.2 Safety Integrated Extended Functions Safety Integrated 52 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Switching to a higher speed level If you switch over from a lower to a higher speed level, the converter immediately monitors the actual velocity against the higher velocity. Details and parameterization For further details and information on how to parameterize this function, see Section "Safely- Limited Speed (SLS) (Page 99)".

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 53 3.2.8 Safe Speed Monitor (SSM) Definition according to EN 61800-5-2: "The SSM function supplies a safe output signal to indicate whether the motor speed is below a specified limit value." Note SSM is a pure signaling function Unlike other Safety Integrated functions, exceeding the SSM limit value does not result in a drive-autonomous stop response. Example of how the function can be used Example Possible solution A centrifuge may only be filled below a velocity defined by the user. • SSM is activated by configuring the Safety Integrated Extended Functions. • The converter safely monitors the centrifuge speed and enables the process to advance to the next step using the "Status SSM" status bit. Details and parameterization For further details and information on how to parameterize this function, see Section "Safe Speed Monitor (SSM) (Page 108)".

3.2 Safety Integrated Extended Functions Safety Integrated 54 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 How does SSM function in detail? Requirements The safety function SSM cannot be selected or deselected using external control signals. SSM is active when you have set a monitoring velocity > 0 for SSM . Evaluating the speed The converter compares the load speed with the speed limit and signals if the limit value is undershot to the high-level control. Parameterizable hysteresis The parameterizable hysteresis ensures that the SSM output signal does not jump between the values "0" and "1" in the limit range. Image 3-5 Time response of the safety function SSM (Safe Speed Monitor)

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 55 3.2.9 Safe Direction (SDI) Definition according to EN 61800-5-2: "The SDI function prevents the motor shaft mov- ing in the wrong direction." Examples of how the function can be used Example Possible solution A protective door must only be opened if a drive moves in the safe direction (away from the operator). • Select SDI in the converter using a fail- safe input or PROFIsafe . • Enable the locking mechanism of the protective doors via the PROFIsafe status bit of the converter. When replacing the pressure cylinders of the plates, the drive must only move in the safe direction of rotation. • Select SDI in the converter using a fail- safe input or PROFIsafe . • In the converter, inhibit the direction of rotation that is not permitted. Once the protection against jamming has been trig- gered, a roller shutter gate must only be able to start moving in one direction. At an operational limit switch, the trolley of a crane must only be able to start in the opposite direction. How does SDI function in detail? SDI monitors the actual direction of rotation. The SDI setpoint limit can be transmit- ted to the higher-level motion control- ler (e.g. SIMOTION) to enable limitation of the velocity setpoint there. In addition, you can configure the setpoint limit provided by SDI as max- imum speed in the ramp-function generator. In this case, SDI limits the speed setpoint to the permissible di- rection. You can select to block either the positive or the negative direction of rotation via 2 fail-safe signals (F-DIs or PROFIsafe).

3.2 Safety Integrated Extended Functions Safety Integrated 56 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Selecting and deselecting SDI As soon as the converter identifies that SDI has been selected via a fail-safe input or via PROFIsafe safe communication, the following happens: ● You can also set a delay time, within which you can ensure that the converter moves in the enabled (safe) direction. ● You can also set a tolerance, within which the converter tolerates movement in the direction that has not been enabled (unsafe). You can avoid the triggering of faults during braking (overshoot) as well as in controlled standstill. ● After the delay time has expired, the converter monitors the direction of rotation of the motor. ● If the converter now moves in the blocked direction by more than the configured tolerance, a message will be output and the defined stop response will be initiated. Image 3-6 Time response of the safety function SDI (Safe Direction) Note SDI without selection As an alternative to controlling via terminals and/or PROFIsafe, there is also the option of parameterizing SDI without selection. In this case, SDI will be permanently active after POWER ON. You will find details of this in Chapter "Safe Direction without selection (Page 119)." Details and parameterization For further details and information on how to parameterize this function, see Section "Safe Direction (SDI) (Page 115)".

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 57 3.2.10 Safely-Limited Position (SLP) Definition according to EN 61800-5-2: "The SLP function prevents the motor shaft from exceeding the specified position limit(s)." The Safely Limited Position function (SLP) is used to safely monitor the limits of two traversing and/or positioning ranges, which are toggled between using a safe signal. Examples of how the function can be used Example Possible solution The drive must not exit the specified position ranges. • Selection of SLP in the converter; inhibiting the range that is not permitted. • After the enabled range has been exited, a parameterizable stop response is initiated. Features ● Selection via terminals or PROFIsafe ● 2 position ranges, each defined by a limit switch pair ● Safe switchover between the two position ranges ● Adjustable stop response ● To run the motor out of the prohibited range, you must perform a special sequence (see Chapter "Retraction (Page 124)"). Requirements ● The function is only available with a suitable encoder. ● The drive has to be safely referenced (see Chapter "Safe referencing (Page 58)"). Details and parameterization For further details and information on how to parameterize this function, see Section "Safely- Limited Position (SLP) (Page 121)".

3.2 Safety Integrated Extended Functions Safety Integrated 58 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 3.2.11 Safe referencing The "safe referencing" function allows a safe absolute position to be defined. This safe position is used for the following functions: ● Safely-Limited Position (SLP) (Page 57) ● Transferring safe position values (SP) (Page 59) General description In most cases, an external control performs referencing to an absolute position. The converter only performs this task in special cases (for example, EPOS). ● Referencing using an external control Requirement: No movement of the drive The reference position determined by the control is entered into parameter p9572 and is declared to be valid using p9573 = 89. ● Referencing by EPOS The SINAMICS EPOS function transfers, when referencing, the determined position directly to Safety Integrated. This can also take place during motion. ● User agreement The user agreement must be set (p9726 = p9740 = AC hex) within 2 seconds after referencing. Safety Integrated only evaluates the reference position if this is required by a function that has been enabled (e.g. SLP). Using diagnostics bit r9723.17, Safety Integrated indicates whether the drive has been referenced. Safety Integrated indicates the position of the drive in diagnostic parameters r9708 and r9713. Bit r9722.23 is set when the axis is safely referenced. Function diagrams (see SINAMICS S120/S150 List Manual) • 2821 SI Extended Functions - Safe referencing Details and parameterization For further details and information on how to parameterize this function, see Section "Safe referencing (Page 127)".

3.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 59 3.2.12 Transferring safe position values (SP) The "Safe Position (SP)" function enables you to transfer safe position values to the higher- level fail-safe controller (F-CPU) via PROFIsafe (telegram 901 or 902). From the position change over time, the F-CPU can also calculate the current velocity. In tele- gram 902, the values are transferred in 32-bit format, in telegram 901, in 16-bit format. After parameter assignment, release and POWER ON, the function is automatically selected and the values transferred. Please observe the following: ● For use as the safe absolute position, the "Absolute position" must also be enabled and then safely referenced. ● In order that the transferred position can be used, the actual position value must be valid. Using the time stamp that is also transferred, you can also calculate the velocity from the position values. If you only want to calculate the velocity, it is sufficient to enable the "Transfer of safe position values" without the "Absolute position." Details and parameterization For further details and information on how to parameterize this function, see Section "Transferring safe position values (SP) (Page 129)".

3.2 Safety Integrated Extended Functions Safety Integrated 60 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 3.2.13 Safe Brake Test The diagnostic function "Safe Brake Test" function (SBT) checks the required holding torque of a brake (operating or holding brake). You can test linear and rotary brakes. The drive purposely generates a force/torque against the applied brake. If the brake is operating correctly, the axis motion remains within a parameterized tolerance. If, however, a larger axis motion is detected, it must be assumed that the braking force/torque has deteriorated and maintenance is required. The "Safe Brake Test" function allows a safe test of up to two brakes: ● 1 motor holding brake and 1 external brake ● 2 external brakes ● 1 motor holding brake ● 1 external brake The Safe Brake Test (SBT) diagnostic function meets the requirements for Category 2 according to EN ISO 13849-1. Details and parameterization For further details and information on how to parameterize this function, see Section "Safe Brake Test (SBT) (Page 132)".

61 Description of Safety Integrated functions 4 Two-channel parameterization Parameterization of the Safety Integrated functions must be performed in two channels; i.e. there is one parameter each for the 1st and 2nd channel. These two parameters must be identically parameterized. For safety reasons, when using the STARTER commissioning tool (or SCOUT), you can only set the safety-related parameters of the first channel offline. To set the safety-related parameters of the second channel, proceed as follows: ● Activate the "Copy parameters after download" checkbox and then establish an online connection to the drive unit. Perform the download and then adapt the checksums. Execute the "Copy RAM to ROM" command and then a POWER ON. ● Or establish an online connection to the drive unit first and then duplicate the parameters by clicking the "Copy parameters" button on the start screen of the configuration. Because, in STARTER, you can set the safety-related parameters of the 2nd channel by copying, only the parameters of the 1st channel are stated in this manual. You will find the relevant parameters of the 2nd channel in the parameter description, e.g. in SINAMICS S120/S150 List Manual. On faults and alarms, only the error number of the 1st channel is stated.

4.1 Safety Integrated basic functions Safety Integrated 62 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.1 Safety Integrated basic functions Note Basic functions do not require an encoder The Safety Integrated Basic Functions are functions for safely stopping the drive. You do not require an encoder. Note Application of the Basic Functions The Basic Functions are available without any restrictions in all control modes, with and without an encoder, for synchronous, induction, and reluctance motors. Note Control via TM54F If you want to control the Safety Integrated Basic Functions via TM54F, set p9601.6 = 1. Note PFH values The PFH values of the individual SINAMICS S120 safety components can be found at: http://support.automation.siemens.com/WW/view/de/76254308 4.1.1 Safe Torque Off (STO) In conjunction with a machine function or in the event of a fault, the "Safe Torque Off" (STO) function is used to safely disconnect the torque-generating energy supply to the motor. A restart is prevented by the two-channel pulse suppression. The switching on inhibited prevents an automatic restart after deselection of STO. The two-channel pulse suppression function integrated in the Motor Modules / Power Modules is the basis for this function. Functional features of "Safe Torque Off" ● The function is completely integrated in the drive. It can be selected via terminals, TM54F or PROFIsafe from an external source. ● The function is drive-specific, i.e. it is available for each drive and must be individually commissioned. ● The function must be enabled via parameter.

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 63 ● When the "Safe Torque Off" function is selected, the following applies: – The motor cannot be started accidentally. – The pulse suppression safely disconnects the torque-generating energy supply to the motor. – The power unit and motor are not electrically isolated. ● The selection/deselection of the STO function also acknowledges the safety faults when the Basic Functions are used. The standard acknowledgment mechanism must also be performed. ● Extended acknowledgement: The selection/deselection of STO can also acknowledge the safety messages of the extended safety functions. This requires that the extended message acknowledgement is configured (p9507.0 = 1). If in addition to the "Extended Functions", the "Basic Functions via terminals" are also enabled, in addition to selection/deselection of STO via PROFIsafe or TM54F, acknowledgement is also possible by selection/deselection of STO via terminals. ● The status of the "Safe Torque Off" function is displayed using parameters (r9772, r9872, r9773 and r9774). WARNING Danger to life as a result of undesirable motor movement After the energy feed has been disconnected (STO active) the motor can undesirably move (e.g. the motor can coast down), therefore presenting risk to persons. • Take suitable measures to prevent undesirable movement, e.g. by using a brake with safety-relevant monitoring. For additional information, see Section "Safe Brake Control (SBC) (Page 71)". WARNING Danger to life as a result of undesirable motor movement Undesirable motor motion can occur if 2 power transistor simultaneously become defective (breakdown of the depletion layer). This can result in accidents leading to death or severe injury. • Take suitable measures to prevent undesirable movement, e.g. by using a brake with safety-relevant monitoring. For additional information, see Section "Safe Brake Control (SBC) (Page 71)". 1) The maximum movement can involve: ● Synchronous rotary motors: Max. movement = 180° / no. of pole pairs ● Synchronous linear motors: Max. movement = pole width

4.1 Safety Integrated basic functions Safety Integrated 64 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Enabling the "Safe Torque Off" function The "Safe Torque Off" function is enabled via parameter p9601: ● STO for the Safety Integrated Basic Functions: – p9601 = 1 hex (Basic Functions via onboard terminals) – p9601 = 8 hex (Basic Functions via PROFIsafe) – p9601 = 9 hex (Basic Functions via PROFIsafe and onboard terminals) – p9601 = 40 hex (basic functions via TM54F) – p9601 = 41 hex (basic functions via TM54F and onboard terminals) ● STO in the Safety Integrated Extended Functions (EF): – p9601 = 4 hex (EF via TM54F) – p9601 = 5 hex (EF via TM54F and basic functions via onboard terminals) – p9601 = C hex (EF via PROFIsafe) – p9601 = D hex (EF via PROFIsafe via onboard terminals) – p9601 = 25 hex (EF without selection and basic functions via onboard terminals) Selecting/deselecting "Safe Torque Off" The following is executed when "Safe Torque Off" is selected: ● Each monitoring channel triggers safe pulse suppression via its switch-off signal path. ● A motor holding brake is closed (if connected and configured). Deselecting "Safe Torque Off" represents an internal safety acknowledgment. The following is executed if the cause of the fault has been removed: ● Each monitoring channel cancels safe pulse suppression via its switch-off signal path. ● The Safety requirement "Close motor holding brake" is canceled. ● Any pending STOP F or STOP A commands are canceled (see r9772). ● The messages in the fault memory must also be reset using the general acknowledgment mechanism. Note No message for selection/deselection within the tolerance time (p9650) If "Safe Torque Off" is selected and deselected through one channel within the tolerance time p9650, the pulses are suppressed without a message being output. However, if you want a message to be displayed, then you must reconfigure N01620 as an alarm or fault using p2118 and p2119.

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 65 Restart after the "Safe Torque Off" function has been selected 1. Deselect the function. 2. Set drive enables. 3. Cancel the "switching on inhibited" and switch the drive back on. – 1/0 edge at input signal "ON/OFF1" (cancel "switching on inhibited") – 0/1 edge at input signal "ON/OFF1" (switch on drive) Status for "Safe Torque Off" The status of the function STO is displayed via r9772, r9872, r9773, and r9774. Alternatively, you can display the status of the function via the configurable message N01620 (configuration via p2118 and p2119). Response time for the "Safe Torque Off" function For the response times when the function is selected/deselected via input terminals, see the table in Section "Response times (Page 351)". Internal armature short-circuit with the "Safe Torque Off" function The function "internal armature short-circuit" can be configured together with the "STO" function. The "STO" safety function has the higher priority when simultaneously selected. If the "STO" function is initiated, then an activated "internal armature short-circuit" is disabled. Function diagrams (see SINAMICS S120/S150 List Manual) • 2810 SI Basic Functions - STO (Safe Torque Off), SS1 (Safe Stop 1) • 2811 SI Basic Functions - STO (Safe Torque Off), safe pulse suppression Overview of important parameters (see SINAMICS S120/S150 List Manual) • p9601 SI enable functions integrated in the drive (Control Unit) • r9720 CO/BO: SI Motion drive-integrated control signals • r9722 CO/BO: SI Motion drive-integrated status signals • r9772 CO/BO: SI Status (Control Unit) • r9773 CO/BO: SI Status (Control Unit + Motor Module) • r9774 CO/BO: SI Status (group STO)

4.1 Safety Integrated basic functions Safety Integrated 66 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.1.1.1 Safe Torque Off (STO) for SINAMICS HLA For the HLA module, safe torque off (STO) corresponds to shutting off a safety-relevant shutoff valve. Special features of STO for HLA ● The shutoff valve controls the infeed to the hydraulic circuit. The shutoff valve is controlled via an F-DO of SINAMICS HLA. ● For Safety Integrated functions, it is absolutely necessary that a shutoff valve is connected with the associated feedback signals. ● You configure the feedback signal contacts of the shutoff valve using parameter p9626. ● You can take into account the response times of the feedback signals using parameter p9625. ● The shutoff valve is safely closed by selecting STO. If the shutoff valve signals a safe state via the feedback signal(s), the "STO active/Power removed" state is displayed, and is output at the configured safety-relevant output (PROFIsafe feedback signal telegram, F-DO on TM54F). Image 4-1 Interconnecting the shutoff valve (for an axis) ● F-DO is dynamized each time that STO is selected/deselected: "Diag DO+" and "Diag DO-" are checked when switching F-DO+ and F-DO-.

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 67 ● This makes it unnecessary to select forced dormant error detection (test stop) explicitly. ● If an error occurs in forced dormant error detection (test stop), the converter will issue the fault F01632 or F30632. Function diagrams (see SINAMICS S120/S150 List Manual) • 2810 SI Basic Functions - STO (Safe Torque Off), SS1 (Safe Stop 1) • 2811 SI Basic Functions - STO (Safe Torque Off), safe pulse suppression Overview of important parameters (see SINAMICS S120/S150 List Manual) • p9625[0...1] SI HLA shutoff valve wait time (CU) • p9626 SI HLA shutoff valve feedback contacts configuration (CU) • r9773 CO/BO: SI Status (Control Unit + Hydraulic Module) • r9774 CO/BO: SI Status (group STO) • r9780 SI monitoring cycle (Control Unit)

4.1 Safety Integrated basic functions Safety Integrated 68 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.1.2 Safe Stop 1 (SS1, time controlled) 4.1.2.1 SS1 with OFF3 The "Safe Stop 1" (SS1) function allows the drive to be stopped in accordance with EN 60204-1, Stop Category 1. The drive decelerates with the OFF3 ramp (p1135) once "Safe Stop 1" is selected and switches to "Safe Torque Off" once the delay time set in p9652 has elapsed. Note Selection via terminals The selection of the "Safe Stop 1" (time-controlled) function via terminals is parameterized by setting a delay > 0 in p9652. In this case, the STO function can no longer be selected directly via terminals, i.e. either STO or SS1 can be selected via terminals. If the "Safe Stop 1" (time-controlled) function has been selected by parameterizing a delay time in p9652, STO can no longer be selected directly via terminals. Functional features of Safe Stop 1 SS1 is enabled by p9652 (delay time) ≠ 0. ● Setting parameter p9652 has the following effect: – p9652 = 0 SS1 is not enabled. Only STO can be selected via TM54F, the onboard terminals and/or PROFIsafe. – p9652 > 0 SS1 is enabled. Only SS1 can be selected via the onboard terminals; with PROFIsafe, a selection of SS1 and STO is possible. ● When SS1 is selected, the drive is braked along the OFF3 ramp (p1135) and STO/SBC is automatically initiated after the delay time has expired (p9652). After the function has been selected, the delay timer runs down - even if the function is deselected during this time. In this case, after the delay time has expired, the STO/SBC function is selected and then again deselected immediately. Note Setting the delay time So that the drive is able to travel down the OFF3 ramp completely and any motor holding brake present can be applied, before the pulses have been safely deleted, the delay time should be set as follows: • Motor holding brake parameterized: Delay time p9652 ≥ p1135 + p1228 + p1217 • Motor holding brake not parameterized: Delay time p9652 ≥ p1135 + p1228 • The setting of parameter p1135 must be oriented towards the actual braking capability of the drive. ● The timer (p9652) after whose expiration STO is activated, is implemented with two channels, although deceleration along the OFF3 ramp is only one channel.

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 69 Requirement ● The Basic Functions are enabled via terminals and/or PROFIsafe: – p9601 = 1, 8 or 9 (hex) ● Enabling Basic Functions via TM54F – p9601.6 = 1 ● In order that the drive can brake down to a standstill even when selected through one channel, the time in p9652 must be shorter than the sum of the parameters for the data cross-check (p9650 and p9658). Otherwise the drive will coast down after the time p9650 + p9658 has elapsed. Status of Safe Stop 1 The status of the "Safe Stop 1" (SS1) function is displayed using the parameters r9772, r9872, r9773 and r9774. As an alternative, the status of the function can be displayed using the configurable message N01621 (configured using p2118 and p2119). 4.1.2.2 SS1 with external stop In drive line-ups (e.g. drives that are mechanically connected via the material), the drive- independent braking on the respective OFF3 ramp can cause problems. If the SS1E function is used, the safe delay time (p9562) is started when the function is selected, but no OFF3 is triggered. The higher-level controller still enters the setpoint. The controller receives the information that SS1E has been selected via the Safety Info Channel. WARNING Danger to life due to unsupervised axis motion During the unsupervised delay time, for "Safe Stop 1 (time-controlled) with external stop", unsupervised axis motion is possible. • If there is a hazard due to unwanted movement in your application, take measures to counter it, for example, by using a brake with safe monitoring. For more information, see Chapter "Safe Brake Control (SBC) (Page 71)". Differences between "SS1 with OFF3" and "SS1 with external stop" "SS1 with OFF3" and "SS1 with external stop" have the following differences: ● In order to activate "Safe Stop 1 with external stop", additionally set p9653 to 1. ● When SS1E is selected, the drive is not braked along the OFF3 ramp, but after the delay time has expired (p9652), only STO/SBC is automatically initiated.

4.1 Safety Integrated basic functions Safety Integrated 70 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.1.2.3 Function diagrams and parameters Function diagrams (see SINAMICS S120/S150 List Manual) • 2810 SI Basic Functions - STO (Safe Torque Off), SS1 (Safe Stop 1) • 2811 SI Basic Functions - STO (Safe Torque Off), safe pulse cancellation Overview of important parameters (see SINAMICS S120/S150 List Manual) • p1135[0...n] OFF3 ramp-down time • p1217 Motor holding brake closing time • p1228 Pulse suppression delay time • p9601 SI enable functions integrated in the drive (Control Unit) • p9652 SI Safe Stop 1 delay time (Control Unit) • r9772.0...23 CO/BO: SI Status (Control Unit) • r9773.0...31 CO/BO: SI Status (Control Unit + Motor Module) • r9774.0...31 CO/BO: SI Status (group STO) Only for "Safe Stop 1 (time-controlled) with external stop" • p9653 SI Safe Stop 1 drive-based braking response

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 71 4.1.3 Safe Brake Control (SBC) The "Safe Brake Control" function (SBC) is used to safely control holding brakes that function according to the closed-circuit principle (e.g. motor holding brake). The opening and closing of the brake is controlled by the Motor Module / Power Module. Terminals are available for this on the device in booksize format. A Safe Brake Relay is also required for the "Safe Brake Control" in the blocksize format. A Safe Brake Adapter is required in the chassis format (starting with article numbers ending with ...3). When the Power Module is configured automatically, the Safe Brake Relay is detected and the motor holding brake type is defaulted (p1278 = 0). Brake activation via the brake connection on the Motor Module / Safe Brake Relay (SBR) / Safe Brake Adapter (SBA) involves a safe, two-channel method. Note No SBC for SINAMICS HLA SINAMICS HLA does not support Safe Brake Control. Note Controlling the brake via a relay for "Safe Brake Control": If you use the "Safe Brake Control (SBC)" function, the use of relays/contactors can cause faults in the brake control when brakes are switched. For this reason, this type of control is not generally enabled. WARNING Danger to life as a result of undesirable motor motion due to defective brake "Safe Brake Control" does not detect mechanical defects of the brake. A cable break or a short-circuit in the brake winding is only detected when the state changes, i.e. when the brake either opens and/or closes. In SINAMICS S120M, a cable break is only identified when opening the brake. For devices in chassis format with connected Safe Brake Adapter, the connecting cable between the Safe Brake Adapter and the motor brake is not monitored for cable break or short-circuit. The aforementioned defects may trigger unwanted motor motion, which may result in physical injury or death. • In particular, ensure the brake is not powered from an external source. Information on this topic can be found in EN 61800-5-2:2007, Appendix D. • During commissioning, test the brake using the Safety Integrated Extended Function "Safe Brake Test (SBT)" (for further information, see Section "Safe Brake Test (SBT) (Page 132)").

4.1 Safety Integrated basic functions Safety Integrated 72 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Functional features of "Safe Brake Control" ● SBC is executed when "Safe Torque Off" (STO) is selected. ● In contrast to conventional brake control, SBC is executed via two channels. ● SBC is executed regardless of the brake control or mode set in p1215. However, SBC does not make sense for 1215 = 0 or 3. ● The function must be enabled using parameters. ● When the state changes, electrical faults, such as a short circuit in the brake winding or wire breakage can be detected. Enabling the "Safe Brake Control" function The "Safe Brake Control" function is enabled via parameter p9602. The SBC function can be used only together with STO. The selection of SBC alone is not possible. Two-channel brake control Note Connecting the brake The brake cannot be directly connected to the Motor Module in chassis format: A Safe Brake Adapter is also required. The brake is controlled from the Control Unit. Two signal paths are available for applying the brake. Image 4-2 Two-channel brake control, blocksize (example) For the "Safe Brake Control" function, the Motor/Power Module assumes a monitoring function to ensure that when the Control Unit fails or malfunctions, the brake current is interrupted therefore closing the brake.

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 73 The brake diagnosis can only reliably detect a malfunction in either of the switches (TB+, TB-) when the status changes, i.e. when the brake is released or applied. If the Motor Module or Control Unit detects a fault, the brake current is switched off. The brake then closes and a safe state is reached. 4.1.3.1 SBC for Motor Modules in the chassis format To be able to set higher power in the brakes of devices of this format, an additional Safe Brake Adapter (SBA) module is needed. For more information about connecting and wiring the Safe Brake Adapter, refer to the "SINAMICS G130/G150/S120 Chassis/S120 Cabinet Modules/S150 Safety Integrated" Function Manual. Using parameter p9621, you can define via which digital input the relay (NO contacts) feedback signal of the Safe Brake Adapter is routed to the Control Unit. To evaluate the feedback signal contacts, you must maintain the wait times caused by the SBA. Parameter p9622 is pre-assigned with the SBA-relay wait times: ● p9622[0] ≙ wait time, switching on ● p9622[1] ≙ wait time, switching off Further functionality and the activation of the brake, i.e. reaching the safe status, are in this case the same as the above described procedure for booksize devices. Safe Brake Control with power units in a parallel connection Note SBC for parallel connection of power units Safe Brake Control with power units in a parallel connection is available if r9771.14 = 1. If you wish to use SBC with SBA for chassis format power units connected in parallel, then it is only permissible that you connect precisely one SBA to a power unit in the parallel connection. The Safe Brake Adapter and therefore the brake are controlled via this power unit.

4.1 Safety Integrated basic functions Safety Integrated 74 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 There are two options for registering this power unit with the system: ● Automatic brake identification when commissioning the system for the first time – Requirements: - No Safety Integrated functions enabled - p1215 = 0 (no motor holding brake available) – During the first commissioning, SINAMICS checks at which power unit an SBA is connected. If precisely one SBA is found, the number of the power unit is entered into parameter p7015. If several SBAs are found at the parallel-connected power units, message "F07935 drive: Motor holding brake configuration error" is output. – For devices in the chassis format, if the SBA feedback signal (SBA_DIAG) is read in via an input of the power unit, then in addition, this digital input is automatically entered into parameter p9621. ● Manually defining the power unit – Enter the component number of the power unit, to which the SBA is connected, into parameter p7015. If no SBA is connected to the power unit, faults are detected when controlling the motor holding brake and fault F01630 is output. – In parameter p9621 (p9621 = BICO interconnection to r9872.3), enter the digital input of the power unit to which the SBA is connected and via which the SBA feedback signal (SBA_DIAG) is read in. Note Disconnecting the brake cable for service purposes As long as the brake is permanently released and not actuated, it is possible to briefly disconnect the brake cable, e.g. for service purposes, and not receive fault messages. In the case of a fault, message F07935 is only output when the brake is controlled.

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 75 4.1.3.2 Function diagrams and parameters Function diagrams (see SINAMICS S120/S150 List Manual) • 2814 SI Basic Functions - SBC (Safe Brake Control), SBA (Safe Brake Adapter) Overview of important parameters (see SINAMICS S120/S150 List Manual) • p0799 CU inputs/outputs, sampling time • p1215 Motor holding brake configuration • p7015 Par_circuit holding brake power unit data set • p9602 SI enable safe brake control (Control Unit) • p9621 BI: SI Safe Brake Adapter signal source (Control Unit) • p9622[0...1] SI SBA relay wait times (Control Unit) • r9771.14 SI common functions (Control Unit): SBC supported for parallel connection • r9780 SI monitoring cycle (Control Unit)

4.1 Safety Integrated basic functions Safety Integrated 76 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.1.4 Safety faults The fault messages of the Safety Integrated Basic Functions are saved in the standard message buffer and can be read out from there. By contrast, the fault messages of the Safety Integrated Extended Functions are stored in a separate Safety message buffer (see Chapter "Message buffer (Page 371)"). When faults associated with Safety Integrated Basic Functions occur, the following stop responses can be initiated: Table 4- 1 Stop responses for Safety Integrated Basic Functions Stop response Triggered ... Action Effect STOP A cannot be acknowledged For all Safety faults with pulse suppression that cannot be acknowledged. Trigger safe pulse suppres- sion via the switch-off signal path for the relevant monitor- ing channel. During operation with SBC: Apply motor holding brake. The motor coasts to a standstill or is braked by the holding brake. STOP A For all acknowledgeable Safety faults As a follow-up reaction of STOP F STOP A corresponds to Stop Category 0 in accordance with EN 60204-1. With STOP A, the motor is switched directly to zero torque via the "Safe Torque Off (STO)" function. A motor at standstill cannot be started again accidentally. A moving motor coasts to standstill. This can be prevented by using external braking mechanisms, e.g. holding or operating brake. When STOP A is present, "Safe Torque Off" (STO) is active. STOP F If an error occurs in the data cross- check. Transition to STOP A. Follow-up response STOP A with adjustable delay (factory setting without delay) if one of the safety functions is selected STOP F is permanently assigned to the data cross-check (DCC). In this way, errors are detected in the monitoring channels. After STOP F, STOP A is triggered. When STOP A is present, "Safe Torque Off" (STO) is active. WARNING Danger to life due to an uncontrolled movement of the axis With a vertical axis or a pulling load, there is a danger of uncontrolled movement of the axis when STOP A/F if triggered. This can cause serious injury or death to persons in the danger zone. • If there is a hazard due to unwanted movement in your application, take measures to counter it, for example, by using a brake with safe monitoring. For additional information, see Section "Safe Brake Control (SBC) (Page 71)".

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 77 Acknowledging the Safety faults There are several ways to acknowledge Safety faults: ● Acknowledgment through deselection of STO or SS1: – Remove the cause of the fault. – Deselect "Safe Torque Off" (STO) or "Safe Stop 1" (SS1). – Acknowledge the fault. If the Safety commissioning mode is excited when the Safety functions are switched off (p0010 ≠ 95 when p9601 = 0), all Safety faults can be acknowledged. Once safety commissioning mode has been selected again (p0010 = 95), all the faults that were previously present reappear. ● The higher-level controller sets the signal "Internal Event ACK" via the PROFIsafe telegram (STW bit 7). A falling edge in this signal resets the status "Internal Event" and so acknowledges the fault. ● Acknowledgment by switching the drive unit off/on Safety faults can also be acknowledged (as with all other faults) by switching the drive unit off and then on again (POWER ON). If this action has not eliminated the fault cause, the fault is displayed again immediately after power-up. Description of faults and alarms Note References The faults and alarms for SINAMICS Safety Integrated functions are described in the following document: References: SINAMICS S120/S150 List Manual

4.1 Safety Integrated basic functions Safety Integrated 78 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.1.5 Forced dormant error detection (test stop) Forced dormant error detection or test of the switch-off signal paths (test stop) for Safety Integrated Basic Functions The forced dormant error detection function (test stop) at the switch-off signal paths is used to detect software/hardware faults at both monitoring channels in time and is automated by means of activation/deactivation of the "Safe Torque Off" (STO) or "Safe Stop 1" (SS1) function. To fulfill the requirements of ISO 13849-1 regarding timely error detection, the two switch-off signal paths must be tested at least once within a defined time to ensure that they are functioning properly. This functionality must be implemented by means of forced dormant error detection (test stop), triggered either in manual mode or by the automated process. A timer ensures that forced dormant error detection (test stop) is carried out in a timely fashion. ● p9659 SI forced dormant error detection, timer. A forced dormant error detection (test stop) must be performed on the switch-off signal paths at least once during the time set in this parameter. Once this time has elapsed, an alarm is output and remains active until forced dormant error detection (test stop) is carried out. The timer returns to the set value each time the STO/SS1 function is deactivated. When the appropriate safety devices are implemented (e.g. protective doors), it can be assumed that running machinery will not pose any risk to personnel. As a consequence, the user is only made aware of the forced checking procedure (test stop) that is required using an alarm, and is requested to perform the forced checking procedure (test stop) at the next possible opportunity. This alarm does not affect machine operation. The user must set the time interval for carrying out forced dormant error detection (test stop) to between 0.00 and 9000,00 hours depending on the application (factory setting: 8.00 hours). Examples of when forced dormant error detection (test stop) must be performed: ● When the drives are at a standstill after the system has been switched on (POWER ON). ● When the protective door is opened. ● At defined intervals (e.g. every 8 hours). ● In automatic mode (time and event dependent). ● The maximum time interval is one year (8760 hours). Forced dormant error detection (test stop) can be automatically executed at POWER ON. ● If the forced dormant error detection (test stop) as well as the test of the F-DO for the CU310-2 are to be executed automatically, then set p9507.6 = 1. When testing the FD-O of the CU310-2, you must parameterize p10042 and activate the test in p10046. ● If the forced dormant error detection (test stop) of the F-DI and F-DO of the TM54F is to be executed automatically, then set p10048 = 1.

4.1 Safety Integrated basic functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 79 ● If you have parameterized the forced dormant error detection (test stop) for POWER ON, you can still initiate a forced dormant error detection (test stop) at any time through the application. ● If the automatically initiated function cannot be correctly completed as a result of a problem (e.g. communication failure), then after the problem has been resolved, the function is automatically restarted. ● After the forced dormant error detection (test stop) has been successfully executed, the converter goes into the "Ready" state. ● Timer p9659 is automatically reset as a result of the forced dormant error detection (test stop). ● The automatic forced dormant error detection (test stop) for POWER ON does not influence the Safety Integrated functions. Note Resetting the timer of the basic functions • If the Extended Functions and the associated forced dormant error detection (test stop) are used at the same time, the timer of the Basic Functions is also reset. Discrepancy is not checked at the terminals used to select the Basic Functions as long as STO is set by the Extended Functions. This means that the forced dormant error detection (test stop) of the basic functions must be performed by the Extended Functions without simultaneous selection of STO or SS1. It is otherwise not possible to verify the correct control through the terminals. • The timer is also reset if you first select "Change settings" and then "Activate settings" in the start screen of the configuration in STARTER. 4.1.6 Function diagrams and parameters Function diagrams (see SINAMICS S120/S150 List Manual) • 2800 SI Basic Functions - Parameter manager • 2802 SI Basic Functions - Monitoring functions and faults/alarms • 2890 SI TM54F - Overview • 2891 SI TM54F - Parameter manager • 2900 SI TM54F - Basic Functions control interface (p9601.2/3 = 0, p9601.6 = 1) • 2901 SI TM54F - Basic Functions Safe State selection • 2902 SI TM54F - Basic Functions assignment (F-DO 0 ... F-DO 3)

4.2 Safety Integrated Extended Functions Safety Integrated 80 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.2 Safety Integrated Extended Functions Note PFH values The PFH values of the individual SINAMICS S120 safety components can be found at: http://support.automation.siemens.com/WW/view/de/76254308 4.2.1 License for Extended Functions ● For operation of the Safety Integrated Extended Functions, one license is required for each axis. You enter the associated license key with the "License Key" button in STARTER. Then activate the license key using Activate. As an alternative, you can enter the license key into parameter p9920 in the ASCII code. The license key is activated using parameter p9921 = 1. ● For information on how to generate the license key for the product "SINAMICS Safety Integrated Extended Functions", read the section "Licensing" in the SINAMICS S120 Function Manual. An insufficient license is indicated via the following alarm and LED: – A13000 --> License not sufficient – LED RDY --> Flashes greed/red at 0.5 Hz ● When purchasing your drive, you can already decide to use Safety Integrated functions, and you will then be provided with the required license(s) on the memory card supplied. In this case, you do not have to explicitly activate the licenses. 4.2.2 Differences between Extended Functions "with encoder" and "without encoder" If motors without a (safety-capable) encoder are being used, not all Safety Integrated functions can be used. You will find general information on this distinction in Chapter "Drive monitoring with or without encoder (Page 32)." Activation For activation of the Safety Integrated Extended Functions "with encoder" and "without encoder", set the parameters p9306 and p9506 (factory setting = 0). You can also make this setting by selecting "with encoder" or "without encoder" on the Safety Integrated STARTER screen. You will find this STARTER screen in every drive under "Functions > Safety Integrated." ● Operation with encoder p9506 = 0 or p9506 = 2 ● Operation without encoder p9506 = 1 or p9506 = 3

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 81 Monitoring with an encoder The Safety Integrated Functions with encoder are configured with p9506 = 0 (factory setting) or p9506 = 2 in the expert list or by selecting "with encoder" in the Safety screen. ● If p9506 = 0: Braking is monitored with the "Safe Acceleration Monitor" function. ● If p9506 = 2: Here, also for SS1, the monitoring function "Safe Brake Ramp" is active. More detailed information on actual value acquisition with encoder can be found in Section "Notes regarding safe actual value sensing using an encoder system (Page 147)". Monitoring without an encoder The Safety Integrated functions without encoder are configured in the expert list using p9506 = 1 or p9506 = 3 or by selecting "without encoder" in the Safety screen form. ● For p9506 = 1, the following applies: Here, also for SS1, the monitoring function "Safe Brake Ramp" is active. ● For p9506 = 3, the following applies: Braking is monitored with the "Safe Acceleration Monitor" function. The behavior corresponds to "monitoring with encoder". Taking into account the slip of an induction motor For Safety Integrated without encoder (depending on the drive load), as a result of slip (deviations between electrical and mechanical speed), deviations can occur between the safely determined electrical speed and the mechanical speed at the motor shaft. Note Sudden changes in the current and voltage curve (e.g. sudden change in the setpoint setting and load) and very small absolute values with a high proportion of noise generally result in faults of the safe encoderless actual value acquisition and must be avoided. More detailed information on actual value acquisition without encoder can be found in Section "Notes regarding setting parameters for safe actual value sensing without encoder (Page 154)". Note Scope of functions There are fewer Safety Integrated Extended Functions available "without encoder" than "with encoder" (see Section "Drive monitoring with or without encoder (Page 32)"). Note Safety Integrated functions "without encoder" for group drives The Safety Integrated functions "without encoder" are also permitted for group drives (several motors connected to one power unit).

4.2 Safety Integrated Extended Functions Safety Integrated 82 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 "Parking" state for Safety Integrated Extended Functions with encoder Note Extended Functions with encoder and "parking" When a drive object, for which Safety Integrated Extended Functions with encoder are enabled, is switched to "Park" mode, the Safety Integrated software responds by selecting STO without generating a separate message. This internal STO selection is displayed in parameter r9772.19. 4.2.3 Restrictions for Safety Integrated Functions "without encoder" Basic Functions The Basic Functions are available without any restrictions in all control modes, with and without an encoder, for synchronous, induction, and reluctance motors. A safety-related encoder is not required for Basic Functions. The Safety Integrated functions "without encoder" are also permitted for group drives (several motors connected to one power unit). Extended Functions Extended Functions SS1, SLS, SDI and SSM "without encoder" do not require safety-related speed actual value sensing. If an encoder is used for the drive control, this has no influence on the sensorless safety functions. They can be used with induction motors in all control modes, as well as with SIEMOSYN synchronous motors with U/f control. The Safety Integrated functions "without encoder" are also permitted for group drives (several motors connected to one power unit). Note The slip of an induction motor must be taken into account For Safety Integrated without encoder (depending on the drive load), as a result of slip for induction motors (deviations between electrical and mechanical speed), deviations can occur between the safely determined electrical speed and the mechanical speed at the motor shaft. When using Extended Functions, observe the following restrictions.

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 83 Inadmissible operating modes for Safety Integrated Functions "without encoder" ● No operation with SINAMICS Hydraulic Drive (HLA) ● Current controller clock cycles 31.25 µs and 62.5 μs (for Double Motor Modules with two configured safety drives) are not permissible. ● For the independent setting of current controller clock cycle and pulse frequency in conjunction with Safety Integrated "without encoder", the following system clock cycles are not permitted: – Double Motor Module: <125 μs – All other components: <62.5 μs – p9589 must be set = 3300 to allow the current controller clock cycle and pulse frequency to be independently set. ● For chassis format devices, the following also applies: – For chassis format devices, operation without encoder is only permissible for induction motors, however not for synchronous motors. – No operation involving parallel connections – Optimized pulse patterns cannot be selected for SIMOTICS FD – Only using parameter p1810 = factory setting, this includes: - No wobbling - No fine setting of the pulse frequency ● No "shaft generator" functionality ● Induction motors up to 1000 kW On very large machines, it may also be necessary to adjust the parameter p9585. Critical operating modes for Safety Integrated Functions "without encoder" When the safety functions are deactivated, the following technology functions are not negatively influenced. When using the following operating modes with the Safety Integrated functions activated without encoder, this can result in errors in the encoderless safe actual value sensing (see messages C01711, C30711 with fault values 1040 ff.). Safe, encoderless actual value sensing is based on the measurement of current and voltage variables, which can influence the following functions. This does not result in unsafe states. However, this fault can be expected to have a negative impact on availability. Note Irregular operating states Note that in irregular operating states (e.g. "stalled motor"), the converter can fail with safety faults. However, under no circumstances is an unsafe state reached.

4.2 Safety Integrated Extended Functions Safety Integrated 84 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 ● Current limiting of the power unit When the current limitation of the power unit responds, a fault of the encoderless safe actual value acquisition and a consequent stop response can be expected. Note When engineering the drive and when the parameterizing the current and torque limits, it must be ensured that the power unit current limiting does not respond. ● Operation with pulling loads It is not permissible that the converter is forced into regenerative operation as a result of external forces. Note If a coupled drive comprises an electric drive that motors and one that regenerates (e.g. a test stand), and the speeds of both drives are safely monitored, safety functions without encoder can be used. This is because in the case of a fault, the motoring drive recognizes when a limit value is violated. If, in this example, the motoring drive is an internal combustion engine, which is not safely monitored, then it is not permissible to use safety functions without encoder for the braking drive. Winders with a motoring and a braking drive can be assessed in the same way (both drives are monitored). ● Motor data identification When using the measuring functions (stationary and rotating measurement) to determine the motor data, then it can be assumed that the encoderless safe actual value sensing will have an error. Note The motor data identification should always be performed before commissioning the Safety Integrated Functions. ● Data set switchover The motor and drive data switchover can always be used for safety functions without encoder. It is not possible to switch over between induction and synchronous motors (this is interlocked). For several motor data sets it must be ensured that all motors have the same number of pole pairs. If the number of pole pairs in r0313 is not the same value that was taken into account when configuring the safe actual value sensing (gearbox), then the calculated, safe actual speed no longer corresponds to the mechanical speed of the shaft. When SLS is activated, the shaft can rotate faster than the configured limits. ● Alternating acceleration/deceleration For alternating acceleration and deceleration, it must be ensured that the following conditions are maintained. – Within 1 s, only one acceleration and one braking ramp are permitted. Therefore, for a cycle 0 → +nset → -nset → 0 – one period of at least 2 s is required.

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 85 ● This also applies to positioning operation; it may be necessary that the position control settings and traversing profiles must be adapted so that no overshoots occur in the speed characteristic (e.g. reduce the dynamic response, use flatter braking ramps). ● Flying restart A flying restart should not be performed in operation with the Safety Integrated Functions active. Note If you must use this function, then before the flying restart, you can deactivate the Safety Integrated Functions, and then reactivate them again after the flying restart has been completed. In this case, the user must check as to whether it is permissible that the safety functions are deactivated during the flying restart. It is only permissible to activate and deactivate Safety Integrated Functions using fail-safe signals. ● DC brake When using this function, DC current is impressed to brake the drive: This can result in a fault of the encoderless safe actual value acquisition and a consequent stop response. Note If you must use this function, then before braking, you can deactivate the Safety Integrated Functions, and then reactivate them again after braking has been completed. In this case, the user must check as to whether it is permissible that the safety functions are deactivated during braking. It is only permissible to activate and deactivate Safety Integrated Functions using fail-safe signals. Recommendations for stable operation with active Extended Functions without encoder The following preconditions must be fulfilled to avoid fault messages from the safe actual value sensing without encoder: ● The motor and the power unit are adequately dimensioned for this application. ● Motor and power unit should fulfill the following condition: The ratio between the rated power unit current (r0207[0]) and rated motor current (p0305) should be less than 5. ● Before commissioning the safety functions, we recommend that the motor data are identified at standstill and a rotating measurement is carried out. ● For the basic commissioning, i.e. before the safety commissioning, the closed-loop control should be optimally set. The following effects should be avoided: - speed overshoots - current peaks and/or discontinuous/unsteady current actual value over time - voltage peaks and/or discontinuous/unsteady voltage actual value over time - the lowest possible amount of noise in the current and voltage

4.2 Safety Integrated Extended Functions Safety Integrated 86 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Safety Integrated Extended Functions without encoder for Control Unit Adapter CUA31 and CUA32 In the case of the control unit adapters CUA31 and CUA32, the Safety Integrated Extended Functions without encoder with SINAMICS firmware version 4.5 (or higher) are available as follows: Control Unit Adapter Article number Safety Integrated without encoder SINAMICS firm ware version 4.5 (or higher) Not available for Available for CUA31 6SL3040-0PA01-0AA1 Version (function states) A, B and C Version D or newer CUA32 6SL3040-0PA01-0AA0 Version (function states) A and B Version C or newer 4.2.4 Safe Torque Off (STO) For the control options and the functionality for "Safe Torque Off" (STO), see Section "Safe Torque Off (STO) (Page 62)".

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 87 4.2.5 Safe Stop 1 (SS1) 4.2.5.1 Safe Stop 1 with encoder For function SS1 of the Extended Safety Functions, braking monitoring is included. ● If p9506 = 0: Braking is monitored with the "Safe Acceleration Monitor" function (see Chapter "Safe Acceleration Monitor (SAM) (Page 142)"). In this case, we also talk about "SS1 (time and acceleration controlled)". ● If p9506 = 2: Here, also for SS1, the monitoring function "Safe Brake Ramp" is active (see Chapter "Safe Brake Ramp (SBR) (Page 144)"). In this case, we also talk about "SS1 (speed controlled)". The "Safe Stop 1" (SS1) function allows the drive to be stopped according to EN 60204-1, Stop Category 1. The drive brakes with the OFF3 ramp (p1135) once "Safe Stop 1" is selected and switches to "Safe Torque Off" (STO) once the delay time has elapsed (p9556) or when the shutdown speed is fallen below (p9560). Functional features of Safe Stop 1 with encoder ● The delay time starts after the function has been selected. If SS1 is deselected within this time, after the delay time has elapsed or after the velocity has fallen below the shutdown speed, the STO function is selected and deselected again immediately; i.e. the SS1 function is ended completely normally. It cannot be interrupted. ● Selection and monitoring of the acceleration (SAM) or the monitoring function "Safe Brake Ramp" are implemented in two channels, but braking along the OFF3 ramp is only implemented in one channel. Note Interrupting the ramp function with OFF2 by the higher-level controller Activating SS1 can mean that the higher-level controller (PLC, motion controller), which specifies the speed setpoint, interrupts the ramp function (e.g. with OFF2). The device behaves in this way as a result of a fault reaction triggered by OFF3 activation. This fault reaction must be avoided by assigning appropriate parameters or configurations. Note No OFF2 with SS1 and EPOS If you use SS1 together with EPOS, the fault reaction to F07490 (EPOS: enable withdrawn while traversing) OFF2 is not permitted. The response to this error message (OFF1, OFF2 or OFF3) can be configured via p2100/p2101.

4.2 Safety Integrated Extended Functions Safety Integrated 88 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 Commissioning The delay time (SS1 time) is set by entering parameter p9556. The wait time until safe pulse suppression (STO) can be shortened by specifying a shutdown speed in p9560. To enable the drive to brake to standstill after selection, the time in p9556 must be selected to be large enough for the drive to be able to brake along the OFF3 ramp (p1135) from any speed of the work process to below the shutdown speed (p9560). Note Setting the delay time To enable the drive to travel the entire OFF3 ramp and close any existing motor holding brake, you must set the delay time as follows: • Motor holding brake parameterized: Delay time ≥ p1135 + p1228 + p1217 • Motor holding brake not parameterized: Delay time ≥ p1135 + p1228 The shutdown speed defined in p9560 must be set in such a way that coasting down (due to the subsequent STO function) does not represent any risk for man and machine. Responses: System error 1. STOP F with subsequent STOP B, followed by STOP A 2. Safety message C01711 Status for "Safe Stop 1" The status of the "Safe Stop 1" function is displayed using the following parameters: ● r9722.1 CO/BO: SI Motion drive-integrated status signals, SS1 active ● r9722.0 CO/BO: SI Motion drive-integrated status signals, STO or safe pulse suppression active

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 89 4.2.5.2 Safe Stop 1 without encoder Two encoderless Safe Stop 1 (SS1) monitoring functions can be set with parameter p9506: ● p9506 = 3: Safe monitoring of acceleration (SAM) / delay time The function is identical to "Safe Stop 1" with encoder, which was described in the previous section. In this case, we also talk about "SS1 (time and acceleration controlled)". ● p9506 = 1: Safe brake ramp monitoring (SBR) In this case, there is no SS1 delay time active. The transition from SS1 to STO depends entirely on the speed falling below the shutdown speed (p9560). You will find more information on the function "Safe Brake Ramp (SBR)" in Chapter "Safe Brake Ramp (SBR) (Page 144)." In this case, we also talk about "SS1 (speed controlled)". Image 4-3 Sequence for "Safe Stop 1" without encoder with SBR monitoring (p9506 = 1) Functional feature of Safe Stop 1 without encoder ● Selection and monitoring of the brake ramp (SBR) or the acceleration (SAM) are implemented in two channels, however braking at the OFF3 ramp is only through one channel.

4.2 Safety Integrated Extended Functions Safety Integrated 90 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.2.5.3 Safe Stop 1 with external stop General description NOTICE Danger to life due to any axis movement During the delay time (p9652), for "Safe Stop 1 (time-controlled) with external stop," any axis movements are possible. • If there is a hazard due to unwanted motion in your application, take measures to counter it, for example, by using a brake with safe monitoring. Further information can be found in Section "Safe Brake Control (Page 91)". With external stop, "Safe Stop 1" basically works exactly as described in the previous Chapters "Safe Stop 1 with encoder (time and acceleration controlled)" and "Safe Stop 1 without encoder (speed controlled)." Note, however, the following differences: Differences between "Safe Stop 1 with OFF3" and "SS1 with external stop" ● In order to activate "Safe Stop 1 with external stop", additionally set p9507.3 = 1. ● When SS1 with external stop is selected, the drive is not braked along the OFF3 ramp: You are responsible in applying suitable measures to brake the drive. After the delay time has expired (p9556), only STO/SBC are automatically initiated. After the function has been selected, the delay timer runs down - even if the function is deselected during this time. In this case, after the delay time has expired, the STO/SBC function is selected and then again deselected immediately. ● The brake ramp (SBR) and the acceleration (SAM) are not monitored and there is no standstill detection. ● With this configuration, STO becomes active after the SS1 timer p9556 has expired; this also applies if SBR has been configured. ● Further information can be found in Section Stop responses (Page 365).

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 91 4.2.5.4 Function diagrams and parameters Function diagrams (see SINAMICS S120/S150 List Manual) • 2819 SI Extended Functions - SS1, SS2, SOS, internal STOP B, C, D, F Overview of important parameters (see SINAMICS S120/S150 List Manual) • p1135[0...n] OFF3 ramp-down time • p9501 SI Motion enable safety functions (Control Unit) • p9506 SI Motion function specification (Control Unit) • p9560 SI Motion STO shutdown speed (Control Unit) • r9722.0...31 CO/BO: SI Motion drive-integrated status signals Only for SS1 (Extended Functions) with external stop • p9507 SI Motion function configuration (Control Unit) 4.2.6 Safe Brake Control (SBC) For the control options and the functionality for "Safe Brake Control" (STO), see Section "Safe Brake Control (SBC) (Page 71)". Note No SBC for SINAMICS HLA SINAMICS HLA does not support Safe Brake Control.

4.2 Safety Integrated Extended Functions Safety Integrated 92 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.2.7 Safe Operating Stop (SOS) This function serves for fail-safe monitoring of the standstill position of a drive. WARNING Danger to life: Drive can be forced out of the SOS position by mechanical forces Mechanical forces greater than the maximum drive torque may force a drive currently operated in the position control mode out of the Safe Operating Stop (SOS) and trigger stop function category 1 according to EN 60204-1 (fault response function STOP B). • If there is a hazard due to unwanted movement in your application, take measures to counter it, for example, by using a brake with safe monitoring. For further information, see Chapter "Safe Brake Control (SBC) (Page 71)." Note SOS only with encoder In particular, the motor is energized while the SOS function is performing position control. • Ensure that the motor cannot be touched while it is in the SOS state. Drive stopping is monitored using an SOS tolerance window (p9530). Note Size of the tolerance window The size of the tolerance window should be slightly above the standard standstill monitoring limit, otherwise the standard monitoring functions will no longer be effective. Parameter r9731 displays the safe position accuracy (load side) that can be achieved as a maximum, based on the acquisition of the actual value for the safe motion monitoring functions. STOP B is the stop response after the standstill tolerance window has been violated. The SOS function comes into effect in the following cases: ● After SOS is selected and the delay time in p9551 has elapsed The drive must be braked to standstill within this delay time (e.g. by the controller). ● As a consequence of SS2 ● As a consequence of STOP C (corresponds to selection of SS2) ● As a consequence of STOP D (corresponds to selection of SOS) ● As a consequence of STOP E (corresponds to selecting SOS with additional activation of the standard "Extended stop and retract (ESR)" function)

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 93 Responses ● Standstill tolerance violated in p9530 – STOP B with subsequent STOP A – Safety message C01707 ● System error – STOP F – Safety message C01711 Function diagrams (see SINAMICS S120/S150 List Manual) • 2819 SI Extended Functions - SS1, SS2, SOS, internal STOP B, C, D, F Overview of important parameters (see SINAMICS S120/S150 List Manual) • p9501 SI Motion enable safety functions (Control Unit) • p9530 SI Motion standstill tolerance (Control Unit) • p9551 SI Motion SLS(SG) switchover/SOS(SBH) delay time (CU) • r9722.0...31 CO/BO: SI Motion drive-integrated status signals • r9731 SI Motion safe positioning accuracy

4.2 Safety Integrated Extended Functions Safety Integrated 94 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.2.8 Safe Stop 2 (SS2) Note The "Safe Stop 2" (SS2) safety function can only be used with an encoder. The safety function "Safe Stop 2" (SS2) is used to brake the motor of the OFF3 deceleration ramp (p1135) safely with transition after the delay time (p9552) has expired in to the SOS state (see Chapter "Safe Operating Stop (SOS) (Page 92)"). The delay time set must allow the drive to brake to a standstill from every speed of the operating process within this time. The standstill tolerance (p9530) may not be violated after this time. After braking, the drives remain in speed control mode with the speed setpoint n = 0. The full torque is available. The default setpoint (e.g. from the setpoint channel, or from a higher-level controller) remains inhibited as long as SS2 is selected. During braking, one of the following functions is active: ● If p9506 = 0: Braking is monitored with the "Safe Acceleration Monitor" function (see Chapter "Safe Acceleration Monitor (SAM) (Page 142)"). ● If p9506 = 2: Here, also for SS1, the monitoring function "Safe Brake Ramp" is active (see Chapter "Safe Brake Ramp (SBR) (Page 144)"). The selection and monitoring of the acceleration (SAM) are realized through two channels – however, braking along the OFF3 ramp, only through one channel. Interruption of the ramp function with OFF2 Activating SS2 can mean that the higher-level controller (PLC, motion controller) which specifies the speed setpoint, interrupts the ramp function (e.g. with OFF2). The device behaves in this way as a result of a fault reaction triggered by OFF3 activation. This fault reaction must be avoided by assigning appropriate parameters or configurations. Responses ● Speed limit violated (SAM): – STOP A – Safety message C01706 ● Standstill tolerance violated in p9530 (SOS): – STOP B with subsequent STOP A – Safety message C01707 ● System fault: – STOP F with subsequent STOP A – Safety message C01711

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 95 Function diagrams (see SINAMICS S120/S150 List Manual) • 2814 SI Basic Functions - SBC (Safe Brake Control), SBA (Safe Brake Adapter) Overview of important parameters (see SINAMICS S120/S150 List Manual) • p1135[0...n] OFF3 ramp-down time • p9501 SI Motion enable safety functions (Control Unit) • p9530 SI Motion standstill tolerance (Control Unit) • p9548 SI Motion SAM actual speed tolerance (Control Unit) • p9552 SI Motion transition time STOP C to SOS (SBH) (Control Unit)1) • r9722.0...31 CO/BO: SI Motion drive-integrated status signals 1) STOP C corresponds to SS2. 4.2.8.1 Interaction with EPOS Since the function SS2 – with its setpoint-independent braking – is not suitable for use with EPOS, the Safe Operating Stop (SOS) function can be used with delay. On selection of SOS, the EPOS function "intermediate stop" (p2640 = 0) ensures that EPOS is able to stop the drive in its tracks and then keep it under control in this state before the SOS becomes active. The maximum necessary braking time (from p2573 and p2645) must then be entered in the delay time for SLS/SOS (p9551) with a safety margin: This ensures that the drive is at a standstill before SOS is active. To do this, proceed as follows: 1. Connect the EPOS function "intermediate stop" (p2640) with the control signal "Deselect SOS" (r9720.3). 2. Enter the maximum necessary EPOS braking time (depending on the values set in p2573 and p2645) with a safety margin (approx. +5%) in the SOS delay time (p9551). Since the STOP C stop response – with its setpoint-independent braking – is not suitable for use with EPOS, the Safe Operating Stop (SOS) function can be used with delay. On selection of SOS, the EPOS function "intermediate stop" (p2640 = 0) ensures that EPOS is able to stop the drive in its tracks and then keep it under control in this state before the SOS becomes active. The maximum required braking time (from p2573 and p2645) must then be entered in the "Transition time STOP D to SOS" (p9553) with a small safety margin: This ensures that the drive is at a standstill before SOS is active. To do this, proceed as follows: 1. Parameterize "STOP D" as stop response. 2. Connect the EPOS function "intermediate stop" (p2640) with the control signal "Deselect SOS" (r9720.3). 3. Enter the maximum required EPOS braking time (depending on the values set in p2573 and p2645) with a safety margin (approx. +5%) in the "Transition time STOP D to SOS" (p9553).

4.2 Safety Integrated Extended Functions Safety Integrated 96 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.2.8.2 SS2 with external stop (SS2E) WARNING Danger to life through unexpected axis movement When function "Safe Stop 2 with external stop" (SS2E) is active, during the delay time (p9553) the speed follows the setpoint issued from the higher-level control system. As a consequence, unexpected axis motion is possible, which can lead to severe injury and death. • During delay time (p9553), avoid that persons enter the hazardous area of the machine or system, e.g. by keeping protective equipment closed. Image 4-4 Selecting function SS2E With external stop, "Safe Stop 2" functions in principle exactly the same way as described in the previous sections. Note, however, the following differences: Differences between "Safe Stop 2 with OFF3" and "SS2 with external stop (SS2E)" ● When SS2 is selected with external stop, the drive does not automatically brake the motor, but instead, follows the specified speed setpoint. ● During delay time p9553, the brake ramp (SBR) and the acceleration (SAM) are not monitored and there is no standstill detection. ● SOS becomes active after the delay time p9553 expires. When function SS2E is active, the higher-level control must issue the speed setpoint so that at the latest after delay time p9553 expires, the motor has come to a complete standstill. ● In order to activate "Safe Stop 2 with external stop", set p9501.18 = 1. ● PROFIsafe STW2.28 selects function SS2E. PROFIsafe STW2.28 is included in telegrams 30, 901 and 902. ● PROFIsafe ZSW2.28 indicates whether function SS2E is active. PROFIsafe ZSW2.28 is included in telegrams 30, 901 and 902. The associated diagnostics parameter is r9722.28. In the "Safety Info Channel", status word S_ZSW3B.11 indicates whether function SS2E is active. The associated diagnostics parameter is r10234.11. Diagnostic parameters p9722.28 and p10234.11 are also set during an internal STOP D.

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 97 For additional information, see Section "Safety faults (Page 365)". Deselecting function SS2E while SS2E is active Image 4-5 Deselecting function SS2E while SS2E is active After the function has been selected, the delay time starts to expire - even if the function is deselected during this time. In this case, after the delay time has expired, the SOS function is briefly active. Afterwards, the drive may accelerate the motor back to the speed setpoint. Interruption of the active SS2E function by functions SS1 and SS2 Image 4-6 Interruption of function SS2E by functions SS1 (shown at the left) and SS2 (shown at the right) When selecting SS1, the drive brakes the motor along the OFF3 ramp and monitors the speed using the SAM function. Function STO becomes active when the motor is at a standstill. When selecting SS2, the drive also brakes the motor along the OFF3 ramp and monitors the speed using the SAM function. Function SOS becomes active after time p9552.

4.2 Safety Integrated Extended Functions Safety Integrated 98 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.2.8.3 Overview of important parameters Overview of important parameters (see SINAMICS S120/S150 List Manual) • p2573 EPOS maximum delay • p2594 CI: EPOS maximum speed, externally limited • p2640 BI: EPOS intermediate stop (0 signal) • p2645 CI: EPOS direct setpoint input/MDI, deceleration override • p9551 SI Motion SLS(SG) switchover/SOS(SBH) delay time (CU) • p9552 SI motion transition time STOP C to SOS (SBH) (Control Unit) • p9553 SI motion transition time STOP D to SOS (SBH) (Control Unit) • r9720.0...27 CO/BO: SI Motion drive-integrated control signals • r9733[0...2] CO: SI Motion speed setpoint limit active

4.2 Safety Integrated Extended Functions Safety Integrated Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 99 4.2.9 Safely-Limited Speed (SLS) The Safely Limited Speed (SLS) function is used to protect a drive against unintentionally high speeds in both directions of rotation. This is achieved by monitoring the current drive speed up to a speed limit. Safely Limited Speed prevents a parameterized speed limit from being exceeded. Limits must be specified based on results of the risk analysis. Up to four different SLS speed limits can be parameterized using parameter p9531[0..3]; it is possible to switch between them even if the SLS is activated. An override can also be added to SLS limit value 1. In operation, this override can be varied using a PROFIsafe telegram. Note Deviation of the displayed speed limit The SLS speed limit displayed in r9714[2] can deviate slightly from the specified SLS speed limit. The reason for this is the internal resolution (r9732) of the speed values. Note Response in the event of a communication error If p9580 ≠ 0 and SLS is active, in the event of communication failure, the parameterized ESR reaction is only realized if, as SLS response, a STOP with delayed pulse cancellation when the bus fails has been parameterized (p9563[0...3] ≥ 10). Note Setpoint speed limit and SLS • It makes sense to configure the set velocity limit if SLS is also parameterized. This is done in a higher-level controller that evaluates the safety information channel, for example, or by wiring r9733[0/1] to the speed limits of the ramp-function generator (p1051/p1052). • It does not make sense to use the positive and negative setpoint limiting for SLS in conjunction with standard telegram 105 and others: With this combination, the velocity setpoint of the standard telegram is only effective after the setpoint limiting.

4.2 Safety Integrated Extended Functions Safety Integrated 100 Function Manual, (FHS), 07/2016, 6SL3097-4AR00-0BP6 4.2.9.1 Safely Limited Speed (SLS) Features ● When SLS is selected, the monitoring only takes effect after the configured delay time has expired (p9551). Within this time, the actual speed must be below the (selected) limit. The delay time is not effective when SLS is deselected. ● After switching to a lower limit value (p9531), the actual speed of the drive must have dropped below the new limit within the delay time (p9551). The existing limit remains active during the delay time. The lower limit value becomes active after the delay time expires. This also applies to a reduction of the limit value via PROFIsafe. ● If the actual speed of the drive is higher than the new Safely Limited Speed limit after the delay time has elapsed, a message is generated with the parameterized stop response. ● The stop response (STOP A, STOP B, STOP C, STOP D or STOP E) is parameterized with p9563. ● During changeover to a higher limit value, the delay time is not active and the high limit value becomes immediately active. This also applies to increasing the limit value via PROFIsafe. ● 4 parameterizable limit values p9531[0...3] ● The first limit value can be entered via the PROFIsafe telegrams 901 and 902 (for p9501.24 = 1) ● In parameter p9533 enter the weighting factor to determine the setpoint limit from the selected actual speed limit in percent. The active limit value is evaluated using this factor, and is provided as setpoint limit in r9733. – r9733[0] = p9531[x] x p9533 (converted from the load to the motor side) – r9733[1] = - p9531[x] x p9533 (converted from the load to the motor side) [x] = selected SLS stage Conversion factor from the motor to the load side: – Motor type = rotary and axis type = linear: p9522/(p9521 × p9520) – Otherwise: p9522/p9521 ● Limit value – r9733[0] = p9531[x] x p9533; x = selected SLS limit value – r9733[1] = - p9531[x] x p9533; x = selected SLS limit value r9733 is used, for example, for transferring values to a higher-level controller, which can then, for example, adjust traversing speeds to the SLS levels or at the setpoint channel (p1051). r9733 is a part of the Safety Info Channel (SIC). ● The currently monitored limit value is displayed in parameter r9714[2].