ist intelligent safety technology

Application Manual

DOK-CONTRL-IST********-AW01-EN-P

SYSTEM200

ISTIntelligent Safety Technology

About this Documentation IST Intelligent Safety Technology


IST

Intelligent Safety Technology

Application Manual


Document Number 120-0400-B315-01/EN

This documentation is used as description and project planning instructionfor using the Intelligent Safety Technology.

Description ReleaseDate

Notes

120-0400-B315-01/EN 04.2003 First Issue

2003 Bosch Rexroth AG

Copying this document, giving it to others and the use or communicationof the contents thereof without express authority, are forbidden. Offendersare liable for the payment of damages. All rights are reserved in the eventof the grant of a patent or the registration of a utility model or design(DIN 34-1).

The specified data is for product description purposes only and may notbe deemed to be guaranteed unless expressly confirmed in the contract.All rights are reserved with respect to the content of this documentationand the availability of the product.

Bosch Rexroth AGBgm.-Dr.-Nebel-Str. 2 • D-97816 Lohr a. Main

Telephone +49 (0)93 52/40-0 • Tx 68 94 21 • Fax +49 (0)93 52/40-48 85

http://www.boschrexroth.com/

Dept. BRC/ESM3 (MaMu)

Dept. BRC/ESM6 (DiHa)

This document has been printed on chlorine-free bleached paper.

Title

Type of Documentation

Document Typecode

Internal File Reference

Purpose of Documentation

Record of Revisions

Copyright

Validity

Published by

Note

IST Intelligent Safety Technology Contents I


Contents

1 Preface 1-1

1.1 Documentation .............................................................................................................................. 1-1

1.2 BG-PRÜFZERT Symbol................................................................................................................ 1-1

1.3 Prototype Test Certification........................................................................................................... 1-2

2 Important Directions for Use 2-1

2.1 Appropriate Use ............................................................................................................................ 2-1

Introduction .............................................................................................................................. 2-1

Areas of Use and Application................................................................................................... 2-2

2.2 Inappropriate Use.......................................................................................................................... 2-2

3 Safety Instructions for Electric Drives and Controls 3-1

3.1 Introduction ................................................................................................................................... 3-1

3.2 Explanations.................................................................................................................................. 3-1

3.3 Hazards by Improper Use ............................................................................................................. 3-2

3.4 General Information ...................................................................................................................... 3-3

3.5 Protection Against Contact with Electrical Parts........................................................................... 3-5

3.6 Protection Against Electric Shock by Protective Low Voltage (PELV) ......................................... 3-6

3.7 Protection Against Dangerous Movements .................................................................................. 3-7

3.8 Protection Against Magnetic and Electromagnetic Fields During Operation andMounting ....................................................................................................................................... 3-9

3.9 Protection Against Contact with Hot Parts .................................................................................. 3-10

3.10 Protection During Handling and Mounting .................................................................................. 3-10

3.11 Battery Safety.............................................................................................................................. 3-11

3.12 Protection Against Pressurized Systems.................................................................................... 3-11

4 Safety Technology Basics 4-1

4.1 General.......................................................................................................................................... 4-1

4.2 Analysis of Dangers and Risk Assessment .................................................................................. 4-1

4.3 Safety-Relevant Standards and Regulations................................................................................ 4-3

Component-Relevant Standards ............................................................................................. 4-3

Machine-Relevant Standards................................................................................................... 4-3

Overview of Required Safety Categories in C Standards........................................................ 4-4

4.4 Definition of Terms........................................................................................................................ 4-5

5 Intelligent Safety Technology (IST) 5-1

5.1 Bosch Rexroth Control and Drive System with Intelligent Safety Technology ............................. 5-1

Basic Structure and Functions................................................................................................. 5-1

5.2 Comparison with Conventional Safety Technology ...................................................................... 5-3

II Contents IST Intelligent Safety Technology


5.3 Overview of Safety Functions ....................................................................................................... 5-4

5.4 Functioning of Intelligent Safety Technology ................................................................................ 5-5

Dual Channel Structure............................................................................................................ 5-5

Two-way Data Comparison...................................................................................................... 5-6

Forced dynamics...................................................................................................................... 5-8

6 IST Safety Functions 6-1

6.1 Overview of Safety Functions for Protection of Persons .............................................................. 6-1

6.2 Safe Stop ...................................................................................................................................... 6-2

6.3 Safe Operation Stop...................................................................................................................... 6-4

6.4 Safely Reduced Speed ................................................................................................................. 6-6

6.5 Safely Limited Absolute Positions................................................................................................. 6-8

6.6 Safe Cams .................................................................................................................................. 6-10

6.7 Consent ....................................................................................................................................... 6-11

6.8 Safe Referencing ........................................................................................................................ 6-14

6.9 Switching between Two Safety Functions .................................................................................. 6-19

6.10 Description of Safety Parameters ............................................................................................... 6-23

6.11 Password Protection ................................................................................................................... 6-30

6.12 Transferring Safety I/O Signals................................................................................................... 6-32

Technical Data of RMP12.2 Safety I/O Module ..................................................................... 6-36

Processing of Safety Output Signals ..................................................................................... 6-37

6.13 Starting Lockout as a Shutdown Circuit of the CNC ................................................................... 6-39

7 Reaction Times and Braking Paths 7-1

7.1 Introduction ................................................................................................................................... 7-1

7.2 Basic Procedure............................................................................................................................ 7-1

Determining the Drive Reaction / Using an Intermediate Circuit Short-Circuit ........................ 7-2

7.3 Reaction Times and Braking Paths When Monitors within Safety Function Safe Stop areActivated ....................................................................................................................................... 7-3

7.4 Reaction Times and Braking Paths When Monitors within Safety Function SafeOperating Stop are Activated........................................................................................................ 7-4

Reaction Times and Braking Paths Determined by the Control .............................................. 7-4

Reaction Times and Braking Paths Determined by the Drive ............................................... 7-11

Overall Reaction Times and Braking Paths ........................................................................... 7-15

7.5 Reaction Times and Braking Paths when Monitors within Safety Function “SafelyReduced Speed with Safely Limited Absolute Position” are Activated....................................... 7-15

Reaction Times and Braking Paths Determined by the Control ............................................ 7-16

Reaction Times and Braking Paths Determined by the Drive ............................................... 7-24

Overall Reaction Times and Braking Paths ........................................................................... 7-28

7.6 Installation Guidelines for Drive Control Devices........................................................................ 7-28

8 Planning a System with Bosch Rexroth IST 8-1

8.1 Rules for Using the Safety Functions............................................................................................ 8-1

8.2 Residual Risks .............................................................................................................................. 8-2

8.3 Sample Application ....................................................................................................................... 8-3

General .................................................................................................................................... 8-3

Sample switching setup ........................................................................................................... 8-5

IST Intelligent Safety Technology Contents III


CNC Shutdown Circuit ........................................................................................................... 8-10

Emergency Stop Chain .......................................................................................................... 8-12

PLC Program ......................................................................................................................... 8-14

Safety Parameters ................................................................................................................. 8-42

9 Commissioning of Intelligent Safety Technology 9-1

9.1 Notes Regarding Safety................................................................................................................ 9-1

9.2 General Notes ............................................................................................................................... 9-1

9.3 Instructions for First-Time Commissioning.................................................................................... 9-2

9.4 Serial commissioning .................................................................................................................... 9-5

9.5 Acceptance and Logging the Safety Functions ............................................................................ 9-6

Complete Acceptance Test...................................................................................................... 9-6

Partial Acceptance Test ........................................................................................................... 9-6

Acceptance report .................................................................................................................... 9-6

Sample Machine and Axis Report ........................................................................................... 9-7

9.6 Commissioning of IST for Series Machines................................................................................ 9-12

10 Subsequent System Modifications 10-1

10.1 Making Modifications................................................................................................................... 10-1

10.2 Logging and Acceptance............................................................................................................. 10-1

10.3 Procedure for Software and Firmware Updates ......................................................................... 10-3

11 Error Messages and Error Elimination 11-1

11.1 CNC Error Messages (Channel 1) .............................................................................................. 11-1

11.2 Error Messages for Drives (Channel 2) ...................................................................................... 11-5

11.3 FB DYNAM Forced Dynamics Error Messages........................................................................ 11-11

12 Appendix 12-1

12.1 Selection Lists for IST Components............................................................................................ 12-1

Control Modules in PC Format (MTC200-P).......................................................................... 12-1

Control Modules in RECO Format (MTC200-R) .................................................................... 12-4

Firmware for Intelligent Safety Technology Version 19 ......................................................... 12-7

Firmware for Intelligent Safety Technology as of Version 22 ................................................ 12-7

Safety I/O Module .................................................................................................................. 12-8

DIAX04 Drive Components.................................................................................................... 12-9

Explanations of Configurations ............................................................................................ 12-11

12.2 Overview of Safety Parameters for MTC200 and DIAX04 Drives ............................................ 12-14

12.3 Acceptance Report.................................................................................................................... 12-15

Machine Report.................................................................................................................... 12-15

Axis Report........................................................................................................................... 12-18

Acceptance Report, Machine............................................................................................... 12-21

Acceptance Inspection of Safety Functions of the Axis....................................................... 12-28

13 Index 13-1

14 Service & Support 14-1

IV Contents IST Intelligent Safety Technology


14.1 Helpdesk ..................................................................................................................................... 14-1

14.2 Service-Hotline............................................................................................................................ 14-1

14.3 Internet ........................................................................................................................................ 14-1

14.4 Vor der Kontaktaufnahme... - Before contacting us.................................................................... 14-1

14.5 Kundenbetreuungsstellen - Sales & Service Facilities ............................................................... 14-2

IST Intelligent Safety Technology Preface 1-1


1 Preface

1.1 Documentation

This documentation describes the design and utilization of IntelligentSafety Technology (IST).

In addition to the general safety technology, the safety functions and therequired hardware and software components are described. The planningand commissioning of Intelligent Safety Technology are also covered inthis documentation.

Additional documentation is available for user-based activities such asgeneral design and parts programming. In this case, contact your localsales partner.

1.2 BG-PRÜFZERT Symbol

BG-Zeichen.tif

Fig. 1-1: BG-PRÜFZERT symbol with certification number

1-2 Preface IST Intelligent Safety Technology


1.3 Prototype Test Certification

BG-Baumuster.jpg

Fig. 1-2: Prototype test certification

IST Intelligent Safety Technology Important Directions for Use 2-1


2 Important Directions for Use

2.1 Appropriate Use

IntroductionBosch Rexroth products represent state-of-the-art developments andmanufacturing. They are tested prior to delivery to ensure operating safetyand reliability.

The products may only be used in the manner that is defined asappropriate. If they are used in an inappropriate manner, then situationscan develop that may lead to property damage or injury to personnel.

Note: Bosch Rexroth, as manufacturer, is not liable for any damagesresulting from inappropriate use. In such cases, the guaranteeand the right to payment of damages resulting frominappropriate use are forfeited. The user alone carries allresponsibility of the risks.

Before using Bosch Rexroth products, make sure that all the pre-requisites for appropriate use of the products are satisfied:

• Personnel that in any way, shape or form uses our products must firstread and understand the relevant safety instructions and be familiarwith appropriate use.

• If the product takes the form of hardware, then they must remain intheir original state, in other words, no structural changes arepermitted. It is not permitted to decompile software products or altersource codes.

• Do not mount damaged or faulty products or use them in operation.

• Make sure that the products have been installed in the mannerdescribed in the relevant documentation.

2-2 Important Directions for Use IST Intelligent Safety Technology


Areas of Use and ApplicationFor Intelligent Safety Technology IST Bosch Rexroth defines appropriateuse as..[outline the basic purpose and/or use of the product described].

Control and monitoring of (the) IST may require additional sensors andactors.

Note: Intelligent Safety Technology IST may only be used with theaccessories and parts specified in this document. If acomponent has not been specifically named, then it may notbe either mounted or connected. The same applies to cablesand lines.

Operation is only permitted in the specified configurations andcombinations of components using the software and firmwareas specified in the relevant function descriptions.

Every drive controller has to be programmed before starting it up, makingit possible for the motor to execute the specific functions of an application.

Intelligent Safety Technology IST belonging to line IST have beendeveloped for use in single or multiple-axis drives and control tasks.

Available for application-specific use of IST are unit types with differingdrive power and different interfaces.

Typical applications of IST of line IST are:

• [Handling and assembly systems],

• [Packaging and foodstuff machines],

• [Printing and paper processing machines] and

• [Machine tools].

The Intelligent Safety Technology IST may only be operated under theassembly, installation and ambient conditions as described here(temperature, system of protection, humidity, EMC requirements, etc.)and in the position specified.

2.2 Inappropriate Use

Using the Intelligent Safety Technology IST outside of the above-referenced areas of application or under operating conditions other thandescribed in the document and the technical data specified is defined as“inappropriate use".

Intelligent Safety Technology IST may not be used if

• they are subject to operating conditions that do not meet the abovespecified ambient conditions. This includes, for example, operationunder water, in the case of extreme temperature fluctuations orextremely high maximum temperatures or if

• Bosch Rexroth has not specifically released them for that intendedpurpose. Please note the specifications outlined in the general SafetyGuidelines!

IST Intelligent Safety Technology Safety Instructions for Electric Drives and Controls 3-1


3 Safety Instructions for Electric Drives and Controls

3.1 Introduction

Read these instructions before the initial startup of the equipment in orderto eliminate the risk of bodily harm or material damage. Follow thesesafety instructions at all times.

Do not attempt to install or start up this equipment without first reading alldocumentation provided with the product. Read and understand thesesafety instructions and all user documentation of the equipment prior toworking with the equipment at any time. If you do not have the userdocumentation for your equipment, contact your local Bosch Rexrothrepresentative to send this documentation immediately to the person orpersons responsible for the safe operation of this equipment.

If the equipment is resold, rented or transferred or passed on to others,then these safety instructions must be delivered with the equipment.

WARNING

Improper use of this equipment, failure to followthe safety instructions in this document ortampering with the product, including disablingof safety devices, may result in materialdamage, bodily harm, electric shock or evendeath!

3.2 Explanations

The safety instructions describe the following degrees of hazardseriousness in compliance with ANSI Z535. The degree of hazardseriousness informs about the consequences resulting from non-compliance with the safety instructions.

Warning symbol with signalword

Degree of hazard seriousness accordingto ANSI

DANGER

Death or severe bodily harm will occur.

WARNING

Death or severe bodily harm may occur.

CAUTION

Bodily harm or material damage may occur.

Fig. 3-1: Hazard classification (according to ANSI Z535)

3-2 Safety Instructions for Electric Drives and Controls IST Intelligent Safety Technology


3.3 Hazards by Improper Use

DANGER

High voltage and high discharge current!Danger to life or severe bodily harm by electricshock!

DANGER

Dangerous movements! Danger to life, severebodily harm or material damage byunintentional motor movements!

WARNING

High electrical voltage due to wrongconnections! Danger to life or bodily harm byelectric shock!

WARNING

Health hazard for persons with heartpacemakers, metal implants and hearing aids inproximity to electrical equipment!

CAUTION

Surface of machine housing could be extremelyhot! Danger of injury! Danger of burns!

CAUTION

Risk of injury due to improper handling! Bodilyharm caused by crushing, shearing, cutting andmechanical shock or incorrect handling ofpressurized systems!

CAUTION

Risk of injury due to incorrect handling ofbatteries!



3.4 General Information

• Bosch Rexroth AG is not liable for damages resulting from failure toobserve the warnings provided in this documentation.

• Read the operating, maintenance and safety instructions in yourlanguage before starting up the machine. If you find that you cannotcompletely understand the documentation for your product, please askyour supplier to clarify.

• Proper and correct transport, storage, assembly and installation aswell as care in operation and maintenance are prerequisites foroptimal and safe operation of this equipment.

• Only persons who are trained and qualified for the use and operationof the equipment may work on this equipment or within its proximity.

• The persons are qualified if they have sufficient knowledge of theassembly, installation and operation of the equipment as well as anunderstanding of all warnings and precautionary measures noted inthese instructions.

• Furthermore, they must be trained, instructed and qualified toswitch electrical circuits and equipment on and off in accordancewith technical safety regulations, to ground them and to mark themaccording to the requirements of safe work practices. They musthave adequate safety equipment and be trained in first aid.

• Only use spare parts and accessories approved by the manufacturer.

• Follow all safety regulations and requirements for the specificapplication as practiced in the country of use.

• The equipment is designed for installation in industrial machinery.

• The ambient conditions given in the product documentation must beobserved.

• Use only safety features and applications that are clearly and explicitlyapproved in the Project Planning Manual.For example, the following areas of use are not permitted: constructioncranes, elevators used for people or freight, devices and vehicles totransport people, medical applications, refinery plants, transport ofhazardous goods, nuclear applications, applications sensitive to highfrequency, mining, food processing, control of protection equipment(also in a machine).

• The information given in the documentation of the product with regardto the use of the delivered components contains only examples ofapplications and suggestions.The machine and installation manufacturer must

• make sure that the delivered components are suited for hisindividual application and check the information given in thisdocumentation with regard to the use of the components,

• make sure that his application complies with the applicable safetyregulations and standards and carry out the required measures,modifications and complements.

• Startup of the delivered components is only permitted once it is surethat the machine or installation in which they are installed complieswith the national regulations, safety specifications and standards of theapplication.



• Operation is only permitted if the national EMC regulations for theapplication are met.The instructions for installation in accordance with EMC requirementscan be found in the documentation "EMC in Drive and ControlSystems".The machine or installation manufacturer is responsible forcompliance with the limiting values as prescribed in the nationalregulations.

• Technical data, connections and operational conditions are specified inthe product documentation and must be followed at all times.



3.5 Protection Against Contact with Electrical Parts

Note: This section refers to equipment and drive components withvoltages above 50 Volts.

Touching live parts with voltages of 50 Volts and more with bare hands orconductive tools or touching ungrounded housings can be dangerous andcause electric shock. In order to operate electrical equipment, certainparts must unavoidably have dangerous voltages applied to them.

DANGER

High electrical voltage! Danger to life, severebodily harm by electric shock! Only those trained and qualified to work with or on

electrical equipment are permitted to operate, maintainor repair this equipment.

Follow general construction and safety regulations whenworking on high voltage installations.

Before switching on power the ground wire must bepermanently connected to all electrical units accordingto the connection diagram.

Do not operate electrical equipment at any time, evenfor brief measurements or tests, if the ground wire is notpermanently connected to the points of the componentsprovided for this purpose.

Before working with electrical parts with voltage higherthan 50 V, the equipment must be disconnected fromthe mains voltage or power supply. Make sure theequipment cannot be switched on again unintended.

The following should be observed with electrical driveand filter components:

Wait five (5) minutes after switching off power to allowcapacitors to discharge before beginning to work.Measure the voltage on the capacitors before beginningto work to make sure that the equipment is safe totouch.

Never touch the electrical connection points of acomponent while power is turned on.

Install the covers and guards provided with theequipment properly before switching the equipment on.Prevent contact with live parts at any time.

A residual-current-operated protective device (RCD)must not be used on electric drives! Indirect contactmust be prevented by other means, for example, by anovercurrent protective device.

Electrical components with exposed live parts anduncovered high voltage terminals must be installed in aprotective housing, for example, in a control cabinet.



To be observed with electrical drive and filter components:

DANGER

High electrical voltage on the housing!High leakage current! Danger to life, danger ofinjury by electric shock! Connect the electrical equipment, the housings of all

electrical units and motors permanently with the safetyconductor at the ground points before power isswitched on. Look at the connection diagram. This iseven necessary for brief tests.

Connect the safety conductor of the electricalequipment always permanently and firmly to thesupply mains. Leakage current exceeds 3.5 mA innormal operation.

Use a copper conductor with at least 10 mm² crosssection over its entire course for this safety conductorconnection!

Prior to startups, even for brief tests, always connectthe protective conductor or connect with ground wire.Otherwise, high voltages can occur on the housingthat lead to electric shock.

3.6 Protection Against Electric Shock by Protective LowVoltage (PELV)

All connections and terminals with voltages between 0 and 50 Volts onRexroth products are protective low voltages designed in accordance withinternational standards on electrical safety.

WARNING

High electrical voltage due to wrongconnections! Danger to life, bodily harm byelectric shock! Only connect equipment, electrical components and

cables of the protective low voltage type (PELV =Protective Extra Low Voltage) to all terminals andclamps with voltages of 0 to 50 Volts.

Only electrical circuits may be connected which aresafely isolated against high voltage circuits. Safeisolation is achieved, for example, with an isolatingtransformer, an opto-electronic coupler or whenbattery-operated.



3.7 Protection Against Dangerous Movements

Dangerous movements can be caused by faulty control of the connectedmotors. Some common examples are:

• improper or wrong wiring of cable connections

• incorrect operation of the equipment components

• wrong input of parameters before operation

• malfunction of sensors, encoders and monitoring devices

• defective components

• software or firmware errors

Dangerous movements can occur immediately after equipment isswitched on or even after an unspecified time of trouble-free operation.

The monitoring in the drive components will normally be sufficient to avoidfaulty operation in the connected drives. Regarding personal safety,especially the danger of bodily injury and material damage, this alonecannot be relied upon to ensure complete safety. Until the integratedmonitoring functions become effective, it must be assumed in any casethat faulty drive movements will occur. The extent of faulty drivemovements depends upon the type of control and the state of operation.



DANGER

Dangerous movements! Danger to life, risk ofinjury, severe bodily harm or material damage! Ensure personal safety by means of qualified and

tested higher-level monitoring devices or measuresintegrated in the installation. Unintended machinemotion is possible if monitoring devices are disabled,bypassed or not activated.

Pay attention to unintended machine motion or othermalfunction in any mode of operation.

Keep free and clear of the machine’s range of motionand moving parts. Possible measures to preventpeople from accidentally entering the machine’s rangeof motion:

- use safety fences

- use safety guards

- use protective coverings

- install light curtains or light barriers

Fences and coverings must be strong enough toresist maximum possible momentum, especially ifthere is a possibility of loose parts flying off.

Mount the emergency stop switch in the immediatereach of the operator. Verify that the emergency stopworks before startup. Don’t operate the machine if theemergency stop is not working.

Isolate the drive power connection by means of anemergency stop circuit or use a starting lockout toprevent unintentional start.

Make sure that the drives are brought to a safestandstill before accessing or entering the dangerzone. Safe standstill can be achieved by switching offthe power supply contactor or by safe mechanicallocking of moving parts.

Secure vertical axes against falling or dropping afterswitching off the motor power by, for example:

- mechanically securing the vertical axes

- adding an external braking/ arrester/ clampingmechanism

- ensuring sufficient equilibration of the vertical axes

The standard equipment motor brake or an externalbrake controlled directly by the drive controller arenot sufficient to guarantee personal safety!



Disconnect electrical power to the equipment using amaster switch and secure the switch againstreconnection for:

- maintenance and repair work

- cleaning of equipment

- long periods of discontinued equipment use

Prevent the operation of high-frequency, remotecontrol and radio equipment near electronics circuitsand supply leads. If the use of such equipment cannotbe avoided, verify the system and the installation forpossible malfunctions in all possible positions ofnormal use before initial startup. If necessary, performa special electromagnetic compatibility (EMC) test onthe installation.

3.8 Protection Against Magnetic and Electromagnetic FieldsDuring Operation and Mounting

Magnetic and electromagnetic fields generated near current-carryingconductors and permanent magnets in motors represent a serious healthhazard to persons with heart pacemakers, metal implants and hearingaids.

WARNING

Health hazard for persons with heartpacemakers, metal implants and hearing aids inproximity to electrical equipment! Persons with heart pacemakers, hearing aids and

metal implants are not permitted to enter the followingareas:

- Areas in which electrical equipment and parts aremounted, being operated or started up.

- Areas in which parts of motors with permanentmagnets are being stored, operated, repaired ormounted.

If it is necessary for a person with a heart pacemakerto enter such an area, then a doctor must beconsulted prior to doing so. Heart pacemakers thatare already implanted or will be implanted in thefuture, have a considerable variation in their electricalnoise immunity. Therefore there are no rules withgeneral validity.

Persons with hearing aids, metal implants or metalpieces must consult a doctor before they enter theareas described above. Otherwise, health hazards willoccur.



3.9 Protection Against Contact with Hot Parts

CAUTION

Housing surfaces could be extremely hot!Danger of injury! Danger of burns! Do not touch housing surfaces near sources of heat!

Danger of burns! After switching the equipment off, wait at least ten (10)

minutes to allow it to cool down before touching it. Do not touch hot parts of the equipment, such as

housings with integrated heat sinks and resistors.Danger of burns!

3.10 Protection During Handling and Mounting

Under certain conditions, incorrect handling and mounting of parts andcomponents may cause injuries.

CAUTION

Risk of injury by incorrect handling! Bodilyharm caused by crushing, shearing, cutting andmechanical shock! Observe general installation and safety instructions

with regard to handling and mounting. Use appropriate mounting and transport equipment. Take precautions to avoid pinching and crushing. Use only appropriate tools. If specified by the product

documentation, special tools must be used. Use lifting devices and tools correctly and safely. For safe protection wear appropriate protective

clothing, e.g. safety glasses, safety shoes and safetygloves.

Never stand under suspended loads. Clean up liquids from the floor immediately to prevent

slipping.



3.11 Battery Safety

Batteries contain reactive chemicals in a solid housing. Inappropriatehandling may result in injuries or material damage.

CAUTION

Risk of injury by incorrect handling! Do not attempt to reactivate discharged batteries by

heating or other methods (danger of explosion andcauterization).

Never charge non-chargeable batteries (danger ofleakage and explosion).

Never throw batteries into a fire. Do not dismantle batteries. Do not damage electrical components installed in the

equipment.

Note: Be aware of environmental protection and disposal! Thebatteries contained in the product should be considered ashazardous material for land, air and sea transport in the senseof the legal requirements (danger of explosion). Disposebatteries separately from other waste. Observe the legalrequirements in the country of installation.

3.12 Protection Against Pressurized Systems

Certain motors and drive controllers, corresponding to the information inthe respective Project Planning Manual, must be provided withpressurized media, such as compressed air, hydraulic oil, cooling fluidand cooling lubricant supplied by external systems. Incorrect handling ofthe supply and connections of pressurized systems can lead to injuries oraccidents. In these cases, improper handling of external supply systems,supply lines or connections can cause injuries or material damage.

CAUTION

Danger of injury by incorrect handling ofpressurized systems ! Do not attempt to disassemble, to open or to cut a

pressurized system (danger of explosion). Observe the operation instructions of the respective

manufacturer. Before disassembling pressurized systems, release

pressure and drain off the fluid or gas. Use suitable protective clothing (for example safety

glasses, safety shoes and safety gloves) Remove any fluid that has leaked out onto the floor

immediately.

Note: Environmental protection and disposal! The media used in theoperation of the pressurized system equipment may not beenvironmentally compatible. Media that are damaging theenvironment must be disposed separately from normal waste.Observe the legal requirements in the country of installation.

IST Intelligent Safety Technology Safety Technology Basics 4-1


4 Safety Technology Basics

4.1 General

The working safety of a machine is determined to a large part by to whatdegree dangerous movements are generated by this machine. When amachine is in automatic operation, protective equipment prevents humanaccess to points of danger.

When machines and systems are in set-up mode, it often happens thatpersons must be in areas of danger at a time when the entire systemcannot be removed from power. In these situations, the machine operatormust be protected by internal drive and control mechanisms.

Bosch Rexroth Intelligent Safety Technology (IST) provides the user thecontrol- and drive-side requirements for implementing protective functionsfor persons and machines with a minimum of effort in planning andinstallation. By using Intelligent Safety Technology, the functioning andavailability of the machine is increased significantly compared to the useof conventional safety technology.

4.2 Analysis of Dangers and Risk Assessment

In order to bring a machine into operation, the manufacturer must subjectthe machine to an analysis of dangers according to machine guideline89/392/EWG to determine the dangers involved in using the machine. Inorder to attain a degree of safety that is as high as possible, threeprinciples are listed in the guideline:

• elimination/minimization of the dangers due to the construction itself,

• taking the required protective measures against dangers that cannotbe eliminated, and

• documentation of the existing residual risks and informing the user ofthese risks.

The analysis of dangers is a multi-step iterative process that is describedin more detail in EN 1050 [4] – Guiding Principles for Risk Assessment.Within the framework of this documentation, only a very brief overviewcan be given regarding the analysis of dangers. Otherwise, the user ofIntelligent Safety Technology must intensively occupy himself withstandards and the legal situation.

Completion of the analysis of dangers fulfills a requirement for specifyingthe category for safety-related controls according to EN 954-1, which thesafety-oriented parts of the machine control must satisfy. Moreinformation regarding these categories can be found, other than in thestandard itself, in BIA report “Categories for Safety-Related ControlsAccording to EN 954-1”.

The safety-related parts of the MTC200 control family and/or the DIAX04drive family corresponds to the use of IST category 3 of EN 954-1. Withthe certification of both systems by a accredited liboratory, the user hasthe possibility to execute the certification of his machines himself with IST.

4-2 Safety Technology Basics IST Intelligent Safety Technology


Category 1) Summary of requirements System behavior

2) Principles forattaining safety

B The safety-related parts of controls and/ortheir protective equipment, as well as theircomponents, must be designed, built,selected, assembled and combined inagreement with the applicable standards insuch a manner that they can withstand theexpected influences.

The occurrence of an error can lead toloss of the safety function.

Characterizedmainly by theselection ofcomponents.

1 Requirements of category B must be fulfilled.

Tried-and-tested components and safetyprinciples used.

The occurrence of an error can lead toloss of the safety function, but thepossibility of occurrence is less than incategory B.

2 The requirements of category B and the useof tried-and-tested safety principles must befulfilled.

The safety function must be checked atsuitable intervals by the machine control.

The occurrence of an error can lead toloss of the safety function between thetesting times. The loss of the safetyfunction is detected by the test.

3 The requirements of category B and theuse of tried-and-tested safety principlesmust be fulfilled.

Safety-related parts must be designed insuch a manner that a single error in eachof these parts does not lead to loss of thesafety function; the single error is alwaysdetected during tests at suitable intervals.

If the single error occurs, the safetyfunction is always retained. Certain,but not all, errors are detected. Anaccumulation of undetected errorscan lead to loss of the safetyfunction.

Characterizedmainly by thestructure.

4 The requirements of category B and the useof tried-and-tested safety principles must befulfilled.

Safety-related parts must be designed insuch a manner that a single error in each ofthese parts does not lead to loss of the safetyfunction; the single error is detected during orbefore the next test of the safety function; ifthis is not possible, an accumulation ofundetected errors must not lead to loss of thesafety function.

If errors occur, the safety function isalways retained.

The errors are detected in time toprevent loss of the safety function.

1) The categories are not to be used in any given sequence or hierarchic arrangement in terms of the safety-related requirements.2) The risk assessment will demonstrate whether complete or partial loss of the safety function(s) due to errors is acceptable.

Fig. 4-1: Summary of requirements for safety categories (excerpted from EN954-1: 1996, sequence 6)



4.3 Safety-Relevant Standards and Regulations

The following provides the user with a brief overview of standards relevantfor the use of safety-related controls. In this regard, this documentationmakes no claim for completeness. The user himself must determinewhich regulations apply to a certain application.

Component-Relevant Standards

Product group Standard Title Date ofissue

Electric motors EN 60034-1 Turning Electric Machines, Part 1 09.2000

EN 60034-5 Turning Electric Machines, Part 5 12.2001

Supply devices andmodules

EN 50178 Equipment of Power Installations with ElectronicEquipment

04.1998

Drive control devices EN 50178 Equipment of Power Installations with ElectronicEquipment

04.1998

Controls EN 50178 Equipment of Power Installations with ElectronicEquipment

04.1998

Power packs EN 50178 Equipment of Power Installations with ElectronicEquipment

04.1998

Systems EN 50178 Equipment of Power Installations with ElectronicEquipment

04.1998

Electric drives IEC 22G/52CD(IEC61800-5)

Speed-modifiable electric drives part 5: Requeststo the electric, thermic and functional safety

05.1999

Fig. 4-2: Component-relevant standards for IST

Machine-Relevant Standards

Standard Title Date ofissue

EN 60204-1 Safety of Machines,

Electrical Equipment of Machines

11.1998

EN 61491 Electrical Equipment of Industrial Machines 11.1998

IEC 61491 Serial Data Transfer in Real Time between Controls and Drives(SERCOS interface Specifications)

11.1998

EN 292-1EN 292-2

Safety of Machines,

Basic Terms, General Guiding Principles for Design

11.199106.1995

EN 954-1 Safety of Machines,

Safety-Related Parts of Controls

03.1997

EN 1921 Safety of Integrated Manufacturing Systems 10.1995

prEN 775 Safety of Industrial Robots 08.1993

prEN 1037 Safety of Machines. Prevention of Accidental Startup 04.1996

DIN V VDE 0801 Basic Principles for Computers in Systems with Safety-RelatedDuties

01.1990

prEN 12415 Safety of Machine Tools – Small, Numerically-Controlled Lathes andTurning Centers

05.2002

prEN 12417 Safety of Machine Tools – Processing Centers 12.2001

Fig. 4-3: Machine-relevant standards for IST



Overview of Required Safety Categories in C StandardsFollowing is an overview of the required safety categories for safety-related parts of controls in C standards.

prEN 12417

Processingcenters

prEN 12415

Automatic lathes

EN 775

Industrial robots

prEN 1921

Automaticmanufacturingsystems

Approval switchingequipment

Category 3 Category 3 Category 3 Category 3

Speed reduction,incl. protectionagainst accidentalstartup (n=0)


Category B andConsent switch

Category B andConsent switch

Protectiveequipment locks


Category 1 formaintenance doors

End position limits - - Category 3 Category 3

Emergency stop Acc. to EN 60204-1 Category 3 Category 3 Acc. to EN 60204-1

Fig. 4-4: Requirements of safety-related controls in C standards

Note: Standards EN775 and prEN 1921 do not contain any directreferences to EN 954-1; however, the requirements are similarto those in this standard.



4.4 Definition of Terms

In terms of safety technology, an electric drive system includes all of thehardware and software components that can affect the movements of themachine. An electric drive system includes, for example, PLC, CNC, APR,drive controller and firmware. 1

In terms of drive functions such as safe shutdown and safe stopping,“safe” means that a risk assessment according to EN 954-1 applies forthe behavior of the control parts that are relevant for these functions if anerror occurs.

The connection between the CNC and the DIAX04 drive controls isimplemented using fiber optics. A SERCOS ring according to IEC 1491 isused as the bus topology. The ring starts and ends at the CNC control;the optical output of the control is connected with the optical input of thefirst drive. The optical input of the CNC is connected with the opticaloutput of the last drive.

The PLC control is connected with machine operating terminal BTA andthe external RECO I/O units using an Interbus connection according toDIN 19258. Here, the PLC control acts as the Interbus master, while theBTA and RECOs act as Interbus slaves. Each interface is electricallyisolated and contains an RS485 duplex connection.

Intelligent Safety Technology (IST) means the hardware and softwarecharacteristics that permit safety-relevant drive functions to beimplemented. A maximum amount of safety can be implemented forpersons and machines. IST corresponds to the current state of the art forsafety-related controls of category 3 according to EN 954-1 in the area ofhighly dynamic drives.

1 acc. to position paper DKE-AK 226.03

Electric drive system

Safe

SERCOS interface

Interbus connection

Intelligent Safety Technology

IST Intelligent Safety Technology Intelligent Safety Technology (IST) 5-1


5 Intelligent Safety Technology (IST)

5.1 Bosch Rexroth Control and Drive System with IntelligentSafety Technology

Basic Structure and FunctionsA Bosch Rexroth control and drive system with Intelligent SafetyTechnology basically consists of components of the MTC200 controlfamily and DIAX04 drive family. Intelligent Safety Technology consists ofhardware and software components that work together to provide thesafety functions.

!

"

#$ #

!

!

System200.FH7

Fig. 5-1: SYSTEM200 with Intelligent Safety Technology

To use IST, only one additional hardware component is required for eachaxis: a safety I/O module. This module, which is based on RECO I/Omodules, provides electrically isolated safety inputs and potential-freesafety outputs. All other IST components are software components.These consist of firmware parts in the CNC and drive as well as PLC userprogram parts. The PLC user program must not exceed the maximumcycle time of 75ms. The component lists for Intelligent Safety Technologycan be found in the Appendix of this documentation. Intelligent SafetyTechnology can be used with software version 19 or as of softwareversion 22.

5-2 Intelligent Safety Technology (IST) IST Intelligent Safety Technology


The MTC200 control family consists of the BTV, an industrial PC that isusually equipped with the CNC module MTC-P and the PLC module MTS-P (ISA bus plug-in cards). However, RECO variants MTC-R or MTS-Rcan also be used with IST.

The CNC module consists of the CNC processor and the axisprocessor(s). An axis processor card can control up to 7 digital drivesusing a SERCOS fiber optic ring.

Safety-relevant signals are transferred to the control using safetyinput/output units that are connected using Interbus-S.

The DIAX04 drive system consists of an “HVE” or “HVR” power supplyunit that is connected to the power supply as well as several connecteddrives. Each drive is equipped with an “HDS” or “HDD” drive controllerand one of the following motor types:

• “MKD” / “MHD” synchronous motor or

• “2AD” asynchronous motor or

• 1MB built-in asynchronous motor or

• LSF, LAF or LAR built-in linear motor.

The drive controllers are connected to the CNC control using theSERCOS interface.

MTC200 control family

DIAX04 drive family



5.2 Comparison with Conventional Safety Technology

The difference between a control and drive system with Intelligent SafetyTechnology and systems with conventional security technology is that thesafety functions are integrated directly into the intelligent drives and thecontrol is integrated as hardware and software. This allows increasedfunctionality at maximum security to be achieved in all operating modes.Intelligent Safety Technology is not primarily intended for replacingconventional safety technology components such as emergency stopswitch devices and protection door monitors. The following conventionalsecurity technology components are not required:

• motor standstill monitor for observing safe operating stops

• speed monitor for observing safely reduced speeds

• power contactor between controllers and motors

• limit switch or position cams for area detection

At the same time, the available personnel and machine safety isincreased since, for example, the total reaction time of the system to anerror event has been considerably reduced compared to similar systemswith conventional security technology. The safety signals are transferredusing the Interbus-S / SERCOS interface field busses, which significantlysimplifies the cabling structure of the machine. No special drivecontrollers or control modules are required.



5.3 Overview of Safety Functions

Intelligent Safety Technology (IST) provides the following functions for theprotection of machines and personnel:

Safe stop protects a machine axis against unintentionally starting. In caseof a safe stop, the power supply to the drive system is safely interrupted.

Like the safe stop, the safe operation stop also protects the machine axisagainst unintentionally starting. The drive system is stopped at a naturalpoint in the production process. All controlling functions between thecontrol and the drive motor are maintained. Due to Intelligent SafetyTechnology, undesired, dangerous movements as a result of errors aresafely prevented.

Intelligent Safety Technology safely prevents a drive from exceeding thespeed limit value set in the parameters.

Safety measures in the CNC control and drive system prevent an axisfrom moving out of the admissible travel range set in the parameters.

Safe cams allow a safe division of the axis travel range. They can be usedfor switching between various safety functions or for releasing externalsafety mechanisms.

Safe stop

Safe operation stop

Safely reduced speed

Safely limited absolute position

Safe cams



5.4 Functioning of Intelligent Safety Technology

The safety functions are monitored by the control and drive system duringoperation. In this regard, three principles for detecting “sleeping” errorshave been implemented:

• dual channel data processing

• two-way comparison of safety-relevant data

• forced dynamics

These measures ensure that a single error cannot lead to a loss of thesafety functions.

Dual Channel StructureAll safety-relevant data are transferred and processed by two independentchannels. The CNC control, consisting of the PLC and CNC, are the firstmonitoring channel, while the drive controllers, in cooperation with thesafety I/O components, are the second channel.

!

%&&%

'(

"

"

Channels.FH7

Fig. 5-2: Dual channel data processing

The safety signals of the first monitoring channel (CNC) are processedwith the standard I/O level. The input signals are processed in the PLCuser program using logic programmed by the user; they are thentransferred via the image memory to the CNC.

The safety I/Os for the drive (channel 2) are exchanged directly betweenthe safety I/O module and the drive via the PLC and the CNC.

Safety channel 1

Safety channel 2



Two-way Data ComparisonThe relevant monitoring functions for representing the safety functions runindependently in the NC control and in the drive. In order to ensure thatthese functions work with the correct (equal) limit values, two-way datacomparison must be executed. The foundation for two-way datacomparison is a special data exchange mechanism (multiplex channel)using the SERCOS interface.

If differences between the monitored parameters of the NC and of thecorresponding drive are determined, a corresponding error reactionoccurs.

) *'( " ) "'+

!

" %,

% - %

-- &

" %

% - %,

Kreuzvgl.FH7

Fig. 5-3: Two-way data comparison (schematic)

Two-way data comparison is started when the SERCOS ring is “started”.Two-way data comparison starts as soon as the operating mode hasbeen reached. If safety parameters of the NC and of the drive are notidentical during operation and if the system is under power, stopping ofthe axis/axes is initiated.

If one or more safety functions are switched on, the safety monitors areimmediately activated. After a pause, another two-way data comparison,in addition to the one that is always running, is carried out. This occursonly if no safety function was active beforehand, not for the dynamicswitching on and off of additional safety functions. During the pause, thetwo monitoring systems in the CNC and in the drives are in a safeoperating stop.

As long as safety functions are active, the dynamic switching on and off ofadditional safety functions is permitted. After a set switching time, thestatus of the activation inputs in both systems must have been brought inline. Otherwise, an error reaction occurs. Safety output signal “Safetyfunction active” remains on the value “1” even during the transition statuswhile additional safety functions are being switched on and off. Outputsignal “Switching complete” takes on the value “0” during this period.

Cyclic two-way data comparison

Additional two-way datacomparison when activating

safety functions

Switching safetyfunctions on and off



The deactivation of all safety functions must also be carried out accordingto the transition time set in the parameters. During deactivation, safetyoutput signal “Safety function active” is immediately reset. If the statussignals in “Status of safety functions” in both systems are identical whenthe safety functions have been activated and if the “Transition time forswitching the safety functions” has elapsed, both systems set safetyoutput signal “Switch complete” to 1.

The following errors can be detected using two-way data comparison:

• safety function has been activated on only one system.

• activation of the incorrect safety functions.

• addressing of the incorrect drive (danger of mix-up).

• monitoring the incorrect datum (actual position).

• use of different monitoring parameters.

• safety function does not work (life counter).

• random hardware error.

• random software error.

Note: Chapter 11 "Error Messages and Error Elimination" providesmore information regarding problem localization of an errorthat has occurred using two-way data comparison!

Deactivation of safety functions

Errors that can be detectedusing two-way data comparison



Forced dynamicsThe shutdown circuits for switching on the power of drives that areactivated when a safety function detects an error must be tested if theyfunction before a safety function is activated for the first time and atregular intervals thereafter. Accordingly, the tests are carried out withprotective doors closed and safety functions inactive. The goal of forceddynamics is to discover static error states, so-called sleeping errors, in theshutdown circuits.

Both the MTC200 (CNC control) and the drives have their own shutdowncircuits:

Shutdown circuits of drive Shutdown reaction

Internal controller enablement Controller enablement is shut down

Error message on supply module Power contactor is shut down

Error message via SERCOS Depending on reaction of NC

Shutdown circuits of CNC control

Controller enablement via SERCOS interface Controller enablement is shut down

Error message on PLC Shutdown via SERCOS interface

Fig. 5-4: Intelligent Safety Technology shutdown circuits

Testing of shutdown circuits is carried out in two parts. In the first part, thesafe operation stop on the drive is activated. Then the interpolator on theCNC control simulates a movement of the corresponding axis, thustriggering stopping by the safety monitor on the drive. The response of theshutdown circuits is tested by the drive, the CNC control and the PLCuser program.

In the second part, the safe operation stop on the CNC control isactivated. Then the drive sends a simulated incorrect actual position valueto the CNC control. The safety monitor of the CNC control detects theerror and initiates the stopping of the drive on its part. The function of theshutdown circuits is again tested by the drive, the CNC control and thePLC user program.

Note: The axes remain stopped in any case during the forceddynamics!

The Consent key is also tested within the framework of forced dynamics.The Consent key must not be pressed during forced dynamics!

Shutdown circuits

Testing shutdown circuits

Test of Consent key



Forced dynamics is controlled by the PLC user program. For this purpose,the DYNAM standard function module is provided by Bosch Rexroth. Thisfunction module monitors the execution of forced dynamics. Only after allthe shutdown circuits have been successfully tested is the timer reset andthe use of safety functions with this drive released. If an error occursduring forced dynamics, this is curtailed immediately. Regardless ofwhether safety functions were active before the error or not, safetyfunctions can no longer be used with the corresponding axis after forceddynamics is curtailed by an error. The forced dynamics timer is reset afterthe error is detected

Note: The use of the DYNAM function module in the PLC userprogram is described in detail in section 8.3 "SampleApplication". A short description of the module can be found inthe Appendix.

Forced dynamics procedure

IST Intelligent Safety Technology IST Safety Functions 6-1


6 IST Safety Functions

6.1 Overview of Safety Functions for Protection of Persons

Safety function for protection ofpersons

Description of functions Implementedin

2-channelprocessing and

connection

(1)

Safe stop In case of a safe stop, the power supply tothe drive is safely interrupted.

NC/ PLC anddrive

Yes

Safe operation stop The drive system is stopped at a naturalpoint in the production process (operationstop). All control functions between theelectronic control and the drive motor aremaintained. Control measures prevent thedrive from executing dangerous movementsas a result of errors.

NC/ PLC anddrive

Yes

Safely reduced speed (2) Control measures safely prevent the drivefrom exceeding the given speed limit values.

NC/ PLC anddrive

Yes

Safely limited absolute positions (2) Control measures shut the drive systemdown when it reaches a given absoluteposition limit value.

NC/ PLC anddrive

Yes

Safe cams Safe activation of valves, solenoid switches,etc. at certain positions of the axis, forexample for rotary tables.

NC/ PLC anddrive

Yes

Consent key Procedure in manual operation whilepersons are in the danger zone (with opendoor) so that this can be shut down safely ina critical dangerous situation.

NC/ PLC anddrive

Yes

Fig. 6-1: Overview of Safety Functions

(1) according to safety category 3 of EN 60 954-1

(2) These safety functions are combined in safely reduced speed with safely limited absolute positions.

6-2 IST Safety Functions IST Intelligent Safety Technology


6.2 Safe Stop

Safeguard against accidental startup. The drive does not generate torqueand thus does not generate dangerous movements.

The safe shutdown is carried out by pressing the starting lockout found inthe Bosch Rexroth drive module. The starting lockout safely switches offthe power in the drive on the software and hardware sides.

Note: Safety function safe stop should not be used to stop a movingaxis.

The following conditions must be fulfilled before safety function safe stopcan be selected:

• The safety function must be enabled in the safety parameters of theCNC and in the drive.

• Forced dynamics has been carried out or is valid.

• Safe stop must be selected using two channels in the CNC and in thedrive via the “Safe stop” deactivation signals (signal status ‘0’).

• Signals “Activate starting lockout” and “Starting lockout active” must bewired to/from the drive.

• The starting lockout must be activated by the PLC user program andthe feedback must be passed on to the CNC by the PLC userprogram.

Safe stop must be selected/deselected using two channels in the CNCand in the drive. If only one channel is used to select/deselect the safetyfunction, the drives are shut down by the shutdown circuits.

1. Channel (CNC) 2. Channel (drive) Meaning

Safe stopdeactivation signal =

Safe stopdeactivation signal =

0 0 Safe stop has beenselected

1 1 Safe stop has beendeselected

Fig. 6-2: Selecting and deselecting safe stop

Note: If safe stop has been selected, the axis can be manuallymoved out of the position.

The starting lockout is described in detail in section "Starting Lockout as aShutdown Circuit of the CNC" (p. 6-39).

Application

Conditions

Selecting anddeselecting safe stop



In the case of vertical axes in manual operation, observe the following:

DANGER

Dangerous movements!Persons endangered by falling or descendingaxes! The motor brake that is supplied as standard is not

suitable by itself for the protection of persons, even ifthe motor is not under power!

An external brake that is activated and monitoredsolely by the drive controller is also unsuitable for theprotection of persons!

Ensure the protection of persons usingsuperordinate error-proof measures:Cordon off the hazardous area by means of a safetyfence or a safety screen.

Secure vertical axes against falling or slipping afterswitching off the motor power by, for example:

- mechanically locking the vertical axis

- external brake/catching/clamping mechanisms or

- adequately counterbalancing the axis.



6.3 Safe Operation Stop

Safeguard against accidental startup. In certain operating states of asystem, it may be necessary to stop the production process at specificpoints and then to continue the process without switching the system off.If no one is in the danger zone of the machine in these operating states,the safe stop has no relevance to safety and does not require anyadditional safety mechanisms.

However, if a person must move within the danger zone in the describedoperating state, protection of persons is ensured by selecting functionsafe operation stop.

Any accidental startup of the axis is immediately detected by the twomonitoring systems in the drive and in the CNC, leading to the drive beingshut down.

The following conditions must be fulfilled before safety function safeoperation stop can be selected:

• The safety function must be enabled and set in the safety parametersof the CNC and in the drive.


• The function must have been selected using the safety input signals ofthe CNC and the drive (signal status ‘0’).

Safety function safe operation stop must be selected/deselected in theCNC and in the drive. A discrepancy is detected by the two-way datacomparison, leading to a shutdown of the drives by the shutdown circuits.

If only safety function safe operation stop is to be implemented withoutswitching to safety function safely reduced speed, selection/deselection iscarried out using the following safety input signals:


Safe operation stopdeactivation signal =

Safe operation stopdeactivation signal =

0 0 Safe operation stop hasbeen selected

1 1 Safe operation stop hasbeen deselected

Fig. 6-3: Selecting and deselecting safe operational stop

Application

Conditions

Selecting and deselecting safeoperation stop



When the safety function is switched on in operating mode “Positioncontrol”, the safety monitor stores the currently output position setpoint.Modification of the cyclic position setpoint results in the drive beingswitched off immediately by the switch-off paths. The actual position valueis compared with the stored position setpoint. Variance within the positionwindow that is defined by parameter “Position monitoring window for safeoperation stop” is permitted here.

In operating mode “Speed control” the current actual position value isstored when safe operation stop is started. The current actual positionvalue is continuously compared to the stored position value; it may notleave the position window. Only a value of ‘0’ is permitted for the speedsetpoint.

DANGER

Uncontrolled axis movements!

If an error occurs, jolting of the motor shaft can occur.

If there is a defect in the power electronics in the driveand safety function safe operation stop is selected,brief jolting of the motor shaft can occur, dependingon the construction of the motor.

Position monitoring window



6.4 Safely Reduced Speed

Monitoring of safely reduced speed is part of safety function safelyreduced speed with safely limited absolute positions 1 and 2. IST providesa combination of the two safety functions. In order to satisfy differingconditions, two switchable sets of safety parameters can be selected.

In the function safely reduced speed, exceedance of a specified speedlimit value is observed by monitoring functions in the CNC and in thedrives. Activation of the monitor leads to a shutdown of the drive system.

Note: If a transmission gear is used, a second encoder is required.

Note: Monitoring of safely reduced speed always refers only to theindividual axis. Resulting path velocities could be greater thansafely reduced speed.

The following conditions must be fulfilled before safely reduced speed canbe selected:

• Safety function safely reduced speed must be set in the safetyparameters of the CNC and in the drive.


• Safety input signals “Deactivation of safely reduced speed with safelylimited absolute positions” in the CNC and in the drive have signalstatus ‘0’ (selected).

Application

Conditions



Safety function safely reduced speed must be selected/deselected usingtwo channels in the CNC and in the drive. After selection, safety functionsafe stop or safe operation stop is preselected at first. Which of the twosafety functions is activated can be set in safety parameter “Selection ofsafety functions”. If safety input signal “Consent” (Consent key) is nowswitched on in both channels, the axis can be moved using safelyreduced speed.


Safely reducedspeeddeactivationsignal =

Con-sent =

Safely reducedspeeddeactivationsignal =

Con-sent =

0 0 0 0 Safe stop orsafeoperationstop hasbeen selected

0 1 0 1 SafelyreducedSpeed hasbeen selected

1 0 / 1 1 0 / 1 Safetyfunction hasbeendeselected

Fig. 6-4: Selecting and deselecting safely reduced speed

Monitoring of safely reduced speed with safety function safely reducedspeed with safely limited absolute positions selected can be switched offonly if safely limited absolute positions is used. To do this, safetyparameter “Maximum speed for safety function” of the CNC and of thedrive are to be set to a value of ‘0’.

The limit values for the individual techniques (milling, turning, grinding,etc.) are specified in the C standards (product standards).

Possible limit values for lathes in the Setup operating mode:

• 2m/min for axis movements

• 50 rpm for spindle rotations

Note: The machine manufacturer is responsible for the correctselection of speed limit values, depending on utilization andoperating mode.

Selecting and deselecting safelyreduced speed

Switching off safely reducedspeed

Limit values for speeds



6.5 Safely Limited Absolute Positions

Monitor safely limited absolute positions is part of safety function safelyreduced speed with safely limited absolute positions 1 and 2.

The safety function ensures that the drive system is switched off whendefined absolute position limit values are exceeded. Due to safely limitedabsolute positions, axis-specific protective measures for persons andmachines can be implemented, as can working area limitations withouthardware limit switches.

Note: The specification of position limit values must take themaximum technically possible coasting down of the axis intoaccount. Unexpected drive movements must be taken intoaccount within the limited range.

The safety function can be switched on only under the followingconditions:

• The safety function must be set in the safety parameters of the CNCand in the drive.

• Safety input signals “Deactivation of safely reduced speed with safelylimited absolute position” in the CNC and in the drive have signalstatus ‘0’ (deselected).


• Safe referencing must be carried out by the user.

If no safe reference exists or if forced dynamics has not been carried out,the drive is shut down when the safety function is activated.

Application

Conditions



The safety function must be selected/deselected using two channels inthe CNC and in the drive. In the following figure, it is assumed that theConsent key is not pressed. Pressing the Consent key would result inswitching from safety function safe stop or safe operation stop to safetyfunction safely reduced speed. Consent has no influence on safely limitedabsolute positions.


Deactivation signalsafely reduced speedwith safely limitedabsolute position =

Deactivation signalsafely reduced speedwith safely limitedabsolute position =

0 0 Safe stop or Safeoperation stop andsafely limited absoluteposition have beenselected

1 1 Safety function hasbeen deselected

Fig. 6-5: Selecting and deselecting safely reduced speed with safely limitedabsolute position

Monitoring of safely limited absolute position with safety function safelyreduced speed with safely limited absolute positions selected can beswitched off only if safely reduced speed is used. To do this, the twosafety parameters “Upper position limit for safety function” and “Lowerposition limit for safety function” of the CNC and of the drive are to be setto a value of ‘0’.

Selecting and deselecting safelylimited absolute position

Switching off safely limitedabsolute positions



6.6 Safe Cams

With the help of position switch points, output signals are used to indicatethat the axis is within a certain position range. 4 pairs of cams areavailable for each axis. Each pair of cams consists of two position switchpoints that are defined by parameters “Upper limit for position switchpoint” and “Lower limit for position switch point”.

Safe cams replaces the following hardware-based solutions:

• area detection

• working area limitations

• shelter limitations

The signals of the position switch points are generated using twochannels in the CNC and in the drive. The validity of the signal is ensuredonly if both channels have set the position switch point signal to ‘1’. Only asignal status of ‘1’ may be evaluated for safety-related jobs.

Note: The position switch points of safe cams must be processedfurther according to category 3 of EN 60954-1.

An example of further processing of safe cams can be found in section"Transferring Safety I/O Signals", p. 6-32.

Safety function safe cams has the following requirements:

• Safe cams must be designed in the safety parameters of the CNC andin the drive.

• Safe referencing must be carried out for the axis.

• Forced dynamics is not a requirement for safe cams.

Note: The signals of safety function safe cams are issued – and thusgo into effect – only after safe referencing has been carriedout.

Application

Signal evaluation

Conditions



6.7 Consent

When safety function safely reduced speed with safely limited absolutepositions is active, each axis movement is blocked by a consent signal.The user can move axes as long as he presses the Consent key. Whenthe key is released, safety function safely reduced speed with safelylimited absolute positions switches to safe stop or safe operation stop.

Which safety function is active when the Consent key is not pressed canbe preset in the safety parameters. Which of the two safety functions is tobe used is specified in safety parameter Cxx.117 in the control and P-0-0269 in the drive “Selecting safety functions”.

In manual operation of a system, a Consent key may be required if theoperator has to safely switch off the existing axis (axes) in a dangeroussituation. This is also the case if he does not press the Jog keys forjogging or does not turn the handwheel in manual operation.

Safety function safely reduced speed with safely limited absolute positionsis preselected in jogging or manual operation. An axis movement ispermitted by the safety functions in the CNC and in the drive only if thesignal from the Consent key also arrives via the input. Otherwise, the axisis shut down using the shutdown circuits.

Note: Consent must have the highest priority for an axis movement.This means that consent must be present before movementcan be triggered, e.g. by a jog command.

In the PLC user program, the Consent signal can be linked to the processenablement (PXXC.ENABL). This ensures that movement is triggeredonly if the Consent key is pressed first and a movement command isissued thereafter.

Switching from safely reducedspeed to safe stop or safe

operation stop

Consent key in manual operation

Activation



The signals from the Consent key are laid out in two channels on the two“Consent key” safety inputs of the CNC and of the drive of theparticipating axes. As soon as the safety functions in the CNC and in thedrive have received an enablement from the Consent key, theyacknowledge the enablement.

If the acknowledgement is in both channels, the CNC generates anoverall “Movement enabled” acknowledgement signal that is transferredto the PLC as an axis status signal (AXXS.SAFEN). In the PLC userprogram, movement should be blocked with axis control signalAXXC.MHOLD until the “Movement enabled” acknowledgement or theconsent signal is present. Movement without acknowledgement alwaysleads to the drive being shut down using the shutdown circuits.

The following figure shows the monitoring of safely reduced speeddepending on the Consent signal. If consent exists (signal status ‘1’), thespeed of the axis is monitored for safely reduced speed. If consent is nowremoved (signal status ‘0’), monitoring of safely reduced speed switchesto safe operation stop. The speed value for monitoring safely reducedspeed is reduced to a value of ‘0’ over a ramp, depending on safetyparameter “Transition time for switching safety functions”.

If consent is removed during an axis movement and if a motion hold is notissued for the axis, the axis movement leads to a malfunction reaction. Inthis case, the drives are switched off using the shutdown circuits witherror message “Monitoring of safely reduced speed”.

In the PLC user program, movement should be prevented by the motionhold (AXXC.MHOLD) as long as there is no consent signal and safetyfunction safely reduced speed is selected.

!

&

#

.

!

#/#01

./-%1%

,

,

23(

4

Zustimmung.FH7

Fig. 6-6: Consent and motion hold

Internal processing



60*018.Cxx

1000)*104.orCxx101.Cxx(

a

Vt

Axis

actB ==

L: tB = Braking time in sVact = Actual speed in mm/minaAxis = Acceleration in mm/s2

Cxx.101= maximum speedfor safety function 1 in mm/s

Cxx.104= maximum speedfor safety function in mm/s

Cxx.018= maximum acceleration mm/s2

xx = Axis number -Fig. 6-7: Formula for calculating the braking time

If safety functions safely reduced speed 1 and 2 are used, the largerspeed limit value must always be used to calculate the braking time.

( )ZLPLCbü ttt*1,2tCxx.118 ++==

where: 6,16*min]/1000[Kv

1000*5tZL =

L: Cxx.118= transition time for switchingthe safety functions in ms

tb = Braking time in mstPLC = maximum PLC cycle time in mstZL = time constant position controller in msKv = position controller Kv factor

(S-0-0104) in 1000/minxx = Axis number -

Fig. 6-8: Formula for calculating “Transition time for switching the safetyfunctions“

Safety parameter "Transition time for switching safety functions" isdescribed in section "Description of Safety Parameters" (p. 6-23).

Braking time calculation

Calculation of transition time forswitching safety functions



6.8 Safe Referencing

Safety functions safely reduced speed with safely limited absolutepositions and safe cams require safe referencing. The effectiveness ofthese safety functions is guaranteed only if the safe referencing procedurehas been used to ensure that the axis mechanical system is really at theposition that is displayed using the measurement system(s).

Safe referencing can be implemented either automatically or with manualuser consent. If safe referencing is implemented automatically, anadditional switch is required on the axis mechanical system. This switch isconnected, using two channels, to the “Reference cam for safereferencing” safety inputs of the NC and of the drives. The switch isactivated at the position of a short cam that is specified by safetyparameter “Reference position for safe referencing”. In this way, themechanical reference can be controlled to some extent.

!"#

$

%&$'(

) )

*

*

+ +

$

,-

!"#

Sichere_Referenz.FH7

Fig. 6-9: Automatically executed safe referencing

Description

Automatically executed safereferencing



In safe referencing with manual user consent, the machine operatorgenerates the cam signal with, for example, a dual-channel key. Themachine operator must determine if the axis position is correct afterreferencing. Then he acknowledges that the axis position is correct usingthe dual-channel key. The switch is connected, using two channels, to thetwo “Reference cam for safe referencing” safety inputs of the CNC and ofthe drive.

Safe referencing is a function that is carried out within the framework ofreferencing (G74 command) that is required for operation. The process ofthe G74 command is administrated in the CNC. When a G74 block isprocessed, the CNC calls up SERCOS command “Drive-guidedreferencing” in the drive if there is not already a reference. The driveexecutes referencing on its own and reports the successful completion ofreferencing back to the CNC.

Two reference status signals exist in the drive and in the CNC:

Reference status signal “Drive being referenced”

Reference status signal “Drive safely referenced”

Reference status signal “Drive being referenced” is set by the drive andthe CNC after successful completion of referencing.

Reference status signal “Drive safely referenced” is set and stored afterthe additional check for the correct mechanical axis position (describedabove).

The check is initiated by the CNC before and after command “Drive-guided referencing” within the G74 block. To do this, SERCOS command“Reference check” is triggered on the drive at the beginning (block startposition) of the G74 block or at the end (block end position) of “Drive-guided referencing” if the drive is being referenced at this time.

With the command, the drive and the NC carry the following checks out:

• Is referencing available for the drive?

• Is the position of the drive the same as that in safety parameter“Reference position for safe referencing”?

• Is safety input signal “Reference cam for safe referencing” present(cam activated)?

Only if all 3 conditions have been fulfilled is status signal “Drive safelyreferenced” set in the CNC and in the drive. Only then are safety functionssafe cams and safely limited absolute positions of safety function safelyreduced speed valid.

Note: The comparison of the position of the drive with safetyparameter “Reference position for safe referencing” is carriedout using the position window of safety parameter “Positionmonitoring window for safe operation stop”.

Safe referencing withmanual user consent

Referencing procedure



After the drive reference has been established with the first G74 block,each additional G74 call merely starts the safe reference check.Movement is no longer triggered by starting command “Drive-guidedreferencing”. After referencing has been carried out, a G74 command ispermitted only if the axis is on “Reference position for safe reference”.

Note: Safe referencing of an axis is lost if the control and drive donot recognize the cam signal on “Reference position for safereferencing” after another G74 command.

Safety input “Reference cam for safe referencing” is checked for a statusof “not activated” if the axis is not located on the reference cam. It isassumed that the cam does not cover a range larger than 0.1m (linearaxis) or 10° (rotary axis).

A check is always carried out if:

• the drive is at a standstill (setpoint speed = 0)

• safe reference is active

• the actual position of the drive is further than 0.1m or 10° from the“Reference position for safe referencing”

In the case of an error, safe referencing is lost and an error message isgenerated.

Note: Reference status bits “Drive being referenced” and “Drivesafely referenced” in the control and in the drive are valid untilthe reference is lost due to an error, the control or the drive isswitched off or if the drive is switched to Phase 2.

G74 for drive reference

Test of safety input “Referencecam for safe referencing”



Safe referencing for axes with relative measuring systemSafe referencing with a relative measuring system must be carried out intwo steps. First, a G74 command (e.g. in the NC home program) must beused to establish a reference to the measuring system. Then the axesmust be moved to the “Reference position for safe referencing” position.The next G74 command triggers the safe reference check. It is requiredthat both channels recognize the cam signal on this position and that theposition is the same as that in safety parameter “Reference position forsafe referencing” in the control and in the drive.

N0000 .HOME

N0001 G74 X0 Y0 Z0 ;X-, Y- and Z axis referencing

N0002 G01 X5 Y5 Z100 F1000 ;Approach safe reference position

N0003 G74 X0 Y0 Z0 ;Axes safe referencing

N0004 RET

N0005 END OF PROGRAM

Fig. 6-10: Safe referencing with relative measuring system

Safe referencing for axes with absolute measuringsystemIn normal operation, a referencing procedure is not required for axes withan absolute measuring system. The machine reference is already activeafter the control and the drive control device have been switched on.

In order to place an axis in the safely referenced status, the CNC is to beused to move the drive (e.g. in the NC Home program) to the positionstored in safety parameter “Reference position for safe referencing”. Thena G74 block is called. Subsequently, the safe reference check is started inthe control and in the drive. The drive position must agree with theposition in the safety parameter and the cam must be activated. If theresult of the check is positive, safe reference is set.

N0000 .HOME



N0003 RET


Fig. 6-11: Safe referencing with absolute measuring system



Safe referencing for axes with distance-codedmeasuring systemThe referencing procedure is carried out twice for axes with a distance-coded measuring system. The first reference movement establishes thereference of the scale. Then the control is used to move the drive (e.g. inthe NC Home program) to the position stored in safety parameter“Reference position for safe referencing”. Then another G74 block iscalled. The CNC starts the safe reference check in the CNC and in thedrive. The drive position must agree with the position in the safetyparameter and the cam must be activated. If the result of the check ispositive, safe reference is set.

N0000 .HOME

N0001 G74 X0 Y0 Z0 ;X-, Y- and Z axis referencing



N0004 RET


Fig. 6-12: Safe referencing with distance-coded measuring system



6.9 Switching between Two Safety Functions

When switching between two safety functions, it must be ensured that thedeactivation signals are switched overlappingly. Otherwise, when allsafety functions are switched off for a brief time, this is interpreted by thesafety monitors as an intentional shutdown of the safety functions.

Several safety functions can be activated simultaneously. For example, itis possible to permanently activate safety function safely reduced speedwith safely limited absolute positions 2 (V_Max_2 > V_Max_1) with thehighest degrees of freedom. When additional safety functions areactivated, the possible movements of the axes may be limited (e.g.activation of safely reduced speed with safely limited absolute positions1).

The safety functions are alternatingly switched on. This results in thedanger that all safety functions are briefly deselected during switching.For the safety monitors, this is the same as a shutdown of the safetyfunctions. Safety output signal “Safety function active” is immediatelyreset. Signal “Safety function active” takes on the value of ‘1’ again onlyafter the activation sequence runs through again.

In the figure, safety functions safely reduced speed with safely limitedabsolute positions 1 and safe operation stop are switched off for time t1.Both safety functions are deselected (signal status ‘1’) via the deactivationsignals. When the safe operation stop function is selected again, nosafety function is reported as being active for time t2.

t1

t2=300ms

t

Deactivation of safely reduced

speed with

safely lim. abs. position 1

Switching

correct

Switching incorrect. Shutdown of safety

function

t

Deactivation of safe operation

stop

Safety function

active

t Saf. red. Speed 1 Safely red. speed 1 Safe operation stop

Reactivation of safety function

Fig. 6-13: Alternating switching of safety functions

Note: The activation sequence of a safety function, from its selectionto the “Safety function active” report, requires 300 ms.

General

Alternating switching of safetyfunctions



This problem can be avoided using additive switching.

The safety function with the highest degrees of freedom (safely reducedspeed with safely limited absolute position 1 in the example) ispermanently activated. The other safety functions are also activated ifthey are required. In this way, at least one safety function is always ineffect. There is no danger of accidental shutdown.

t

Deactivation ofsafely reducedspeed withsafely limitedabs. positions 1

Switchingcorrect

Switchingcorrect

Safely reduced speed 1 always activated

t

Deactivation ofsafe operationstop

t

Safety functionactive

Saf. red. speed 1 Safe operation stop Safely red. speed 1

Fig. 6-14: Additive switching of safety functions

Additive switching of safetyfunctions



Each time that the maximum permitted speed is reduced from V_Max_1to V_Max_2 (V_Max_1 > V_Max_2) when the safety functions areswitched, the new speed threshold goes into effect only after the timespecified in safety parameter “Transition time for switching safetyfunctions” has elapsed. The permitted speed drops continuously fromspeed V_Max_1 to V_Max_2. This allows NC Interpolator to adapt to thenew speed threshold. In the opposite case (V_Max_1 < V_Max_2), thenew speed threshold goes into effect immediately.

Transitions with transition time:

• safely reduced speed 1 --> safely reduced speed 2 (V 1 > V 2)

• safely reduced speed 2 --> safely reduced speed 1 (V 1 < V 2)

• safely reduced speed 1 or 2 --> safe stop

• safely reduced speed 1 or 2 --> safe operation stop

• safely reduced speed 1 or 2 --> safely reduced speed 1 or 2 andConsent key = 0 (not activated)

V_Max

t

V_Max_1

V_Max_2

Trans-itiontime

Safely reducedspeed 2




Fig. 6-15: Temporal progression of the speed threshold

Transition time for switchingsafety functions



In order to deselect safety functions, all used deactivation signals of thesafety functions to the control and the drive must be wired with 24V levels.The following then occurs in the control and the drives:

• The control and the drives internally deactivate the safety functions.

• The “Safety function active” enablement signals of the control and thedrives are reset.

In order to select safety functions, all used deactivation signals of thesafety functions to the control and the drive must be wired with 0V levels.Before safety functions can be switched on, the drives must be at astandstill. Otherwise, switching safety functions on leads to an immediateshutdown of the drives.

Note: When a safety function is selected, the safe operation stop isalways activated in the control and the drives during atransition time of 300ms. This does not apply for switchingbetween two safety functions.

Deselecting safety functions

Selecting safety functions



6.10 Description of Safety Parameters

For each safety parameter, one is in the control and one is in the drive.The safety parameters of the control are in the Axis parameters menu ofthe machine parameters, while the safety parameters of the drive are inthe SERCOS parameters menu of the drive.

The safety parameters must always be set in the same way in bothchannels. Incorrect entries are detected by two-way data comparison,leading to a shutdown of the drive system when the power is switched on.

Safety parameters Control parameter Drive parameter

Safety function Cxx.100 P-0-0249

Maximum speed 1 for the safety function Cxx.101 P-0-0253

Upper position limit 1 for the safety function Cxx.102 P-0-0254

Lower position limit 1 for the safety function Cxx.103 P-0-0255

Maximum speed 2 for the safety function Cxx.104 P-0-0256

Upper position limit 2 for the safety function Cxx.105 P-0-0257

Lower position limit 2 for the safety function Cxx.106 P-0-0258

Upper position limit for position switching point 1 Cxx.107 P-0-0259

Lower position limit for position switching point 1 Cxx.108 P-0-0260







Position monitoring window for Safe operation stop Cxx.115 P-0-0267

Reference position for Safe referencing Cxx.116 P-0-0268

Selection of safety functions Cxx.1117 P-0-0269

Transition time for switching safety functions Cxx.118 P-0-0270

Time interval for forced dynamics Cxx.119 P-0-0271

Checksum of the weighting data Cxx.120 P-0-0248

Fig. 6-16: Safety parameter



Safety parameter control: Cxx.100

Safety parameter drive: P-0-0249

The “Safety function” safety parameter opens or activates the safetyparameter menu in the control and in the drive.

By setting the parameter to ‘yes’, safety function parameters Cxx.101 toCxx.120 are added to the axis parameters in the control.

In the same way, the 1st bit (bit 0) of the bit bar is to be set to ‘1’ in the

Drive parameters menu.

Example: P-0-0249 = 0000000000000001

Safety parameter control: Cxx.101, Cxx.104

Safety parameter drive: P-0-0253, P-0-0256

This parameter defines the maximum permissible speed when themonitoring function safely reduced speed with safely limited absolutepositions has been selected. Exceeding the entered value results in thedrive being switched off by the shutdown circuits.

If safety functions safely reduced speed 1 and 2 are selected, the lowermaximum speed value is always used for monitoring.

Monitoring of safely reduced speed can be switched off if only safelylimited absolute positions is used in the combined safety function safelyreduced speed with safely limited absolute positions. In this case, safetyparameter “Maximum speed for safety function” is to be set to ‘0’. If safetyfunction safely reduced speed with safely limited absolute positions isselected in this combination, only the monitoring of safely limited absolutepositions is activated.

Safety parameter control: Cxx.102, Cxx.103, Cxx.105, Cxx.106

Safety parameter drive: P-0-0254, P-0-0255, P-0-0257, P-0-0258

The “Upper and lower position limit for the safety function” safetyparameters define the safely limited absolute positions of the combinedsafety function safely reduced speed with safely limited absolutepositions.

Exceeding the absolute positions leads to a shutdown of the drive systemwhen safety function safely reduced speed with safely limited absolutepositions is selected. Axis parameters “Positive travel limit” (Cxx.011) and“Negative travel limit” (Cxx.012) are to be set in such a manner that theyare located before safely limited absolute positions. The advantage of thisis that the travel limits are reached before the absolute positions, so thatthe drive system is not switched off.

Monitoring of safely limited absolute positions with safety function safelyreduced speed with safely limited absolute positions selected can beswitched off if only safely reduced speed is used. In this case, safetyparameter “Upper and lower position limit for the safety function” is to beset to ‘0’.

Safety function

Maximum speed forsafety function

Upper and lower position limitsfor safety function



Safety function control: Cxx.107 bis Cxx.114

Safety parameter drive: P-0-0259 to P-0-0266

The range of a safe cam is defined by safety parameter “Upper positionlimit for position switch points” and “Lower position limit for position switchpoints”. If the axis is within the defined range, then the controller and thedrive set the corresponding position switch points.

The position switch points of an axis are issued only if safe referencinghas been carried out for the drive.

Safe cams is switched off if safety parameters “Upper position limit forposition switch points” and “Lower position limit for position switch points”are set to ‘0’.

Note: The position switch points of safe cams must safely undergofurther processing; only signal status ‘1’ may be evaluated forsafety-relevant jobs.

An example of further processing of safe cams can be found in section"Transferring Safety I/O Signals", p. 6-32.



This parameter sets the position window that must not be exceeded whenthe safety function safe operation has been selected. When safeoperation stop is selected, the setpoint position value must not change atall; the actual position value may change no more than the value enteredin parameter “Position monitoring window for safe operation stop”. If anaxis is manually pressed or turned out of this position, the drives areimmediately shut down by the shutdown circuits.



The “Reference position for safe referencing” is the position at which thecontrol system and the drive expects the cam signal or the manual useracknowledgement to check the position after referencing.

The comparison of the position of the drive with safety parameter“Reference position for safe referencing” is carried out using the positionwindow of safety parameter “Position monitoring window for safeoperation stop”. This means that the position of the drive may differ from“Reference position for safe referencing” no more than this amount.

Upper and lower position limitsfor position switch points

Position monitoring window forSafe operation stop

Reference position for Safereferencing





The safety functions to be used for an axis are set in safety parameter"Selection of safety functions".

To keep wiring to a minimum, safety functions that are not used can behidden using this parameter. Hidden safety functions therefore do nothave to be deselected using the deactivation signals in both channels.

A safety function that is not hidden (Hide = No) is automatically selecteduntil it is deselected using the deactivation signals in both channels.

The “Safety function selection” safety parameter makes it possible to hidesafety functions safe stop, safe operation stop and safely reduced speedwith safely limited absolute positions 1 and 2.

Furthermore, this parameter is used to specify which safety function isselected when safely reduced speed is selected and the Consent key isnot activated. Option “SOS switch” is used to specify whether safe stop orsafe operation stop is selected if there is no consent.

The following example shows the setting in the control and in the drive forswitching between safe stop and safely reduced speed 1.

Cxx.117 Selecting safety functions

Bit Meaning Value

00 Hide “safe stop” Yes

01 Hide “safe operation stop” Yes

02 Hide “safely reduced speed 1” No

03 Hide “safely reduced speed 2” Yes

04 Hide “SOS switch” Yes

Fig. 6-17: Selection of safety functions for switching between safe stop andsafely reduced speed 1 in the control

In the drive, a safety function is hidden by setting the corresponding bit to‘1’.

'567,,,,

3 8-%83 8 & 83 8 & ,8

3 8&&83 8&8

Antrieb_SH_SRG.FH7

Fig. 6-18: Selection of safety functions for switching between safe stop andsafely reduced speed 1 in the drive

Selection of safety functions



The following example shows the setting in the control and in the drive forswitching between safe operation stop and safely reduced speed 1.


Bit Meaning Value





04 Hide “SOS switch” No

Fig. 6-19: Selection of safety functions for switching between safe operationalstop and safely reduced speed 1 in the control

'567,,,

3 8-%83 8 & 83 8 & ,8

3 8&&83 8&8

Antrieb_SBH_SRG.FH7

Fig. 6-20: Selection of safety functions for switching between safe operationalstop and safely reduced speed 1 in the drive

Note: When safely reduced speed is used with a switch to safe stopor safe operation stop, the switch occurs solely using theConsent signal. In this case, safe stop and safe operation stopmust be hidden.





This safety parameter defines the time it takes for a new safety function tobe active when a switch-over is made from one safety function to another.The transition time is only taken into consideration when the new safetyfunction allows a lower speed than the function that was previously active.

The transition time must be precisely set, especially in the case of aswitch from safely reduced speed to safe stop or safe operation stopusing the Consent signal. For example, if a switch is made from safelyreduced speed to safe operation stop and the axis is still moving, thesafety monitor of the safe operation stop triggers the shutdown of thedrive system if the axis leaves the position monitoring window for safeoperation stop.

The transition time is calculated from the sum of the: braking time,maximum PLC cycle time and the position regulation time constants plusa variance factor of 20 percent.

( )ZLPLCB ttt*1,202700PCxx.118 ++=−−=

With 60*018Cxx

1000)*104orCxx101Cxx(tB =

and:6,16*min]/1000[Kv

1000*5tZL =

L: Cxx.118= transition time for switchingthe safety functions inthe control in ms

P-0-0270= Transition time for switchingthe safety functions inDrive in ms

tb = Braking time in mstPLC = maximum PLC cycle time in mstZL = time constant position controller in msCxx101 = maximum speed

for safety function 1 in mm/sCxx104 = maximum speed

for safety function 5.08 cm mm/s

Cxx018 = acceleration in mm/s2

Kv = position controller Kv factor(S-0-0104) in 1000/min

xx = Axis number -Fig. 6-21: Formula “Transition time for switching the safety functions“

The maximum PLC cycle time (tPLC) can be found in the PLCprogramming interface under menu item Diagnostics / PLC info.

Note: If safety functions safely reduced speed 1 and 2 are used, thelarger speed limit value must always be used to calculate thebraking time.






This safety parameter determines the time intervals in which the switch-off paths are checked by the controller and the drive. Forced dynamicsshould be carried out at least once every eight hours. A reason for a valuegreater than eight hours must be provided in writing in the acceptancereport.

Note: The selection of safety functions safe stop, safe operation stopor safely reduced speed with safely limited absolute positionsrequires that forced dynamics be carried out beforehand orthat forced dynamics is still in effect.



A checksum (P-0-0248) covers the values of all the parameters that havean effect on the actual position value generated by the drive.

This checksum, which is generated by the drive, must be entered insafety parameter “Checksum of weighting data” (Cxx.120) on the controlside if safety functions are used.

The parameter is calculated in the drive only after operation is switchedfrom the parameter-setting mode to the operation mode.

This parameter ensures that subsequent changes to the drive parametersare recognized by the control. A manipulation of the drive parameters isthereby recognized by comparing the data and results in a shutdown ofthe drive system.

Time interval for forceddynamics

Checksum of the weighting data



6.11 Password Protection

Safety parameters Cxx.100 to Cxx.120 of the control are protected bytheir own password. This ensures that only personnel especiallyauthorized by the machine and system manufacturer (safety officers) areable to edit safety parameters.

Password protection for software version 19In software version 19, the safety parameters of the control are protectedby their own password and a security diskette.

Differentiation is made between a supervisor and a normal user. Thesupervisor, along with his ID data, is already specified during theinstallation of the user interface. The supervisor is the only one who hasthe right to specify additional users and their access rights.

During installation of the user interface, the ID data (user name andpassword) of the supervisor are entered. Access rights for all functionsare automatically assigned to him in the key list.

After installation, only the supervisor has the right to modify safetyparameters in the control. Function “Modify IST safety parameters” in thekey list is enabled for the supervisor.

The supervisor must specify ID data with a limited CNC user interfaceoperating scope for each user. For the security of the control data, thesepersons are generally allowed only certain operating functions.

The supervisor must specify which users obtain the right to modify safetyparameters.

The safety parameters in the control can be edited only if function “ModifyIST safety parameters” has been enabled for the user in the key list and ifhe can also identify himself with the security diskette. After the user nameand password have been entered successfully, they remain valid until theuser interface is terminated, another user logs on or the time limit of theuser has elapsed.

Passworteingabe.bmp

Fig. 6-22: User name and password entry

The security diskette can be created solely by the supervisor. To do this,proceed as follows:

1. Open the Password management menu and log on using the username and password.

2. Activate function “Modify IST safety parameters” in the key list.The user obtains the right to modify safety parameters.

3. Insert an empty formatted diskette.4. Press function key F4 “IST diskette”.The diskette is created.

Note: In order to ensure that the security diskette is not accidentallydeleted, write protection of the diskette should then beactivated.

Password hierarchy

Supervisor ID data

User ID data

User name and password

Security diskette



The security diskette must be inserted into drive ‘A’ each time that asafety parameter is edited in the control. The ID data of the user who iscurrently logged on is compared each time with the ID data stored on thesecurity diskette. A safety parameter can be edited only after a positivecheck.

The safety parameters of the drives are secured, as is the case for alldrive parameters, by the standard password management. Function“Drive parameters” must be enabled for editing in the key list.

For more information regarding password management, seedocumentation folder 2, “MTCNC/MTC200 User Interface” under “GeneralInformation and Password Management”.

Password protection as of software version 22As of software version 22, password protection is organized in Usermanagement. The procedure is described in Chapter 3 (UserManagement) of documentation “MTC200/ISP200/TRANS200 Setup”.

Safety parameters for drives



6.12 Transferring Safety I/O Signals

The safety-relevant input and output signals of the control (abbreviatedsafety I/O) are transferred using two channels to the safety functions inthe NC/drive. The safety I/Os of the NC form channel 1 and those of thedrive form channel 2 (also see previous chapter).

The safety I/Os for the safety functions of the NC are transferred in thesame manner as non-safety-relevant I/Os. To do this, the correspondinghardware I/Os (RECO I/Os) are to be copied to the internal safety I/Oarea of the NC. This information is transferred to the safety functions ofthe NC.

An area for the safety I/Os of the NC is reserved for each axis in the I/Oarea between the NC and the PLC (axis interface signals). The NCsignals to the PLC are designated as axis status signals, while the PLCsignals to the NC are designated as axis control signals.

Axis status signal Name Meaning

AxxS.SAFAC Safety functions active Safety functions are active

AxxS.SAFRY Switching complete Switching safety function(s) on or off is complete

AxxS.SAFP1 Position switch point 1 Position switch point 1 has been attained




AxxS.SAFSL Activate starting lockout The PLC is to activate the starting lockout for thecorresponding drive

AxxS.SAFEN Enable movement Drive movement enabled by safety function

Fig. 6-23: Axis status signals for safety functions

Axis control signal Name Meaning

AxxC.SAFSS Deactivation of safe stop Deactivate safety function safe stop for drive

AxxC.SAFOS Deactivation of safe operation stop Deactivate safety function safe operation stop fordrive

AxxC.SAFA1 Deactivation of safely reduced speedwith safely limited absolute position1

Deactivate safety function safely reduced speedwith safely limited absolute position 1 for drive

AxxC.SAFA2 Deactivation of safely reduced speedwith safely limited absolute position2

Deactivate safety function safely reduced speedwith safely limited absolute position 2 for drive

AxxC.SAFAG Consent key Signal for status “Consent key activated”

AxxC.SAFRS Reference cam for safe referencing Reference cam for safe referencing has beenactivated

AxxC.SAFSL Starting lockout active Transfer acknowledgement (Starting lockoutactive) to CNC

Fig. 6-24: Axis control signals for safety functions

Safety I/O of NC

Interface signals ofsafety I/O of NC



A RECO RMP12.2-8E-8A safety I/O module must be provided for everydrive for which safety functions are to be used. The RMP 12.2-8E-8ARECO module is a digital input/output module for the Interbus-S RECOsystem. The module is operated as a participant in the local bus oncarrying bar RMB 12.2-04 or RMB 12.2-02 in connection with bus terminalRMK 12.2-IBS-BKL.

RMP12_2.wmf

Fig. 6-25: Safety I/O module RMP12.2-8E-8A

The module has 8 floating input channels and 8 output channels in theform of potential-free relay contacts. The input and output channels arenot directly served by the local bus connection, but rather by theinterposed microprocessor, which also processes the safety-relevantprograms for use in the IST system. The safety module has its ownwatchdog for controlling the microprocessor; if an error occurs, “Moduleerror” is displayed on the Interbus.

BA

Status

“Bus active” display• green LED lit: Interbus active

• green LED off: no data telegram exchange

Status display• yellow LED lit: communication with drive OK• yellow LED flashing: communication with drive faulty• yellow LED off: safety module not working

The data of the safety module are permanently assigned to the drive withthe same SERCOS address using the address selection switches on themodule.

Safety I/Os of drives

Diagnostic LEDs

Address selection switch



The safety input signals consist of the deactivation signals for the 4 safetyfunctions, the signal for the Consent key and the signal for the referencecam for safe referencing.

The information of the safety inputs is compressed directly by the safetyI/O module, is assigned additional safety mechanisms, and is transferredvia the PLC and the NC to the drive. The safety mechanisms ensure thatonly the drive that belongs to the module receives the safety signals.

Input bit Allocation

IX.5.0 Deactivation of safe stop

IX.5.1 Deactivation of safe operation stop

IX.5.2 Deactivation of safely reduced speed with safely limitedabsolute position 1

IX.5.3 Deactivation of safely reduced speed with safely limitedabsolute position 2

IX.5.4 Consent key

IX.5.5 Reference cam safe referencing

IX.5.6 Reserved

IX.5.7 Reserved

Fig. 6-26: Allocation of RMP12.2-8E-8A safety inputs

! '.

/012/

30#

4'.+'.,

0+$

RMP12_E.FH7

Fig. 6-27: Internal RMP12.2-8E-8A input switching

Safety inputs of drives



The safety output signals are gathered together by the drive and are alsocompressed and assigned safety mechanisms. The data package istransferred via the CNC and PLC directly to the corresponding safetymodule. The safety mechanisms ensure that only the module that belongsto the drive receives the safety signals of the drive.

Output bit Allocation

QX.1.0 Safety function active

QX.1.1 Switching complete

QX.1.2 Position switch point 1




QX.1.6 Reserved

QX.1.7 Reserved

Fig. 6-28: Allocation of RMP12.2-8E-8A safety outputs

5'.5

30

4'.+'.,

'. 67,-4

0

RMP12_A.FH7

Fig. 6-29: Internal RMP12.2-8E-8A output switching

Safety outputs of drives



Technical Data of RMP12.2 Safety I/O Module

Input voltage range Low -10V.... ..........+ 8V

Input voltage range High +17V.... ..........+ 30V

Input current 2,5mA.............. 8mA

Potential-free relay contacts

Switching voltage Umax 230V

Switching capacity Pmax. 220W

Switching current Imax. 2A

Operational temperature range 0-50°C ambient temperature

Input data

Output data

Ambient conditions



Processing of Safety Output SignalsIf the output signals of the safety I/O module are to be used for safety-relevant functions, further processing must also correspond to safetycategory 3 according to EN 954-1.

Since dual-channel monitoring of further processing is impossible, 2-channel signaling with 1-channel monitoring must be used to attain thesafety category. The purpose of the following examples is to demonstratethe possible ways that such further processing can take place.

K1

RMP supply

K2

+UL +ULRMPsafetyoutput "Q K2"

PLCoutputsignal "QK1"

Enabl. circ. forsafety function

PLCinputsignals

"IK1"

"IK2"

Fig. 6-30: Discrete 2-channel processing of a safety output signal

The fig. above shows the circuit diagram for 2-channel processing ofsafety output QK2. The enablement circuit for the safety-relevant functionis formed by relays K1 and K2. Relay K1 is activated by an ordinary PLCQK1 output signal; K2 is activated by the safety output itself. The PLCmonitors the feedback of the two switching channels using signals IK1 andIK2. If an error occurs in relay K1 or in the upstream PLC output, there isno direct way of preventing the safety output from being reactivated; insuch a case, it must be possible to switch off the power supply of thesafety output by the PLC. Another relay, K0, is used for this purpose, asshown in fig. below.

K0

+24V

RMP power

PLC inputIK0:Feedback

status

+UL

PLC output QK0:ctivation ofpower forRMP outputs

Fig. 6-31: Shutdown circuit for power supply of safety outputs



The PLC user program monitors the relays. For this purpose, thefollowing logic must be programmed:1 (*Monitor relay functions, error if feedback equals output!*

+---------+¦= ¦ +---------+

QK0-¦ ¦ ¦>=1 ¦IK0-¦ +-¦ ¦

+---------+ ¦ ¦+---------+ ¦ ¦¦= ¦ ¦ ¦

QK1-¦ ¦ ¦ ¦IK1-¦ +-¦ ¦

+---------+ ¦ ¦+---------+ ¦ ¦¦= ¦ ¦ ¦

QK1-¦ ¦ ¦ ¦IK2-¦ +-¦ +-MK0OFF

+---------+ +---------+QK0.......................... Power supply of RMP module................ %Q12.IK0.......................... Power supply of RMP module OFF............ %I11.QK1.......................... Safety function switching channel 1....... %Q12.IK1.......................... PLC switching channel 1 OFF............... %I11.QK1.......................... Safety function switching channel 1....... %Q12.IK2.......................... RMP switching channel 2 OFF............... %I11.MK0OFF....................... Switch off RMP power...................... .....

2 (*In case of error, switch off power supply of safety output+---------+ fbRS¦& ¦ +---------------------+

IK0-¦ ¦ ¦RS ¦IRESET-¦ +-¦S_ ¦

+---------+ ¦ ¦fbTON ¦ ¦+---------------------+ ¦ ¦¦TON ¦ ¦ ¦

MK0OFF-¦IN_ Q_+-¦R_1 Q_1+-QK0tAB-¦PT_ ET_+ +---------------------+

+---------------------+fbRS......................... Shutdown of RMP supply.................... .....IK0.......................... Power supply of RMP module OFF............ %I11.IRESET....................... Power supply reset........................ %I11.fbTON........................ Shutdown delay............................ .....MK0OFF....................... Switch off RMP power...................... .....QK0.......................... Power supply of RMP module................ %Q12.tAB.......................... Delay time................................ .....

3 (*Process request of safety function*)+---------+¦& ¦

P00SAFP1-¦ ¦QK0-¦ +-QK1

+---------+P00SAFP1..................... Position switch point 1 has been attained. %I11.QK0.......................... Power supply of RMP module................ %Q12.QK1.......................... Safety function switching channel 1....... %Q12.

Fig. 6-32: Monitoring of relay switching in the PLC

In the example, position switch point 1 of axis 1, i.e. axis status signalA01S.SAFP1, is used in a safety-relevant function. When the signal isrequested, QK1 is switched on via the PLC (network 3). However, thisoccurs only if no errors were detected in the relay switch by thecomparator circuit in network 1. The error message regarding QK0shutdown must be delayed by the switching times of the relay, the PLCcycle time and the transfer times of the bus systems. We recommend adelay time T of 300ms.

Note: When the residual risks that result from further processing ofthe safety output signals are considered, the reaction time ofthe downstream equipment, e.g. the hydraulic system, mustbe taken into account.



WARNING

Injuries due to errors in activating motors andmoving elements! Safe design of software and hardware Output signals QK0 and QK1 may be programmed in

only one location of the PLC user program as shownabove. (Must be checked using cross-check list.)

The wiring of the relay switch must be checked duringthe safety-related inspection; functioning must alsobe tested. These inspections must also be entered inthe acceptance report.

6.13 Starting Lockout as a Shutdown Circuit of the CNC

The starting lockout serves the control as a shutdown circuit if a safetymonitor in the control triggers a shutdown of the drive system.Furthermore, the starting lockout is activated in the drive control devicewhen safety function safe stop is selected.

The starting lockout is activated by the PLC user program. The followingprocesses must always be observed:

The CNC requests the PLC user program to activate the starting lockoutin the drive if a safety monitor triggers a shutdown of the drive system or ifsafety function safe stop is selected (AXXC.SAFSS).

The PLC user program activates the starting lockout in the drive (AS) inthe fast PLC program (2ms implementation) via a digital output.

The drive acknowledges the activation of the starting lockout (ASQ) of thePLC.

In the PLC user program, the acknowledgement is passed on to the CNCwith axis control signal “AXXC.SAFSL” via the cycle interface.

%!*9+

%

!*+

!!

'(

"

24

24(

& )

$

:$

Anlaufsperre_Demo.FH7

Fig. 6-33: Activation of the starting lockout by the PLC user program

In order to keep wiring to a minimum, the acknowledgement of thestarting lockout of several drive modules can be guided to the PLC by asignal line. Further information can be found in Section 8.3 "SampleApplication" – " CNC Shutdown Circuit".

The activation of the starting lockout by the PLC user program isdescribed in detail in section 8.3 "Sample Application" – "PLC Program".

Further information regarding the design of the starting lockout on thedrive module can be found in function description “DIAX04 Drive withServofunctions”, Section 7.5 “Starting Lockout”.

Activate starting lockout

Switching example forstarting lockout

Designing thestarting lockout

IST Intelligent Safety Technology Reaction Times and Braking Paths 7-1


7 Reaction Times and Braking Paths

7.1 Introduction

The purpose of this chapter is to determine the relevant reaction timesand the resulting brake paths when the monitors of the safety functionsare activated. This chapter first describes the basic procedure and thenprovides more detail about the specific conditions for the various safetyfunctions.

7.2 Basic Procedure

The shutdown circuits are served both by the control (by shutting downthe EMERGENCY STOP safety circuits / triggering the “starting lockout”drive reaction) and by the drives; this is specified by their parameters.

The following basic procedure is recommended to determine the reactiontimes and brake paths when the monitors of the safety functions areactivated:

• determine the relevant safety functions that are to be used.

• specify the drive reaction using drive parameters P-0-0117, P-0-0118and P-0-0119.

• specify whether an intermediate circuit short-circuit is to be used.

• determine the reaction times and the corresponding braking pathswhen the monitors within the relevant safety functions are activatedwhen the drive and control are functioning.

• determine the reaction times and the corresponding braking pathswhen the monitors within the relevant safety functions are activatedwhen the drive is functioning and the control is malfunctioning.

• determine the reaction times and the corresponding braking pathswhen the monitors within the relevant safety functions are activatedwhen the drive is malfunctioning and the control is functioning.

The corresponding worst-case scenario is then to be used to derive therelevant measures, such as determining the minimum distance between aprotective door and a moving machine part, or to clarify whether aprotective door lock is to be used.

Basic shutdown principles

Procedure

7-2 Reaction Times and Braking Paths IST Intelligent Safety Technology


Determining the Drive Reaction / Using an Intermediate Circuit Short-Circuit

Drive parameters P-0-0117 “Activation of NC reaction duringmalfunction”, P-0-0118 “Power shutdown during malfunction” or P-0-0119“Best possible shutdown” and the associated drive parameters are usedto specify the drive reaction to activation of the monitors within the safetyfunctions. For more information, see the documentation “DIAX04, Drivewith Servofunction, SSE03VRS Function Description” with typedesignation DOK-DIAX04-SSE03VRS**-FKB1-EN-P or “DIAX04, Drivewith Main Spindle Function, SHS03VRS Function Description” with typedesignation DOK-DIAX04-SHS03VRS**-FKB1-EN-P. Following is a shortexplanation of the parameters.

This drive parameter is used to specify whether a control-side reaction ora drive-internal reaction is to occur when a malfunction is determined in adrive. For use with Intelligent Safety Technology, only the drive-internalreaction is currently meaningful. For more information, see thedocumentation “DIAX04, Drive with Servofunction, SSE03VRS FunctionDescription” with type designation DOK-DIAX04-SSE03VRS**-FKB1-EN-P or “DIAX04, Drive with Main Spindle Function, SHS03VRS FunctionDescription” with type designation DOK-DIAX04-SHS03VRS**-FKB1-EN-P.

This drive parameter is used to specify as a priority how all other driveson the same power supply are to react with “Best-possible shutdown”when a malfunction is determined in a drive. This must normally be set forapplications with Intelligent Safety Technology. For more information, seethe documentation “DIAX04, Drive with Servofunction, SSE03VRSFunction Description” with type designation DOK-DIAX04-SSE03VRS**-FKB1-EN-P or “DIAX04, Drive with Main Spindle Function, SHS03VRSFunction Description” with type designation DOK-DIAX04-SHS03VRS**-FKB1-EN-P.

This drive parameter is used to specify what the reaction should be whena malfunction is determined in a drive. The following possibilities areavailable:

• Switching the setpoint speed to zero. The drive brakes with themaximum possible torque/force.

• Switching the setpoint torque/force to zero. This frees the drive oftorque/force. The drive is braked solely by friction and any brakingequipment that may be present (brake integrated in motor or attachedexternally and separately to the mechanical system).

• Switching the setpoint speed to zero with filter and ramp. The drivebrakes with the set ramp.

• Retract movement. The affected drive attempts to move along adefined path in a defined direction. This function is often used in gearmanufacturing machines so that, if a malfunction occurs, axes in theroller coupling can be separated and then shut down withoutdamaging the tool, workpiece or machine.

For more information, see the documentation “DIAX04, Drive withServofunction, SSE03VRS Function Description” with type designationDOK-DIAX04-SSE03VRS**-FKB1-EN-P or “DIAX04, Drive with MainSpindle Function, SHS03VRS Function Description” with type designationDOK-DIAX04-SHS03VRS**-FKB1-EN-P.

Drive parameter P-0-0117“Activation of NC reaction

during malfunction”

Drive parameter P-0-0118“Power shutdown during

malfunction”

Drive parameter P-0-0119 “Best-possible shutdown”



Using the intermediate circuit short-circuit leads to a shutdown reaction bythe counter-EMF of the intermediate circuit in the case of drivemalfunctions. However, use of this function is not safe for persons, butonly for machines. Its use is advantageous without limitations forsynchronous motors, but with limitations for induction motors. When anintermediate circuit short-circuit is activated, induction motors slow downonly by braking due to friction and due to the activation of any existingbrakes. If this does not pose a danger to the machine, the intermediatecircuit short-circuit can be used.

7.3 Reaction Times and Braking Paths When Monitors withinSafety Function Safe Stop are Activated

Within safety function Safe Stop, the “Starting lockout” function is used onthe hardware side in the drive; on the software side, the drive enablementis removed. In the control, the axis is blocked on the software side. Usingthe “Starting lockout acknowledgement” contact on the drive controldevice, the correct functioning in the shutdown circuit of the drive andcontrol activation is monitored on the hardware side. When the monitoringfunctions within safety function Safe Stop are activated, the shutdowncircuit of the drive and control activation is thus served on the hardwareside. On the software side, the starting lockout of the control-side axisblock and the drive-side removal of the drive enablement remain if thereis a malfunction in the activation system.

Due to errors within the PLC program, the starting lockout can bedeactivated even if a safety function on the drive is activated.

The reaction times are determined mainly by specifying the removal of thestarting lockout and the associated triggering of the shutdown circuit. Thebraking path does not need to be considered because no movements canoccur due to the redundant software-side and hardware-side monitoringof safety function safe stop.

The reaction time of the monitor in the control is t1.1.1 = 4 ms. The reactiontime of the monitor in the drive is t1.2.1 = 6 to 8 ms.

The reaction time of the control for operating the shutdown circuits is:

t1.1.2 = processing time + 6 x Interbus transfer time + delay time forstarting lockout relay

The processing time is 6 ms. Typical values for the Interbus transfer timeare 2 to 9 ms. You can calculate this more precisely using the followingformula. For the number of user data bytes, please use the larger of theinput or the output information. The delay time for the starting lockoutrelay is 25 ms for HVE / HVR supply devices.

[ ] swbitü tt1000

1m3)n6(15,113t +⋅⋅⋅++⋅⋅=

L: tü = transition time in msn = number of user data bytesm = number of remote bus and local bus participantstbit = bit duration in µs (currently 2 µs at 500 kBit/s)tsw = software running time in ms (generation 4: 0,7 ms)

Fig. 7-1: Determining the Interbus transfer time

The reaction time of the drive for operating the shutdown circuits is t1.2.2 =2 ms.

Using the intermediatecircuit short-circuit

Explanation

Malfunction scenario

Reaction times and brakingpaths

Monitor reaction time

Reaction time until shutdowncircuits are operated

Interbus transfer time



The following results:

Overall reaction time control: t1.1 = t1.1.1 + t1.1.2

Overall reaction time drive: t1.1 = t1.1.1 + t1.1.2

It can be seen that the shutdown circuit is operated via the drive with amax. reaction time of 10 ms.

7.4 Reaction Times and Braking Paths When Monitors withinSafety Function Safe Operating Stop are Activated

Within safety function Safe Operating Stop, the axis is monitored formaintenance of the “Position monitoring window for safe operating stop”,both in the drive and in the control. When the position monitoring windowis exceeded, the shutdown circuits are operated both via the drive and viathe control. Drive parameters P-0-0117 “Activation of NC reaction duringmalfunction”, P-0-0118 “Power shutdown during malfunction” and P-0-0119 “Best-possible shutdown” are relevant for the shutdown circuit viathe drive.

Due to errors within the drive, e.g. incorrect assignment of commutationfor synchronous motors or incorrect entry of field parameters by the userfor induction motors, the drive can be accelerated to a final speed that isspecified by the counter-EMF of the intermediate circuit. This is the worst-case scenario.

Due to errors within the control, incorrect command values can be presetwhich could initiate movement. The drive then follows the incorrectcommand values until it is detected that the position monitoring windowhas been exceeded.

Reaction Times and Braking Paths Determined by the ControlThe reaction times and braking paths are determined mainly by detectingthat the position monitoring window for safe operating stop has beenexceeded and the resulting triggering of the shutdown circuit using the“Starting lockout” function via the control.

In the above-mentioned error scenario, where the drive is accelerated to afinal speed, the following reaction times and braking paths result:

The reaction time of the monitor is t2.1.1 = 4 ms.

The reaction time of the control for operating the shutdown circuit usingthe “Starting lockout” function is:

t2.1.2 = processing time +6 x Interbus transfer time + delay time for startinglockout relay

The processing time is 6 ms. Typical values for the Interbus transfer timeare 2 to 9 ms. You can calculate the values more precisely using thefollowing formula. For the number of user data bytes, please use thelarger of the input or the output information. The delay time of the startinglockout relay is 25 ms.

[ ] swbitü tt1000

1m3)n6(15,113t +⋅⋅⋅++⋅⋅=



Overall reaction time

Explanation

Error scenarios


Control reaction time





Overall reaction time: t2.1 = t2.1.1 + t2.1.2

For translation axes:

21.2acc1.2 ta

2

1S ⋅⋅= 1.21.2 tav acc ⋅=

L: S2.1 = acceleration path in maacc = acceleration in m/s2

t2.1 = reaction time in sv2.1 = speed in m/s

Fig. 7-3: Calculation of working path within the reaction time, assumingconstant acceleration for translation axes

For rotary axes:

21.2acc1.2 t

2

1 ⋅⋅= αϕ 1.21.2 tacc ⋅= αω

L: ϕ2.1 = Acceleration angle in radαacc = Acceleration in rad/s2

t2.1 = reaction time in sω2.1 = Angle speed in rad/s

Fig. 7-4: Calculation of working path within the reaction time, assumingconstant acceleration for rotatory axes

Under the following conditions:

60

hnv vitlim

1.2

⋅≤ or itlim1.2 vv ≤ or 60i

n2 itlim1.2 ⋅

⋅⋅≤ πω

L: v2.1 = speed in m/snlimit = limit speed (can be seen in torque- speed diagram of the associated motor documentation) in min-1

hv = feed constant in m/revolutionvlimit = limit speed (can be seen

in force-velocity diagram of the corresponding motor documentation) in m/s

ω2.1 = Angle speed in rad/si = calculation of transformation ratio -

Fig. 7-5: Conditions for translation / rotary axes for calculating the accelerationpath/angle within the reaction time


Working path within the reactiontime (assuming constant

acceleration without attainingthe final speed)



The acceleration for translation axes is calculated as follows:

( )ges

vfrictmaxacc J2

hMMa

⋅⋅⋅−

=π

or ( )

ges

frictmaxacc m

FFa

−=

L: a acc = acceleration in m/s2

Mmax = max. motor torque in NmMfrict = friction torque in Nmhv = feed constant in m/revolutionJges = total moment of inertia

reduced to the motor shaft (Jload+Jmot) in kgm2

Fmax = max. motor power in NFfrict = friction force in Nmges = total mass (mload+mmot) in kg

Fig. 7-6: Calculation of acceleration for translation axes

The acceleration for rotary axes is calculated as follows:

( )ges

frictmaxacc Ji

MM

⋅−

=α

L: αacc = acceleration in rad/s2

Mmax = max. motor torque in NmMfrict = friction torque in Nm

i = calculation of transformation ratio -Jges = total moment of inertia


Fig. 7-7: Calculation of acceleration for rotatory axes




( )acc1.2vitlim

accvitlim

1.2 tt60

hnt

60

hn

2

1S −⋅⋅+⋅⋅⋅= or

( )acc1.2itlimaccitlim1.2 ttvtv2

1S −⋅+⋅⋅=

with: acc

vitlimacc a60

hnt

⋅⋅= or

acc

itlimacc a

vt =

and: 60

hnv vitlim

1.2

⋅= or grenzvv =1.2

L: S2.1 = acceleration path in mnlimit = limit speed (can be seen in torque- speed diagram of the associated motor documentation) in min-1

hv = feed constant in m/revolutiontacc = Acceleration time in st2.1 = reaction time in svlimit = limit speed (can be seen in force-velocity diagram of the corresponding motor documentation) in m/sa acc = acceleration in m/s2

v2.1 = speed in m/sFig. 7-8: Calculation of working path within the reaction time, assuming

constant acceleration and attaining of the final speed for translationaxes

For rotary axes:

( )acc1.2itlim

accitlim

1.2 tt60i

n2t

60i

n2

2

1 −⋅⋅⋅⋅+⋅

⋅⋅⋅⋅= ππϕ

with: acc

itlimacc 60i

n2t

απ

⋅⋅⋅⋅= and

60i

n2 itlim1.2 ⋅

⋅⋅= πω

L: ϕ2.1 = Acceleration angle in radnlimit = limit speed (can be seen in torque- speed diagram of the associated motor documentation) in min-1

i = calculation of transformation ratio -tacc = Acceleration time in st2.1 = reaction time in sαacc = Acceleration in rad/s2

ω2.1 = Angle speed in rad/sFig. 7-9: Calculation of working path within the reaction time, assuming

constant acceleration and attaining of the final speed for rotatory axes


acceleration with attaining of thefinal speed)



The braking path resulting from triggering of the shutdown circuits by thecontrol using the “Starting lockout” function is determined by friction andany external brakes that may be used. Using the intermediate circuitshort-circuit results in a further reduction of the braking path. However,use of this function is not safe for persons, but only for machines.Furthermore, use with induction motors is possible only to a degree.When an intermediate circuit short-circuit is activated, induction motorsslow down only by braking due to friction and due to the activation of anyexisting brakes.


dec1.22.2 tv2

1S ⋅⋅= with:

decdec a

vt 1.2= and:

( )ges

vfrictBremse.extdec J2

hMMa

⋅⋅⋅+

=π

or ( )

ges

frictBremse.extdec m

FFa

+=

L: s2.2f = deceleration path in mv2.1 = speed in (see above) in m/stdec = deceleration time in s

adec = deceleration in m/s2

Mext. Bremse= Torque of external brake in NmMfrict = friction torque in Nmhv = feed constant in m/revolutionJges = total moment of inertia


Fext. Bremse= braking force of external brake in NFfrict = friction force in Nmges = total mass (mload+mmot) in kg

Fig. 7-10: Calculation of braking path to shutdown of axis after triggering theshutdown circuits by the control (without intermediate circuit short-circuit / decisive for protection of persons) for translation axes

For rotary axes:

dec1.22.2 t2

1 ⋅⋅= ωϕ with

decdect

αω 1.2=

and:( )

ges

frictBremse.extdec Ji

MM

⋅+

=α

L: ϕ2.2 = deceleration angle in radω2.1 = Angle speed in rad/stdec = deceleration time in sαdec = deceleration in rad/s2

Mext. Bremse= Torque of external brake in NmMfrict = friction torque in Nm i = calculation of transformation ratio -Jges = total moment of inertia


Fig. 7-11: Calculation of braking path to shutdown of axis after triggering theshutdown circuits by the control (without intermediate circuit short-circuit / decisive for protection of persons) for rotatory axes

Braking path to shutdown aftertriggering the shutdown circuits

by the control (withoutintermediate circuit short-circuit

/ decisive for protection ofpersons)




frictBremse.extzks

gesv

2

v

1.2

2.2 MMM

Jhh

v8,1

S++

⋅⋅⋅

⋅

=π

or

( )frictBremse.extzks

ges2

1.22.2 FFF2

mv8,1S

++⋅⋅⋅

= with:

( )2

Av

1.22eA

v

1.2

2

dN

dN

zks

Lph

v2RR

h

v2

I

M

M

⋅⋅⋅⋅++

⋅⋅⋅

=π

π

or

( ) ( )21.2

2

1.2

2

AeA

dN

dN

zks

LpvRR

vI

F

F⋅⋅++

⋅

=

L: s2.2f = deceleration path in mv2.1 = speed in (see above) in m/shv = feed constant in m/revolutionJges = total moment of inertia


Mzks = intermediate circuit shourt-circuitbraking torque in Nm

Mext. Bremse= Torque of external brake in NmMfrict = friction torque in Nmmges = total mass (mload+mmot) in kgFzks = intermediate circuit short-circuit

braking force in NFext. Bremse= braking force of external brake in NFfrict = friction force in NNdN = continuous torque at standstill in NmIdN = continuous current at standstill in ARA = motor winding resistance in ΩRe = bleeder resistance in Ω (bei HVE/HVR:

6Ω)p = number/width of pole pairs in - or mLA = coil inductivity in H

Fig. 7-12: Calculation of braking path to shutdown of axis after triggering theshutdown circuits by the control (with intermediate circuit short-circuit /decisive for protection of machinery only) for translation axes

Braking path to shutdown aftertriggering the shutdown circuitsby the control (with intermediatecircuit short-circuit / decisive for

protection of machinery only)



For rotary axes:


ges2

1.22.2 MMM2

iJ8,1

++⋅⋅⋅⋅

=ω

ϕ

with:

( ) ( )21.2

2

1.2

2

AeA

dN

dN

zks

LpRR

I

M

M⋅⋅++

⋅

=ω

ω

L: ϕ2.2 = braking angle in radω2.1 = Angle speed in (see above) in rad/sJges = total moment of inertia


i = calculation of transformation ratio -Mzks = intermediate circuit shourt-circuit

braking torque in NmMext. Bremse= Torque of external brake in NmMfrict = friction torque in NmNdN = continuous torque at standstill in NmIdN = continuous current at standstill in ARA = motor winding resistance in ΩRe = bleeder resistance in Ω (bei HVE/HVR:


Fig. 7-13: Calculation of braking path to shutdown of axis after triggering theshutdown circuits by the control (with intermediate circuit short-circuit /decisive for protection of machinery only) for rotatory axes


Overall working path: s2= s2.1 + s2.2

Overall working path



Reaction Times and Braking Paths Determined by the DriveThe reaction times are determined mainly by specifying the exceedanceof the position monitoring window for safe operation stop and the resultingtriggering of the shutdown circuit of the drive. Drive parameters P-0-0117“Activation of NC reaction during malfunction”, P-0-0118 “Powershutdown during malfunction” and P-0-0119 “Best-possible shutdown”play a large role in determining this behavior.

In the above-mentioned error scenario, where the control generatesincorrect command values, the following reaction times and braking pathsresult:

The reaction time of the monitor is t2.2.1 = 6 to 8 ms.

The reaction time of the drive for operating the shutdown circuit is t2.2.2 = 2ms.




22.2CNC3.2 ta

2

1S ⋅⋅= with: 2.22.2 tav CNC ⋅=

under the following conditions: CNCvv ≤2.2

L: S2.3 acceleration path in ma CNC = programmable acceleration in m/s2

t2.2 = reaction time in sv2.2 = speed in m/svCNC = Programmable CNC speed m/s

Fig. 7-14: Calculation of working path within the reaction time, assumingprogrammed acceleration without attaining the programmed finalspeed for translation axes

For rotary axes:

22.2CNC3.2 t

2

1 ⋅⋅= αϕ with: 2.22.2 tCNC ⋅= αω

under the following conditions: 60

n2 CNC2.2

⋅⋅≤ πω

L: ϕ2.3 = Acceleration angle in radα CNC = programmable acceleration in rad/s2

t2.2 = reaction time in sω2.2 = Angle speed in rad/snCNC = programmed CNC speed in min-1

Fig. 7-15: Calculation of working path within the reaction time, assumingprogrammed acceleration without attaining the programmed finalspeed for rotatory axes


Reaction time of drive



acceleration without attainingthe programmed final speed)




−⋅+

⋅=

CNC

CNC2.2CNC

CNC

2CNC

3.2 a

vtv

a2

vS

under following condition: CNCvv =2.2

L: S2.3 acceleration path in mvCNC = Programmable CNC speed m/sa CNC = programmable acceleration in m/s2


Fig. 7-16: Calculation of working path within the reaction time, assumingprogrammed acceleration and attaining the programmed final speedfor translation axes

For rotary axes:

⋅⋅⋅−⋅⋅⋅+

⋅⋅⋅⋅

=60

n2t

60

n2

60

n2

2

1

CNC

CNC2.2

CNC

2

CNC

CNC3.2 α

πππα

ϕ

under following condition: 60

n2 CNC2.2

⋅⋅= πω


nCNC = programmed CNC speed in min-1



The shutdown circuit of the drive is operated after the reaction timeelapses. Drive parameters P-0-0117 “Activation of NC reaction duringmalfunction”, P-0-0118 “Power shutdown during malfunction” and P-0-0119 “Best-possible shutdown” determine the braking behavior. Driveparameter P-0-0117 “Activation of NC reaction during malfunction” isusually set to a drive-internal reaction in applications with the MTC200.The CNC-side reaction will no longer be considered here. Parameter P-0-0118 “Power shutdown during malfunction” mainly affects only how theother drives operated on the same drive package are to behave. It has noeffect on the movement of the axis affected by the activation of the safetyfunctions.






dec2.24.2 tv2

1S ⋅⋅= with:

decdec a

vt 2.2= and:

ges

vdec J2

hMa

⋅⋅⋅=

π or

gesdec m

Fa =

L: s2.4 = deceleration path in mv2.2 = speed in (see above) in m/stdec = deceleration time in sadec = deceleration in m/s2

M = braking torque in Nmhv = feed constant in m/revolutionJges = total moment of inertia


F = intermediate circuit short-circuit Nmges = total mass (mload+mmot) in kg

Fig. 7-18: Calculation of the braking path to shutdown of the axis after operatingthe shutdown circuits of the drive for translation axes

For rotary axes:

dec2.24.2 t2

1 ⋅⋅= ωϕ with

decdect

αω 2.2=

and:ges

dec Ji

M

⋅=α

L: ϕ2.4 = deceleration angle in radω2.2 = Angle speed in (see above) in rad/stdec = deceleration time in sαdec = deceleration in rad/s2

M = braking torque in Nm i = calculation of transformation ratio -Jges = total moment of inertia


Fig. 7-19:Calculation of the braking path to shutdown of the axis after operatingthe shutdown circuits of the drive for rotatory axes

Depending on the setting of drive parameter P-0-0119 “Best-possibleshutdown”, the following correlations result:

P-0-0119 set to setpoint speed value of zero:

frictmax MMM += or frictmax FFF +=L: M = braking torque in Nm

Mmax = max. torque of drive in NmMfrict = friction torque in NmF = intermediate circuit short-circuit NFmax = max. force of drive in NmFfrict = friction force in N

Fig. 7-20: Calculation of braking torque/force if P-0-0119 is set to setpoint speedvalue of zero

Braking path to shutdown afteroperating the shutdown circuits

via the drive



P-0-0119 set to setpoint force/torque value of zero:

frictBremse.ext MMM += or frictBremse.ext FFF +=L: M = braking torque in Nm

Mext. Bremse= Torque of external brake in NmMfrict = friction torque in NmF = intermediate circuit short-circuit NFext.brake = braking force of external brake NFfrict = friction force in N

Fig. 7-21: Calculation of braking torque/force if P-0-0119 set to setpointforce/torque value of zero

P-0-0119 set to setpoint speed value of zero with filter and ramp:

12010−−= Pdec aa or 12010−−= Pdec ααL: adec = deceleration in m/s2

aP-0-1201 = deceleration ramp in parameter P-0-1201 in m/s2

αdec = deceleration in rad/s2

αP-0-1201 = deceleration ramp in parameter P-0-1201 in rad/s2

Fig. 7-22: Calculation of deceleration if P-0-0119 is set to setpoint speed value ofzero with filter and ramp

P-0-0119 set on retract movement:

retractioncurrent4.2 sss += or retractioncurrent4.2 ϕϕϕ +=L: s2.4 = deceleration path in m

scurrent = current position in msretraction = retraction path in mϕ2.4 = deceleration angle in radϕcurrent = current position in radϕretraction = retraction path in rad

Fig. 7-23: Calculation of deceleration path if P-0-0119 is set on retract movement

The overall working path results: s2= s2.3 + s2.4Overall working path



Overall Reaction Times and Braking Paths

The overall reaction times and braking paths are specified by the interplayof the two shutdown circuits. The shorter of the two reaction timesdetermined above and the shorter braking path apply.

The overall reaction times and braking paths are specified solely by theshutdown circuit via the drive.

The overall reaction times and braking paths are specified solely by theshutdown circuit via the control.

7.5 Reaction Times and Braking Paths when Monitors withinSafety Function “Safely Reduced Speed with SafelyLimited Absolute Position” are Activated

Within safety function safely reduced speed with safely limited absoluteposition, the axis is monitored for maintenance of the “Maximum speedfor safety function 1 / 2”, the “Upper position limit for safety function 1 / 2”and the “Lower position limit for safety function 1 / 2” – both in the driveand in the control. When the speed / position limit is exceeded, theshutdown circuits are operated both via the drive and via the control.Drive parameters P-0-0117 “Activation of NC reaction duringmalfunction”, P-0-0118 “Power shutdown during malfunction” and P-0-0119 “Best-possible shutdown” are relevant for the shutdown circuit viathe drive.

Due to errors within the drive, e.g. incorrect assignment of commutationfor synchronous motors or incorrect entry of field parameters by the userfor induction motors, the drive can be accelerated from the safely reducedspeed to a final speed that is specified by the counter-EMF of theintermediate circuit. This is the worst-case scenario.

Due to errors within the control, incorrect command values can be presetwhich could initiate a movement speed that is larger than the safelyreduced speed or outside the position limit. The drive then follows theincorrect command values until it is detected that the speed or theposition limit has been exceeded.

Reaction times and brakingpaths with functioning drive and

control


malfunctioning control

Reaction times and brakingpaths with malfunctioning drive

and functioning control

Explanation

Error scenarios



Reaction Times and Braking Paths Determined by the ControlThe reaction times and braking paths are determined mainly by detectingthat the speed / position limit for safely reduced speed with safely limitedabsolute position has been exceeded and the resulting triggering of theshutdown circuit using the “Starting lockout” function via the control. In theabove-mentioned error scenario, where the drive is accelerated to a finalspeed, the following reaction times and braking paths result:

The reaction time of the monitor is t3.1.1 = 4 ms.

The reaction time of the control for operating the shutdown circuit usingthe “Starting lockout” function is:

t2.1.2 = processing time + 3 x Interbus transfer time + delay time forstarting lockout relay

The processing time is 6 ms. Typical values for the Interbus transfer timeare 2 to 9 ms. You can calculate this more precisely using the followingformula. For the number of user data bytes, please use the larger of theinput or the output information. The delay time of the starting lockout relayis 25 ms.


Control reaction time



[ ] swbitü tt1000

1m3)n6(15,113t +⋅⋅⋅++⋅⋅=






1.3red2

1.3acc1.3 tvta2

1s ⋅+⋅⋅= redacc vtav +⋅= 1.31.3

with: ( )

ges

vfrictmaxacc J2

hMMa

⋅⋅⋅−

=π

or ( )

ges

frictmaxacc m

FFa

−=


hnv vitlim

1.3

⋅≤ or itlim1.3 vv ≤

L: S3.1 = working path in reaction time in maacc = acceleration in m/s2

t3.1 = reaction time in svred = reduced speed in m/sv3.1 = speed in m/sMmax = max. motor torque in NmMfrict = friction torque in Nmhv = feed constant in m/revolutionJges = total moment of inertia

reduced to the motor shaft(Jload+Jmot) in kgm2

Fmax = max. motor power in NFfrict = friction force in Nmges = total mass (mload+mmot) in kgnlimit = limit speed (can be seen in torque- speed diagram of the associated motor documentation) in min-1

Fig. 7-25: Calculation of working path within the reaction time, assumingconstant acceleration in translation axes




acceleration without attainingthe final speed)



For rotary axes:

1.3red2

1.3acc1.3 t60

n2t

2

1 ⋅⋅⋅+⋅⋅= παϕ 60

n2t red

1.3acc1.3

⋅⋅+⋅= παω

with: ( )

ges

frictmaxacc Ji

MM

⋅−

=α


n2 itlim1.3

⋅⋅≤ πω

L: ϕ3.1 = working angle in reaction time in radα acc = Acceleration in rad/s2

t3.1 = reaction time in snred = reduced speed in min-1

ω3.1 = Angle speed in rad/sMmax = max. motor torque in NmMfrict = friction torque in Nmi = calculation of transformation ratio -Jges = total moment of inertia

reduced to the motor shaft(Jload+Jmot) in kgm2

nlimit = limit speed (can be seen in torque- speed diagram of the associated motor documentation) in min-1

Fig. 7-26: Calculation of working path within the reaction time, assumingconstant acceleration in rotatory axes




1.3redacc1.3redvitlim

1.3 tvt2

1tv

60

hnS ⋅+

⋅−⋅

−⋅= or

( ) 1.3redacc1.3reditlim1.3 tvt2

1tvvS ⋅+

⋅−⋅−=

and: 60

hnv vitlim

1.3

⋅= or limitvv =1.3

and: ( )

ges

vfrictmaxacc J2

hMMa

⋅⋅⋅−

=π

or ( )

ges

frictmaxacc m

FFa

−=

L: S3.1 = working path in reaction time in mnlimit = limit speed (can be seen in torque- speed diagram of the associated motor documentation) in min-1

hv = feed constant in m/revolutionvred = reduced speed in m/st3.1 = reaction time in stacc = Acceleration time in svlimit = limit speed (can be seen in force-velocity diagram of the corresponding motor documentation) in m/s

v3.1 = speed in m/sαacc = Acceleration in rad/s2

Mmax = max. motor torque in NmMfrict = friction torque in NmJges = total moment of inertia


Fmax = max. motor power in NFfrict = friction force in Nmges = total mass (mload+mmot) in kg

Fig. 7-27: Calculation of working path within the reaction time, assumingconstant acceleration and attaining the final speed for translation axes





For rotary axes:

( )1.3

redacc1.3

reditlim1.3 t

60

n2t

2

1t

60i

nin2 ⋅⋅⋅+

⋅−⋅⋅

⋅−⋅⋅= ππϕ

with: ( )

acc

redvitlimacc a60

v60hnt

⋅⋅−⋅= or acc

redlimitacc

a

vvt

−=

or ( )

acc

reditlimacc 60i

nin2t

απ

⋅⋅⋅−⋅⋅=

and: 60i

n2 itlim1.3 ⋅

⋅⋅= πω

and: ( )

ges

frictmaxacc Ji

MM

⋅−

=α

L: ϕ3.1 = working angle in reaction time in radnlimit = limit speed (can be seen in torque- speed diagram of the associated motor documentation) in min-1

i = calculation of transformation ratio -nred = reduced speed in min-1

t3.1 = reaction time in stacc = Acceleration time in shv = feed constant in m/revolutionvred = reduced speed in m/sαacc = Acceleration in rad/s2

vlimit = limit speed (can be seen in force-velocity diagram of the corresponding motor documentation) in m/s

ω3.1 = Angle speed in rad/sMmax = max. motor torque in NmMfrict = friction torque in NmJges = total moment of inertia


Fig. 7-28: Calculation of working path within the reaction time, assumingconstant acceleration and attaining the final speed for rotatory axes



The braking path resulting from triggering of the shutdown circuits by thecontrol using the “Starting lockout” function is determined by friction andany external brakes that may be used. Using the intermediate circuitshort-circuit results in a further reduction of the braking path. However,use of this function is not safe for persons, but only for machines.Furthermore, use with induction motors is possible only to a degree.When an intermediate circuit short-circuit is activated, induction motorsslow down only by braking due to friction and due to the activation of anyexisting brakes.


dec1.32.3 tv2

1S ⋅⋅= with:

decdec a

vt 1.3= and:

( )ges

vfrictBremse.extdec J2

hMMa

⋅⋅⋅+

=π

or ( )

ges

frictBremse.extdec m

FFa

+=


Mext. Bremse= Torque of external brake in NmMfrict = friction torque in Nmhv = feed constant in m/revolutionJges = total moment of inertia


Fext. Bremse= braking force of external brake in NFfrict = friction force in Nmges = total mass (mload+mmot) in kg

Fig. 7-29: Calculation of braking path to shutdown of axis after triggering theshutdown circuits by the control (without intermediate circuit short-circuit / decisive for protection of persons) for translation axes

For rotary axes:

dec1.32.3 t2

1 ⋅⋅= ωϕ with

decdect

αω 1.3=

and:( )

ges

frictBremse.extdec Ji

MM

⋅+

=α

L: ϕ3.1 = deceleration angle in radϖ3.1 = Angle speed in (see above) in rad/stdec = deceleration time in sαdec = deceleration in rad/s2

Mext. Bremse= Torque of external brake in NmMfrict = friction torque in Nmi = calculation of transformation ratio -

Jges = total moment of inertiareduced to the motor shaft

(Jload+Jmot) in kgm2

Fig. 7-30: Calculation of braking path to shutdown of axis after triggering theshutdown circuits by the control (without intermediate circuit short-circuit / decisive for protection of persons) for rotatory axes

Braking path to shutdown aftertriggering the shutdown circuits

by the control (withoutintermediate circuit short-circuit

/ decisive for protection ofpersons)




frictBremse.extzks

gesv

2

v

1.3

2.3 MMM

Jhh

v8,1

S++

⋅⋅⋅

⋅

=π

or


ges2

1.32.3 FFF2

mv8,1S

++⋅⋅⋅

=

with:

( )2

Av

1.32eA

v

1.3

2

dN

dN

zks

Lph

v2RR

h

v2

I

M

M

⋅⋅⋅⋅++

⋅⋅⋅

=π

π

or

( ) ( )21.3

2

1.3

2

AeA

dN

dN

zks

LpvRR

vI

F

F⋅⋅++

⋅

=

L: s3.2 = deceleration path in mv3.1 = speed in (see above) in m/shv = feed constant in m/revolutionJges = total moment of inertia


Mzks = intermediate circuit shourt-circuitbraking torque in Nm

Mext. Bremse= Torque of external brake in NmMfrict = friction torque in Nmmges = total mass (mload+mmot) in kgFzks = intermediate circuit short-circuit

braking force in NFext. Bremse= braking force of external brake in NFfrict = friction force in NNdN = continuous torque at standstill in NmI dN = continuous current at standstill in ARA = motor winding resistance in ΩRe = bleeder resistance in Ω (bei HVE/HVR:

6Ω)p = number/width of pole pairs in - or mLA = coil inductivity in HFdN = braking force to a standstill in N

Fig. 7-31: Calculation of braking path to shutdown of axis after triggering theshutdown circuits by the control (with intermediate circuit short-circuit /decisive for protection of machinery) for translation axes

Braking path to shutdown aftertriggering the shutdown circuitsby the control (with intermediatecircuit short-circuit / decisive for

protection of machinery only)



For rotary axes:


ges2

1.32.3 MMM2

iJ8,1

++⋅⋅⋅⋅

=ω

ϕ where:

( ) ( )21.3

2

1.3

2

AeA

dN

dN

zks

LpRR

I

M

M⋅⋅++

⋅

=ω

ω

L: ϕ3.2 = braking angle in radω3.1 = Angle speed in (see above) in rad/sJges = total moment of inertia


i = calculation of transformation ratio -Mzks = intermediate circuit shourt-circuit

braking torque in NmMext. Bremse= Torque of external brake in NmMfrict = friction torque in NmNdN = continuous torque at standstill in NmI dN = continuous current at standstill in ARA = motor winding resistance in ΩRe = bleeder resistance in Ω (bei HVE/HVR:


Fig. 7-32: Calculation of braking path to shutdown of axis after triggering theshutdown circuits by the control (with intermediate circuit short-circuit /decisive for protection of machinery) for rotatory axes






Reaction Times and Braking Paths Determined by the DriveThe reaction times are determined mainly by specifying the exceedanceof the position monitoring window for safe operation stop and the resultingtriggering of the shutdown circuit of the drive. Drive parameters P-0-0117“Activation of NC reaction during malfunction”, P-0-0118 “Powershutdown during malfunction” and P-0-0119 “Best-possible shutdown”play a large role in determining this behavior.

In the above-mentioned error scenario, where the control generatesincorrect command values, the following reaction times and braking pathsresult:

The reaction time of the monitor is t3.2.1 = 6 to 8 ms.

The reaction time of the drive for operating the shutdown circuit is t3.2.2 = 2ms.




22.3CNC3.3 ta

2

1S ⋅⋅= with: 2.32.3 tav CNC ⋅=

under the following conditions: CNCvv ≤2.3

L: S3.3 = acceleration path in ma CNC = programmable acceleration in m/s2

t3.2 = reaction time in sv3.2 = speed in m/svCNC = Programmable CNC speed m/s

Fig. 7-33: Calculation of working path within the reaction time, assumingprogrammed acceleration without attaining the programmed finalspeed for translation axes

For rotary axes:

22.3CNC3.3 t

2

1 ⋅⋅= αϕ


n2 CNC2.3

⋅⋅≤ πω


t3.2 = reaction time in sω3.2 = Angle speed in rad/snCNC = programmed CNC speed in min-1

Fig. 7-34: Calculation of working path within the reaction time, assumingprogrammed acceleration without attaining the programmed finalspeed for rotatory axes


Reaction time of drive



acceleration without attainingthe programmed final speed)




−⋅+

⋅=

CNC

CNC2.3CNC

CNC

2CNC

3.3 a

vtv

a2

vS

under following condition: CNCvv ≤2.3

L: S3.3 = acceleration path in mvCNC = Programmable CNC speed m/sa CNC = programmable acceleration in m/s2



For rotary axes:

⋅⋅⋅−⋅⋅⋅+

⋅⋅⋅⋅

=60

n2t

60

n2

60

n2

2

1

CNC

CNC2.3

CNC

2

CNC

CNC3.3 α

πππα

ϕ


n2 CNC2.3

⋅⋅≤ πω


nCNC = programmed CNC speed in min-1



The shutdown circuit of the drive is operated after the reaction timeelapses. Drive parameters P-0-0117 “Activation of NC reaction duringmalfunction”, P-0-0118 “Power shutdown during malfunction” and P-0-0119 “Best-possible shutdown” determine the braking behavior. Driveparameter P-0-0117 “Activation of NC reaction during malfunction” isusually set to a drive-internal reaction in applications with the MTC200.The CNC-side reaction will no longer be considered here. Parameter P-0-0118 “Power shutdown during malfunction” mainly affects only how theother drives operated on the same drive package are to behave. It has noeffect on the movement of the axis affected by the activation of the safetyfunctions.






dec2.34.3 tv2

1S ⋅⋅= with:

decdec a

vt 2.3= and:

ges

vdec J2

hMa

⋅⋅⋅=

π or

gesdec m

Fa =


M = braking torque in Nmhv = feed constant in m/revolutionJges = total moment of inertia


F = intermediate circuit short-circuit Nmges = total mass (mload+mmot) in kg

Fig. 7-37: Calculation of the braking path to shutdown of the axis after operatingthe shutdown circuits of the drive for translation axes

For rotary axes:

dec2.34.3 t2

1 ⋅⋅= ωϕ with

decdect

αω 2.3=

and:ges

dec Ji

M

⋅=α

L: ϕ3.4 = deceleration angle in radϖ3.2 = Angle speed in (see above) in rad/stdec = deceleration time in sαdec = deceleration in rad/s2

M = braking torque in Nmi = calculation of transformation ratio -

Jges = total moment of inertiareduced to the motor shaft

(Jload+Jmot) in kgm2

Fig. 7-38: Calculation of the braking path to shutdown of the axis after operatingthe shutdown circuits of the drive for rotatory axes

Depending on the setting of drive parameter P-0-0119 “Best-possibleshutdown”, the following correlations result:

P-0-0119 set to setpoint speed value of zero:

frictmax MMM += or frictmax FFF +=L: M = braking torque in Nm

Mmax = max. torque of drive in NmMfrict = friction torque in NmF = intermediate circuit short-circuit NFmax = maximum force in NFfrict = friction force in N

Fig. 7-39: Calculation of braking torque/force if P-0-0119 is set to setpoint speedvalue of zero

Braking path to shutdown afteroperating the shutdown circuits

via the drive



P-0-0119 set to setpoint force/torque value of zero:

frictBremse.ext MMM += or frictBremse.ext FFF +=L: M = braking torque in Nm

Mext. Bremse= Torque of external brake in NmMfrict = friction torque in NmF = intermediate circuit short-circuit NFext. Bremse= braking force of external brake in NFfrict = friction force in N

Fig. 7-40: Calculation of braking torque/force if P-0-0119 set to setpointforce/torque value of zero

P-0-0119 set to setpoint speed value of zero with filter and ramp:

12010−−= Pdec aa or 12010−−= Pdec ααL: adec = deceleration in m/s2

aP-0-1201 = deceleration ramp in parameter P-0-1201 in m/s2

αdec = deceleration in rad/s2

αP-0-1201 = deceleration ramp in parameter P-0-1201 in rad/s2

Fig. 7-41: Calculation of deceleration if P-0-0119 is set to setpoint speed value ofzero with filter and ramp

P-0-0119 set on retract movement:

retractioncurrent4.3 sss += or retractioncurrent4.3 ϕϕϕ +=L: s3.4 = deceleration path in m

scurrent = current position in msretraction = retraction path in mϕ3.4 = deceleration angle in radϕcurrent = current position in radϕretraction = retraction path in rad

Fig. 7-42: Calculation of deceleration path or angle if P-0-0119 is set on retractmovement






Overall Reaction Times and Braking Paths

The overall reaction times and braking paths are specified by the interplayof the two shutdown circuits. The shorter of the two reaction timesdetermined above and the shorter braking path apply.

The overall reaction times and braking paths are specified solely by theshutdown circuit via the drive.

The overall reaction times and braking paths are specified solely by theshutdown circuit via the control.

7.6 Installation Guidelines for Drive Control Devices

Note: For the installation guidelines, see the design documents forthe drive control devices.


control


malfunctioning control

Reaction times and brakingpaths with malfunctioning drive

and functioning control

IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-1


8 Planning a System with Bosch Rexroth IST

8.1 Rules for Using the Safety Functions

In the case of spindles or motors with gears that can be shifted, a secondmeasuring system must be used so that the position or the speed of theload is reliably detected.

The safety functions must be selected and deselected by the machinemanufacturer over two channels. A setting example can be found insection "Sample Application", p. 8-3.

The default structure of the emergency stop chain described in the BoschRexroth drive documents is modified when Intelligent Safety Technologyis used. The following criteria must be heeded:

• The safety door lock is not a component of the emergency stop chain.

• Signals “Power on” and “Power off” must not be implemented directlyusing buttons, but rather via potential-free contacts of the PLC.

Section "Sample Application" (p. 8-3) describes the structure of theemergency stop chain.

Operation of a system with Intelligent Safety Technology without forceddynamics is permitted only if the system has separating protectiveequipment that is locked.

Without separating locked protective equipment and without forceddynamics, the main contactor must be switched off immediately after thesafety functions are selected. This shutdown must not be carried outusing solely the PLC user program; instead it must be wired as discretelogic.

Bosch Rexroth recommends that safety function safe stop be used forspindle drives. Generally, a defect in the drive electronics can cause shortjolting of the motor shaft when other safety functions are used.

A resolver is not permitted in single-encoder systems with IntelligentSafety Technology.

The starting lockout located in the drive module must be used for everyaxis with which Intelligent Safety Technology safety functions are used.The starting lockout serves as a shutdown circuit for the control.

Gear shifting for spindles

Selecting and deselectingthe safety functions

Emergency stop chain

Operation withoutforced dynamics

Spindle drives

Resolver

CNC shutdown circuit

8-2 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology


8.2 Residual Risks

The machine and system manufacturer is hereby reminded of residualrisks that occur during the use of Intelligent Safety Technology. Thefollowing residual risks are known:

• A defect in the end stage located in the drive module can lead to ashort-term rotation of the motor shaft by a maximum of 180 degrees,even when a safety function is active.

• A short-circuit or interruption in the encoder cables can cause a briefrotation of the motor shaft when safety function safe operation stop isselected. The following applies: 6-pole motors turn a maximum of 60degrees, 2-pole motors turn a maximum of 180 degrees.

• The position switch points of safe cams are issued only after safereferencing. Only allow active signals (signal state ‘1’) for safetyfunctions to be processed further.

• When safety function safe operation stop is selected, an axis locatedin position control can be pressed out of the position by mechanicalforces that are greater than the torque of the axis, causing ashutdown of the drive system.

• Inclined axes must be mechanically protected from activation of thestarting lockout; see safety note "Dangerous movements!" in section6.2.

• Safety functions always work in relation to the drive axis. In the caseof interpolatory movement and mechanical transformations, divergentspeeds may occur in the resulting movement under certainconditions. (Example: Scara robot, rod cinematics, etc.)

• In the case of an encoder shaft break, an asynchronous drive with asingle-encoder system and safety function safe operation stopselected can move at asynchronous speed without being detected bythe safety monitors. This does not apply for safety function safe stop.



8.3 Sample Application

GeneralThe following sample application shows a system with four axes wherethe safety functions can be activated in operating mode Setup.

The safety functions must be selected before the electromagneticprotective door lock can be opened. The “Safety functions active” reportsof the first (CNC) and the second channel (drives) are evaluated toactivate the protective door lock. The position of the protective door ismonitored by a protective door monitor with force-guided contacts. This isrequired for reliable two-channel selection and deselection of the safetyfunctions.

The following safety functions are used:

• Safe stop

• Safe operation stop

• Safely reduced speed with safely limited absolute positions 1

• Safe referencing

• Safely reduced speed 1


• Safe cams

• Safe referencing

Use of safely limited absolute positions and safe cams requires the use ofsafe referencing. Safe referencing of digital linear axis Y and digital rotaryaxis A is carried out automatically using an additional cam.

The safe cams of digital rotary axis A are used to switch between safelyreduced speeds 1 and 2.

Digital main spindle S

(1. axis)

Digital linear axis X

(2. axis)

Digital linear axis Y

(3. axis)

Digital rotary axis A

(4. axis)



The safety functions are selected and deselected in operating modesAutomatic and Setup as follows:

In automatic operation, the safety functions are deselected usingdeactivation signals. The electromagnetic door lock prevents theprotective door from being opened. Opening of the protective door in the“Automatic” operating mode in the case of, for example, a defective doorlock is monitored via two channels; it always leads to the immediateactivation of the safety functions. Automatic program processing when aprotective door is open leads to an immediate shutdown of the drives andis therefore impossible.

In operating mode “Setup”, the user can move the axes without limits andwithout activating the safety functions when a protective door is closed.The status of the protective door lock is monitored over two channels. Asin Automatic operation, opening the protective door immediately activatesthe safety functions. An axis movement in turn leads to a shutdown of thedrives.

In operating mode “Setup”, the user can select the safety functions usinga button. Preconditions for this are that the protective door be closed, thedrives be at a standstill and operating mode Setup be preselected. Afterselection, the deactivation signals of the safety functions must beswitched off and the electromagnetic door lock opened. The user can nowmanually move the Y- and A-axis with safely reduced speed with theprotective door open. For this, it is required that the operator press a dual-channel Consent key.

The axes can be moved with the protective door open only under thefollowing conditions:

• Setup mode must be selected

• Safe operation must be selected with the protective door closed

• The Consent key must be pressed

Automatic operation

Setup operation whenprotective door is closed

Setup operation whenprotective door is open



Sample switching setup

"');2,

!#$%&&'"(-%

<=

$"&'"(>

!

&

&

!

!#$% >,

!

'2-%&2,

2& ,

2&

!

2& ,

&

2><

2>

#"(#)# *

&+#",

!#$% >

!#$% ><

!#$% >

?,,?,,2,?,,2

$"&'"(><

:$

:$

$

:$

@

?

?<?<

?:$

$

?

:$

'(

8&8&1

:$

'(

*+

:$

'(

"&

:$

'(

$

:$

:$

:$

Schaltungsbeispiel.FH7

Fig. 8-1: Sample switching setup



Safety ChannelsThe sample switching setup shown has a dual-channel structure. Thefunctions of both channels are the same. The CNC safety channel isimplemented by the PLC user program using software. The safetychannel of the drives is implemented using hardware.

A discrepancy in the two channels is detected by two-way datacomparison, causing an error.

Before the safety functions in the sample switching setup can be used,operating mode “Setup” must be selected. The safety functions areselected with the “Select safety functions / open door” button or withcontactor K3 and are deselected with the “Safety area OK” button or withcontactor K4.

The safety signals for selecting and deselecting the safety functions of the1st

channel (CNC) are guided via INTERBUS-S to the PLC.

Standard input module RME 12.2:

• Report “Door open”

• Report “Door closed”

• Y-axis reference cams

• A-axis reference cams

Machine operating terminal BTA20:

• “Setup” operating mode

• Select safety function / open door

• Safety area OK

• Consent key

The input signals are processed by a function module in the PLC userprogram. In the function module, the signals are logically linked as in thesample switching setup of the 2nd

channel (drives). The function moduleswitches the deactivation signals of the safety functions that are sent onto the CNC via the cycle interface. The cycle interface between the PLCand the CNC provides a separate I/O area for the safety signals for eachaxis.

The reference cams for the safe referencing of the Y- and A-axes in thePLC user program are sent on by the cycle interface directly to the CNC.

Safety channel 1



The safety signals of the 2nd channel (drive) are connected to special

safety I/O modules. A safety module (S, X, Y, A) is assigned to everydrive. The safety modules communicate directly with the assigned drives.The following safety inputs are used for the individual safety modules:

S-axis:

• Safe stop

X-axis:


Y-axis:


• Reference cam safe referencing

• Consent key

A-axis:



• Reference cam safe referencing

• Consent key

Inputs safe stop and safe operation stop of the Y and A safety I/O moduleare unoccupied. To keep wiring to a minimum, the inputs are hidden inthe safety parameters of the CNC and the drives. This means thatselecting safely reduced speed automatically selects the safe stop of theY-axis and the safe operation stop of the A-axis. Only after the Consentkey is pressed does the monitor of the Y- and A-axes switch to safelyreduced speed. Which safety function is selected when the Consent keyis not pressed is specified in safety parameter “Selection of safetyfunctions” in the CNC.

The “Safety functions active” (door enablement) outputs of the CNC andthe drives are switched in series. If both channels report that the safetyfunctions are active, the door lock mechanism is activated (lock lifted).

Output signal “Position switch cabinet 1” of safety module RMP 12.2 ofthe 4th

axis is used to switch between safely reduced speeds 1 and 2 inthe second channel. In the PLC user program, the switch is implementedby axis status signal “AXXS.SAFP1” for the first channel.

Safety channel 2

Safety outputs



Protective Door MonitorThe electromagnet of the protective door monitor is activated by thesafety outputs of the CNC (“Door enablement”) and of the drives (“Safetyfunctions active”). If both channels signal that the safety functions areactive (logic ‘1’), the door lock can be opened.

The activation of the door lock is implemented over one channel. This issufficient because the feedback is certainly evaluated over two channelsvia the protective door monitor. Opening of the protective doorimmediately activates the safety functions, which leads to an immediateshutdown of the drives. The 1st

channel (NC) reacts to the safety inputreport “Door closed” (contact 11.2) and the 2nd

channel (drives) reacts tocontact 11.1 of the protective door monitor. Opening contact 11.2 resultsin contactor K4 dropping out, which switches off the deactivation signalsof the safety functions.

When the protective door is closed, contacts K11.1 and 11.2 of theprotective door monitor are closed. The safety functions can bedeactivated only in this position (“Safety area ok”). If the protective door isnot closed, the safety functions cannot be deactivated.

Note: The design of the protective door lock depends on both therisk assessment of the machine manufacturer for the machineand on its use.

Protective door monitor

Protective door monitor



Selecting Safety FunctionsThe following conditions must be fulfilled before the safety functions canbe selected:

• the drives must be at a standstill,

• the protective door must be closed/locked,

• operating mode “Setup” must be selected using the key-operatedswitch, and

• button “Select safety functions” must have been pressed.

When operating mode “Setup” is selected and button “Select safetyfunctions / open door” is pressed, contactor K3 picks up and contactor K4drops off. The opening of K4 causes the signals for deactivating thesafety functions to be switched off in the 2nd

channel (drives). Switchpositions “Setup” and “Select safety functions / open door” are evaluatedin the PLC, leading to the deactivation signals being switched off in the 1st

channel (CNC). If both channels signals that the safety functions areactive, the electromagnet of the protective door is activated and theprotective door can be opened.

In order to move the Y- and A- axes with safely reduced speed with theprotective door open, the Consent key must be pressed.

Pressing the dual-channel Consent key signals the CNC and the drivesthat the monitor of the Y- and A- axes has been switched from safe stop /safe operation stop to safely reduced speed. The two axes can now bemoved manually (jog mode) as long as the Consent key is pressed.Releasing the Consent key switches the monitor of the Y- and A- axesback to safe stop / safe operation stop.

Deselecting safety functionsThe user can deactivate the safety functions only if the protective door isclosed. The user must use button “Safety area OK” to acknowledge thatthe safety area is OK, i.e. the protective door is closed and there are nopeople in the danger zone within the system.

The “Safety area OK” acknowledgement interrupts the activation of thedoor magnets (door enablement) in the PLC user program. Reports “Doorclosed” (K11.1) and “Safety area OK” are evaluated directly in the PLCuser program, leading to deactivation of the safety functions in the 1st

channel (CNC).

If the protective door is closed, the protective door monitor closes contactK11.2. Pressing button “Safety area OK” closes contactor K4 anddeselects the safety functions in the 2nd

channel (drives) via thedeactivation signals.

Consent key



CNC Shutdown CircuitThe starting lockout present in the drive must be used for each axis that isplanned for use with safety functions. The starting lockout serves thecontrol as a shutdown circuit if a safety monitor in the control triggers ashutdown of the drive system.

The starting lockout is checked within forced dynamics. The activationand feedback of the starting lockout is tested. Forced dynamics can besuccessfully executed only if the starting lockout is correctly wired.

The starting lockout of each drive module must be activated separately bythe PLC user program. A digital output of the I/O level must be providedfor each drive.

The feedback “Starting lockout active” of all drive modules can be guidedto the PLC as a collective signal. The acknowledgement signal isabsolutely required for monitoring in the control.

If safety function safe stop is selected, the starting lockout with the samesignal lines is activated / the acknowledgement is monitored.

Further information regarding the design of the starting lockout on thedrive module can be found in the DIAX04 function description, Section 7.5“Starting lockout”.

Forced dynamics

Activate starting lockout

“Starting lockout active”acknowledgement

Safety function safe stop

Designing thestarting lockout



The following digital input and output signals are required for the sampleapplication:

Standard input module RME 12.2:

• “Starting lockout active” collective message

Standard output module RME 12.2:

• Activate S-axis starting lockout

• Activate X-axis starting lockout

• Activate Y-axis starting lockout

• Activate A-axis starting lockout

The fig. below shows the switch setup for activating and evaluating thestarting lockout of the sample application.

9>,AA<A

&+#",

>,

-&

><

>

>

-&

-&.

-&/

:$

$

:$

Anlaufsperre.FH7

Fig. 8-2: Sample application: control shutdown circuit

Sample application



Emergency Stop ChainThe following figure shows the modified structure of the emergency stopchain and the input power when using Intelligent Safety Technology.

'>> 8

8

8

>> $(

'>> ##B'

8

8

'>>

'>> 3

0>>'C44

0>>'C)

+

95

0

0

:;"

:<"

:<"

:;"

:;";

=+=

,/4 ,/4; ,/4

,/4,/4,/4 ,/4

,/4;,/4;

+

0

0

0

8

#66 8

0 8 #8

,/4

,/4,/4,/4

,/4;

>

95

>

:;"

:;"?

:;"@

:@";

:@"

/

0

Not-Aus.FH7

Fig. 8-3: Emergency stop chain with Intelligent Safety Technology



The emergency-stop button, the NC ready signal (CNC enablement) andthe “Power off” signal are monitored by an emergency-stop switchingdevice. When the supply module is ready for power to be switched on,this can happen using PLC signal “Power on”.

Further information on switching the power on can be found in the PLCinterface description.

Note: Signals “Power on” and “Power off” must be implemented viapotential-free contacts of the PLC.

The safety door lock is not a component of the emergency stop chain.Opening the protective door results in the safety functions being selectedin both channels.

When Intelligent Safety Technology is used, PLC control signals“PxxCESTP1”, “PxxCESTP2” and “PxxCESTP3” can not be used tomonitor the protective doors. The signals must be set to logic ‘1’ in thePLC user program.

Note: The default structure of the emergency stop chain described inthe Bosch Rexroth drive documents is modified whenIntelligent Safety Technology is used.

As an additional safety feature for braking the drives to a standstill whenthe drive electronics malfunction, the intermediate circuit can be short-circuited.

With an intermediate circuit short-circuit, motors with permanent magnetexcitation are always braked to a standstill, regardless of whether thedrive electronics still function or not.

Without an intermediate circuit short-circuit, motors with permanentmagnet excitation come to an uncontrolled stop when the driveelectronics malfunction.

Note: Asynchronous drives do not brake with intermediate circuitshort-circuiting.

Further information regarding intermediate circuit short-circuits can befound in application description “DIAX04 HVE and HVR Supply Devices,2nd

Generation” (Chapter 7).

Description

Intermediate circuit short-circuit



PLC Program

The PLC user program undertakes the following duties during processingand transport of the safety signals:

• Logical linking and evaluation of the safety signals for selecting anddeselecting the safety functions in the 1st

channel (CNC),corresponding to the hardware-side logic of the 2nd

channel (drives) forselecting and deselecting the safety functions.

• Transport of the safety input and output signals of the 2nd channel

(drives).

• Activation of the starting lockout for safely shutting down the drives (ina 2ms implementation in Version 19, in a time-controlled task as ofVersion 22).

• Execution of forced dynamics.

When designing the PLC program, note that the maximum PLC cycletime of 75 ms may not be exceeded. The determined PLC cycle time is tobe documented in the acceptance report.

All program parts that are relevant to the processing of the safety signalsare implemented in step sINIT in the sample application.

Figure below shows a typical SFC structure of a Bosch Rexroth userprogram. Initialization step sINIT is active after the program is started.The step is used for initialization events. The PLC cyclically processesstep sINIT until initialization is complete and transition condition tINIT hasbeen fulfilled. Fulfilling the transition starts step sProgram. Step sINITbecomes inactive and step sProgram active.

!"# !"#$%!"#!"#&'(#&

Fig. 8-4: Sample application: SFC structure user program

General

Design of PLC program

Sequential Function Chart (SFC)



Step sINIT is divided into three action blocks: aSAFE_1, aSAFE_2 andaDYNAM. The initialization step usually contains additional action blocksfor initialization; these are not listed here.

)) *+ ,-./0 12"34563078 ,-./9 12"34563978 :;,<-5==2#5$>>%

:2#?3 ##2@6555(?525353325=?26"#A1?5#5AB

Fig. 8-5: Sample application: action blocks in step sINIT

It is recommended that the processing of the safety signals beprogrammed in the initialization step of the PLC user program. Thisensures that the transport and evaluation of the safety signals are carriedout, because the first step (initial step) is processed at least once. “S” (setin memory) must be used as the ID symbol of the actions so that theactions can continue to be cyclically processed by programs even afterthe step becomes inactive.

Safety signals of channel 1 (CNC)The safety functions of the 1st

channel are selected and deselected in thePLC user program. Here, the same logic must be used when linkingsignals as that of the hardware structure of the 2nd

channel for selectingand deselecting the safety functions.

The cycle interface between the PLC and the CNC provides a separateI/O area for the safety signals for each axis. The following status signals(signals from the CNC to the PLC) exist:

Status signal Description

AxxS.SAFAC Safety function active

AxxS.SAFRY Switching complete

AxxS.SAFP1 Position switch point 1




AxxS.SAFSL Activate starting lockout

AxxS.SAFEN Enable movement

Fig. 8-6: Status signals (CNC to PLC, xx = axis number)

Action blocks in step sINIT

Recommendation

General



Signals from the CNC to the PLC are called control signals:

Control signals Description

AxxC.SAFSS Deactivation of safe stop

AxxC.SAFOS Deactivation of safe operation stop

AxxC.SAFA1 Deactivation of safely reduced speed withsafely limited absolute position 1

AxxC.SAFA2 Deactivation of safely reduced speed withsafely limited absolute position 2

AxxC.SAFAG Consent key

AxxC.SAFRS Reference cam for safe referencing

AxxC.SAFSL Starting lockout active

Fig. 8-7: Control signals (PLC to CNC, xx = axis number)

The following input signals are evaluated in the PLC user program:

Input signal Description

iTUERAUF Message: protective door open

iTUERZU Message: protective door closed

iSafeRefY Y-axis reference cams

ISafeRefA A-axis reference cams

iANSP_ALL “starting lockout active” collective signal

iEINRICHT Setup mode

iSAFE_AKT Select safety functions / open door

iSAFE_OK Safety area OK

iZUSTIMM Consent key

Fig. 8-8: Safety input signals of channel 1

Five signals are required on the default output module. The outputs foractivating the starting lockout are processed in the 2ms implementation inVersion 19 and in a time-controlled task as of Version 22.

Output signal Description

qTUERFREI Door enablement / activation of doormagnet

qANSP_Y Activate S-axis starting lockout

qANSP_X Activate X-axis starting lockout

qANSP_Y Activate Y-axis starting lockout

qANSP_A Activate A-axis starting lockout

Fig. 8-9: Safety output signals of channel 1

In the example, every axis is assigned to a user-defined function moduleFB_IST01. In this module, the input signals are logically linked in thesame manner as in the hardware structure for activating the safety signalsin the 2nd

channel (drives).

As a result, the function module supplies a signal for activating theelectromagnetic door lock (qTM) and the positions of the two contactorsK3 (qK3) and K4 (qK4). Output qK3 is further processed in the PLC userprogram for generating messages and displays. The deactivation signalsof the safety functions are switched depending on output qK4 and aresent on to the NC directly via the cycle interface.

Sample application

FB_IST01



Note: Function module FB_IST01 has been developed especially forthis example; it is not included in the scope of delivery forIntelligent Safety Technology.

Safety function safe stop is designed for the S axis and, for the third axis(Y-axis), safely reduced speed with a switchover to safe stop if theConsent key is not pressed. Selecting safety function safe stop meansthat the starting lockout is activated by the PLC user program. Thefollowing steps are executed in the first channel:

1. Safety function safe stop is selected in the CNC with control signalAxxC.SAFSS (signal status ‘0’). In the second channel, the safetyfunction is selected directly on the corresponding safety I/O module.

2. The CNC requests the PLC user program to activate the startinglockout in the drive.

3. The PLC user program activates the starting lockout in the drive inthe fast PLC program (in a 2ms implementation in Version 19 and ina time-controlled task as of Version 22) via a digital output.

4. The drive acknowledges the activation of the starting lockout of thePLC.

5. In the PLC user program, the acknowledgement is passed on to theCNC with axis control signal “AXXC.SAFSL” via the cycle interface.

Steps two to five are identical with the shutdown circuit of the control. Thismeans that, when a safety monitor in the control triggers a shutdown ofthe drive system, steps two to five are executed. Since the startinglockout must be designed as a shutdown circuit of the control for eachaxis with safety functions, steps two to five are executed automaticallywhen safety function safe stop is selected.

The activation of the starting lockout is described in detail in this chapterunder "Safe shutdown of drives" (p. 8-31) .

The 2ms implementation must be enabled/started in the PLC userprogram. To do this, system variable “FastEnabl” in the PLC userprogram must be set to logic ‘1’.

The time-controlled task is to be declared in the area TASK of theresource with an INTERVAL of 4ms and enabled with a priority higherthan the default program.

The signals for activating the door magnet are switched in series. Output“qTUERFREI” is set only after all function modules signal that the doorlock is activated.

If safety function safe stop or safe operation stop is selected, a movementalways leads to immediate shutdown of the axis by the shutdown circuits.This can be prevented by issuing a motion hold for the corresponding axiswith control signal “AxxC.MHOLD” on the CNC. Note that the motion holdmust be switched off when switching to safety function safely reducedspeed.

starting lockout

2ms implementation (Version 19)

Time-controlled task(as of Version 22)

Door magnet

Motion hold



Note: The motion hold’s sole purpose is to make the operation ofsystems and machines more comfortable. The motion hold isnot a safety function.

The input signals of reference switches “iSafeRefY” and “iSafeRefA”, forthe safe referencing of the Y- and A-axes, in the PLC user program aresent on to control signals “A03C.SAFRS” / “A04C.SAFRS”.

The input signal of Consent key “iZUSTIMM” is required to select safetyfunction safely reduced speed of the Y- and A-axes. The signal for bothaxes is passed on directly to the CNC using the cycle interface.

Note: Consent must have the highest priority for an axis movement.This means that consent must be present before movementcan be triggered, e.g. by a jog command.

In the PLC user program, the Consent signal can be linked to the processenablement (PxxC.ENABL). This ensures that movement is triggered onlyif the Consent key is pressed first and a movement command is issuedthereafter.

The collective signal “iANSP_ALL” of the four drive modules is passed onto control signal “AxxC.SAFSL” of the four axes.

Safe referencingreference switch

Consent key

“Starting lockout active”acknowledgement



The following figure shows action block aSAFE_1. All the safety signalsfor selecting and deselecting the safety functions of the 1st

channel (CNC)are processed in the action block.

.?3#19##3#-.?378-.?3BBBBBBBBBBBBBBBBBBBBB.?39##3#BBBBBBBBBBBBBBBBBBBBBBBBBCDDE

,5A15A=35F=="12"3#</ #</G#</;#</,H(-7878787878#</ BBBBBBBBBBBBBBBBBBBBBBBB,5A15A=35F1 BBBBBBBBBBBCDDE#</GBBBBBBBBBBBBBBBBBBBBBBBB,5A15A=35F1GBBBBBBBBBBBCDDE#</;BBBBBBBBBBBBBBBBBBBBBBBB,5A15A=35F1;BBBBBBBBBBBCDDE#</,BBBBBBBBBBBBBBBBBBBBBBBB,5A15A=35F1,BBBBBBBBBBBCDDEH(-BBBBBBBBBBBBBBBBBBBB 121(55AI=?3#BJKL9B0BMBBCDDE

12"31 N1? / -C/ M0((1#</ 7878/,O-H<78(P(#QR/ 7878/SOHQR78,(,M0TB ,- 78I78.UHQV78 1/,F7878 ,-./,Q 1/DF7878 ,-./DQ,M0 B ,-,T7878,NN ,-,T$%1? / BBBBBBBBBBBBBBBBBBBBBB 12"3405634=3BBBBBBBBBBBBBBB-C/ M0((1BBBBBBBBBBBBBBBBBBBBB<"W:W1#;0B0VBBBBBBBBBBJLVB0BMBBCDDE#</ BBBBBBBBBBBBBBBBBBBBBBBB,5A45A=35F4=3BBBBBBBBBBCDDE(P(BBBBBBBBBBBBBBBBBBBBBB<"W:53=W1#Q9B0VBBBBBBBBJLVB0B0BBCDDE#QR/ BBBBBBBBBBBBBBBBBBBBBBBBT5QRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,(BBBBBBBBBBBBBBBBBBBBBBBB,(#5BBBBBBBBBBBBBBBBBBBBBJRMBXB9BBCDDE,M0TB ,- BBBBBBBBBBBBBBBBBBB:5A11BBBBBBBBBBBBBBBBBBBBBBBBBCDDE 1/,FBBBBBBBBBBBBBBBBBBBB 35121(5BBBBBBBBBBBBBBBBBJRMBYB9BBCDDE 1/DFBBBBBBBBBBBBBBBBBBBBB 12DQBBBBBBBBBBBBBBBBBBBBBBBBBBJRMBYBVBBCDDE,M0 B ,-,TBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

E5FN#F16121(55A1Z56"25#3,M0 B ,-,T#<[DE:/ 787)8,M0 B ,-U;78I7%,M0 B ,-,TBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE#<[DE:/ BBBBBBBBBBBBBBBBBBBBB<63=4 NBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,M0 B ,-U;BBBBBBBBBBBBBBBBBBB Z56"5#3BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

Action block aSAFE_1



12"31GN1? /G -C/ M0((1#</G7878/,O-H<78(P(#QR/G7878/SOHQR78,(,M9TB ,-D 78I78.UHQV78 1/,F7878 ,-./,Q 1/DF7878 ,-./DQ,M9 B ,-,T7878,NN ,-,T$%1? /GBBBBBBBBBBBBBBBBBBBBBB 12"3405634GNBBBBBBBBBBBBBBB-C/ M0((1BBBBBBBBBBBBBBBBBBBBB<"W:W1#;0B0VBBBBBBBBBBJLVB0BMBBCDDE#</GBBBBBBBBBBBBBBBBBBBBBBBB,5A15A=35F1GBBBBBBBBBBBCDDE(P(BBBBBBBBBBBBBBBBBBBBBB<"W:53=W1#Q9B0VBBBBBBBBJLVB0B0BBCDDE#QR/GBBBBBBBBBBBBBBBBBBBBBBBBT5QRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,(BBBBBBBBBBBBBBBBBBBBBBBB,(#5BBBBBBBBBBBBBBBBBBBBBJRMBXB9BBCDDE,M9TB ,-D BBBBBBBBBBBBBBBBBBB:5A11BBBBBBBBBBBBBBBCDDE 1/,FBBBBBBBBBBBBBBBBBBBB 35121(5BBBBBBBBBBBBBBBBBJRMBYB9BBCDDE 1/DFBBBBBBBBBBBBBBBBBBBBB 12DQBBBBBBBBBBBBBBBBBBBBBBBBBBJRMBYBVBBCDDE,M9 B ,-,TBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

E5FN#F16121(55A1Z56"25#3,M9 B ,-,T#<[DE:/G787)8,M9 B ,-U;78I7%,M9 B ,-,TBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE#<[DE:/GBBBBBBBBBBBBBBBBBBBBB<63=4GNBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,M9 B ,-U;BBBBBBBBBBBBBBBBBBB Z56"5#3BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

12"31;N1? /; -C/ M0((1#</;7878/,O-H<78(P(#QR/;7878/SOHQR78,(,MRTB ,-,078I78.UHQV78 1/,F7878 ,-./,Q 1/DF7878 ,-./DQ,MR B ,-,T7878,NN ,-,T$%1? /;BBBBBBBBBBBBBBBBBBBBBB 12"3405634;NBBBBBBBBBBBBBBB-C/ M0((1BBBBBBBBBBBBBBBBBBBBB<"W:W1#;0B0VBBBBBBBBBBJLVB0BMBBCDDE#</;BBBBBBBBBBBBBBBBBBBBBBBB,5A15A=35F1;BBBBBBBBBBBCDDE(P(BBBBBBBBBBBBBBBBBBBBBB<"W:53=W1#Q9B0VBBBBBBBBJLVB0B0BBCDDE#QR/;BBBBBBBBBBBBBBBBBBBBBBBBT5QRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,(BBBBBBBBBBBBBBBBBBBBBBBB,(#5BBBBBBBBBBBBBBBBBBBBBJRMBXB9BBCDDE,MRTB ,-,0BBBBBBBBBBBBBBBBBBB:5A1132=B=0BBBBBBBBBBBBBBBCDDE 1/,FBBBBBBBBBBBBBBBBBBBB 35121(5BBBBBBBBBBBBBBBBBJRMBYB9BBCDDE 1/DFBBBBBBBBBBBBBBBBBBBBB 12DQBBBBBBBBBBBBBBBBBBBBBBBBBBJRMBYBVBBCDDE,MR B ,-,TBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

1;N15Z561115"T 1U1;,MRTB ,-U 78I78 1U1;BBBBBBBBBBBBBBBBBBBBU15Z56 13215=;BBBBJLVB0B9BBCDDE,MRTB ,-U BBBBBBBBBBBBBBBBBBBU155# 115"BBBBBBBBBBBBBBBBBBBBCDDE



E5FN#F16121(55A1Z56"25#3#A#?3=,MR B ,-,TS(###<[DE:/;7878I7)8,MR B ,-U;78I78,MR B ,-.78I7%,MR B ,-,TBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDES(##BBBBBBBBBBBBBBBBBBBBBTF2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBJRMBYBYBBCDDE#<[DE:/;BBBBBBBBBBBBBBBBBBBBB<63=4;NBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MR B ,-U;BBBBBBBBBBBBBBBBBBB Z56"5#3BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MR B ,-U;BBBBBBBBBBBBBBBBBBB<A#?3=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

12"31,N1? /, -C/ M0((1#</,7878/,O-H<78(P(#QR/,7878/SOHQR78,(,MVTB ,-,078I78.UHQV78 1/,F7878 ,-./,Q 1/DF7878 ,-./DQ,MV B ,-,T7878,NN B ,-,T$%1? /,BBBBBBBBBBBBBBBBBBBBBB 12"3405634,NBBBBBBBBBBBBBBB-C/ M0((1BBBBBBBBBBBBBBBBBBBBB<"W:W1#;0B0VBBBBBBBBBBJLVB0BMBBCDDE#</,BBBBBBBBBBBBBBBBBBBBBBBB,5A45A=35F4,BBBBBBBBBBBBBBBCDDE(P(BBBBBBBBBBBBBBBBBBBBBB<"W:53=W1#Q9B0VBBBBBBBBJLVB0B0BBCDDE#QR/,BBBBBBBBBBBBBBBBBBBBBBBBT5QRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,(BBBBBBBBBBBBBBBBBBBBBBBB,(#5BBBBBBBBBBBBBBBBBBBBBJRMBXB9BBCDDE,MVTB ,-,0BBBBBBBBBBBBBBBBBBB:5A1132=B=0BBBBBBBBBBBBBBBCDDE 1/,FBBBBBBBBBBBBBBBBBBBB 35121(5BBBBBBBBBBBBBBBBBJRMBYB9BBCDDE 1/DFBBBBBBBBBBBBBBBBBBBBB 12DQBBBBBBBBBBBBBBBBBBBBBBBBBBJRMBYBVBBCDDE,MV B ,-,TBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

1,N15Z561115"T 1U1,,MVTB ,-U 78I78 1U1,BBBBBBBBBBBBBBBBBBBBU15Z56 13215=,BBBBJLVB0BRBBCDDE,MVTB ,-U BBBBBBBBBBBBBBBBBBBU155# 115"BBBBBBBBBBBBBBBBBBBBCDDE

Z56132=(5==91Z56"0,MV B ,-!0,MVTB ,-,9787)8,MVTB ,-,0787%,MV B ,-!0BBBBBBBBBBBBBBBBBBB!Z56"0BBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MVTB ,-,9BBBBBBBBBBBBBBBBBBB:5A1132=B=9BBBBBBBBBBBBBBBBBBCDDE,MVTB ,-,0BBBBBBBBBBBBBBBBBBB:5A1132=B=0BBBBBBBBBBBBBBBBBCDDE

E5FN#F16121(55A1Z56"25#3#A#?3=,MV B ,-,TS(###<[DE:/,7878I7)8,MV B ,-U;78I78,MV B ,-.78I7%,MV B ,-,TBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDES(##BBBBBBBBBBBBBBBBBBBBBTF2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBJRMBYBYBBCDDE#<[DE:/,BBBBBBBBBBBBBBBBBBBBB<63=4,NBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MV B ,-U;BBBBBBBBBBBBBBBBBBB Z56"5#3BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MV B ,-U;BBBBBBBBBBBBBBBBBBB<A#?3=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

15F205634;=,NS(##,MRTB ,-,\787)8,MVTB ,-,\$8S(##BBBBBBBBBBBBBBBBBBBBBTF2(BBBBBBBBBBBBBBBBBBBBBBBJRMBYBYBBCDDE,MRTB ,-,\BBBBBBBBBBBBBBBBBBBTF2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MVTB ,-,\BBBBBBBBBBBBBBBBBBBTF2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE



15FZ3="#"3W 6?5AWTT, !/,EE,M0TB ,- E787)8,M9TB ,- E78,MRTB ,- E78,MVTB ,- E$8, !/,EEBBBBBBBBBBBBBBBBBBBBT33B"3 6?5ABBBBBJLRB9BMBBCDDE,M0TB ,- EBBBBBBBBBBBBBBBBBBB 6?5ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,M9TB ,- EBBBBBBBBBBBBBBBBBBB 6?5ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MRTB ,- EBBBBBBBBBBBBBBBBBBB 6?5ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MVTB ,- EBBBBBBBBBBBBBBBBBBB 6?5ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

Fig. 8-10: Action block aSAFE_1

-C/ M0CDDE8/,O-H<7CDDECDDE8/SOHQR7CDDECDDE8.UHQV7CDDECDDE8 ,-./,QCDDE8 ,-./DQCDDE8,GG ,-,T$%

Fig. 8-11: Interface overview of FB_IST01

Identifier Application Type

Input variables

iT_OPEN Report “Door open” BOOL

iT_CLOSED Report “Door closed” BOOL

tSETUP “Setup” operating mode BOOL

tSAFE_AKT Select safety functions BOOL

tSAFE_OK Safety area OK BOOL

AxxS.SAFAC “Safety function active” status signal BOOL

Output variables

qTM Activation of door magnet BOOL

qK3 Contactor K3 BOOL

qK4 Safe operation deactivation signal BOOL

Fig. 8-12: Description of the designator

Interface overview of FB_IST01

Description of the identifiers



The first two networks reproduce the positions of contactors K3 and K4.Both networks are structured according to the sample switching setup forselecting and deselecting the safety functions of the first channel (drives).

The door magnet is activated depending on status signal “Safetyfunctions active” (AxxS.SSAFAC). Activation of the door magnet isremoved if status signal “Safety functions active” drops off or if theprotective door is closed and acknowledgement signal “Safety area OK” ispresent.

\HQR55QR 121(535= ,-./,Q/SO.UHQR78787878 ,-./,QBBBBBBBBBBBBBBBBBBBB 35121(5BBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE/SOBBBBBBBBBBBBBBBBBBBBBBBB:53=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE.UBBBBBBBBBBBBBBBBBBBBBBBB (BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDEHQRBBBBBBBBBBBBBBBBBBBBBBBBBBT5QRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

\HQV55QV 121(5=35=/SOHQR ,-./DQHQV7878I7)87)8HQV$87%/SOBBBBBBBBBBBBBBBBBBBBBBBB:53=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDEHQRBBBBBBBBBBBBBBBBBBBBBBBBBBT5QRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE ,-./DQBBBBBBBBBBBBBBBBBBBBB 12DQBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDEHQVBBBBBBBBBBBBBBBBBBBBBBBBBB 121(5=5A=BBBBBBBBBBBBBBBBBBBBBBBCDDEHQVBBBBBBBBBBBBBBBBBBBBBBBBBB 121(5=5A=BBBBBBBBBBBBBBBBBBBBBBBCDDE

,5A1=#",NN ,-,T</<H<7878I78,NN ,-,TBBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</<BBBBBBBBBBBBBBBBBBBBBBBBB<,UQ.UU=#"BBBBBBBBBBBBBBBBBBBBBBBBBBCDDEH<BBBBBBBBBBBBBBBBBBBBBBBBBB,5A1=#"BBBBBBBBBBBBBBBBBBBBBBBBBCDDE

\#F</<,5A1=#",NN ,-,T ,-./DQ/,O-</<787)878I7)8</<$87%,NN ,-,TBBBBBBBBBBBBBBBBBBBB 121(55ABBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE ,-./DQBBBBBBBBBBBBBBBBBBBBB 12DQBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE/,O-BBBBBBBBBBBBBBBBBBBBBBB:BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</<BBBBBBBBBBBBBBBBBBBBBBBBB<,UQ.UU=#"BBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</<BBBBBBBBBBBBBBBBBBBBBBBBB<,UQ.UU=#"BBBBBBBBBBBBBBBBBBBBBBBBBBCDDE

Fig. 8-13: Function block FB_IST01

Description



Safety signals of channel 2 (drive)To transport the data for the safety I/O of channel 2 (drive) through thecontrol, function “SAVE_IO” (described in the following) must beprogrammed in the PLC user program for each axis designed for use withsafety functions.

The purpose of this function is to provide a secure transfer of the safetyI/O signals between the used safety I/O module and the associatedintelligent digital SERCOS drive.

To ensure continuous communication between the safety I/O module andthe drive, processing of the function must be ensured in every PLCprogram run. Therefore, it is a good idea to call the functions directly inthe initialization in a saving step.

,&./DO 8,G 7O:O:8$%

Fig. 8-14: Interface overview function SAVE_IO

Input AXIS must be occupied with the drive address set on the safety I/Omodule. Values between 1 and 32 are possible here. The date must be ofdata type “USINT”.

Providing this address specifies the drive that exchanges the safety I/Oinformation with this module.

The input information from the safety I/O module is stored on input IN.This input must be switched with the identifier of the safety I/O moduleinputs specified in the declaration. The input and output data are of type“UDINT”.

The output of function SAVE_IO provides the output information for thesafety I/O module. This output is located directly on the output register ofthe assigned safety I/O module.

When the function is switched, the relationship between the drive on thecontrol and the safety I/O module on the field bus is created.

The definition of the data contents for the safety I/O module ensures thatthe information is recognized as valid only by the drive / safety I/O modulewith the same addresses. This eliminates assignment errors due toprogramming an incorrect axis address

Before the safety I/O signals can be transferred between the used safetyI/O modules and the associated digital drives, 32-bit data consistencymust be switched on. If 32-bit data consistency is not active,communication between the safety I/O modules and the digital drivescannot be established.

Note: Transport of the safety I/O signals between the safety I/Omodule and the digital drive is possible only if 32-bit dataconsistency is active.

Description

Interface overview of functionSAVE_IO

AXIS

IN

Output SAVE_IO

32-bit data consistency



32-bit data consistency is activated in the PLC programming interface ofVersion 19. To do this, open menu ‘Project’ – ‘IO assignment’. In the I/Oconfiguration, select IBM2 (Interbus-S master) and confirm with the<Enter> key. Then use key combination <Alt><F10> to open menu “IOEditor”. In the IO Editor, open menu ‘Interbus-S’ – ‘Parameter’.

Interbus-S Parameter.bmp

Fig. 8-15: Interbus-S parameters for Version 19

In the ‘Interbus-S – Parameter’ window, 32-bit data consistency isactivated by marking the field ‘Data consistency’ under ‘Parameter’ withan ‘x’. To do this, use the Tab key to select the field ‘Data consistency’and mark it using the Space key.

Datenkonsistenz.bmp

Fig. 8-16: Activation of 32-bit data consistency for Version 19

After successful activation, the PLC user program must be loaded into thecontrol.

32-bit data consistency remains active until it is deactivated in menu‘Interbus-S – Parameter’.

At the start of the actual programming, the I/O hardware configurationmust be entered in the IO tables in the programming system. The IO tablerecords the participants of a bus.

Only after this specification has been made can the linkage of inputs andoutputs to absolute addresses be sensibly carried out. Before theprogram is loaded into the PLC, the data generated here are compared tothe actual hardware data of the control.

Four safety I/O modules, with logical numbers 20, 21, 22 and 23, havebeen entered In the following IO table.

Activation of 32-bit dataconsistency for Version 19

Sample applicationfor Version 19

I/O Editor for Version 19



U"#=(30?( "BE"B3A3C B:O:C209R5=M09RV]YXL^M09RV]YXL^M09R

00M_ 0BM`MMMLU<Q09B0C CQEBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB99M_ 0B0`M9C-U<!09B0L.L,KKKKBBBBBBBBBBBBBBBBBBBBBBBBBBBBR90_ 0B9`M9C-U<!09B0L.L,KKKKBBBBBBBBBBBBBBBBBBBBBBBBBBBBV99_ 0BR`M9C-U<!09B0L.L,KKKKBBBBBBBBBBBBBBBBBBBBBBBBBBBB]9R_ 0BV`M9C-U<!09B0L.L,KKKKBBBBBBBBBBBBBBBBBBBBBBBBBBBB

Fig. 8-17: Field bus assignment in the I/O Editor for Version 19

In the declaration part, the symbolic names of the input and outputvariables, the addresses and the data type are agreed upon.

=1,;!.aT##!UD\U,< ("3112ID&,U/!O 1 J:9MBVO: 12("34 N 1GJ:90BVO: 12("34GN 1;J:99BVO: 12("34;N 1,J:9RBVO: 12("34,N.:/&,U

D(("3112ID&,U/DO!OH 1 JK:9MBMO: 12(("34 NH 1GJK:90BMO: 12(("34GNH 1;JK:99BMO: 12(("34;NH 1,JK:9RBMO: 12(("34,N.:/&,U

Fig. 8-18: Declaration of safety I/O modules for Version 19

Declaration for Version 19



In the user program, the input and output variables are transferred directlyto function SAVE_IO in action aSAFE_2.

12"34 N ,&./D08,G 7H 1 1 8$%

12"34GN ,&./D98,G 7H 1G 1G8$%

12"34;N ,&./DR8,G 7H 1; 1;8$%

12"34,N ,&./DV8,G 7H 1, 1,8$%

Fig. 8-19: Implementation function SAVE_IO in action aSAFE_1 for Version 19

Implementation for Version 19



As of Version 22, 32-bit data consistency is activated in the PLCprogramming interface by selecting activation “Interbus/M/CON” in the I/OEditor of the resource for RMP12 safety I/O modules (see Fig. 7-21).

As of Version 22, the I/O hardware configuration is declared using tool“CMD”. The following figure shows a typical application. Operator terminalBTA20 (participant 30) and a RMK12 RECO bus terminal are connectedvia the Interbus activation. Two standard output modules (RMA12), astandard input module (RME12) and 4 safety I/O modules (RMP12) areconnected on the RECO bus terminal.

The Interbus activation is to be configured in the CMD systemconfigurator as follows:

CMD_Konf.bmp

Fig. 8-20: Interbus activation configuration as of Version 22

The existing modules are declared in the I/O Editor of the resource asfollows.

Activation of 32-bit dataconsistency as of Version 22

Sample applicationas of Version 22

CMD configurationas of Version 22

I/O Editor as of Version 22



IO_Edit.bmp

Fig. 8-21: I/O Editor of the resource as of Version 22

Note: Each safety I/O module occupies 4-byte inputs and 4-byteoutputs in the I/O reproduction. All safety I/O modules must bedeclared in the I/O Editor as one participant (in the exampleabove, as participant 86).

The inputs and outputs of the safety I/O modules must be declaredbetween VAR and END_VAR in the declaration of the program.

Dekl.bmp

Fig. 8-22: Safety signals declaration as of Version 22

Declaration as of Version 22



In the user program, the input and output variables are transferred directlyto function SAVE_IO in action aSAFE_2.

AB - BC

AB - BCD*$.@4/

EAB - BC

D!$.@4

,+F!#

AB6!8%! !"#BC

,:!,+F!#

AB$ ;BC

!8

44444AB - BC44444D!$.@4444443$!8GE4444AB - BC4444D*$.@4/4443$!8G

AB :- BC

AB :- BCD*$.@4

E:AB :- BC

D!$.@4.

:

,+F!#

AB6!8%! !"#BC

,:!,+F!#

AB$ ;BC

!8

:44444AB :- [email protected]$!8GE:4444AB :- BC4444D*$.@44443$!8G

AB H- BC

AB H- BCD*$.@4.

EH;AB H- BC

D!$.@4

H

,+F!#

AB6!8%! !"#BC

,:!,+F!#

AB$ ;BC

!8

H44444AB H- BC44444D!$.@4444443$!8GEH4444AB H- BC4444D*[email protected]$!8G

AB ,- BC

AB ,- BCD*$.@4

E,AB ,- BC

D!$.@4@

H

,+F!#

AB6!8%! !"#BC

,:!,+F!#

AB$ ;BC

!8

,44444AB ,- BC44444D!$.@4@444443$!8GE,4444AB ,- BC4444D*$.@44443$!8G

Implementation V22.FH7

Fig. 8-23: Implementation function SAVE_IO in action aSAFE_1 as of Version 22

Implementation as of Version 22



Safe shutdown of drivesSafe shutdown must be implemented (in Version 19 by a fast PLCprogram (2ms implementation) and as of Version 22 by a time-controlledtask) for every axis that is designed for use with safety functions.

If a safety monitor in the control triggers the shutdown of the drive system,the CNC uses the cycle interface of the PLC to signal that the startinglockout must be activated. In order to ensure that the safe shutdown ofthe drives is not delayed by the PLC cycling time, the drives must be shutdown or the starting lockout activated (for Version 19 in the 2msimplementation and as of Version 22 by a time-controlled task).

When safety function safe stop is selected, the starting lockout is alsoactivated by the safe shutdown of the drives in the 2ms implementation(for Version 19) or using a time-controlled task (as of Version 22).

In Version 19, the PLC program is divided into two areas that run atdifferent speeds. One area contains the PLC program. The cycle timevaries based on the length of the PLC user program.

The second area, the fast PLC program, is called every 2 ms if it hasbeen enabled by “FastEnabl = True”. The symbolic name “FastEnabl” ispermanently specified to activate the 2ms implementation.

Further information regarding 2ms implementation can be found in the“PLC Programming Instructions”.

Via the following fixed physical input addresses, the CNC requests thePLC to activate the starting lockout:

Address axis number

0.1437.0...0.1437.7 1, 2, 3, 4, 5, 6, 7,8

0.1436.0...0.1436.7 9, 10, 11, 12, 13, 14, 15, 16

0.1435.0...0.1435.7 17, 18, 19, 20, 21, 22, 23, 24

0.1434.0...0.1434.7 25, 26, 27, 28, 29, 30, 31, 32

Fig. 8-24: PLC input addresses for activating the starting lockout for Version 19

In order to ensure that the request for activating the starting lockout doesnot depend on the input reproduction of the PLC program cycle, the inputsmust be addressed as fast input bytes or input words. Direct access toperipherals is implemented in the declaration by character ‘P’ in thephysical address.

Example: %IBP0.1437

Correspondingly, the outputs for activating the starting lockout must beaddressed as fast output bytes or output words.

Note: Only type BYTE or WORD can be used for the direct accessto peripherals.

Safe stop

2ms implementation(for Version 19)

Addresses in Version 19

Direct access to peripheralsin Version 19



In the declaration part, the symbolic name of the input and output byte foractivating the starting lockout is agreed upon. Character ‘P’ in the physicaladdress declares both bytes as fast inputs/outputs (direct access toperipherals).

=1,;!.aT##!UD\U,<!U/

&,U/!O

UH(5A(6?1#TT[DE:/,GJC!MB0VRX(?2,5A(6?1#TT

.:/&,U&,U/DO!O

,5A(6?H[DE:/,GJKC!LRB0D((?2,5A(6?

.:/&,U

Fig. 8-25: Declaration example direct peripheral access for Version 19

In the 2ms implementation, input byte “iHOLD_AX” is copied directly tooutput byte “qHOLD_AX”. The CNC requests the PLC user program toactivate the starting lockout with “iHOLD_AX”. Signal status ‘1’ meansthat the starting lockout must be activated.

If the outlet byte activates only the starting lockout of the drives and nooutlet bits are used for other duties (danger of overwriting), the inlet byte(iHOLD_AX) can be copied directly to the output byte (qHOLD_AX).

T2(?21#TT((?2 a[DE:/,G87H[DE:/,G$%[DE:/,GBBBBBBBBBBBBBUH(5A(6?1#TTBBJC!MB0VRXC;.H[DE:/,GBBBBBBBBBBBBB,5A(6?((BBBBBBBBBBBBBBJKC!LRB0BBC;.

Fig. 8-26: Activation of the starting lockout in the 2 ms implementation of Version19


Implementation partfor Version 19



In Version 22, the PLC program is divided into two tasks: a cyclic task(TSK1) and a time-controlled one (TSK2). The time-controlled task is tobe declared with an INTERVAL of 4ms and enabled with a priority higherthan the cyclic task.

RES_IST.bmp

Fig. 8-27: Task division in Version 22

Note: Detailed notes regarding the function of task administrationcan be found in Section 11.3 of the documentation “Operatingand Programming Instructions for WinPCL 04VRS”.

Via the following fixed physical input addresses, the CNC requests thePLC to activate the starting lockout:

Address Axis number

1.523.0...1.523.7 1, 2, 3, 4, 5, 6, 7,8

1.522.0...1.522.7 9, 10, 11, 12, 13, 14, 15, 16

1.521.0...1.521.7 17, 18, 19, 20, 21, 22, 23, 24

1.520.0...1.520.7 25, 26, 27, 28, 29, 30, 31, 32

Fig. 8-28: PLC input addresses for activating the starting lockout as of Version22

In the declaration part, the symbolic name of the input and output byte foractivating the starting lockout is agreed upon in the area between VARand END_VAR.

Time-controlled taskas of Version 22

Addresses as of Version 22




In the declaration part, the signals for the starting lockout are declared asfollows:

DEKL_ZEIT.bmp

Fig. 8-29: Declaration part of time-controlled task as of Version 22

In the time-controlled task, input byte “iHOLD_AX” is copied directly tooutput byte “qHOLD_AX”. The CNC requests the PLC user program toactivate the starting lockout with “iHOLD_AX”. Signal status ‘1’ meansthat the starting lockout must be activated.

If the outlet byte activates only the starting lockout of the drives and nooutlet bits are used for other duties (danger of overwriting), the inlet byte(iHOLD_AX) can be copied directly to the output byte (qHOLD_AX).

IMPL_ZEIT.bmp

Fig. 8-30: Implementation part of time-controlled task as of Version 22

Declaration part as of Version 22

Implementation partas of Version 22



Forced dynamicsIn order to provide the machine manufacturers as much freedom aspossible in the handling of forced dynamics, forced dynamics is activatedusing the PLC user program. The machine manufacturer is thus able todetermine the optimum time for forced dynamics himself. Therefore, forexample, it is possible to execute forced dynamics automatically when thesystem is started, after a certain time between workpiece processingcycles has elapsed, or manually by the machine operator using a switch.

Forced dynamics must be executed in the CNC and the drive after thesystem is started but before the first activation of a safety function andafter the forced dynamics timer has elapsed. The time interval of forceddynamics is specified by the machine manufacturer in the “Forceddynamics time interval” safety parameters of the CNC and the drive.Forced dynamics should be carried out at least once every eight hours.

Forced dynamics tests the Consent key and checks the shutdown circuitsof the CNC and the drive. After successful execution, the forced dynamicstimers in the CNC and the drive are restarted. In the case of an error,forced dynamics is cancelled and an error message is generated.

The following conditions must be fulfilled before forced dynamics can bestarted:

• Safety functions are deselected (deactivation signals have signalstatus ‘1’).

• The Consent key must not be pressed

• Power must be switched on or must be able to be switched on usingfunction module DYNAM.

• Forced dynamics must not be active.

Note: Automatic program processing is impossible during forceddynamics. During forced dynamics, axis movement alwayscauses an error and thus the cancellation of forced dynamics.

Description

Conditions



Bosch Rexroth provides a standard DYNAM function module for forceddynamics. The function module must be designed once in the PLC userprogram for each axis that is to be used with safety functions. It must beensured that forced dynamics be carried out separately for each axis. Theinterfaces of the function module must merely be correctly switched in thePLC user program; forced dynamics itself is carried out automatically byfunction module DYNAM.

The forced dynamics procedure is divided into nine steps that are startedby function module DYNAM using a step provision and checked byfeedback. Each step is monitored by a timer. Feedback must be detectedby the DYNAM module within ten seconds. In the case of an error, forceddynamics is cancelled after ten seconds and an error is output anddescribed at output ERR_FLG / ERR_NR.

+

G I

,

I

$

,

2I

$ 82

G5I

Zwangsdynamisierung.FH7

Fig. 8-31: Forced dynamics step sequence

Function module DYNAM



The figure below shows the interfaces of function module DYNAM.

:;,<CDDE8.,CE.<./7<.CDDE8 ,UU.,:;/7CDDE8,G ,T&.7CDDECDDE8!GG !Db.U!Db.U/D7CDDECDDE8,GG U-UU/-E\7CDDE<.8<./<,G.UU/U7CDDE8U. .$%

Fig. 8-32: Interface overview of DYNAM

Identifier Application Type

Input variables

ENABLE Activation input BOOL

START Start forced dynamics BOOL

AXIS Axis number (1-32) INT

PXXSPOWER Status signal Power ON BOOL

AXXSRF Controller enablement BOOL

TIME_MAX Forced dynamics time interval TIME

RESET Error acknowledgement BOOL

Output variables

TIME_ Elapsed time (max.: TIME_MAX) TIME

READY_ Forced dynamics ready BOOL

ACTIVE Forced dynamics active BOOL

POWER_ON Switch power on BOOL

ERR_FLG Error flag BOOL

ERR_NR Error description INT

Fig. 8-33: Description of the designator

Interface overview offunction module DYNAM

Description of the identifiers



InputsActivation input ENABLE releases processing of function moduleFB_DYNAM (logic ‘1’). If the input is logic ‘0’, the module is not processedand forced dynamics is invalid for the function module. Forced dynamicsis required after every activation.

A positive flank on inlet START starts forced dynamics, assuming thatthere is no error and that the module is active.

Inlet AXIS is used to assign the axis number of the axis to the functionmodule.

Process status signal PXXS.POWER applied to inlet PXXSPOWER. Thefunction module uses this inlet to check, before and during forceddynamics, if power has been switched on.

The function module detects on input AXXSRF whether controllerenablement is present for the affected axis. Controller enablement isrequired to start forced dynamics.

Input TIME_MAX describes the time interval of forced dynamics. Thevalue should be selected so that it is lower than or equal to that in the“Forced dynamics time interval” safety parameters in the CNC and thedrive.

The RESET input acknowledges/deletes error messages that have beenissued.

OutputsOutput TIME_ shows the time that has elapsed since the last valid forceddynamics. The time is shown regardless of the forced dynamics timers ofthe CNC and the drive. The maximum value at this output corresponds tothe value set in input TIME_MAX. Time measurement is reset only aftersuccessful forced dynamics.

In the PLC program, the timer can be used to, for example, generate amessage that forced dynamics must be carried out within the next hour.

Output READY_ signals that forced dynamics was successfully carriedout and is valid. The outlet is set to logic ‘1’ until the forced dynamics timeinterval has elapsed (TIME_=TIME_MAX). The user can use this inlet tointerlink several function modules so that forced dynamics can be startedsequentially.

The outlet signals that forced dynamics is being carried out.

Before forced dynamics is started, the function module uses this outlet tosignal the PLC user program that power is to be switched on if power iscurrently switched off. The outlet must be taken into account in the logicof the power startup.

Outlet ERR_FLG signals that an error has occurred.

Outlet ERR_NR describes an error that has occurred.

The error numbers are described in section 11.3 "FB DYNAM ForcedDynamics Error Messages".

ENABLE

START

AXIS

PXXSPOWER

AXXSRF

TIME_MAX

RESET

TIME_

READY_

ACTIVE

POWER_ON

ERR_FLG

ERR_NR



In the example, one function module of type DYNAM is assigned to eachof the axes S, X, Y and A. Using a button (input “iSTART”), forceddynamics of spindle S is started (function module FB_DYNAMS). Afterforced dynamics finishes successfully, the function module starts timemeasurement “TIME_” and sets output “READY_”. Using flag“M_READY_S”, forced dynamics of the X-axis is now started on functionmodule FB_DYNAMX, and so on.

The time interval of forced dynamics (CNC and drive safety parameters)is eight hours in the example. The time interval of the DYNAM functionmodules is also set to eight hours (input “TIME_MAX”). Outputs “TIME_”and “READY_” help the PLC programmer in the execution of forceddynamics. Time interval “TIME_MAX” and output “TIME_” of the elapsedtime do not depend on the safety parameters of the CNC and the drive.The time output is merely started when the function module has carriedout all the required steps and the CNC and drive restart their forceddynamics timers. If forced dynamics in the drive becomes invalid due toan error, e.g. because the drive is shut down, this is not automaticallyrecognized by the function module. In this case, forced dynamics can bemade invalid using input “ENABLE” (logic “0”).

Note: Output “POWER_ON” must be taken into account in the logicof the power startup in the PLC user program.

Sample application



-5==2#51 4G4;=,N-C/:;,< :;,<78.,CE.<./7<./ ,U</U.,:;/ 7878 ,UU.,:;/78</:;,T/ 08,G ,T&.78!MM B!Db.U</!DbD/ 7878!GG !Db.U!Db.U/D78,M0 BU-</.UU-E\ 7878,GG U-.UU/-E\78cL68<./<,G.UU/U7</.UU/ U. .7878U. .$%-C/:;,< BBBBBBBBBBBBBBBBBBBB-<-5==2#54 NBBBBBBBBBBBBBBBBBBBBBBB:;,<<./ BBBBBBBBBBBBBBBBBBBBBBB#4 NBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB<. ,UBBBBBBBBBBBBBBBBBBBBBBBC( 15==2#5BBBBBBBBBBBJ0MB0]BMBCDDE</U.,:;/ BBBBBBBBBBBBBBBBBBBB<F ,G =2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE0BBBBBBBBBBBBBBBBBBBBBBBBBBBB,N(#?BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB,;/</:;,T/ BBBBBBBBBBBBBBBBBBBB<F-5==2#55ABBBBBBBBBBBBBBBBBBBBCDDE!MM B!Db.UBBBBBBBBBBBBBBBBBBB!Z?3=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</!DbD/ BBBBBBBBBBBBBBBBBBBB<F!ETZH(BBBBBBBBBBBBBBBBBBBBBBBBBCDDE,M0 BU-BBBBBBBBBBBBBBBBBBBBBBT3?3#BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</.UU-E\ BBBBBBBBBBBBBBBBBBBB<F.415==2#5 BBBBBBBBBBBBBBBBBBCDDEcL6BBBBBBBBBBBBBBBBBBBBBBBBB#A3115==2#5BBBBBBBBBBBBBBBBB<.</.UU/ BBBBBBBBBBBBBBBBBBBBBB<F.(#? BBBBBBBBBBBBBBBBBBBBBBBBBBBBU. .BBBBBBBBBBBBBBBBBBBBBBBC(UBBBBBBBBBBBBBBBBBBBBBBBBBBBJ0MB0VBXBCDDE

-C/:;,<G :;,<78.,CE.<./7<./G</U.,:;/ </U.,:;/G7878 ,UU.,:;/78</:;,T/G98,G ,T&.78!MM B!Db.U</!DbD/G7878!GG !Db.U!Db.U/D78,M9 BU-</.UU-E\G7878,GG U-.UU/-E\78cL68<./<,G.UU/U7</.UU/GU. .7878U. .$%-C/:;,<GBBBBBBBBBBBBBBBBBBBB-<-5==2#54GNBBBBBBBBBBBBBBBBBBBBBBB:;,<<./GBBBBBBBBBBBBBBBBBBBBBBB#4GNBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB<.</U.,:;/ BBBBBBBBBBBBBBBBBBBB<F ,G =2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</U.,:;/GBBBBBBBBBBBBBBBBBBBB<FGN=2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE9BBBBBBBBBBBBBBBBBBBBBBBBBBBB,N(#?BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB,;/</:;,T/GBBBBBBBBBBBBBBBBBBBB<F-5==2#55ABBBBBBBBBBBBBBBBBBBBCDDE!MM B!Db.UBBBBBBBBBBBBBBBBBBB!Z?3=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</!DbD/GBBBBBBBBBBBBBBBBBBBB<F!ETZH(BBBBBBBBBBBBBBBBBBBBBBBBBCDDE,M9 BU-BBBBBBBBBBBBBBBBBBBBBBT3?3#BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</.UU-E\GBBBBBBBBBBBBBBBBBBBB<F.415==2#5GBBBBBBBBBBBBBBBBBBCDDEcL6BBBBBBBBBBBBBBBBBBBBBBBBB#A3115==2#5BBBBBBBBBBBBBBBBB<.</.UU/GBBBBBBBBBBBBBBBBBBBBBB<F.(#?GBBBBBBBBBBBBBBBBBBBBBBBBBBBBU. .BBBBBBBBBBBBBBBBBBBBBBBC(UBBBBBBBBBBBBBBBBBBBBBBBBBBBJ0MB0VBXBCDDE



-C/:;,<; :;,<78.,CE.<./7<./;</U.,:;/G</U.,:;/;7878 ,UU.,:;/78</:;,T/;R8,G ,T&.78!MM B!Db.U</!DbD/;7878!GG !Db.U!Db.U/D78,MR BU-</.UU-E\;7878,GG U-.UU/-E\78cL68<./<,G.UU/U7</.UU/;U. .7878U. .$%-C/:;,<;BBBBBBBBBBBBBBBBBBBB-<-5==2#54;NBBBBBBBBBBBBBBBBBBBBBBB:;,<<./;BBBBBBBBBBBBBBBBBBBBBBB#4;NBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB<.</U.,:;/GBBBBBBBBBBBBBBBBBBBB<FGN=2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</U.,:;/;BBBBBBBBBBBBBBBBBBBB<F;N=2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDERBBBBBBBBBBBBBBBBBBBBBBBBBBBB,N(#?BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB,;/</:;,T/;BBBBBBBBBBBBBBBBBBBB<F-5==2#55ABBBBBBBBBBBBBBBBBBBBCDDE!MM B!Db.UBBBBBBBBBBBBBBBBBBB!Z?3=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</!DbD/;BBBBBBBBBBBBBBBBBBBB<F!ETZH(BBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MR BU-BBBBBBBBBBBBBBBBBBBBBBT3?3#BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</.UU-E\;BBBBBBBBBBBBBBBBBBBB<F.415==2#5;BBBBBBBBBBBBBBBBBBCDDEcL6BBBBBBBBBBBBBBBBBBBBBBBBB#A3115==2#5BBBBBBBBBBBBBBBBB<.</.UU/;BBBBBBBBBBBBBBBBBBBBBB<F.(#?;BBBBBBBBBBBBBBBBBBBBBBBBBBBBU. .BBBBBBBBBBBBBBBBBBBBBBBC(UBBBBBBBBBBBBBBBBBBBBBBBBBBBJ0MB0VBXBCDDE

-C/:;,<, :;,<78.,CE.<./7<./,</U.,:;/;</U.,:;/,7878 ,UU.,:;/78</:;,T/,V8,G ,T&.78!MM B!Db.U</!DbD/,7878!GG !Db.U!Db.U/D78,MV BU-</.UU-E\,7878,GG U-.UU/-E\78cL68<./<,G.UU/U7</.UU/,U. .7878U. .$%-C/:;,<,BBBBBBBBBBBBBBBBBBBB-<-5==2#54,NBBBBBBBBBBBBBBBBBBBBBBB:;,<<./,BBBBBBBBBBBBBBBBBBBBBBB#4SNBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB<.</U.,:;/;BBBBBBBBBBBBBBBBBBBB<F;N=2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</U.,:;/,BBBBBBBBBBBBBBBBBBBB<F,N=2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDEVBBBBBBBBBBBBBBBBBBBBBBBBBBBB,N(#?BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB,;/</:;,T/,BBBBBBBBBBBBBBBBBBBB<F-5==2#55ABBBBBBBBBBBBBBBBBBBBCDDE!MM B!Db.UBBBBBBBBBBBBBBBBBBB!Z?3=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</!DbD/,BBBBBBBBBBBBBBBBBBBB<F!ETZH(BBBBBBBBBBBBBBBBBBBBBBBBBCDDE,MV BU-BBBBBBBBBBBBBBBBBBBBBBT3?3#BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBCDDE</.UU-E\,BBBBBBBBBBBBBBBBBBBB<F.415==2#5,BBBBBBBBBBBBBBBBBBCDDEcL6BBBBBBBBBBBBBBBBBBBBBBBBB#A3115==2#5BBBBBBBBBBBBBBBBB<.</.UU/,BBBBBBBBBBBBBBBBBBBBBB<F.(#?,BBBBBBBBBBBBBBBBBBBBBBBBBBBBU. .BBBBBBBBBBBBBBBBBBBBBBBC(UBBBBBBBBBBBBBBBBBBBBBBBBBBBJ0MB0VBXBCDDE

Fig. 8-34: Sample application: function block DYNAM in action block aDYNAM



Safety ParametersThis section describes the safety parameters of the control and drives inthe sample application. It must be ensured that each safety parameter ispresent in the control and in the drive.

If a parameter is not entered in the same way in both channels, e.g. dueto incorrect entry, the drives are shut down using the shutdown circuits. Inthis case, the control and the drive issue error message “Two-way datacomparison incorrect” with the corresponding axis number.

Safely limited absolute positions and safe cams are not evaluated if theupper and lower position limits are set to a value of ‘0’.

The parameters are always internally evaluated, regardless of whichsafety function is selected.

Safety parameter “Position monitoring window for safe operation stop”must not be set so that it is too small.

Parameter “Safe referencing reference position” is evaluated only if safelylimited absolute positions and safe cams are used.

If only safety function safe stop or safe operation stop is used withoutswitching to another safety function, parameter “Transition time forswitching safety functions” can be set to ‘0’.

Note: Unused safety parameters are to be set to a value of ‘0’ inboth channels!

The time interval for forced dynamics is 8 hours for all four axes.

Note: A reason for a value greater than ‘8’ hours for the time intervalfor forced dynamics must be provided by the machinemanufacturer in the acceptance report!

Two-way data comparison

Safely limited absolute positions/ safe cams

Position monitoring window forSafe operation stop

Safe referencingreference position


Time interval for forceddynamics



S-Axis (1st Axis)

• Safe stop

In safety parameter C01.117, safe stop is not hidden in the control.Therefore, safe stop is planned for the S axis on the control side.

C01.117 Selection of safety functions

Bit Meaning Value

00 Hide “safe stop” No





Fig. 8-35: Mask of the unused safety inputs, S-axis

In the drive, bits 1, 2, 3 and 4 of parameter P-0-0269 must becorrespondingly set to a value of ‘1’.

Control parameters:

Parameter Description Value Unit

C01.100 Safety function Yes -

C01.101 Maximum speed 1 for safety function 0.0000 1 rpm

C01.102 Upper position limit 1 for safety funct. 0.0000 deg

C01.103 Lower position limit 1 for safety funct. 0.0000 deg

C01.104 Maximum speed 2 for safety function 0.0 1 rpm

C01.105 Upper position limit 2 for safety funct. 0.0000 deg

C01.106 Lower position limit 2 for safety funct. 0.0000 deg

C01.107 Upper pos. limit for pos. switch pt. 1 0.0000 deg

C01.108 Lower pos. limit for pos. switch pt. 1 0.0000 deg







C01.115 Position monitoring window for safeoperation stop

1.0000 deg

C01.116 Reference position for Safereferencing

0.0000 deg

C01.117 Selection of safety functions 30 -

C01.118 Transition time for switching safetyfunctions

0 ms

C01.119 Time interval for forced dynamics 8 h

C01.120 Checksum of the weighting data 25316 -

Fig. 8-36: CNC safety parameters, S-axis

Safety function




Drive parameters:


P-0-0248 Checksum via weighting data, drive 25361 -

P-0-0249 Activation of safety functions 0000000000000001 -

P-0-0253 Maximum speed 2 for safety function 0.0000 rpm

P-0-0254 Upper position limit 1 for the safety function 0.0000 Degrees

P-0-0255 Lower position limit 1 for the safety function 0.0000 Degrees

P-0-0256 Maximum speed for the 2nd safety function 0.0000 rpm



P-0-0259 Upper position limit for position switch point 1 0.0000 Degrees

P-0-0260 Lower position limit for position switch point 1 0.0000 Degrees







P-0-0267 Position monitoring window for Safe operation stop 1.0000 Degrees

P-0-0268 Reference position for Safe referencing 0.0000 Degrees

P-0-0269 Selection of safety functions 0000000000011110 -

P-0-0270 Transition time for switching safety functions 0 ms

P-0-0271 Time interval for forced dynamics, drive 8 h

Fig. 8-37: Drive safety parameters, S-axis



X-Axis (2nd Axis)


In safety parameter C02.117, safe operation stop is not hidden in thecontrol. Therefore, safe operation stop is planned for the X axis on thecontrol side.


Bit Meaning Value


01 Hide “safe operation stop” No




Fig. 8-38: Mask of the unused safety inputs, X-axis


Control parameters:



C02.101 Maximum speed 1 for safety function 0.0000 mm/min

C02.102 Upper position limit 1 for safety funct. 0.0000 mm

C02.103 Lower position limit 1 for safety funct. 0.0000 mm




C02.107 Upper pos. limit for pos. switch pt. 1 0.0000 mm

C02.108 Lower pos. limit for pos. switch pt. 1 0.0000 mm








1.0000 mm


0.0000 mm



0 ms



Fig. 8-39: CNC safety parameters, X-axis

Safety function




Drive parameters:




P-0-0253 Maximum speed 2 for safety function 0.0000 mm/min

P-0-0254 Upper position limit 1 for the safety function 0.0000 mm

P-0-0255 Lower position limit 1 for the safety function 0.0000 mm

P-0-0256 Maximum speed for the 2nd safety function 0.0000 mm/min



P-0-0259 Upper position limit for position switch point 1 0.0000 mm

P-0-0260 Lower position limit for position switch point 1 0.0000 mm







P-0-0267 Position monitoring window for Safe operation stop 1.0000 mm

P-0-0268 Reference position for Safe referencing 0.0000 mm




Fig. 8-40: Drive safety parameters, X-axis



Y Axis (2nd Axis)


The maximum safely reduced speed of the Y-axis is specified at 2000.0mm/min.


Exceeding the position limit results in the drive being shut downimmediately by the shutdown circuits.

Control parameters “Positive travel limit” (Cxx.011) and “Negative travellimit” (Cxx.012) are to be set correspondingly lower. In this example, thesettings C03.011 = 200 and C03.012 = -200 are sufficient.

Safely limited absolute positions can be selected only if safe referencehas been carried out. After referencing, the control and drive expectacknowledgment “Reference cam for safe referencing” on position ‘-105’.

In safety parameter C03.117, safely reduced speed is not hidden in thecontrol. Therefore, safely reduced speed is planned for the Y axis on thecontrol side. Hiding “Switch safe operation stop” selects safety functionsafe stop if the Consent key is not pressed.


Bit Meaning Value






Fig. 8-41: Mask of the unused safety inputs, Y-axis


Safety function

Maximum speed 2 for safetyfunction

Upper/lower position limit 1 forthe safety function

Reference position for safereferencing




Parameter “Transition time for switching safety functions” is calculated asfollows:

( ) ]ms[ttt*1,20270-0-PCxx.118 ZLPLCB ++==

with: 60*018.Cxx

1000)*104.orCxx101.Cxx(tB =

and: 6,16*

1000*5

KvtZL =


P-0-0270= transition time for switchingthe safety functions inDrive in ms

Cxx.101 = maximum speedfor safety function 2 in mm/min


Cxx.018 = maximum acceleration mm/s2



Fig. 8-42: Formula “Transition time for switching the safety functions“

Parameters of the Y-axis for calculating the transition time for switchingsafety functions:

Parameter Designation Value

C03.101 Max. safe speed 2000 [mm/min]

C03.118 Max. axis acceleration 5000 [mm/(s*s)]

tPLC PLC cycle time 20 [ms]

S-0-0104 Kv factor 1 [1000 rpm]

Fig. 8-43: Y-axis parameters for calculating C03.118

The maximum PLC cycle time can be found in the PLC programminginterface under menu item Diagnostics / PLC info.

ca.400ms02700P118.03C

392ms301)[ms]20(6*1,20270-0-PC03.118

]ms[16,6*1

1000*5+20

60*5000

1000*2000*1,20270-0-PC03.118

=−−==++==

+==

L: C03.118= transition time for switchingthe safety functions inthe control in ms


Fig. 8-44: Calculation of “Transition time for switching safety functions”, Y-axis




Control parameters:





C03.103 Lower position limit 1 for safety funct. -201.0 mm













1.0000 mm


-105.0 mm



400 ms



Fig. 8-45: CNC safety parameters, Y-axis



Drive parameters:




P-0-0253 Maximum speed 2 for safety function 2000.0000 mm/min


P-0-0255 Lower position limit 1 for the safety function -201.0000 mm

P-0-0256 Maximum speed for the 2nd safety function 0.0000 mm/min











P-0-0267 Position monitoring window for Safe operation stop 1.0000 mm

P-0-0268 Reference position for Safe referencing 0.0000 mm




Fig. 8-46: Drive safety parameters, Y-axis



A-Axis (4th Axis)



• Safe cams 1

The maximum safely reduced speed 1 of the A-axis is specified at 10800units/min.

The maximum safely reduced speed 2 of the A-axis is specified at 1080units/min.


Cam pair 1 of the A-axis is evaluated for switching between safetyfunctions safely reduced speed 1 and 2.

Note: The position switch points of safe cams must undergo furtherprocessing according to Category 3 of EN 60954-1; only signalstatus ‘1’ may be evaluated for safety-relevant jobs.

Safe cams is output only if safe reference has been carried out. Afterreferencing, the control and drive expect acknowledgment “Referencecam for safe referencing” on position ‘0’.

In safety parameter C04.117, safely reduced speeds 1 and 2 are nothidden in the control. Therefore, safely reduced speeds 1 and 2 areplanned for the A-axis on the control side. Because safe operation stopis not hidden, switching between safe operation stop and safely reducedspeed occurs by pressing the Consent key.


Bit Meaning Value





04 Hide “SOS switch” No

Fig. 8-47: Mask of the unused safety inputs, A-axis

In the drive, bits 0 and 1 of parameter P-0-0269 must be correspondinglyset to a value of ‘1’.

Safety function

Maximum speed 1for safety function

Maximum speed 2for safety function

Safe cams 1

Reference position for safereferencing




Parameter “Transition time for switching safety functions” is calculatedaccording to the following formula:

( ) ]ms[ttt*1,20270-0-PCxx.118 ZLPLCB ++==

with: 60*018.Cxx

1000)*104.orCxx101.Cxx(tB =

and: 6,16*

1000*5

KvtZL =





Cxx.018 = maximum acceleration mm/s2



Fig. 8-48: Formula “Transition time for switching the safety functions“

Parameters of the A-axis for calculating the transition time for switchingsafety functions:

Parameter Designation Value

C04.101 Max. safe speed 1 10800 [units/min]

C04.118 Max. axis acceleration 3600 [units/s*s]

tPLC PLC cycle time 20 [ms]

S-0-010 Kv factor 1 [1000 rpm]

Fig. 8-49: A-axis parameters for calculating C04.118

If safety functions safely reduced speed 1 and 2 are used, the largerspeed limit value must be used to calculate the transition time for safetyparameter “Switching safety functions”.

The PLC cycle time can be found in the PLC programming interfaceunder menu item Diagnostics / PLC info.

ms450.ca02700P118.04C

ms445]ms)[3012050(*2,102700P118.04C

]ms[16,6*1

1000*5+20

60*3600

1000*10800*1,20270-0-PC04.118

=−−==++=−−=

+==

L: C04.118= transition time for switchingthe safety functions inthe control in ms


Fig. 8-50: Calculation of “Transition time for switching safety functions”, A-axis




Control parameters:



C04.101 Maximum speed 1 for safety function 10800 Units/min

C04.102 Upper position limit 1 for safety funct. 0.0000 units

C04.103 Lower position limit 1 for safety funct. 0.0000 units

C04.104 Maximum speed 2 for safety function 1080.0 Units/min

C04.105 Upper position limit 2 for safety funct. 0.0000 units

C04.106 Lower position limit 2 for safety funct. 0.0000 units

C04.107 Upper pos. limit for pos. switch pt. 1 180.00 units

C04.108 Lower pos. limit for pos. switch pt. 1 1.0000 units







C04.115 Position monitoring window for Safeoperation stop

1.0000 units


0.0000 units



450 ms



Fig. 8-51: CNC safety parameters, A-axis



Drive parameters:




P-0-0253 Maximum speed 2 for safety function 10800 rpm



P-0-0256 Maximum speed for the 2nd safety function 1080.0 rpm











P-0-0267 Position monitoring window for Safe operation stop 1.0000 Degrees

P-0-0268 Reference position for Safe referencing 0.0000 Degrees




Fig. 8-52: Drive safety parameters, A-axis

IST Intelligent Safety Technology Commissioning of Intelligent Safety Technology 9-1


9 Commissioning of Intelligent Safety Technology

9.1 Notes Regarding Safety

Before commissioning Intelligent Safety Technology, read and observethe general notes regarding use and safety in chapters 1 and 2 of thisdocumentation. Furthermore, observe the notes regarding the individualcommissioning steps.

9.2 General Notes

Commissioning of Intelligent Safety Technology is divided into severalsections. Before the Intelligent Safety Technology functions are activated,the electrical installation, the commissioning of the mechanical systemand the installation of safety-relevant components must be complete.

Note: The commissioning and acceptance of the safety technologymust be carried out only by appropriately trained personnelthat are authorized by the machine manufacturer.

Note: The machine manufacturer is responsible for the propercommissioning, acceptance and logging of the safetytechnology.

9-2 Commissioning of Intelligent Safety Technology IST Intelligent Safety Technology


9.3 Instructions for First-Time Commissioning

Before the safety functions are activated, the commissioning andoptimization of the axes must be complete. For this, observe the functiondescription of drive controller DIAX04. This has the advantage that themonitoring functions can be tested immediately under real conditions afterthe activation and the input of data.

Observe the following steps during the first-time commissioning of thesafety functions:

Open the menus of the safety parameters in the control

The menu of the safety parameters in the control is opened in themachine parameters. To do this, axis parameter Cxx.100 “Safetyfunction” must be set to ‘yes’.

The entry adds safety parameters Cxx.101 to Cxx.120 to the axisparameters.

Hide the unused safety inputs of the control

Safety parameter Cxx.117 “Selection of safety functions” is used tospecify which safety function is to be used for the affected axis. When theEnter key is pressed, the selection window for hiding the safety functionsis displayed.

The unused safety inputs / safety functions must be hidden. A safetyfunction is not used by setting Hide to ‘Yes’. You can switch between ‘Yes’and ‘No’ by pressing the Space key.

As an example of safety parameter “Selection of safety functions”, thefigure below shows the unused safety inputs in the control. Safe operationstop is not hidden. “Hide safe operation stop” is set to ‘No’. This meansthat only safety input Safe operation stop is evaluated, i.e. safety functionSafe operation stop is used.


Bit Meaning Value


01 Hide “safe operation stop” No




Fig. 9-1: Mask off the unused safety inputs in the control

Setting safety parameters in the control

The data of safety parameters Cxx.101 to Cxx.116, Cxx.118 and Cxx.119must be entered.

The associated safety parameters are to be set to a value of ‘0’ forunused safety functions.

1. step:

2. step:

3. step:



Repeat steps 1 to 3 for all axes

Repeat steps 1 to 3 for all the axes for which safety functions are to beused.

Load machine parameters into the control

The modified set of machine parameters must be loaded into the control.

Activate the safety functions in the drive

Use safety parameter P-0-0249 “Activation of safety functions” to activatethe safety functions in the drive. For activation, the 1st

bit (bit 0) is set to‘1’. First, you must switch to “Parameter-setting mode”.

Example: P-0-0249 = 0000000000000001

Hide unused safety inputs in the drive

The safety inputs of the drive are hidden using safety parameter P-0-0269“Selection of safety functions”.

The safety inputs are displayed/hidden using a bit bar. A safety input ishidden by setting it to ‘1’.

The figure below shows an example of the unused safety inputs in thedrive. Safe operation stop is not hidden. “Hide safe operation stop” is setto ‘0’. This means that only safety input Safe operation stop is evaluated,i.e. safety function Safe operation stop is used.

'567,,,,

3 8-%83 8 & 83 8 & ,8

3 8&&83 8&8

Antrieb_SBH.FH7

Fig. 9-2: Mask off the unused safety inputs in the drive

Set the safety parameters in the drive

The data of safety parameters P-0-0253 to P-0-0268, P-0-0270 and P-0-0271 must be entered. The same values as in the control must beentered.

The associated safety parameters are to be set to a value of ‘0’ forunused safety functions.

The safety parameters previously entered in the control are displayed indrive parameters P-0-0277 to P-0-0295 for checking. Using theparameters, the data entered in the control and in the drive can becompared. Drive parameters P-0-0277 to P-0-0295 cannot be modified.

4. step:

5. step:

6. step:

7. step:

8. step:



Note the checksum of weighting data in the drive

The value of drive parameter P-0-0248 “Checksum of weighting data,drive” must be noted. To calculate the parameter, you must switch out ofthe “Parameter-setting mode” to the “Operating mode”.

Repeat steps 6 to 9 for all axes

Repeat steps 6 to 9 for all the axes for which safety functions are to beused.

Enter the checksum of weighting data in the control

The previously noted value of drive parameter P-0-0248 “Checksum ofweighting data, drive” must be entered in safety parameter Cxx.120“Checksum of weighting data, drive” in the axis parameter menu of thecontrol.

The entry is to be made for all the axes for which safety functions are tobe used.

Load machine parameters into the control

The modified set of machine parameters must be loaded into the control.

Execute forced dynamics

Before forced dynamics can be executed, the safety functions must bedeselected. The safety functions are deselected if the deactivation signalsof the safety functions are present in both channels (signal status ‘1’).

Select and adapt the safety functions

Before the safety functions can be selected, forced dynamics must besuccessfully executed. If position limits or position switch points are used,the corresponding axes must be safely referenced beforehand.

The monitoring limits and times of the safety functions must be adapted:

• Position limits

• Position switch points

• Position monitoring window for Safe operation stop

• Reference position for Safe referencing

• Transition time for switching safety functions

Note: Each modification of a safety parameter must be made in theaxis parameter menu in the control and in the drive parametermenu of the drive; the modified set of machine parametersmust be loaded into the control!

9. step:

10. step:

11. step:

12. step:

13. step:

14. step:



Execute an acceptance test

The individual safety functions of each axis and spindle are to be checkedfor correct functioning; the results must be logged.

See Section 6.4, Acceptance and Logging of Safety Functions.

Note: The acceptance test of the safety functions requires that drivecommissioning, drive optimization and the adaptation of thesafety functions be complete.

Save the machine parameters, drive parameters and the PLC userprogram

The machine parameters, drive parameters and the PLC user programare to be saved on the hard disk or a diskette. The data sets can be usedfor serial commissioning.

Note: Remove old or double data sets to avoid future confusion.

9.4 Serial commissioning

In serial commissioning, the machine parameters and drive parametersthat were saved in the first-time commissioning can be loaded. Thesettings of the safety functions are used in the control and in the drive.

Observe the following steps during serial commissioning:

Load the machine parameters

The machine parameter set saved in the first-time commissioning is to beloaded into the control.

Load the drive parameters

The drive parameters saved in the first-time commissioning are to beloaded.

Load the PLC user program

The PLC user program saved in the first-time commissioning is to beloaded.

Execute forced dynamics

Before forced dynamics can be executed, the safety functions must bedeselected. The safety functions are deselected if the deactivation signalsof the safety functions are present in both channels (signal status ‘1’).

15. step:

16. step:

1. step:

2. step:

3. step:

4. step:



Test the safety functions by sampling

Commissioning of a new machine requires that the safety functions betested by sampling in an acceptance inspection.

9.5 Acceptance and Logging the Safety Functions

After Intelligent Safety Technology has been commissioned or aftersafety-related parameters have been modified, the proper functioning ofthe safety technology must be accepted and logged in an acceptancetest. Note the difference between the acceptance of all safety functionsand partial acceptance.

Complete Acceptance TestA complete acceptance test, i.e. the inspection of all used safety functionsfor proper functioning, is always required during a first-timecommissioning of a machine with IST. A complete acceptance test of thesafety functions must also be made when the control system is updated toa new firmware or software version, or if the control hardware is modified.The complete acceptance test must be logged.

Partial Acceptance TestA partial acceptance test must be made after modifying only a few saveddata of the safety-relevant parameters. Here, only those safety functionsthat can influence the modification are checked. The partial acceptancetest must also be logged.

Acceptance reportThe acceptance report of a machine with Intelligent Safety Technologyconsists of a machine report and one or more axis reports.

The machine report is used to describe the machine/system, the controlsoftware and hardware, the safety-related equipment, the axes, the databackup and the type of acceptance.

The acceptance report of the machine belongs to the machine report. Allsafety-relevant equipment, signals, parameters, etc. are verified anddocumented here.

The axis equipment, the safety functions used and the settings of thesafety parameters of the first and second channels of an axis aredocumented in the axis report. A separate axis report must be provided inthe machine report for every axis with IST.

An acceptance report of the safety function must be made for every safetyfunction that has been implemented on an axis. The safety function usedis tested in acceptance report “Safety function of axis” and the results aredocumented. Acceptance report “Safety function of axis” is a componentof the axis report and is to be included with it.

Note: A separate axis report must be provided for every axisdesigned with IST.

Copies of the acceptance report templates are included in Section 12.3"Acceptance Report".

5. step:

Machine report /acceptance report for machine

Axis report / acceptance reportof safety functions of the axis



Sample Machine and Axis ReportThe following machine and axis report has been filled in according to thesample application from chapter 8.3 "Sample Application".

System: Reference machine Serial No.: 001

Machine type: Milling/lathing machine Manufacturer: Bosch Rexroth

Number of axes: 4 Number ofspindles:

1

CNC control: MTC-P01.2-M1-A2-A2-A2-FW PLC control: MTS-P01.2-D2-B1-NN-NN-NN-FW

CNC firmware: FWC-CPU06*-004-19V00-NN PLC firmware: FWC-PLC06*-004-19V00-NN

PLC cycle time: 20 ms

Description Sample system for commissioning Intelligent Safety Technology,

of the safety- with open spindle protective doors in Safe stop and axes in

related Safe operation stop. With operator consent, operation of the axes

equipment is possible with Safely reduced speed. For the A-axis,

switching of Safely reduced speed depending on the axis

position.

Fig. 9-3: General part of machine report



Description of axesAxis No. Axis name Axis function IST Change

1 S Main spindle drive Yes

2 X Linear axis Yes

3 Y Linear axis Yes

4 A Rotary axis Yes

For each IST axis, an individual axis report must be enclosed.

Fig. 9-4: „Description of axes“ machine report

Data backupData Medium Designation Archive Date

CNC parameters 31/2" disk IST parameters Department safe 01.04.1999

DIAX04 parameters 31/2" disk IST-DIAX Department safe 01.04.1999

PLC program 31/2" disk IST-PLC Department safe 01.04.1999

Abb. 9-5: Machine protocol "Data backup"



Acceptance report completedComplete acceptance rep.

Serial commissioning

Partial acceptance report

Changes made

Name: Company/department:

Date: Signature:

Abb. 9-6: Machine protocol "Acceptance report completed"

For the completeness and correctness of the acceptance report:Name: Company/department:

Date: Signature:

Abb. 9-7: Machine protocol "Acceptance report confirmed"

System: Reference machine Serial No.: 001Axis No.: 1 Axis name: S Axis function: Main spindle drive

Fig. 9-8: General part of axis report for S-axis



Description of the axis equipmentMotor type: 2AD104

Motor measurement system: DSF

External measurement system: ---

Transmission ratio: ---

Feed constant: ---

Holding brake: ---

Weight compensation: ---

Power supply unit: HVE2

Drive control unit: HDS02

Firmware version DIAX: FWC-HSM1.1-SHS-03VRS-MS

Firmware version ISM: FWC-ISM03*-IST-19V02-NN

Firmware version APR: FWC-APR06*-003-19V00-NN

Fig. 9-9: Description of the axis equipment, S-axis

Overview of the safety functions implemented in this axisSafe stop Safe

operation stopSafely reduced

speedSafely limited

absolute positionConsent

keyReference

camConsent safe

reference

1 2 1 2

X

The acceptance report must include all implemented safety functions!

Fig. 9-10: „Overview of safety functions“ axis report of the S-axis



Axis parameters for safety functions in the CNC control (channel 1)No. Description of the parameter Parameter value Unit

Cxx.100 Safety function (yes/no) Yes -

Cxx.101 Maximum speed 1 for safety function 0 1 rpm

Cxx.102 Upper position limit 1 for the safety function 0 deg

Cxx.103 Lower position limit 1 for the safety function 0 deg

Cxx.104 Maximum speed 2 for safety function 0 1 rpm

Cxx.105 Upper position limit 2 for the safety function 0 deg

Cxx.106 Lower position limit 2 for the safety function 0 deg

Cxx.107 Upper position limit for position switching point 1 0 deg

Cxx.108 Lower position limit for position switching point 1 0 deg







Cxx.115 Position monitoring window for Safe operation stop 1 deg

Cxx.116 Reference position for Safe referencing 0 deg

Cxx.117 Mask of the unused safety inputs 30 -

Cxx.118 Time for transition of the safety functions 0 ms

Cxx.119 Time interval for forced dynamics 8 h

Cxx.120 Checksum of the weighting data 25316 -

Fig. 9-11: "Safety parameters of channel 1" axis report



Drive parameters for safety functions in digital drive (channel 2)No. Description of the parameter Parameter value Unit

P-0-0248 Checksum via weighting data 25316 -


P-0-0253 Maximum speed 1 for safety function 0 rpm

P-0-0254 Upper position limit 1 for the safety function 0 Degrees

P-0-0255 Lower position limit 1 for the safety function 0 Degrees

P-0-0256 Maximum speed 2 for safety function 0 Degrees

P-0-0257 Upper position limit 2 for the safety function 0 Degrees

P-0-0258 Lower position limit 2 for the safety function 0 Degrees

P-0-0259 Upper position limit for position switching point 1 0 Degrees

P-0-0260 Lower position limit for position switching point 1 0 Degrees







P-0-0267 Position monitoring window for Safe operation stop 1 Degrees

P-0-0268 Reference position for Safe referencing 0 Degrees

P-0-0269 Mask of the unused safety inputs 00011110 -

P-0-0270 Time for transition of the safety functions 0 ms

P-0-0271 Time interval for forced dynamics 8 h

Fig. 9-12: "Safety parameters of channel 2" axis report

Data checked for conformanceName: Company/depart

ment:

Date: Signature:

Fig. 9-13: „Data checked“ axis report

9.6 Commissioning of IST for Series Machines

For series machine, the acceptance test need not be repeated if acomplete acceptance test has been made for a machine and if the safetyparameters cannot be modified (see VDE801/A1 AK4 and DKE-AK226.03).

IST Intelligent Safety Technology Subsequent System Modifications 10-1


10 Subsequent System Modifications

10.1 Making Modifications

Modifications to a system equipped with IST may be carried out only bypersonnel authorized by the machine manufacturer if they affect safetyfunctions. Such modifications especially include changing the safetyparameters in the control and drive and changes to the safety-relevantwiring.

Changing the safety parameters of the control requires a password. Onlya user with the corresponding password diskette can modify theseparameters.

Modifications must be made with corresponding care. The modificationsmust be documented and logged and must be able to be traced at anytime. After the machine is commissioned with the modified data, only themodified set of parameters may be present on the hard disk. In the caseof modifications to the PLC program, only the modified program may besaved on the hard disk!

10.2 Logging and Acceptance

The modified safety parameters are verified using an acceptance report.The scope of this acceptance report depends on the modifications thatwere made to the safety parameters / hardware.

After a safety parameter is modified, the safety functions that areinfluenced by this parameter must be verified in a partial acceptancereport.

10-2 Subsequent System Modifications IST Intelligent Safety Technology


Parameters Cxx.101 and P-0-0253 were modified for safely reducedspeed 1.

To verify the modification, a partial acceptance report must be made andlogged for safety function safely reduced speed 1:

Test of safety function safely reduced speed

System: Serial No.:

Axis No.: Axis name: Axis function:

RunningNo.

Function orcharacteristic

Testperformed

Expectation Result Comment

Activate power,deactive safetyfunction

Preselectautomatic andactivate power

“AF” isindicated, noSAFAC

Activate safetyfunction

PreselectSetup andactivate safetyfunction

“AF” isindicated

SAFAC active

Start motionwithout consent

Give jogcommand foraxis

No motion

Start motion withconsent (V=0.95 *Vmax )

Give consentand give jogcommand foraxis

Motion isperformed

Motion withconsent and V =1.05 * Vmax

Start specialNC programforacceptanceinspection

Switch-off, faultdiagnosis

Measuring ofreaction timeand reactionpath

Disconnect axis“RF” and activatesafety function

Disconnectpower, oractivate “RF”through thePLC userprogram

“Ab” isindicated

Displace axis fromits position by adistance greaterthan parameter

Move axis ormotor from itsposition



Move axis withactive safetyfunction andmaximum axisvelocity

Activatepower,activate safetyfunction, giveconsent, startNCacceptancetest program



Fig. 10-1: Test of safety function „Safely reduced speed“

Accordingly, only the part of the acceptance report for safely reducedspeed is to be filled in.

Example

IST Intelligent Safety Technology Subsequent System Modifications 10-3


10.3 Procedure for Software and Firmware Updates

If an IST-equipped system is supplied with a new firmware version, acomplete acceptance report of the safety function must be made for theentire safety technology, with corresponding logging. For series machine,a complete acceptance report must be made for only one machine (seesection 9.5 "Acceptance and Logging the Safety Functions").

It must be able to be traced which firmware and software versions areused for which serial number of the machine.

10-4 Subsequent System Modifications IST Intelligent Safety Technology


IST Intelligent Safety Technology Error Messages and Error Elimination 11-1


11 Error Messages and Error EliminationThis chapter describes the error messages that can occur when usingIntelligent Safety Technology. In addition, ways of eliminating the errorsare described.

11.1 CNC Error Messages (Channel 1)

The “@” character is used here as a wildcard. For example, the controlshows the axis designation at this location.

Two-way data comparison, parameter of @-axis

The parameters for Intelligent Safety Technology differ for the NC (axisparameters) and the drive (drive parameters). These differences aredetected using two-way data comparison.

Affected SERCOS parameter: @1

Recovery: Check and correct the displayed SERCOS parameter and theassociated axis parameter.

Two-way data comparison, actual position of @-axis

Two-way data comparison of Intelligent Safety Technology has detected atransfer error during the check or the actual position.

The check is always carried out when the axis is at a standstill. Thecyclically transferred actual position is compared with the actual positionobtained using the Multiplex channel. The amount of the difference of thetwo positions must not be greater than the value of parameter "Positionmonitoring window for safe operation stop".

Recovery:

1. If parameter "Position monitoring window for safe operation stop" is toolow, increase the parameter value.

2. If the axes move when the safety functions are activated, stop the axesbefore the safety functions are activated.

3. If the IST safety functions are faulty, notify the Bosch Rexroth customerservice department.

Two-way data comparison, inputs of @-axis

Two-way data comparison of Intelligent Safety Technology has detecteddifferences in switching during the check of the IST safety input signals ofthe NC and the drive. The input switching of the deactivation inputs and ofthe Consent key input of the NC and the drive must be identical.

Recovery: Check the IST safety input signals of the NC and the drive.

Two-way data comparison, @-axis in general

Two-way data comparison of Intelligent Safety Technology has detectedan internal error in the NC or the drive.

Recovery: Contact the Bosch Rexroth customer service department.

0490

0491

0492

0493

11-2 Error Messages and Error Elimination IST Intelligent Safety Technology


No safe reference, @-axis

Activation of an IST safety function with safely limited absolute positionwithout safe reference.

An IST safety function with safely limited absolute position must beactivated only after safe referencing. If no safe reference has beenprovided at the time of activation, this error message is issued.

Recovery: Execute "Safe referencing".

Forced dynamics required, @-axis

Activation of an IST safety function without successful forced dynamics.

Activation of an IST safety function is possible only if forced dynamicswas carried out beforehand. Forced dynamics must also be carried outafter the "Time interval for forced dynamics" elapses.

Recovery: Execute forced dynamics.

Internal safety function, @-axis

Monitoring of Intelligent Safety Technology has detected an internal errorin the NC.

Recovery: Contact the Bosch Rexroth customer service department.

Monitor safe stop, @-axis

Activation of safety monitor safe stop.

While safety function safe stop is activated, safety output signal "Activatestarting lockout" is set. Then the PLC must activate the starting lockout ofthe drive. In addition, the NC switches off the controller enablement. Thisis checked by the safety monitor.

Recovery:

1. If the starting lockout is not activated, check the PLC program.

2. If there is an internal error, contact the Bosch Rexroth customer servicedepartment.

Monitor safe operation stop, @-axis

Activation of safety monitor safe operation stop.

The axis was driven or moved without RF, although safe operation stop orsafely reduced speed with safely limited absolute position withoutactivation of the Consent key has been preselected. A transition to safeoperation stop also occurs after the Consent key is released after the"transition time" elapses.

Recovery:

1. If safety output signal "Enable movement" is not linked to the motionhold, check the PLC program.

2. If parameter “Transition time for switching safety functions” is too low,increase the parameter.

3. If parameter "Position monitoring window for safe operation stop" istoo low, increase the parameter value.

0494

0495

0496

0497

0498



Monitor safely reduced speed, @-axis

Activation of monitor safely reduced speed.

After safely reduced speed with safely limited absolute position isactivated, the value of safety parameter safely reduced speed isexceeded.

Recovery: Reduce the interpolation speed of the NC when the safetyfunction has been activated. If the error message occurs when theConsent key is released, the "Transition time for switching safetyfunctions" is too low or safety output signal "Enable movement" is notlinked to the motion hold.

Monitor safely limited absolute positions, @-axis

Activation of monitor safely limited absolute position.

With safety function safely reduced speed with safely limited absoluteposition activated, the position range bounded by the two position limits"Upper position limit for safety function" and "Lower position limit forsafety function" was exited.

Recovery: Limit the working range of the axis to the permitted positionrange when the safety function is activated.

Consent key, @-axis

Consent key (for Intelligent Safety Technology) faulty.

The Consent key is checked when starting the SERCOS ring and duringforced dynamics. The consent key must not be pressed during the check.

Recovery:

1. If the Consent key is always switched on, check the Consent key andthe cables.

2. If the Consent key is pressed by the machine operator during thecheck, press the Consent key only to move the axis.

Forced dynamics execution, @-axis

Error during forced dynamics execution.

To execute forced dynamics, the PLC must select steps 1 to 7 (APR-AXDparameter "Select forced dynamics") for each axis in the correctsequence. In addition, it must wait for the acknowledgement (APR-AXDparameter "Acknowledgement of forced dynamics") after every step. Thecontroller must be enabled in steps 1, 2 and 5.

Recovery:

1. If the sequence of steps is not observed, check the PLC program.

2. If the PLC does not wait for the acknowledgement, check the PLCprogram.

3. If there is no controller enablement in steps 1, 2 or 5, check the PLCprogram.

4. If the shutdown circuits are not activated, check the PLC program andthe cables.

0499

0500

0501

0502



Cam for safe referencing, @-axis

Activation of the cam monitor for safe referencing.

After "safe referencing", the cam for "safe referencing" must not bepressed if the axis is not in the vicinity (linear axis: 0.1m; rotary axis: 10°)of the "Reference position for safe referencing". If a Consent key is usedin place of the cam for "safe referencing", the Consent key must bepressed by the machine operator only for safe referencing.

Recovery:

1. Check whether the reference cam or the cables are faulty.

2. If the reference cam is too long, modify it.

3. If the "Consent key for safe referencing" is pressed by the machineoperator, press it only for referencing.

Shutdown of safety functions, @-axis

Monitor of shutdown of safety functions.

As soon as all the safety functions on the safety inputs of the NC are shutdown, all the safety functions on the safety inputs of the drive must alsobe shut down within 300ms.

Recovery: Check the IST safety input signals of the NC and the drive.

No IST support, @-axis

IST is supported only by real digital drives with IST functions!

If you have further questions, contact the Bosch Rexroth customerservice department.

0503

0504

0505



11.2 Error Messages for Drives (Channel 2)

Safe stop monitor

Safety function safe stop is selected and the starting lockout is not activeor controller enablement is provided by the control.

Cause:

1. Error in activation of the starting lockout (plug X3).

2. Control malfunction.

Recovery:

1. Check the wiring of the starting lockout.

2. Consult the control manufacturer.

Safe operation stop monitor

The monitor of safe operation stop has been activated. The monitor isactive in the following cases:

• When a safety function is activated, the monitor of safe operation stopis active for 300 msec.

• Safety function safe operation stop is active.

• Safety function safely reduced speed 1/2 with safely limited absoluteposition 1/2 is selected and the Consent key is not pressed.

Cause:

1. If operating mode “Position control” is active, the control has modifiedthe setpoint position.

2. If operating mode “Speed control” is active, the control has preset asetpoint speed value not equal to 0.

3. After the monitor of safe operation stop has been switched on, the axishas moved further than the position monitoring window for safeoperation stop (P-0-0267).

Recovery:

Regarding 1: Consult the control manufacturer.

Regarding 2: Consult the control manufacturer.

Regarding 3: Prevent the axis from moving or increase parameter"Position monitoring window for safe operation stop" (P-0-0267).

F501

F502



Monitor of safely reduced speed 1 and absolute position 1

The monitor of safety function safely reduced speed 1 and absoluteposition 1 has been activated.

Either maximum speed 1 (P-0-0253) has been exceeded or the positionrange specified by parameters Upper position limit 1 for safety function(P-0-0254) and Lower position limit 1 for safety function (P-0-0255) hasbeen exited.

If parameters P-0-0254 and P-0-0255 are not zero, the absence of safereference also leads to this error.

Cause:

1. The amount of the actual speed value has become greater thanmaximum speed 1.

2. If operating mode “Position control” is active, the amount of thesetpoint position difference has become greater than maximum speed1.

3. If operating mode “Speed control” is active, the amount of the setpointspeed value has become greater than maximum speed 1.

4. The command for checking the reference (P-0-0272) was notexecuted successfully.

5. The actual position value has exited absolute range 1.

6. If operating mode “Position control” is active, the setpoint positionvalue has exited absolute range 1.

Recovery:

Regarding 1., 2., 3.: Reduce the jogging speed or increase maximumspeed 1.

Regarding 4.: Reference the axis and then issue command "Checkreference".

Regarding 5., 6.:Move the axis in the permitted range. Check the positionlimits (P-0-0254 and P-0-0255).

F503



Monitor of safely reduced speed 2 and absolute position 2

The monitor of safety function safely reduced speed 2 and absoluteposition 2 has been activated.

Either maximum speed 2 (P-0-0256) has been exceeded or the positionrange specified by parameters Upper position limit 2 for safety function(P-0-0257) and Lower position limit 2 for safety function (P-0-0258) hasbeen exited.

If parameters P-0-0257 and P-0-0258 are not zero, the absence of safereference also leads to this error.

Cause:

1. The amount of the actual speed value has become greater thanmaximum speed 2.

2. If operating mode “Position control” is active, the amount of thesetpoint position difference has become greater than maximum speed2.

3. If operating mode “Speed control” is active, the amount of the setpointspeed value has become greater than maximum speed 2.

4. The command for checking the reference (P-0-0272) was notexecuted successfully.

5. The actual position value has exited absolute range 2.

6. If operating mode “Position control” is active, the setpoint positionvalue has exited absolute range 2.

Recovery:

Regarding 1., 2., 3.: Reduce the jogging speed or increase maximumspeed 2.

Regarding 4.: Reference the axis and then issue command "Checkreference".

Regarding 5., 6.:Move the axis in the permitted range. Check the positionlimits (P-0-0257 and P-0-0258).

Incorrect activation of a safety function

300 msec after a safety function is activated, a check is made whetherthe acknowledgement bits for the input signals in the status words of thedrive and the control (parameters P-0-0252 and P-0-0276) are identical.In addition, the difference of the monitored actual position values(parameter P-0-0273 and P-0-0296) must be lower than the positionmonitoring window for safe operation stop (parameter P-0-0267).

Cause:

1. The safety function was activated in only one channel (drive).

2. The monitored actual position value of the control is incorrect.

Recovery:

Regarding 2.: Check the cabling of the safety I/O module.

Regarding 2.: Consult the control manufacturer.

F504

F505



Forced dynamics required

The time interval since the last time that forced dynamics was carried outis greater than that specified in parameter Time interval for forceddynamics (P-0-0271).

After the system is switched on, forced dynamics must always be carriedout before activating a safety function.

The error is set only when the power is switched on.

Cause:

1. A safety function was activated without carrying out forced dynamics.

2. The time interval for forced dynamics elapsed while the safety functionis active.

Recovery:

Regarding 1.: Execute forced dynamics.

Regarding 2.: Execute forced dynamics. Increase parameter Time intervalfor forced dynamics (P-0-0271) .

Incorrect safety input signals, checksum

The 8-bit CRC checksum that was transferred to the drive with the safetyinput signals (P-0-0250) is incorrect.

Cause:

1. Incorrect assignment of I/O module and drive.

2. Error in safety I/O module

Recovery:

Regarding 1.: Check the address settings.

Regarding 2.: Replace the safety I/O module.

Incorrect safety input signals, counter

The 8-bit counters that are incremented every 100 msec in the drive andin the safety I/O module differ by more than 3 increments.

Cause:

Error in safety I/O module

Recovery:

Replace the safety I/O module.

F506

F507

F508



Incorrect two-way data comparison

A lack of agreement has been detected during the comparison of driveparameters with those of the control.

The error is set only when the power is switched on.

Cause:

1. Static safety parameters are different.

2. The acknowledgement bits for the input signals in the status words ofthe drive (P-0-0252) and the control (P-0-0276) differ by more than300 msec.

3. 300 msec after the standstill was detected, the difference of themonitored actual position values of the drive and the control(parameters P-0-0273 and P-0-0296) are greater than the positionmonitoring window for safe operation stop (parameter P-0-0267).

Recovery:

Regarding 1.: The values of parameters P-0-0248, P-0-0253 to P-0-0271of the drive must correspond to those of the control (P-0-0297, P-0-0277to P-0-0295).

Regarding 2.: Check the cabling of the safety I/O module.

Regarding 3.: Check the standstill detector. A standstill is specified whenthe actual speed is lower than the value in parameter Standstill window(S-0-0124). Increase the position monitoring window for safe operationstop (P-0-0267).

Safe reference lost

The signal for the safe reference cam is set in the input signals of thedrive (bit 21, P-0-0250) although the actual position value of the axis isremoved by more than 10° or 0.1 m from the reference position for safereferencing (P-0-0268).

Requirements for the position comparison is that safe reference existsand that the axis is at a standstill (|actual speed| < standstill window (S-0-0124)).

Cause:

Incorrect activation of the input signal for the safe reference cam.

Recovery:

Check the input signal. If necessary, shorten the cam.

F509

F510



Monitor safely reduced speed while switching

When a safety function is activated while another is already active, it mayhappen that a lower speed is permitted by the new safety function than bythe old one. In this case, the active speed limit value is reduced over aramp during the set transition time for the switch (P-0-0270).

The error is set when the active speed limit value is exceeded.

Cause:

1. The amount of the actual speed value has become greater than theactive speed limit value.

2. If operating mode “Position control” is active, the amount of thesetpoint position difference has become greater than the active speedlimit value.

3. If operating mode “Speed control” is active, the amount of the setpointspeed value has become greater than the active speed limit value.

Recovery:

Regarding 1., 2., 3.: Increase parameter Transition time for switchingsafety functions (P0-0270).

F511



11.3 FB DYNAM Forced Dynamics Error Messages

The following table describes the error message numbers that are issuedby function module DYNAM. The error messages are not automaticallydisplayed in the control. In the PLC user program, the error messagescan be output using the user message or the ProVi messages.

ERR_NR Description Error location

0 No error has been detected.

1 Process power or controller enablement absent(timeout message)

Before forced dynamics can be started, the powermust be switched on and the axis must reportcontroller enablement

2 Drive or APR reports an error Step “0” of forced dynamics was cancelled

3 The preset for forced dynamics could not bewritten (timeout message)

Step “0” of forced dynamics was cancelled

4 Feedback of forced dynamics absent (timeoutmessage)


5 Power has been switched off Input signal “PXXSPOWER” has dropped off instep “0”

6 Drive or APR reports an error (Consent key isactivated or power is not switched on)













14 Drive or APR reports an error (shutdowncircuits have not been triggered)















22 Drive or APR reports an error (power notswitched on)







26 Drive or APR reports an error (shutdowncircuits have not been triggered)



















Fig. 11-1: Description of function module DYNAM errors

IST Intelligent Safety Technology Appendix 12-1


12 Appendix

12.1 Selection Lists for IST Components

The selection lists provide an overview of certified IST components.

Control Modules in PC Format (MTC200-P)

CNC module MTC-PThe MTC-P01.2 is a powerful CNC controller in an ISA bus plug-in cardformat for installation in an industrial PC. It belongs to the MTC200product family.

The MTC-P01.2 consists of a basic unit with the CNC processor systemand an integrated axis processor. A maximum of 8 drives can beconnected using the SERCOS fiber optics interface.

By attaching additional (max. 3) axis processor modules, 32 drives thatcan be distributed over 7 processes can be controlled in the largestexpansion level. In this case also, the drives communicate using theSERCOS fiber optics interface, so that a total of 4 fiber optics rings areused.

Together with the MTS-P PLC control unit, this unit forms a compact andflexible solution for a classic tool machine control.

A maximum of 3 CNC controller systems (with 8 axes each) can beintegrated into operating and visualization terminal BTV20 or BTV30,which is provided for the MTC200 controller system.

The MTC-P01.2 is available in two models:

• as MTC-P01.2-M, with an export limitation, for connecting 8 to 32drives

or

• as MTC-P01.2-E, without an export limitation, for connecting 8 to 32drives; however, only 4 axes can be interpolated with each other.

MTC-P.bmp

Fig. 12-1: CNC module MTC-P

12-2 Appendix IST Intelligent Safety Technology


Models:

Type designation Exportlimitation

RAM memory Max. number of axes

MTC-P01.2-E1-NN-NN-NN-FW No 1 MB 8

MTC-P01.2-E1-A2-NN-NN-FW No 1 MB 16

MTC-P01.2-E1-A2-A2-NN-FW No 1 MB 24

MTC-P01.2-E1-A2-A2-A2-FW No 1 MB 32

MTC-P01.2-E2-NN-NN-NN-FW No 2 MB 8

MTC-P01.2-E2-A2-NN-NN-FW No 2 MB 16

MTC-P01.2-E2-A2-A2-NN-FW No 2 MB 24

MTC-P01.2-E2-A2-A2-A2-FW No 2 MB 32

MTC-P01.2-M1-NN-NN-NN-FW Yes 1 MB 8

MTC-P01.2-M1-A2-NN-NN-FW Yes 1 MB 16

MTC-P01.2-M1-A2-A2-NN-FW Yes 1 MB 24

MTC-P01.2-M1-A2-A2-A2-FW Yes 1 MB 32

MTC-P01.2-M2-NN-NN-NN-FW Yes 2 MB 8

MTC-P01.2-M2-A2-NN-NN-FW Yes 2 MB 16

MTC-P01.2-M2-A2-A2-NN-FW Yes 2 MB 24

MTC-P01.2-M2-A2-A2-A2-FW Yes 2 MB 32

Fig. 12-2: CNC modules in ISA bus format

Note: CNC module PPC-P can not be used with Intelligent SafetyTechnology!



PLC modules MTS-PThe MTS-P01.2 and MTS-P02.2 PLC modules are efficient PLC controlsin ISA-bus plug-in card format, intended for being fitted in a BTV20730 orin a commercially available industrial PC. MTS-P02.2 is equipped withpowerful hardware which, contrary to the MTS-P01.2, shows aperformance increase by a factor of 2 to 2.5 (depending on the programstructure).

MTS-P consists of a basic unit, the PLC itself, and various PC104 plug-inmodules. These plug-in modules are, for example, field bus connections,serial interfaces and I/O modules.

Communication with decentralized I/O units or operating units isestablished by means of field-bus connections (which can be plugged onas an option) and/or serial interfaces. These optional connections andinterfaces are designed as PC104 modules. The following are currentlyavailable:

• INTERBUS-master connection

• Serial interfaces (2x RS232 and 2x RS422)

• Profibus-master connectionUp to 4 PC104 modules can be operatedon an MTS-P.

MTS-P.bmp

Fig. 12-3: PLC modules MTS-P

Models:

Type designation With Interbusconnection

With 4 serialinterfaces

With Profibusconnection

MTS-P01.2-D2-B1-NN-NN-NN-FW Yes No No

MTS-P01.2-D2-B1-S4-NN-NN-FW Yes Yes No

MTS-P01.2-D2-B1-P1-NN-NN-FW Yes No Yes

MTS-P01.2-D2-B1-P1-S4-NN-FW Yes Yes Yes

MTS-P02.2-D2-B1-NN-NN-NN-FW Yes No No

MTS-P02.2-D2-B1-S4-NN-NN-FW Yes Yes No

MTS-P02.2-D2-B1-P1-NN-NN-FW Yes No Yes

MTS-P02.2-D2-B1-P1-S4-NN-FW Yes Yes Yes

Fig. 12-4: PLC modules in ISA bus format



Control Modules in RECO Format (MTC200-R)MTC200-R is a powerful CNC control unit that is designed in protectionclass IP 20 and, together with sub-rack RMB02.2, is constructed forinstallation in a switch cabinet. It consists of PLC module MTS-R0*.1 andCNC module MTC-R0*.1. The modules communicate with each otherusing a separate internal local bus that is implemented using an adapterboard.

Together, these units form a compact solution for a classic tool machinecontrol.

A maximum of 32 drives that can be distributed over 7 processes can becontrolled in the largest expansion level. The control has a modulardesign and can be expanded. As a result, it can be optimally adapted tothe current job.

CNC MTC-R modulesThe MTC-R01 consists of a basic unit with the CNC processor systemand an integrated axis processor. Up to 8 drives can be connected to it.An additional module (on slot U1) containing a further axis processor,allows the control of 8 more drives.

The MTC-R02 consists of a basic unit with the CNC processor systemand an integrated axis processor. Up to 8 drives can be connected to it. 3additional modules (on slots U1, U2 and U3), each containing a furtheraxis processor, allow the connection of 8 more drives per module, so that32 drives can be controlled in the largest expansion level.

The MTC-R is available in two models:

• as MTC-R0x.1-M, with an export limitation, for connecting 8 to 32drives

or

• as MTC-R0x.1-E, without an export limitation, for connecting 8 to 32drives; however, only 4 axes can be interpolated with each other.

MTC-R01

MTC-R02



Mtc-r.FH7

Fig. 12-5: CNC modules MTC-R01.1 and MTC-R02.1

Models:

Type designation Design Exportlimitation

Max.number of

axes

MTC-R01.1-M1-NN-FW narrow Yes 8

MTC-R01.1-M1-A2-FW narrow Yes 16

MTC-R01.1-E1-NN-FW narrow No 8

MTC-R01.1-E1-A2-FW narrow No 16

MTC-R02.1-M1-NN-NN-NN-FW wide Yes 8

MTC-R02.1-M1-A2-NN-NN-FW wide Yes 16

MTC-R02.1-M1-A2-A2-NN-FW wide Yes 24

MTC-R02.1-M1-A2-A2-A2-FW wide Yes 32

MTC-R02.1-E1-NN-NN-NN-FW wide No 8

MTC-R02.1-E1-A2-NN-NN-FW wide No 16

MTC-R02.1-E1-A2-A2-NN-FW wide No 24

MTC-R02.1-E1-A2-A2-A2-FW wide No 32

Fig. 12-6: CNC modules in RECO format

Note: CNC module PPC-R can not be used with Intelligent SafetyTechnology!



PLC MTS-R modulesMTS-R01 is a powerful small PLC with an additional module slot U1,which can be filled as an option.

MTS-R02 is a powerful small PLC with three additional module slots: U1,U2, U3. The module slots can be filled with the open INTERBUS field businterface or with a serial interface module (2x RS232 and 2x RS422) asan option.

The following modules are currently available as expansion options forslots U1, U2 and U3:

• INTERBUS-S master module

• serial interface module (2x RS232 and 2x RS422)

• Profibus-master connection

0 5

1

6

2

7

3

8

4

90

5

1

6

2

7

3

8

4

9

0 5

1

6

2

7

3

8

4

90

5

1

6

2

7

3

8

4

9

MTS-R.FH7

Fig. 12-7: PLC modules MTS-R01.1 and MTS-R02.1

Models:MTS-R02.2-M2-B1-NN-NN-FW wide Yes No No

MTS-R02.2-M2-B1-P1-NN-FW wide Yes Yes No

MTS-R02.2-M2-B1-S4-NN-FW wide Yes No Yes

Fig. 12-8: PLC modules in RECO format

MTS-R01

MTS-R02



Firmware for Intelligent Safety Technology Version 19To operate Intelligent Safety Technology software version 19, thefirmware versions listed below must be used in the participatingcomponents:

Module Function of module Version designation of function firmwareand IST firmware components

RMP 12.2 Safety I/O module FWC-ISM03*-IST-19V02-NN

MTS-P01.2 PLC module for MTC200 PC variant FWC-PLC06*-004-19VRS-NNFWC-PLCMT*-IST-19V00-NN

MTS-P02.2 PLC module for MTC200 PC variant FWC-PLC02*-004-19VRS-NNFWC-PLCMT*-IST-19V00-NN

MTC-P CNC module for MTC200 PC variant FWC-CPU06*-004-19VRS-NNFWC-CPUMT*-IST-19V01-NN

MTS-R PLC module for MTC200 RECO variant FWC-PLC08*-004-19VRS-NNFWC-PLCMT*-IST-19V00-NN

MTC-R CNC module for MTC200 RECO variant FWC-CPU08*-004-19VRS-NNFWC-CPUMT*-IST-19V01-NN

MTC / PAP Axis processor MTC200, PC and RECO variant FWC-APR06*-003-19VRS-NNFWC-APRMT*-IST-19V06-NN

HDS / HDD Drive control device DIAX04 for main spindle drives FWC-HSM1.1-SHS-03VRSMSFWC-HSM1.1-IST-01V04-MS

HDS / HDD Drive control device DIAX04 for servodrives FWC-HSM1.1-SSE-03VRS-MSFWC-HSM1.1-IST-01V04-MS

Fig. 12-9: Firmware for Intelligent Safety Technology Version 19

Firmware for Intelligent Safety Technology as of Version 22To operate Intelligent Safety Technology as of software version 22, thefirmware versions listed below must be used in the participatingcomponents:

Module Function of module Version designation of function firmwareand IST firmware components

RMP 12.2 Safety I/O module FWC-ISM03*-IST-19V02-NN

MTS-P01.2 PLC module for MTC200 PC variant FWC-PLC06*-M05-04VRS-NNFWC-PLCMT*-IST-19V00-NN

MTS-P02.2 PLC modules for MTC200 PC variant FWC-PLC02*-M05-04VRS-NNFWC-PLCMT*-IST-19V00-NN

MTC-P CNC module for MTC200 PC variant FWC-CPU06*-006-22VRS-NNFWC-CPUMT*-IST-19V01-NN

MTS-R PLC module for MTC200 RECO variant FWC-PLC08S-M05-04VRS-NNFWC-PLCMT*-IST-19V00-NN

MTC-R CNC module for MTC200 RECO variant FWC-CPU08*-006-22VRS-NNFWC-CPUMT*-IST-19V01-NN

MTC / PAP Axis processor MTC200, PC and RECO variant FWC-APR06*-003-22VRS-NNFWC-APRMT*-IST-19V06-NN

HDS / HDD Drive control device DIAX04 for main spindle drives FWC-HSM1.1-SHS-03VRS-MSFWC-HSM1.1-IST-01V04-MS

HDS / HDD Drive control device DIAX04 for servodrives FWC-HSM1.1-SSE-03VRS-MSFWC-HSM1.1-IST-01V04-MS

Fig. 12-10: Firmware for Intelligent Safety Technology as of Version 22



Safety I/O ModuleThe RMP 12.2-8E-8A safety module is a digital input/output module forthe Interbus-S RECO system. The module is operated as a participant inthe local bus on carrying bar RMB 12.2-04 or RMB 12.2-02 in connectionwith bus terminal RMK 12.2-IBS-BKL.

The module has 8 potential-free input channels and 8 output channels inthe form of potential-free relay contacts. The input/output channels arenot operated directly by the SUPI 3, but rather using the interposedmicroprocessor. The microprocessor also processes the safety-relevantprograms for use in the IST system.

!

"#

"#

"#

"#

"#

"#

"#

"#

#

!

#

#

##

#

#

#

Rmp12.FH7

Fig. 12-11: Safety module RMP12.2-8E-8A

Models:

Type designation Inputs Outputs

RMP12.2-8E-8A 8 8

Fig. 12-12: Safety moduls



DIAX04 Drive Components

HVE supply module with unregulated intermediatecircuit voltage

Type designation Nominal performance

HVE02.2-W018N 18 KW

HVE03.2-W030N 30 KW

HVE04.2-W075N 75 KW

Fig. 12-13: HVE type overview

HVR supply module with regulated intermediate circuitvoltage

Type designation Nominal performance

HVR02.2-W010N 10 KW

HVR02.2-W025N 25 KW

HVR03.2-W045N 45 KW

Fig. 12-14: HVR type overview

HDS drive control devices

40A devices

HDS02.2-W040N-HS12-01-FW

HDS02.2-W040N-HS32-01-FW

HDS02.2-W040N-HS37-01-FW

HDS02.2-W040N-HS45-01-FW

Fig. 12-15: HDS 40A devices


75A devices

HDS03.2-W075N-HS12-01-FW

HDS03.2-W075N-HS32-01-FW

HDS03.2-W075N-HS37-01-FW

HDS03.2-W075N-HS45-01-FW



100A devices

HDS03.2-W100N-HS12-01-FW

HDS03.2-W100N-HS32-01-FW

HDS03.2-W100N-HS37-01-FW

HDS03.2-W100N-HS45-01-FW

HDS03.2-W100N-HS79-01-FW





200A devices

HDS04.2-W200N-HS12-01-FW

HDS04.2-W200N-HS32-01-FW

HDS04.2-W200N-HS37-01-FW

HDS04.2-W200N-HS45-01-FW

HDS04.2-W200N-HS79-01-FW


HDD drive control devices

40A device

HDD02.2-W040N-HD12-01-FW

Fig. 12-19: HDD 40A device



Explanations of Configurations

Note: All drive configurations have at least a SERCOS Interfacemodule (DSS02.1M).

Configuration Add. module Function

HD12-01 DSS02.1M SERCOS interface

HS12-01 DSS02.1M SERCOS interface

HS32-01 DSS02.1M

DLF01.1M

SERCOS interface

High-resolution positioning interface

HS37-01 DSS02.1M

DZF02.1M

SERCOS interface

Gear encoder interface

HS45-01 DSS02.1M

DAG01.2M

SERCOS interface

Synchron. serial encoder interface

HS79-01 DSS02.1M

DZF03.1M

SERCOS interface

Gear encoder

Fig. 12-20: Explanations of drive configurations

HD12-01 and HS12-01 drive configurations

45

65I5

5

$ 5IAC 5IAC

RSF_DSF Geberinterface.FH7

Fig. 12-21: HD12-01 and HS12-01 drive configurations



HS32-01 drive configuration

5

65I5

5

5IAC 5IAC

5IAC 5IAC

=

Linear Geberinterface.FH7

Fig. 12-22: HS32-01 drive configuration



HS37-01 and HS79-01 drive configurations

5

65I5

!

J

""#

5

='

Zahnrad Geberinterface.FH7

Fig. 12-23: HS37-01 and HS79-01 drive configurations

HS45-01 drive configuration

5

65I5

$

5

+$

EnDatgeber Interface.FH7

Fig. 12-24: HS45-01 drive configuration



12.2 Overview of Safety Parameters for MTC200 and DIAX04Drives

Safety parameters Controlparameter

Drive parameter

Maximum speed for safety function 1 Cxx.101 P-0-0253

Upper position limit for the safety function 1 Cxx.102 P-0-0254

Lower position limit for safety function 1 Cxx.103 P-0-0255

Maximum speed for safety function 2 Cxx.104 P-0-0256

Upper position limit for the safety function 2 Cxx.105 P-0-0257

Lower position limit for safety function 2 Cxx.106 P-0-0258









Position monitoring window for Safe operation stop Cxx.115 P-0-0267

Reference position for Safe referencing Cxx.116 P-0-0268

Selection of safety functions Cxx.1117 P-0-0269

Transition time for switching safety functions Cxx.118 P-0-0270

Time interval for forced dynamics Cxx.119 P-0-0271

Checksum of the weighting data Cxx.120 P-0-0248

Fig. 12-25: Overview of safety parameters



12.3 Acceptance Report

Machine Report

System: Serial No.:

Machine type: Manufacturer:

Number of axes: Number of spindles:

CNC control: PLC control:

CNC firmware: PLC firmware:

PLC cycle time:

Description

of the safety-

related

equipment



Description of axesAxis No. Axis name Axis function IST Change

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

For each IST axis, an individual axis report must be enclosed.



Data backupData Medium Designation Archive Date

CNC parameters

DIAX04 parameters

PLC program

Acceptance report completedComplete acceptance rep.

Serial commissioning

Partial acceptance report

Changes made

Name: Company/department:

Date: Signature:

For the completeness and correctness of the acceptance report:Name: Company/department:

Date: Signature:



Axis Report

System: Serial No.:


Description of the axis equipmentMotor type:

Motor measurement system:

External measurement system:

Transmission ratio:

Feed constant:

Holding brake:

Weight compensation:

Power supply unit:

Drive control unit:

Firmware version DIAX:

Firmware version ISM:

Firmware version APR:

Overview of the safety functions implemented in this axisSafe stop Safe

operation stopSafely reduced

speedSafely limited

absoluteposition

Consentkey

Referencecam

Consent safereference

1 2 1 2

The acceptance report must include all implemented safety functions!



Axis parameters for safety functions in the CNC control (channel 1)No. Description of the parameter Parameter

valueUnit

Cxx.100 Safety function (yes/no)

Cxx.101 Maximum speed 1 for safety function

Cxx.102 Upper position limit 1 for the safety function

Cxx.103 Lower position limit 1 for the safety function

Cxx.104 Maximum speed 2 for safety function

Cxx.105 Upper position limit 2 for the safety function

Cxx.106 Lower position limit 2 for the safety function

Cxx.107 Upper position limit for position switching point 1

Cxx.108 Lower position limit for position switching point 1







Cxx.115 Position monitoring window for Safe operation stop

Cxx.116 Reference position for Safe referencing

Cxx.117 Mask of the unused safety inputs

Cxx.118 Time for transition of the safety functions

Cxx.119 Time interval for forced dynamics

Cxx.120 Checksum of the weighting data



Drive parameters for safety functions in digital drive (channel 2)No. Description of the parameter Parameter value Unit

P-0-0248 Checksum via weighting data

P-0-0249 Activation of safety functions

P-0-0253 Maximum speed 1 for safety function

P-0-0254 Upper position limit 1 for the safety function

P-0-0255 Lower position limit 1 for the safety function

P-0-0256 Maximum speed 2 for safety function

P-0-0257 Upper position limit 2 for the safety function

P-0-0258 Lower position limit 2 for the safety function

P-0-0259 Upper position limit for position switching point 1

P-0-0260 Lower position limit for position switching point 1







P-0-0267 Position monitoring window for Safe operation stop

P-0-0268 Reference position for Safe referencing

P-0-0269 Mask of the unused safety inputs

P-0-0270 Time for transition of the safety functions

P-0-0271 Time interval for forced dynamics

Data checked for conformanceName: Company/department:

Date: Signature:



Acceptance Report, Machine

Intelligent Safety Engineering ISTSYSTEM200 (MTC200 with DIAX04)

Name:

Department:

Date:

Machine

RunningNo.


Test performed Expectation Result Comment

Successfulcompletion ofacceptanceinspection otherthan for safetyaspects

According to thecommissioninginstructions of themanufacturer of themachine anddrive/control system

Acceptance logavailable

Documents ondesign ofunit/machine

Check for availabilityand completeness

Documents areavailable

Safety informationon electrical drives

Available, fullylearned, and takeninto account

Document isavailable

The object ofinspection consistsof the componentslisted in thedocuments.

Compare the devicesin hand to the devicesacc. to the documents

Completecorrespondence

The execution andversion of thecomponentscorresponds to theavailabledocument.

Check all type labelsand the individualsoftware versions

Completecorrespondence

Check allocation ofdrive address andmotor

Compare addresssetting I/O moduleand drive

Correspondence

Wiring of theindividual motorsand sensors(allocation!)

Wiring to theallocation controldevice and sensorinterface

Correspondence

Check the existinginternal andexternal holdingbrakes

Check activation ofthe individual brakes

Activate holdingbrakes



RunningNo.



Check weightcompensation

According to theinstruction of themachinemanufacturer

Functionpresent

Protective-conductor system(grounding)present

Conductive partsconnected viaequipment groundingconductor, checkcross section

Control circuitsufficientlyprotected

Max. protection incorrespondence toswitching capacity I/Oand relays

Max. protectionwith 6 A

Test of EMERGENCY STOP

EMERGENCYSTOP functionaland according toregulations

Version acc. toEN954-1 cat. 3 for allEMERGENCY STOPelements

Regulationsmet

EMERGENCYSTOP functionchecked

Check effects; checkother componentsfrom theEMERGENCY STOPchain.

Each individualcomponent isfunctional

NC-ready(watchdog)embedded inEMERGENCYSTOP chain

Remove NC-readycontact

EMERGENCYSTOP must betriggered

Power wiringcorresponds to theregulations

See wiring instructionsfor Intelligent SafetyTechnology

Test of protective door lock

Protective doorlock has beencorrectly wired

Visual check and testof the schematicdiagrams of theinstallation

Correspondence

Protective doorcan be opened incase ofEMERGENCYSTOP

ActivateEMERGENCY STOPand open protectivedoor

Door can beopened

Openinginterlocked in caseof auto and power

Close door, de-activate safetyfunctions, switch onpower

Opening of doormust beimpossible

Fault reaction onforceful opening ofthe door

External activation ofthe interlock bypass,open the door




RunningNo.



Recognition offaulty auxiliaryrelay in the doorinterlock

Activate relaymanually, or interruptselection

Preventdisconnection orconnection

Test of safety I/O module for each axis with safety function

Addressing of thesafety I/Ocorresponds to thedrive address

Visual inspection driveaddress and moduleaddress

Correspondence

Communicationwith drive if Sercosis in phase 4

Check status LED onthe safety I/O module

LED ispermanentlylighted

Transitioncompleted for axeswith safety function

Check output Q*.1.1on the safety I/Omodule

Output must beactive (LED)

Check 2-channelprocessing of theI/O signals

Pull connector at theI/O module whenunder power


Test of power connection and disconnection

Power connectionand disconnectiontested by PLC

Check functions in thePLC user program:

Power contactor mayonly be connected viaPxxS.POWON anddisconnected viaPxxS.POWON and/orPxxS.POWEN.Check PLC programand I/O allocation

PLC programcorresponds tothe userdocumentation

Check PLCshutdown circuitfor power logic

Check connection ofPxxS POWON

PxxS POWONmust activatemain contactor

The maximumPLC program runtime must notexceed 75 msec

Check current andmaximum programrun time in the PCL

Max. 75 msec



RunningNo.



PLC program forexecuting forceddynamics for allaxes with IST

Activate forceddynamics. Powermust be switched offtwice for each axiswith IST whenprocessing forceddynamics

Procedure mustoccuraccordingly.

Test of shutdown circuit of the control

Electric wiring ofthe start inhibitoraccording to thespecifications

Check the schematicdiagram and theconnections at thedrive

Corresponds tothe specification

Processing of thestart inhibitor bythe PLC userprogram

PLC program “Wiring”AS in 2msimplementation


Control of the startinhibitor for Safestop in the PLCuser program

Check programmedlogic with logicanalysis


Test of parameterization

The control isparameterizedaccording to theproject planningdocuments

Compare machineparameters (axis andprocess parameters)to the project planningdocuments.

Correspondenceof theparameters

The control isparameterizedaccording to theproject planningdocuments

Compare driveparameters to theproject planningdocuments.

Correspondenceparameters

Check passwordinterlock

Check allocation ofIST password

Allocationaccording to thespecification

Test of safety parameters

Set unused safetyparameters to ‘0’

Check unused / notrequired safetyparameters

Parameters mustbe ‘0’

Hide unusedsignals viaparameter Cxx.117

Check mask in theparameters

Correct maskmust be used



RunningNo.



Parameter values:

Check positionvalues

Check the values ofsafe positions andsafe cams.

Correspondence

Parameter values:

Speed limits(observe residualdistance)

Define and checklimitation of the valuesdepending on theprocess

Enter correctvalues

Check positioncontrol window

See Chapter 6.10"Description of SafetyParameters"

Values in thepermitted range

Transition time iscalculatedaccording to thespecification

Formula: see Chapter6.10 "Description ofSafety Parameters"

Values in thepermitted range

Time interval forforced dynamics isentered as 8 hoursmax.

Any deviation must bejustified (see DKE-AK226)

Maximum of 8hours entered

Check the safetyparameterschannel 1 andchannel 2

Compare via the driveparameter menu

Correspondence

Test of safety I/O signals (general)

Dual-channelwiring andprocessing ofsafety signals

Dual-channeloperating elements,version acc. toEN954-1 cat.3; checkschematic diagramand installation

Dual-channelprocessing ofsignals

Deactivationsignals for channel1 and channel 2active with inactivesafety function

LED display of theinput modules atstandard and safetyI/O modules

LED displaysactive

Dual-channel testof consent key

Check LED displaysafety I/O module andPLC signal for the 1st

channel

Consent isfunctional

Dual-channel

Dual-channel testof reference camor key


channel

Reference signalis functional

Dual-channel



RunningNo.



Test of safety I/O signals (general)

Dual-channelwiring andprocessing ofsafety signals

Dual-channeloperating elements,version acc. toEN954-1 cat.3; checkschematic diagramand installation

Dual-channelprocessing ofsignals

Deactivationsignals for channel1 and channel 2active with inactivesafety function

LED display of theinput modules atstandard and safetyI/O modules

LED displaysactive

Dual-channel testof consent key


channel

Consent isfunctional

Dual-channel

Dual-channel testof reference camor key


channel

Reference signalfunctions

Dual-channel

Test of unique allocation of the machine parameterization

Determinateallocation of themachineparameter

There must be onlyone set ofparameters!

Only one set ofparameters

Determinateallocation of driveparameters

There must be onlyone set of driveparameters!

Only one set ofdrive parameters

Determinateallocation of thePLC user program

There must be onlyone PLC userprogram!

Only one PLCuser program

Documentation

Installation drawingof the unit (blockdiagram) withdesignation of thecomponents

Check documents forcompleteness

Available

Schematicdiagram of theelectricalinstallation


Available



RunningNo.



PLC user programdocumented withI/O allocation


Available

Machineparameters of thecontroldocumented


Available

Drive parametersof all installed axes


Available

Safety data of allaxes with safetyfunctions


Available

Description ofapplications forIntelligent SafetyTechnology


Available

Overall result



Acceptance Inspection of Safety Functions of the Axis

Test of safety function safe stop

System: Serial No.:


RunningNo.



Electric wiring ofthe start inhibitoraccording to thespecifications

Check the schematicdiagram and theconnections at thedrive


Processing of thestart inhibitor bythe PLC userprogram

Compare PLCprogram to thespecification


Supervision of thestart inhibitor in thePLC user program

Check programmedlogic with logicanalysis


Dual-channelpreliminarywarning signal

Schematic diagram,LED at the I/Omodule, input at theCNC


Motion lockMHOLD forprevention ofundesired switch-off processesactivated

Supervision in thePLC user program

AxxS.SAFENswitched toAxxC.MHOLD

Activate power anddeactivate safestop

Preselect automaticand activate power

“AF” is indicated

Activate safe stop Preselect Setup andactivate safetyfunction

“AS“ indication,SAFAC active

Test supervision inthe PLC userprogram

Statically activateacknowledgement

Powerdeactivation

Measuring ofreactiontime

Open safety door Activate power andsafety function, opendoor

No reaction, “AS”is indicated

Start movementvia command fromthe NC

Deactivate MHOLD inthe PLC program;confirm; start NCprogram with S1000M3.

Disconnectionand faultdiagnosis

Measuring ofreactiontime andreactionpath



Test of safety function safe operation stop

System: Serial No.:


RunningNo.



Activate power anddeactivate safeoperation stop



Activate operationstop

Preselect Setup andactivate safetyfunction


SAFAC active

Movement at max.axis velocitythrough NC

Deactivate MHOLDvia the PLC program;confirm; start NCprogram with motioncommand.


Measuringof reactiontime andcheck ofreactionpath acc.to positionindication

Disconnect axisRF and activatesafety function

Temporarymodification in thePLC user program

“Ab“ is indicated,SAFAC active


Move axis manuallywith released brake


Measurement ofreactiontime andcheck ofreactionpath viathepositionindication



Test of safety function safely reduced speed

System: Serial No.:


RunningNo.









SAFAC active

Start motionwithout consent

Give jog command foraxis

No motion

Start motion withconsent (V=0.95 *Vmax )

Give consent and givejog command for axis

Motion isperformed

Motion withconsent and V =1.05 * Vmax

Start special NCprogram foracceptance inspection


Measuringof reactiontime andreactionpath

Disconnect axis“RF” and activatesafety function

Disconnect power, oractivate “RF” throughthe PLC user program

“Ab” isindicated


Move axis or motorfrom its position



Move axis withactive safetyfunction andmaximum axisvelocity

Activate power,activate safetyfunction, give consent,start NC acceptancetest program





Test of safety function safe referencing

System: Serial No.:


RunningNo.



Safe reference Run NC program forSafe referencing

Reference isactivated

Check safereference position

Approach referencepoint and check axisposition in NC controland drive

Referenceposition isindicated

Check processingof the positionresolution

Approach the knownposition near theupper limit andcompare machineposition to theindication in controland drive.

Known positionvalue near thepositive limitapproachedand indicated

Check processingof the positionresolution

Approach the knownposition near thelower limit andcompare machineposition to theindication in controland drive.

Known positionvalue near thenegative limitapproachedand indicated

Check supervisionof the referencecams

Approach positionfrom a minimumdistance of 0.1 m or10 degrees from thereference point andconfirm cam/key




Test of safety function safely limited absolute position

System: Serial No.:


RunningNo.



Acceptanceinspection for Safereferencingcompleted

See test of the safetyfunction Safereferencing







SAFAC active

Leave safeabsolute position inpositive direction

Start the NC programat maximum velocity



Leave safeabsolute position innegative direction

Start the NC programat maximum velocity



Supervision of safeabsolute position

With the safetyfunction deactivated,bring drive to aposition outside of thesafely limited absoluteposition and activatesafety function




Test of safety function safe cams

System: Serial No.:


RunningNo.



Acceptanceinspection for Safereferencingcompleted

See test of the safetyfunction Safereferencing

Check positionswitch points

Via the NCacceptance program,approach eachposition directly beforeand after the positionswitch points and do adual-port check of thesignals (I/O module,PLC)

Activate camsaccording to theparameterization

Safe furtherprocessing of safecams

Check the schematicdiagrams and the PLCprogram, requirementacc. to EN 954-1 cat.3

Signal safelyprocessed further

IST Intelligent Safety Technology Index 13-1


13 Index

AAcceleration, maximum - Cxx.018 6-13, 8-48, 8-52Acceptance 9-6Acceptance report 12-15Activate starting lockout - AxxS.SAFSL 6-32, 8-15Activation of safe operation stop - AxxC.SAFOS 6-32, 8-16Activation of safe stop - AxxC.SAFSS 6-32, 8-16, 8-17Activation of safely reduced speed with safely limited absolute position 1 -AxxC.SAFA1 6-32, 8-16Activation of safely reduced speed with safely limited absolute position 2 -AxxC.SAFA2 6-32, 8-16Analysis of dangers 4-1Appropriate use

Introduction 2-1Uses 2-2

Axes referencing - G74 6-17, 6-18AxxC.MHOLD 8-17, 12-28AxxC.SAFA1 6-32, 8-16AxxC.SAFA2 6-32, 8-16AxxC.SAFAG 6-32, 8-16AxxC.SAFOS 6-32, 8-16AxxC.SAFRS 6-32, 8-16AxxC.SAFSS 6-32, 8-16, 8-17AxxS.SAFAC 6-32, 8-15, 8-22AxxS.SAFEN 6-32, 8-15, 12-28AxxS.SAFP1 6-32, 8-15AxxS.SAFP2 6-32, 8-15AxxS.SAFP3 6-32, 8-15AxxS.SAFP4 6-32, 8-15AxxS.SAFRY 6-32, 8-15AxxS.SAFSL 6-32, 8-15

BBraking paths 7-1

CCommissioning 9-1Communication function for safety function (IST) - SAVE_IO 8-24, 8-27, 8-30Consent 6-11Consent key 5-8Consent key - AxxC.SAFAG 6-32, 8-16Cxx.011 6-24, 8-47Cxx.012 6-24, 8-47Cxx.018 6-13, 8-48, 8-52Cxx.100 6-23, 6-24, 6-30, 9-2, 9-11, 12-19Cxx.101 6-13, 6-23, 6-24, 8-48, 8-52, 9-2, 9-11, 10-2, 12-14, 12-19Cxx.102 6-23, 6-24, 9-11, 12-14, 12-19Cxx.103 6-23, 6-24, 9-11, 12-14, 12-19Cxx.104 6-13, 6-23, 6-24, 8-48, 8-52, 9-11, 12-14, 12-19Cxx.105 6-23, 6-24, 9-11, 12-14, 12-19Cxx.106 6-23, 6-24, 9-11, 12-14, 12-19Cxx.107 6-23, 6-25, 9-11, 12-14, 12-19Cxx.108 6-23, 9-11, 12-14, 12-19Cxx.109 6-23, 9-11, 12-14, 12-19Cxx.110 6-23, 9-11, 12-14, 12-19Cxx.111 6-23, 9-11, 12-14, 12-19Cxx.112 6-23, 9-11, 12-14, 12-19Cxx.113 6-23, 9-11, 12-14, 12-19Cxx.114 6-23, 6-25, 9-11, 12-14, 12-19Cxx.115 6-23, 6-25, 9-11, 12-14, 12-19Cxx.116 6-23, 6-25, 9-2, 9-11, 12-14, 12-19Cxx.117 6-11, 6-23, 6-26, 6-27, 9-2, 9-11, 12-14, 12-19, 12-24

13-2 Index IST Intelligent Safety Technology


Cxx.118 6-13, 6-23, 6-28, 8-48, 8-52, 9-2, 9-11, 12-14, 12-19Cxx.119 6-23, 6-29, 9-2, 9-11, 12-14, 12-19Cxx.120 6-23, 6-24, 6-29, 6-30, 9-2, 9-4, 9-11, 12-14, 12-19

DDIAX04 5-1, 5-2

EEmergency stop chain 8-12Enable movement - AxxS.SAFEN 6-32, 8-15Error elimination 11-1Error messages 11-1

FFeed, linear interpolation - G01 6-17, 6-18Forced dynamics 5-9

GG01 6-17, 6-18G74 6-16, 6-17, 6-18

IInappropriate use 2-2

Consequences, Discharge of liability 2-1Installation guidelines 7-28Interbus connection 4-5IST, checksum of weighting data - Cxx.120 6-23, 6-24, 6-29, 6-30, 9-2, 9-4, 9-11, 12-14, 12-19IST, Intelligent Safety Technology - Cxx.100 6-23, 6-24, 6-30, 9-2, 9-11, 12-19IST, lower position limit 1 for safety function - Cxx.103 6-23, 6-24, 9-11, 12-14,12-19IST, lower position limit 2 for safety function - Cxx.106 6-23, 6-24, 9-11, 12-14,12-19IST, lower position limit for position switching point 1 - Cxx.108 6-23, 9-11, 12-14, 12-19IST, lower position limit for position switching point 2 - Cxx.110 6-23, 9-11, 12-14, 12-19IST, lower position limit for position switching point 3 - Cxx.112 6-23, 9-11, 12-14, 12-19IST, lower position limit for position switching point 4 - Cxx.114 6-23, 6-25, 9-11,12-14, 12-19IST, max. speed 1 for safety function - Cxx.101 6-13, 6-23, 6-24, 8-48, 8-52, 9-2,9-11, 10-2, 12-14, 12-19IST, max. speed 2 for safety function - Cxx.104 6-13, 6-23, 6-24, 8-48, 8-52, 9-11, 12-14, 12-19IST, position monitoring window for safe operation stop - Cxx.115 6-23, 6-25, 9-11, 12-14, 12-19IST, reference position for safe referencing - Cxx.116 6-23, 6-25, 9-2, 9-11, 12-14, 12-19IST, selecting safety functions - Cxx.117 6-11, 6-23, 6-26, 6-27, 9-2, 9-11, 12-14,12-19, 12-24IST, time interval for forced dynamics - Cxx.119 6-23, 6-29, 9-2, 9-11, 12-14, 12-19IST, transition time for switching safety functions - Cxx.118 6-13, 6-23, 6-28, 8-48, 8-52, 9-2, 9-11, 12-14, 12-19IST, upper position limit 1 for safety function - Cxx.102 6-23, 6-24, 9-11, 12-14,12-19IST, upper position limit 2 for safety function - Cxx.105 6-23, 6-24, 9-11, 12-14,12-19IST, upper position limit for position switching point 1 - Cxx.107 6-23, 6-25, 9-11,12-14, 12-19IST, upper position limit for position switching point 2 - Cxx.109 6-23, 9-11, 12-14, 12-19

IST Intelligent Safety Technology Index 13-3


IST, upper position limit for position switching point 3 - Cxx.111 6-23, 9-11, 12-14, 12-19IST, upper position limit for position switching point 4 - Cxx.113 6-23, 9-11, 12-14, 12-19

LLinear interpolation feed - G01 6-17, 6-18

MMachine and axis report 9-7Monitoring channel 5-5Motion hold - AxxC.MHOLD 8-17, 12-28Movement enabled- AxxS.SAFEN 12-28MTC200 5-1, 5-2, 5-8

PP-0-0117 7-1, 7-2, 7-4, 7-11, 7-12, 7-15, 7-24, 7-25P-0-0118 7-1, 7-2, 7-4, 7-11, 7-12, 7-15, 7-24, 7-25P-0-0119 7-1, 7-2, 7-4, 7-11, 7-12, 7-13, 7-14, 7-15, 7-24, 7-25, 7-26, 7-27P-0-0248 6-23, 6-29, 8-44, 8-50, 8-54, 9-4, 9-12, 11-9, 12-14, 12-20P-0-0249 6-23, 6-24, 8-44, 8-46, 8-50, 8-54, 9-3, 9-12, 12-20P-0-0250 11-8, 11-9P-0-0252 11-7, 11-9P-0-0253 6-23, 6-24, 8-44, 8-46, 8-50, 8-54, 9-3, 9-12, 10-2, 11-6, 11-9, 12-14,12-20P-0-0254 6-23, 6-24, 8-44, 8-46, 8-50, 8-54, 9-12, 11-6, 12-14, 12-20P-0-0255 6-23, 6-24, 8-44, 8-46, 8-50, 8-54, 9-12, 11-6, 12-14, 12-20P-0-0256 6-23, 6-24, 8-44, 8-46, 8-50, 8-54, 9-12, 11-7, 12-14, 12-20P-0-0257 6-23, 6-24, 8-44, 8-46, 8-50, 8-54, 9-12, 11-7, 12-14, 12-20P-0-0258 6-23, 6-24, 8-44, 8-46, 8-50, 8-54, 9-12, 11-7, 12-14, 12-20P-0-0259 6-23, 6-25, 8-44, 8-46, 8-50, 8-54, 9-12, 12-14, 12-20P-0-0260 6-23, 8-44, 8-46, 8-50, 8-54, 9-12, 12-14, 12-20P-0-0261 6-23, 8-44, 8-46, 8-50, 8-54, 9-12, 12-14, 12-20P-0-0262 6-23, 8-44, 8-46, 8-50, 8-54, 9-12, 12-14, 12-20P-0-0263 6-23, 8-44, 8-46, 8-50, 8-54, 9-12, 12-14, 12-20P-0-0264 6-23, 8-44, 8-46, 8-50, 8-54, 9-12, 12-14, 12-20P-0-0265 6-23, 8-44, 8-46, 8-50, 8-54, 9-12, 12-14, 12-20P-0-0266 6-23, 6-25, 8-44, 8-46, 8-50, 8-54, 9-12, 12-14, 12-20P-0-0267 6-23, 6-25, 8-44, 8-46, 8-50, 8-54, 9-12, 11-5, 11-7, 11-9, 12-14, 12-20P-0-0268 6-23, 6-25, 8-44, 8-46, 8-50, 8-54, 9-3, 9-12, 11-9, 12-14, 12-20P-0-0269 6-11, 6-23, 6-26, 8-43, 8-44, 8-45, 8-46, 8-47, 8-50, 8-51, 8-54, 9-3, 9-12, 12-14, 12-20P-0-0270 6-23, 6-28, 8-44, 8-46, 8-48, 8-50, 8-52, 8-54, 9-3, 9-12, 11-10, 12-14,12-20P-0-0271 6-23, 6-29, 8-44, 8-46, 8-50, 8-54, 9-3, 9-12, 11-8, 11-9, 12-14, 12-20P-0-0272 11-6, 11-7P-0-0273 11-7, 11-9P-0-0276 11-7, 11-9P-0-0277 9-3, 11-9P-0-0295 9-3, 11-9P-0-0296 11-7, 11-9P-0-0297 11-9P-0-1201 7-14, 7-27Password protection 6-30PLC program 8-14Position switch point 1 - AxxS.SAFP1 6-32, 8-15Position switch point 2 - AxxS.SAFP2 6-32, 8-15Position switch point 3 - AxxS.SAFP3 6-32, 8-15Position switch point 4 - AxxS.SAFP4 6-32, 8-15Power enablement - PxxS.POWEN 12-23Power on - PxxS.POWON 12-23Process enablement - PxxC.ENABL 8-18Program end with reset - RET 6-17, 6-18Protective Door Monitor 8-8PxxC.ENABL 8-18PxxS.POWEN 12-23PxxS.POWON 12-23

13-4 Index IST Intelligent Safety Technology


RReaction times 7-1Reference cam for safe referencing - AxxC.SAFRS 6-32, 8-16Referencing axes - G74 6-16, 6-17, 6-18Reset, program end - RET 6-17, 6-18Residual risks 8-2RET 6-17, 6-18RMP12.2 6-36RS 6-38RS_FLIP_FLOP, dominating reset - RS 6-38

SS-0-0104 6-13, 6-28, 8-48, 8-52S-0-0124 11-9Safe cams 6-10Safe operation stop 6-4Safe referencing 6-14Safe stop 6-2Safely limited absolute positions 6-8Safely reduced speed 6-6Safety function active - AxxS.SAFAC 6-32, 8-15, 8-22Safety I/O module 5-1, 5-5Safety I/O signals 6-32Safety Instructions for Electric Drives and Controls 3-1Safety parameters 8-42Sample application 8-3SAVE_IO 8-24, 8-27, 8-30SERCOS interface 4-5Shutdown circuit 8-10Standards and regulations 4-3Starting lockout 6-2, 6-39Switching complete - AxxS.SAFRY 6-32, 8-15

TTimer startup delay - TON 6-38TON 6-38Travel limit, negative - Cxx.012 6-24, 8-47Travel limit, positive - Cxx.011 6-24, 8-47Two-way data comparison 5-6

UUse See appropriate use and inappropriate use

IST Intelligent Safety Technology Service & Support 14-1


14 Service & Support

14.1 Helpdesk

Unser Kundendienst-Helpdesk im Hauptwerk Lohram Main steht Ihnen mit Rat und Tat zur Seite.Sie erreichen uns

Our service helpdesk at our headquarters in Lohr amMain, Germany can assist you in all kinds of inquiries.Contact us

- telefonisch - by phone: 49 (0) 9352 40 50 60über Service Call Entry Center Mo-Fr 07:00-18:00- via Service Call Entry Center Mo-Fr 7:00 am - 6:00 pm

- per Fax - by fax: +49 (0) 9352 40 49 41

- per e-Mail - by e-mail: [email protected]

14.2 Service-Hotline

Außerhalb der Helpdesk-Zeiten ist der Servicedirekt ansprechbar unter

After helpdesk hours, contact our servicedepartment directly at

+49 (0) 171 333 88 26

oder - or +49 (0) 172 660 04 06

14.3 Internet

Unter www.boschrexroth.com finden Sieergänzende Hinweise zu Service, Reparatur undTraining sowie die aktuellen Adressen *) unsererauf den folgenden Seiten aufgeführten Vertriebs-und Servicebüros.

Verkaufsniederlassungen

Niederlassungen mit Kundendienst

Außerhalb Deutschlands nehmen Sie bitte zuerst Kontakt mitunserem für Sie nächstgelegenen Ansprechpartner auf.

*) Die Angaben in der vorliegenden Dokumentation könnenseit Drucklegung überholt sein.

At www.boschrexroth.com you may findadditional notes about service, repairs and trainingin the Internet, as well as the actual addresses *) ofour sales- and service facilities figuring on thefollowing pages.

sales agencies

offices providing service

Please contact our sales / service office in your area first.

*) Data in the present documentation may have becomeobsolete since printing.

14.4 Vor der Kontaktaufnahme... - Before contacting us...

Wir können Ihnen schnell und effizient helfen wennSie folgende Informationen bereithalten:

detaillierte Beschreibung der Störung und derUmstände.

Angaben auf dem Typenschild der betreffendenProdukte, insbesondere Typenschlüssel undSeriennummern.

Tel.-/Faxnummern und e-Mail-Adresse, unterdenen Sie für Rückfragen zu erreichen sind.

For quick and efficient help, please have thefollowing information ready:

1. Detailed description of the failure andcircumstances.

2. Information on the type plate of the affectedproducts, especially type codes and serialnumbers.

3. Your phone/fax numbers and e-mail address,so we can contact you in case of questions.

14-2 Service & Support IST Intelligent Safety Technology


14.5 Kundenbetreuungsstellen - Sales & Service Facilities

Deutschland – Germany vom Ausland: (0) nach Landeskennziffer weglassen!from abroad: don’t dial (0) after country code!

Vertriebsgebiet Mitte Germany Centre

Bosch Rexroth AGBgm.-Dr.-Nebel-Str. 2 / Postf. 135797816 Lohr am Main / 97803 Lohr

Kompetenz-Zentrum Europa

Tel.: +49 (0)9352 40-0Fax: +49 (0)9352 40-4885

S E R V I C E

C A L L E N T R Y C E N T E RMO – FR

von 07:00 - 18:00 Uhr

from 7 am – 6 pm

Tel. +49 (0) 9352 40 50 [email protected]

S E R V I C E

HOTLINEMO – FR

von 17:00 - 07:00 Uhrfrom 5 pm - 7 am

+ SA / SOTel.: +49 (0)172 660 04 06

oder / orTel.: +49 (0)171 333 88 26

S E R V I C E

ERSATZTEILE / SPARESverlängerte Ansprechzeit- extended office time -

♦ nur an Werktagen- only on working days -

♦ von 07:00 - 18:00 Uhr- from 7 am - 6 pm -

Tel. +49 (0) 9352 40 42 22

Vertriebsgebiet Süd Germany South

Bosch Rexroth AGLandshuter Allee 8-1080637 München

Tel.: +49 (0)89 127 14-0Fax: +49 (0)89 127 14-490

Vertriebsgebiet West Germany West

Bosch Rexroth AGRegionalzentrum WestBorsigstrasse 1540880 Ratingen

Tel.: +49 (0)2102 409-0Fax: +49 (0)2102 409-406

+49 (0)2102 409-430

Gebiet Südwest Germany South-West

Bosch Rexroth AGService-Regionalzentrum Süd-WestSiemensstr.170736 Fellbach

Tel.: +49 (0)711 51046–0Fax: +49 (0)711 51046–248

Gebiet Südwest Germany South-West

Bosch Rexroth AGRegionalzentrum SüdwestRingstrasse 70 / Postfach 114470736 Fellbach / 70701 Fellbach

Tel.: +49 (0)711 57 61–100Fax: +49 (0)711 57 61–125

Vertriebsgebiet Nord Germany North

Bosch Rexroth AGWalsroder Str. 9330853 Langenhagen

Tel.: +49 (0) 511 72 66 57-0Service: +49 (0) 511 72 66 57-256Fax: +49 (0) 511 72 66 57-93Service: +49 (0) 511 72 66 57-95

Vertriebsgebiet Mitte Germany Centre

Bosch Rexroth AGRegionalzentrum MitteWaldecker Straße 1364546 Mörfelden-Walldorf

Tel.: +49 (0) 61 05 702-3Fax: +49 (0) 61 05 702-444

Vertriebsgebiet Ost Germany East

Bosch Rexroth AGBeckerstraße 3109120 Chemnitz

Tel.: +49 (0)371 35 55-0Fax: +49 (0)371 35 55-333

Vertriebsgebiet Ost Germany East

Bosch Rexroth AGRegionalzentrum OstWalter-Köhn-Str. 4d04356 Leipzig

Tel.: +49 (0)341 25 61-0Fax: +49 (0)341 25 61-111



Europa (West) - Europe (West)

vom Ausland: (0) nach Landeskennziffer weglassen, Italien: 0 nach Landeskennziffer mitwählenfrom abroad: don’t dial (0) after country code, Italy: dial 0 after country code

Austria - Österreich

Bosch Rexroth GmbHElectric Drives & Controls

Tel.: +43 (0)1 985 25 40Fax: +43 (0)1 985 25 40-93

Austria – Österreich

Bosch Rexroth GmbHElectric Drives & ControlsIndustriepark 184061 Pasching

Tel.: +43 (0)7221 605-0Fax: +43 (0)7221 605-21

Belgium - Belgien

Bosch Rexroth AGElectric Drives & ControlsIndustrielaan 81740 TernatTel.: +32 (0)2 5830719- service: +32 (0)2 5830717Fax: +32 (0)2 5830731 [email protected]

Denmark - Dänemark

BEC A/SZinkvej 68900 Randers

Tel.: +45 (0)87 11 90 60Fax: +45 (0)87 11 90 61

Great Britain – Großbritannien

Bosch Rexroth Ltd.Electric Drives & ControlsBroadway Lane, South CerneyCirencester, Glos GL7 5UH

Tel.: +44 (0)1285 863000Fax: +44 (0)1285 863030 [email protected] [email protected]

Finland - Finnland

Bosch Rexroth OyElectric Drives & ControlsAnsatie 6017 40 Vantaa

Tel.: +358 (0)9 84 91-11Fax: +358 (0)9 84 91-13 60

France - Frankreich

Bosch Rexroth SASElectric Drives & ControlsAvenue de la Trentaine(BP. 74)77503 Chelles Cedex

Tel.: +33 (0)164 72-70 00Fax: +33 (0)164 72-63 00Hotline: +33 (0)608 33 43 28

France - Frankreich

Bosch Rexroth SASElectric Drives & ControlsZI de Thibaud, 20 bd. Thibaud(BP. 1751)31084 Toulouse

Tel.: +33 (0)5 61 43 61 87Fax: +33 (0)5 61 43 94 12

France – Frankreich

Bosch Rexroth SASElectric Drives & Controls91, Bd. Irène Joliot-Curie69634 Vénissieux – Cedex

Tel.: +33 (0)4 78 78 53 65Fax: +33 (0)4 78 78 53 62

Italy - Italien

Bosch Rexroth S.p.A.Via G. Di Vittoria, 120063 Cernusco S/N.MI

Tel.: +39 02 92 365 1+39 02 92 365 326

Fax: +39 02 92 365 500+39 02 92 365 516378

Italy - Italien

Bosch Rexroth S.p.A.Via Paolo Veronesi, 25010148 Torino

Tel.: +39 011 224 88 11Fax: +39 011 224 88 30

Italy - Italien

Bosch Rexroth S.p.A.Via del Progresso, 16 (Zona Ind.)35020 Padova

Tel.: +39 049 8 70 13 70Fax: +39 049 8 70 13 77

Italy - Italien

Bosch Rexroth S.p.A.Via Mascia, 180053 Castellamare di Stabia NA

Tel.: +39 081 8 71 57 00Fax: +39 081 8 71 68 85

Italy - Italien

Bosch Rexroth S.p.A.Viale Oriani, 38/A40137 Bologna

Tel.: +39 051 34 14 14Fax: +39 051 34 14 22

Netherlands – Niederlande/Holland

Bosch Rexroth B.V.Kruisbroeksestraat 1(P.O. Box 32)5281 RV Boxtel

Tel.: +31 (0)411 65 19 51Fax: +31 (0)411 65 14 83 www.boschrexroth.nl

Netherlands - Niederlande/Holland

Bosch Rexroth Services B.V.Technical ServicesKruisbroeksestraat 1(P.O. Box 32)5281 RV Boxtel

Tel.: +31 (0)411 65 19 51Fax: +31 (0)411 67 78 [email protected]

Norway - Norwegen

Bosch Rexroth ASElectric Drives & ControlsBerghagan 1 or: Box 30071405 Ski-Langhus 1402 Ski

Tel.: +47 (0)64 86 41 00Fax: +47 (0)64 86 90 62 [email protected]

Spain - Spanien

Bosch Rexroth S.A.Electric Drives & ControlsCentro Industrial SantigaObradors s/n08130 Santa Perpetua de MogodaBarcelona

Tel.: +34 9 37 47 94 00Fax: +34 9 37 47 94 01

Spain – Spanien

Goimendi S.A.Electric Drives & ControlsParque Empresarial ZuatzuC/ Francisco Grandmontagne no.220018 San Sebastian

Tel.: +34 9 43 31 84 21- service: +34 9 43 31 84 56Fax: +34 9 43 31 84 27- service: +34 9 43 31 84 60 [email protected]

Sweden - Schweden

Rexroth Mecman Svenska ABElectric Drives & Controls- Varuvägen 7(Service: Konsumentvägen 4, Älfsjö)125 81 Stockholm

Tel.: +46 (0)8 727 92 00Fax: +46 (0)8 647 32 77

Sweden - Schweden

Rexroth Mecman Svenska ABElectric Drives & ControlsEkvändan 7254 67 Helsingborg

Tel.: +46 (0) 42 38 88 -50Fax: +46 (0) 42 38 88 -74

Switzerland West - Schweiz West

Bosch Rexroth Suisse SAElectric Drives & ControlsRue du village 11020 Renens

Tel.: +41 (0)21 632 84 20Fax: +41 (0)21 632 84 21

Switzerland East - Schweiz Ost

Bosch Rexroth Schweiz AGElectric Drives & ControlsHemrietstrasse 28863 ButtikonTel. +41 (0) 55 46 46 111Fax +41 (0) 55 46 46 222



Europa (Ost) - Europe (East)

vom Ausland: (0) nach Landeskennziffer weglassen

from abroad: don’t dial (0) after country code

Czech Republic - Tschechien

Bosch -Rexroth, spol.s.r.o.Hviezdoslavova 5627 00 Brno

Tel.: +420 (0)5 48 126 358Fax: +420 (0)5 48 126 112

Czech Republic - Tschechien

DEL a.s.Strojírenská 38591 01 Zdar nad SázavouTel.: +420 566 64 3144Fax: +420 566 62 1657

Hungary - Ungarn

Bosch Rexroth Kft.Angol utca 341149 Budapest

Tel.: +36 (1) 422 3200Fax: +36 (1) 422 3201

Poland – Polen

Bosch Rexroth Sp.zo.o.ul. Staszica 105-800 Pruszków

Tel.: +48 22 738 18 00– service: +48 22 738 18 46Fax: +48 22 758 87 35– service: +48 22 738 18 42

Poland – Polen

Bosch Rexroth Sp.zo.o.Biuro Poznanul. Dabrowskiego 81/8560-529 Poznan

Tel.: +48 061 847 64 62 /-63Fax: +48 061 847 64 02

Romania - Rumänien

East Electric S.R.L.B-dul Basarabie, nr.250, sector 373429 Bucuresti

Tel./Fax:: +40 (0)21 255 35 07+40 (0)21 255 77 13

Fax: +40 (0)21 725 61 21 [email protected]

Romania - Rumänien

Bosch Rexroth Sp.zo.o.Str. Drobety nr. 4-10, app. 1470258 Bucuresti, Sector 2

Tel.: +40 (0)1 210 48 25+40 (0)1 210 29 50

Fax: +40 (0)1 210 29 52

Russia - Russland

Bosch Rexroth OOOWjatskaja ul. 27/15127015 Moskau

Tel.: +7-095-785 74 78+7-095 785 74 79

Fax: +7 095 785 74 77 [email protected]

Russia - Russland

ELMIS10, Internationalnaya246640 Gomel, Belarus

Tel.: +375/ 232 53 42 70+375/ 232 53 21 69

Fax: +375/ 232 53 37 69 [email protected]

Turkey - Türkei

Bosch Rexroth OtomasyonSan & Tic. A..S.Fevzi Cakmak Cad No. 334630 Sefaköy Istanbul

Tel.: +90 212 541 60 70Fax: +90 212 599 34 07

Slowenia - Slowenien

DOMELOtoki 2164 228 Zelezniki

Tel.: +386 5 5117 152Fax: +386 5 5117 225 [email protected]



Africa, Asia, Australia – incl. Pacific Rim

Australia - Australien

AIMS - Australian IndustrialMachinery Services Pty. Ltd.28 Westside DriveLaverton North Vic 3026Melbourne

Tel.: +61 3 93 243 321Fax: +61 3 93 243 329Hotline: +61 4 19 369 195 [email protected]

Australia - Australien

Bosch Rexroth Pty. Ltd.No. 7, Endeavour WayBraeside Victoria, 31 95Melbourne

Tel.: +61 3 95 80 39 33Fax: +61 3 95 80 17 33 [email protected]

China

Shanghai Bosch RexrothHydraulics & Automation Ltd.Waigaoqiao, Free Trade ZoneNo.122, Fu Te Dong Yi RoadShanghai 200131 - P.R.China

Tel.: +86 21 58 66 30 30Fax: +86 21 58 66 55 [email protected] [email protected]

China

Shanghai Bosch RexrothHydraulics & Automation Ltd.4/f, Marine TowerNo.1, Pudong AvenueShanghai 200120 - P.R.China

Tel: +86 21 68 86 15 88Fax: +86 21 58 40 65 77

China

Bosch Rexroth China Ltd.15/F China World Trade Center1, Jianguomenwai AvenueBeijing 100004, P.R.China

Tel.: +86 10 65 05 03 80Fax: +86 10 65 05 03 79

China

Bosch Rexroth China Ltd.Guangzhou Repres. OfficeRoom 1014-1016, Metro Plaza,Tian He District, 183 Tian He Bei RdGuangzhou 510075, P.R.China

Tel.: +86 20 8755-0030+86 20 8755-0011

Fax: +86 20 8755-2387

China

Bosch Rexroth (China) Ltd.A-5F., 123 Lian Shan StreetSha He Kou DistrictDalian 116 023, P.R.China

Tel.: +86 411 46 78 930Fax: +86 411 46 78 932

China

Melchers GmbHBRC-SE, Tightening & Press-fit13 Floor Est Ocean CentreNo.588 Yanan Rd. East65 Yanan Rd. WestShanghai 200001

Tel.: +86 21 6352 8848Fax: +86 21 6351 3138

Hongkong

Bosch Rexroth (China) Ltd.6th

Floor,Yeung Yiu Chung No.6 Ind Bldg.19 Cheung Shun StreetCheung Sha Wan,Kowloon, Hongkong

Tel.: +852 22 62 51 00Fax: +852 27 41 33 44

[email protected]

India - Indien

Bosch Rexroth (India) Ltd.Electric Drives & ControlsPlot. A-58, TTC Industrial AreaThane Turbhe Midc RoadMahape VillageNavi Mumbai - 400 701

Tel.: +91 22 7 61 46 22Fax: +91 22 7 68 15 31

India - Indien

Bosch Rexroth (India) Ltd.Electric Drives & ControlsPlot. 96, Phase IIIPeenya Industrial AreaBangalore – 560058

Tel.: +91 80 41 17 02 -11...-18Fax: +91 80 83 94 345

+91 80 83 97 374

[email protected]

India - Indien

Bosch Rexroth (India) Ltd.1st Floor, S-10Green Park ext. MarketNew Delhi – 110016

Tel.: +91 1 16 56 68 88Fax: +91 1 16 56 68 87

Indonesia - Indonesien

PT. Bosch RexrothBuilding # 202, CilandakCommercial EstateJl. Cilandak KKO, Jakarta 12560

Tel.: +62 21 7891169 (5 lines)Fax: +62 21 7891170 - 71

Japan

Bosch Rexroth Automation Corp.Service Center JapanYutakagaoka 1810, Meito-ku,NAGOYA 465-0035, Japan

Tel.: +81 52 777 88 41+81 52 777 88 53+81 52 777 88 79

Fax: +81 52 777 89 01

Japan

Bosch Rexroth Automation Corp.Electric Drives & Controls1F, I.R. BuildingNakamachidai 4-26-44, Tsuzuki-kuYOKOHAMA 224-0041, Japan

Tel.: +81 45 942 72 10Fax: +81 45 942 03 41

Korea

Bosch Rexroth-Korea Ltd.Electric Drives and ControlsBongwoo Bldg. 7FL, 31-7, 1GaJangchoong-dong, Jung-guSeoul, 100-391

Tel.: +82 234 061 813Fax: +82 222 641 295

Korea

Bosch Rexroth-Korea Ltd.1515-14 Dadae-Dong, Saha-KuElectric Drives & ControlsPusan Metropolitan City, 604-050

Tel.: +82 51 26 00 741Fax: +82 51 26 00 747 [email protected]

Malaysia

Bosch Rexroth Sdn.Bhd.11, Jalan U8/82, Seksyen U840150 Shah AlamSelangor, Malaysia

Tel.: +60 3 78 44 80 00Fax: +60 3 78 45 48 00 [email protected] [email protected]

Singapore - Singapur

Bosch Rexroth Pte Ltd15D Tuas RoadSingapore 638520

Tel.: +65 68 61 87 33Fax: +65 68 61 18 25 sanjay.nemade

@boschrexroth.com.sg

South Africa - Südafrika

TECTRA Automation (Pty) Ltd.71 Watt Street, MeadowdaleEdenvale 1609

Tel.: +27 11 971 94 00Fax: +27 11 971 94 40Hotline: +27 82 903 29 23 [email protected]

Taiwan

Rexroth Uchida Co., Ltd.No.17, Alley 24, Lane 737Cheng Bei 1 Rd., YungkangTainan Hsien

Tel.: +886 6 25 36 565Fax: +886 6 25 34 754 [email protected]

Thailand

NC Advance Technology Co. Ltd.59/76 Moo 9Ramintra road 34Tharang, Bangkhen,Bangkok 10230

Tel.: +66 2 943 70 62 +66 2 943 71 21Fax: +66 2 509 23 62 [email protected]



Nordamerika – North AmericaUSAHeadquarters - Hauptniederlassung

Bosch Rexroth CorporationElectric Drives & Controls5150 Prairie Stone ParkwayHoffman Estates, IL 60192-3707

Tel.: +1 847 6 45 36 00Fax: +1 847 6 45 62 [email protected] [email protected]

USA Central Region - Mitte

Bosch Rexroth CorporationElectric Drives & ControlsCentral Region Technical Center1701 Harmon RoadAuburn Hills, MI 48326

Tel.: +1 248 3 93 33 30Fax: +1 248 3 93 29 06

USA Southeast Region - Südwest

Bosch Rexroth CorporationElectric Drives & ControlsSoutheastern Technical Center3625 Swiftwater Park DriveSuwanee, Georgia 30124

Tel.: +1 770 9 32 32 00Fax: +1 770 9 32 19 03

USA SERVICE-HOTLINE

- 7 days x 24hrs -

+1-800-REX-ROTH+1-800-739-7684

USA East Region – Ost

Bosch Rexroth CorporationElectric Drives & ControlsCharlotte Regional Sales Office14001 South Lakes DriveCharlotte, North Carolina 28273

Tel.: +1 704 5 83 97 62+1 704 5 83 14 86

USA Northeast Region – Nordost

Bosch Rexroth CorporationElectric Drives & ControlsNortheastern Technical Center99 Rainbow RoadEast Granby, Connecticut 06026

Tel.: +1 860 8 44 83 77Fax: +1 860 8 44 85 95

USA West Region – West

Bosch Rexroth Corporation7901 Stoneridge Drive, Suite 220Pleasant Hill, California 94588

Tel.: +1 925 227 10 84Fax: +1 925 227 10 81

Canada East - Kanada Ost

Bosch Rexroth Canada CorporationBurlington Division3426 Mainway DriveBurlington, OntarioCanada L7M 1A8

Tel.: +1 905 335 55 11Fax: +1 905 335-41 84 [email protected]

Canada West - Kanada West

Bosch Rexroth Canada Corporation5345 Goring St.Burnaby, British ColumbiaCanada V7J 1R1

Tel. +1 604 205-5777Fax +1 604 205-6944 [email protected]

Mexico

Bosch Rexroth Mexico S.A. de C.V.Calle Neptuno 72Unidad Ind. Vallejo07700 Mexico, D.F.

Tel.: +52 5 754 17 11+52 5 754 36 84+52 5 754 12 60

Fax: +52 5 754 50 73+52 5 752 59 43

[email protected]

Mexico

Bosch Rexroth S.A. de C.V.Calle Argentina No 3913Fracc. las Torres64930 Monterrey, N.L.

Tel.: +52 8 333 88 34...36+52 8 349 80 91...93

Fax: +52 8 346 78 [email protected]

Südamerika – South AmericaArgentina - Argentinien

Bosch Rexroth S.A.I.C."The Drive & Control Company"Acassusso 48 41/471605 MunroProvincia de Buenos Aires

Tel.: +54 11 4756 01 40Fax: +54 11 4756 01 [email protected]

Argentina - Argentinien

NAKASEServicio Tecnico CNCCalle 49, No. 5764/66B1653AOX Villa BalesterProvincia de Buenos Aires

Tel.: +54 11 4768 36 43Fax: +54 11 4768 24 13 [email protected] [email protected] [email protected] (Service)

Brazil - Brasilien

Bosch Rexroth Ltda.Av. Tégula, 888Ponte Alta, Atibaia SPCEP 12942-440

Tel.: +55 11 4414 56 92+55 11 4414 56 84

Fax sales: +55 11 4414 57 07Fax serv.: +55 11 4414 56 86 [email protected]

Brazil - Brasilien

Bosch Rexroth Ltda.R. Dr.Humberto Pinheiro Vieira, 100Distrito Industrial [Caixa Postal 1273]89220-390 Joinville - SC

Tel./Fax: +55 47 473 58 33Mobil: +55 47 9974 6645 [email protected]

Columbia - Kolumbien

Reflutec de Colombia Ltda.Calle 37 No. 22-31Santafé de Bogotá, D.C.Colombia

Tel.: +57 1 368 82 67+57 1 368 02 59

Fax: +57 1 268 97 [email protected]@007mundo.com

IST Intelligent Safety Technology


Notes

Prin

ted

in G

erm

any2 9 3 6 2 8