Function example AS-FE-I-015-V10-EN. SIMATIC Safety Integrated for Factory Automation Safety-related master-i-slave communication via PROFIBUS DP

Transcription

1 Function example AS-FE-I-015-V10-EN SIMATIC Safety Integrated for Factory Automation Safety-related master-i-slave communication via PROFIBUS DP

2 Preliminary remark Function examples for the topic "Safety Integrated" are fully-functioning and tested automation configurations based on standard A&D products for simple, fast and low-cost implementation of automation tasks in safety engineering. Each of the function examples presented deals with a typical problem that occurs in safety engineering. As well as listing all the necessary software and hardware components, and describing their interconnection, the function examples also include tested and commented code. This means the functionalities described here can be set up within a short time and can thus be used as the basis for individual expansions _as_fe_i_015_v10_de_fcomm Important note The safety function examples are non-binding and do not claim to be complete in respect of configuration, equipment or practical contingencies. The safety function examples are not customer-specific solutions and are only intended to facilitate the performance of typical tasks. You yourself are responsible for the proper operation of the described products. These safety function examples do not relieve you of the obligation to use the products safely during application, installation, operation and maintenance. By using these safety function examples, you acknowledge the fact that Siemens cannot be held liable for any claims or damages above and beyond the liability described above. We reserve the right to make changes to these safety function examples at any time without prior notice. If there are any differences between the suggestions made in these safety function examples and other Siemens publications such as catalogs, the contents of the other document(s) take priority. A&D Safety Integrated Page 2/50 AS-FE-I-015-V10-EN

3 Table of contents 1 TOCWarranty, liability and support _as_fe_i_015_v10_de_fcomm 2 Automation functions Brief introduction to safety-related communication Description of functions Technological description Warning zone and detection zone of the laser scanner Events and responses in hazard areas 1 and Simplifications in the safety function example State machine State machine (1): Activation of safety equipment State machine (2): Normal mode Simulating a machine with indicator lights Advantages/customer benefits Necessary components Design and Wiring Overview of the hardware structure Wiring of the hardware components Function test Important settings of the hardware components Key performance data Example code Download Functionality of the STEP 7 project Overview of the program structure Program execution of the standard program Program execution of the safety program Variable tables Operating instructions Diagnostics options in the event of a communication error Background information Connection between master CPU and I slave Structure of F communication General information on the F application blocks Parameterization of the F connection Configuration and F Configuration tabs Important assignments History A&D Safety Integrated Page 3/50 AS-FE-I-015-V10-EN

4 1 Warranty, liability and support Automation functions Brief introduction to safety-related communication Description of functions Technological description Warning zone and detection zone of the laser scanner Events and responses in hazard areas 1 and Simplifications in the safety function example State machine State machine (1): Activation of safety equipment State machine (2): Normal mode Simulating a machine with indicator lights Advantages/customer benefits Necessary components _as_fe_i_015_v10_de_fcomm 4 Design and Wiring Overview of the hardware structure Wiring of the hardware components Function test Important settings of the hardware components Key performance data Example code Download Functionality of the STEP 7 project Overview of the program structure Program execution of the standard program Program execution of the safety program Variable tables Operating instructions Diagnostics options in the event of a communication error Background information Connection between master CPU and I slave Structure of F communication General information on the F application blocks Parameterization of the F connection Configuration and F Configuration tabs Important assignments History A&D Safety Integrated Page 4/50 AS-FE-I-015-V10-EN

5 1 Warranty, liability and support _as_fe_i_015_v10_de_fcomm We do not guarantee any of the information contained in this document. We accept no liability for any damage or loss caused by use of the safety function examples, information, programs, planning data or performance data described in this document, irrespective of the legal basis for claims arising from such damage or loss, unless liability is mandatory, for example, according to the product liability law, in cases of malfeasance, gross negligence, due to endangerment of life, the body or health, due to assumption of a guarantee for a product's characteristics of state, due to malicious concealment of a defect or due to violation of basic contractual obligations. Any claims for damages caused by violation of basic contractual obligations, however, shall be limited to the foreseeable damage or loss which is typically envisaged in contracts unless there has been gross negligence or unless liability is mandatory due to endangerment of life, the body or health. This does not entail a change in the burden of proof to your disadvantage. Copyright 2008 Siemens A&D. Reproduction or transmission of these safety function examples or extracts thereof are forbidden without the express written authority of Siemens A&D. If you have any questions about this article, please send an to the following address: Online-support.automation@siemens.com A&D Safety Integrated Page 5/50 AS-FE-I-015-V10-EN

6 2 Automation functions 2.1 Brief introduction to safety-related communication What is meant by safety-related communication? In safety-critical applications, the transfer of safety-related data (e.g. emergency stop signal) to a safety-related (fail-safe) analysis unit (e.g. F-CPU) must be ensured, or you must be sure of exposing of errors in data transfer. The bus systems PROFIBUS and PROFINET ensure reliable data transfer thanks to the PROFIsafe safety profile. Safety-related communication (F communication) is based on this and offers solution options for different scenarios with the F system S7 Distributed Safety _as_fe_i_015_v10_de_fcomm Solution options for different scenarios There are the following options for safety-related communication (F communication) in the F system S7 Distributed Safety: Safety-related I-slave-slave communication Communication between Transmission medium I slave Slave PROFIBUS DP Safety-related CPU-CPU communication Communication between Transmission medium Master Master PROFIBUS DP Master I slave PROFIBUS DP I slave I slave PROFIBUS DP Safety-related communication via S7 connections Communication between Transmission medium PROFINET CPU PROFINET CPU Industrial Ethernet A&D Safety Integrated Page 6/50 AS-FE-I-015-V10-EN

7 Which solution option is shown by this safety function example? This safety function example shows safety-related bidirectional master-islave communication via PROFIBUS DP: _as_fe_i_015_v10_de_fcomm Note Consideration of the individual safety functions (e.g. safe shutdown) is not within the scope of this documentation. 2.2 Description of functions Technological description Overview The present example assumes two widely separated hazard areas within a production plant. In each hazard area, a machine represents a potential hazard: The aim is then to exchange safety-related data between the two hazard areas. F communication is used for transferring the safety-related data. A&D Safety Integrated Page 7/50 AS-FE-I-015-V10-EN

8 Details (figure) _as_fe_i_015_v10_de_fcomm Note The terms warning zone and detection zone refer to the laser scanner. You can find a brief explanation of these terms in Section Details (explanation of the figure) Each hazard area is secured by: Laser scanner Emergency stop button Hazard area 1 is monitored by a safety-related CPU (DP master) with a lower-level ET 200S (not intelligent). Hazard area 2 is monitored by a safety-related intelligent ET 200S (I slave). The following data is exchanged from one hazard area to the other hazard area by means of F communication: Machine speed (normal, low, minimum) Emergency stop actuated/not actuated Laser scanner detection zone violated/not violated Laser scanner warning zone violated/not violated Machine in basic position yes/no A&D Safety Integrated Page 8/50 AS-FE-I-015-V10-EN

9 2.2.2 Warning zone and detection zone of the laser scanner This section briefly explains what is meant by warning zone and detection zone. Note You do not require any further information about the laser scanner to understand this safety function example. When parameterizing the laser scanner, the physical extent of a warning zone and a detection zone are usually defined: _as_fe_i_015_v10_de_fcomm Warning zone Violation or non-violation of the warning zone is represented by a bit: 1: Warning zone not violated 0: Warning zone violated This bit must not be used for safety-related decisions.! WARNING Detection zone Violation or non-violation of the detection zone is represented by a bit: 1: Detection zone not violated 0: Detection zone violated The bit is used for safety-related decisions. A&D Safety Integrated Page 9/50 AS-FE-I-015-V10-EN

10 2.2.3 Events and responses in hazard areas 1 and 2 Events in one hazard area generate responses in this and in the other hazard area. The table below provides an overview of this _as_fe_i_015_v10_de_fcomm Event in Response in HA 1 HA 2 HA 1 HA 2 Pressing the e- mergency stop --- pushbutton (*1) Violation of the detection zone --- (*1) Violation of the warning zone Pressing the e- mergency stop pushbutton (*1) Violation of the detection zone (*1) Safe shutdown (*2) of machine M1 Safe shutdown (*2) of machine M1 If machine M1 active: Operate at low speed Safe shutdown (*2) of machine M1 Machine M1 driven to basic position Violation of the warning zone --- Safe shutdown (*2) of machine M2 Machine M2 driven to basic position --- Safe shutdown (*2) of machine M2 Safe shutdown (*2) of machine M2 If machine M2 active: Operate at low speed (*1) Pressing the emergency stop, or violation of the detection zone (laser scanner) results in triggering of the safety equipment. (*2) "Safe shutdown": shutdown due to triggering of safety equipment. Examples: "Detection zone violated" in hazard area 1 (HA1) results in: Safe shutdown of machine M1 and driving of machine M2 to basic position "Warning zone violated" in hazard area 1 (HA1) results in: Low speed of M1 (if active); no response from M2 A&D Safety Integrated Page 10/50 AS-FE-I-015-V10-EN

11 2.2.4 Simplifications in the safety function example Laser scanner This safety function example focuses on the implementation of safetyrelated communication, illustrated by a specific application. To keep the safety function example clear, the following simplifications have been made. A real laser scanner is not used. In the safety function example, the signals for violating the warning zone and detection zone are simulated by signals of a position switch in each case. The following link, for example, takes you to information on the laser scanner: _as_fe_i_015_v10_de_fcomm Hazardous machine Indicator lights are used instead of a real machine. The operating status of each machine is simulated by three indicator lights: Indicator light (red) is ON: Machine operates at normal speed and thus represents a potential hazard. Indicator light (yellow) is ON: Machine operates at low speed. Indicator light (green) is ON: Machine goes to basic position at minimum speed. No more than one indicator light can be on at one time. If all three indicator lights are OFF, this means: Machine is at a standstill. Readback signals The integration and evaluation of readback signals when shutting down actuators is not implemented. The following link, for example, takes you to information on this: The simplifications made here must not be made in a real application! WARNING A&D Safety Integrated Page 11/50 AS-FE-I-015-V10-EN

12 2.3 State machine Preliminary information The functional mechanisms and the S7 program shown later are based on a state machine. This is explained in Section and Note A state machine (1) and a state machine (2) are described. This division is purely for the purposes of clarity: state machine (1) describes the safety case; state machine (2) describes normal operation. In functional terms, the functional mechanisms and the S7 program are based on only one state machine _as_fe_i_015_v10_de_fcomm Scope of the chapter All the statements in this chapter are valid for hazard area 1 (HA1). The same statements apply for hazard area 2. In the state machines (1) and (2) shown later that describe hazard area 1, the relevant numbers in the names for the states and conditions are simply swapped. Example: State "M1 Fast" in HA1 becomes state "M2 Fast" in HA2. Condition START1 in HA1 becomes condition START2 in HA2. Content of this chapter The chapter shows all the states of machine M1: Safe state (after triggering the safety equipment) Operating states All conditions that result in state transitions This is represented in the form of a state machine. The following applies: States are represented by circles Conditions are represented by arrows No more than one state can be active at any given time. A&D Safety Integrated Page 12/50 AS-FE-I-015-V10-EN

13 States There are a total of six states: Status 1: Safety demand States 2 to 6: Operating states No. State Description _as_fe_i_015_v10_de_fcomm 1 Safety Demand 1 Safety equipment activated Emergency stop in HA1 Emergency stop in HA2 Detection zone violation in HA1 Machine M1 goes to the safe state (standstill) 2 M1 Fast Machine M1 operates at normal speed. 3 M1 Slow Machine M1 operates at low speed. 4 M1 Stop Operational stop of M1 Machine M1 is in this state and not in basic position. If this is not the case, a direct jump is made to the state M1 in basic position. 5 M1 drive to basic position 6 M1 in basic position Machine M1 goes to the basic position at minimum speed Machine M1 is in the basic position Conditions There are eight conditions in total for state transitions. No. Condition 1 SAFE_DEM1 (Safety Demand) Description Emergency stop actuated in hazard area 1 (HA1) The detection zone has been violated in hazard area 1 (HA) 2 ACK1 Acknowledge pushbutton pressed 3 START1 Start pushbutton pressed 4 STOP1 Stop pushbutton pressed 5 END_SW1 Limit switch has responded: Machine M1 has reached basic position 6 REQ_BAS_POS1 Pushbutton for "Drive M1 to basic position" actuated 7 LS4WARN1 Warning zone violated 8 SAFE_DEM2 The detection zone has been violated in hazard area 2 (HA2) A&D Safety Integrated Page 13/50 AS-FE-I-015-V10-EN

14 2.3.1 State machine (1): Activation of safety equipment Regardless of the current state of the machine, the state "Safety Demand 1" is reached if the safety equipment (emergency stop, detection zone) triggers in hazard area 1, or if emergency stop has been triggered in hazard area 2. Only the state M1 Stop (operational stop) can be reached from the state "Safety Demand 1" (safety-related stop). For this, the safety equipment must permit acknowledgement with ACK1="1" _as_fe_i_015_v10_de_fcomm Note After "Power off -> Power on" of the automation system, the state "Safety Demand 1" is also assumed in order to guarantee that the machine has to be acknowledged before initial start. A&D Safety Integrated Page 14/50 AS-FE-I-015-V10-EN

15 2.3.2 State machine (2): Normal mode When the safety equipment triggers, state machine (1) has priority _as_fe_i_015_v10_de_fcomm Example 1: Machine M1 is active (state "M1 Fast"). A person now enters the warning zone (LS4WARN=1). This results in the state "M1 Slow" being reached, causing machine M1 to run at lower speed. If this person then exits the warning zone, this in turn results in the state "M1 Fast". Machine M1 accelerates to the speed defined in this state (simulated by indicator lights). Example 2: Machine M1 is in the state "M1 Fast" or "M1 Slow". If a person now enters the detection zone in hazard area 2, SAFE_DEM2 becomes "1" and machine M1 is driven to the basic position. During this action, the state "M1 Drive to basic position" is active. If the basic position is reached (limit switch END_SW1=1), the state "M1 In basic position" is active. Note The state change from "M1 Stop" to "M1 in basic position" via the condition END_SW1 means that it must be possible in this example to drive the machine mechanically to the basic position. A&D Safety Integrated Page 15/50 AS-FE-I-015-V10-EN

16 2.3.3 Simulating a machine with indicator lights The state of each machine (M1 in HA1, M2 in HA2) is simulated using three indicator lights in each case. Each indicator light represents a specific speed of the machine. The indicator lights are controlled via three safetyrelated outputs. Name of output Indicator lights With set output, corresponds to M1_FAST Red Normal speed of M1 M1_SLOW Yellow Low speed of M1 M1_BAS_POS Green Minimum speed of M1 and drive to basic position _as_fe_i_015_v10_de_fcomm Dependent on the active state of the machine at any time, one of the three safety-related outputs are set (S), causing the relevant indicator light to light up. Standstill of the machine is simulated by resetting (R) of all three safetyrelated outputs (all indicator lights are OFF). State M1_FAST M1_SLOW M1_BAS_POS R R R S R R R S R R R R R R S R R R A&D Safety Integrated Page 16/50 AS-FE-I-015-V10-EN

17 2.4 Advantages/customer benefits Advantages/customer benefits of using S7 Distributed Safety Lower wiring costs thanks to use of safety-related S7-CPU and distributed I/O. This advantage becomes all the more effective as the number of implemented safety functions increases. Programming the safety-related program with STEP 7 engineering tools. Only one S7-CPU is necessary for safety-related program sections and standard program sections _as_fe_i_015_v10_de_fcomm Additional advantages/customer benefits of F communication Facility for fail-safe data transfer. Use of off-the-shelf and certified blocks from the library of S7 Distributed Safety (F application examples FB F_SENDDP (FB 223) and FB F_RCVDP (FB 224)). Addresses of the data to be sent and received are simply parameterized on the block in the F program. A&D Safety Integrated Page 17/50 AS-FE-I-015-V10-EN

18 3 Necessary components Instructions Please note the following: The signals of the two laser scanners (detection zone, warning zone) are simulated by two position switches each. The operating states of the machines are simulated by indicator lights. The functions have been tested with the indicated hardware components. Other similar products that deviate from the above list can also be used. In such a case, please note that changes to the example code may be necessary (e.g. other addresses). The HF electronic modules can be replaced by standard modules _as_fe_i_015_v10_de_fcomm Two different PM-E power modules are used, both approved for safety applications. You can also decide on only one type of PM-E power module. Only one power supply and one DIN rail are used for the test configuration. A&D Safety Integrated Page 18/50 AS-FE-I-015-V10-EN

19 Hardware components _as_fe_i_015_v10_de_fcomm Component Type MLFB/Ordering details Power supply PS307 5A 6ES73071EA00-0AA0 1 S7-CPU, suitable for safety CPU 315F-2DP 6ES7315-6FF01-0AB0 1 applications Intelligent interface module for IM F-CPU 6ES7151-7FA01-0AB0 1 ET 200S, suitable for safety applications IM 151 HIGH FEATURE IM HF 6ES BA02-0AB0 1 interface module Power module for ET 200S PM-E V DC 6ES7138-4CA50-0AB0 1 Power module for ET 200S PM-E DC 24/48V/AC24/230V 6ES7138-4CB11-0AB0 1 Order numbers for the ET 4DI DC24V HF 6ES7131-4BD00-0AB S Order numbers for the ET 2DI DC24V HF 6ES7131-4BB01-0AB S Order numbers for the ET 4F-DI/3F-DO DC24V/2A 6ES7138-4FC00-0AB S Order numbers for the ET 4/8 F-DI DC24V 6ES7138-4FA03-0AB S Order numbers for the ET 4F-DO DC24V/2A 6ES7138-4FB02-0AB S Terminal module for ET 200S TM-P15S23-A0 6ES7193-4CD20-0AA0 1 Terminal module for ET 200S TM-P15C23-A1 6ES CC30-0AA0 1 Terminal module for ET 200S TM-E15S24-A1 6ES7193-4CA20-0AA0 3 Terminal module for ET 200S TM-E15S ES CB20-0AA0 1 Terminal module for ET 200S TM-E30C46-A1 6ES7193-4CF50-0AA0 3 Mounting rail mm 6ES7390-1AE80-0AA0 1 Standard mounting rail 35 mm, length: 483 mm 6ES5710-8MA11 1 Micro Memory Card MMC 2 MB 6ES7953-8LL20-0AA0 1 Micro Memory Card MMC 512 KB 6ES7953-8LJ20-0AA0 1 Position switches with metal enclosure, 2 NC 3SE2120-6XX 2 Actuator 3SX Position switches Roller lever, 2 NC 3SE2100-8EV00 2 Emergency stop Mushroom button 1NC 3SB3801-0DG3 2 Base element (for emergency Screw-type terminal, 1NC 3SB3420-0C 2 stop) Pushbutton Red, 1NC 3SB3801-0DB3 4 Pushbutton Green, 1NO 3SB3801-0DA3 6 Indicator light Red 3SB3217-6AA20 2 including lamp Indicator light Yellow 3SB3217-6AA30 2 including lamp Indicator light including lamp Green 3SB3217-6AA40 2 No. of Manufacturer SIEMENS AG Configuring software/tools Component Type MLFB/Ordering details No. of Manufacturer SIMATIC STEP 7 V5.4 + SP3 ES7810-4CC08-0YA5 1 SIMATIC Distributed Safety V5.4 + SP4 ES7833-1FC02-0YA5 1 SIEMENS AG A&D Safety Integrated Page 19/50 AS-FE-I-015-V10-EN

20 4 Design and Wiring 4.1 Overview of the hardware structure The example used to demonstrate F communication consists of two safetyrelated S7-CPUs in a DP master-slave arrangement _as_fe_i_015_v10_de_fcomm The warning zone of each laser scanner is simulated by the (nonsafety-related) signal LS4WARN1 or LS4WARN2 (condition in the state machine and bit in the S7 program). The detection zone of the laser scanner is simulated by the (safetyrelated) signal OSSD1 or OSSD2 (leads to the state "Safety Demand 1" and "Safety Demand 2" in the state machine and in the S7 program). The emergency stop affects the local and the remote hazard area. Each of the two hazardous machines is simulated by three indicator lights each. The components of the safety equipment are: Detection zone of the laser scanner (simulated by position switch) Emergency stop button A&D Safety Integrated Page 20/50 AS-FE-I-015-V10-EN

21 4.2 Wiring of the hardware components Hardwarecomponents Requirement: The power supply is supplied with 230 V AC. Check in advance the addresses set on the hardware components listed below: Address to be set IM 151 HF 6 (PROFIBUS address) You can change this 4F-DI/3F-DO Switch position: F-DI F-DO Switch position: Switch position: Note The PROFIsafe addresses are automatically assigned when configuring the fail-safe modules in STEP 7. PROFIsafe addresses 1 to 1022 are permissible. Please ensure that the setting on the address switch (DIL switch) on the module side agrees with the PROFIsafe address in the hardware configuration of STEP _as_fe_i_015_v10_de_fcomm Note The DP interface on the CPU 315F-2DP must be connected with the DP interface on the IM 151 HF. A&D Safety Integrated Page 21/50 AS-FE-I-015-V10-EN

22 A&D Safety Integrated Page 22/50 AS-FE-I-015-V10-EN

23 4.3 Function test The inputs and outputs used can be checked with regard to functionality if the following conditions are met: The hardware components are wired The STEP 7 project has been loaded into both F-CPUs Both F-CPUs are in RUN mode Inputs and outputs used for hazard area 1 (HA1) No. HW component Address Symbol Signal (Default value) in the passive state Note 1 Pushbutton (NO) I 0.0 ACK1 0 Acknowledgement 2 Pushbutton (NO) I 0.1 START1 0 Start request 3 Pushbutton (NC) I 0.2 STOP1 1 Stop request 4 Pushbutton (NC) I 0.3 LS4_WARN1 1 Simulates the warning zone of a laser scanner 5 Pushbutton (NO) I 8.0 REQ_BAS_POS1 0 Request to drive to basic position 6 Pushbutton (NC/NC) I 1.0 ESTP1 1 Emergency stop 7 Position pushbutton (NC/NC) I 1.1 OSSD 1 1 Simulates the detection zone of a laser scanner 8 Limit switch (NC/NC) I 1.2 END_SW1 1 Passive state: Basic position not reached 9 Indicator lights Q 1.0 M1_FAST "0" Normal speed 10 Indicator lights Q 1.1 M1_SLOW 0 Low speed 11 Indicator lights Q 1.2 M1_BAS_POS 0 Minimum speed Inputs and outputs used for hazard area 2 (HA2) No. HW component Address Symbol Signal (Default value) in the passive state Note 1 Pushbutton (NO) I 11.0 ACK2 0 Acknowledgement 2 Pushbutton (NO) I 11.1 START2 0 Start request 3 Pushbutton (NC) I 11.2 STOP2 1 Stop request 4 Pushbutton (NC) I 11.3 LS4_WARN2 1 Simulates the warning zone of a laser scanner 5 Pushbutton (NO) I 12.0 REQ_BAS_POS2 0 Request to drive to basic position 6 Pushbutton (NC/NC) I 0.0 ESTP2 1 Emergency stop 7 Position pushbutton (NC/NC) I 0.1 OSSD 2 1 Simulates the detection zone of a laser scanner 8 Limit switch (NC/NC) I 0.2 END_SW2 1 Passive state: Basic position not reached 9 Indicator lights Q 6.0 M2_FAST "0" Normal speed 10 Indicator lights Q 6.1 M2_SLOW "0" Low speed 11 Indicator lights Q 6.2 M2_BAS_POS "0" Minimum speed A&D Safety Integrated Page 23/50 AS-FE-I-015-V10-EN

24 Testing the inputs and outputs You can test the inputs and outputs by means of the instructions in Section 6.7 "Operating instructions". 4.4 Important settings of the hardware components The STEP 7 project supplied for the present safety function example contains the hardware configuration and the example code. Below is an overview of some important settings from the hardware configuration of STEP 7. If you make changes to the hardware configuration of STEP 7 (e.g. adding another module), the example code of the supplied STEP 7 project must also be adapted accordingly. Overview screen The PROFIBUS address is set on the IM 151 HF using DIP switches. A&D Safety Integrated Page 24/50 AS-FE-I-015-V10-EN

25 Settings of the CPU 315F-2DP Can be reached by double-clicking on "CPU 315F-2 DP" (see Overview ). Display Note The default value (100 ms) is used for OB 35. Please note that the F monitoring time must be greater than the call time of OB 35 (see "Settings of the safety-related DI", or "Settings of the safetyrelated DO"). A password must be assigned to enable setting of the parameter "CPU contains safety program". Only in this case will all the F-blocks required for the safe operation of the F-modules be generated in this case when the hardware configuration of STEP 7 is compiled. Password used here: siemens Set mode: "Test mode" In process operation, test functions such as program status or monitor/modify tags are restricted so that the set permissible cycle time extension is not exceeded. Testing by means of breakpoints and step-by-step program execution cannot be carried out. In Test mode, all the test functions can be used without restriction via the PG/PC, although this may greatly extend the cycle time. Important: If the S7 CPU is in test mode, you must ensure that the S7 CPU and the process can handle significant cycle time increases. A&D Safety Integrated Page 25/50 AS-FE-I-015-V10-EN

26 Settings of the safety-related 4F-DI/3F-DO Can be reached by double-clicking on "4F-DI/3F-DO". The actuators and sensors of HA1 are connected here. Display Note Parameters/F parameters: DIP switch setting (9 0) This value must be set on the F module (F-DI). F-monitoring time (ms) The F-monitoring time must be greater than the call time of OB35. Parameters/module parameters: A cross-circuit detection is implemented. To do so, the cyclic shortcircuit test and the encoder supply must be activated via the F module. Short-circuit test Cyclic short-circuit test is activated Behavior after channel faults In the event of a channel fault, the entire F module is passivated. Parameters/module parameters: Assignment of the input channels: Channel 0, 4 Channel 0: ESTP1 Channel 1, 5 Channel 1: OSSD1 Channel 2, 6 Channel 2: END_SW1 Used channels are activated, unused channels are deactivated. A&D Safety Integrated Page 26/50 AS-FE-I-015-V10-EN

27 Display Note Parameters/module parameters: Assignment of the output channels: DO Channel 0 Channel 0 switches M1_FAST DO Channel 1 Channel 1 switches M1_SLOW DO Channel 2 Channel 2 switches M1_BAS_POS Read-back time The read-back time defines the duration of the shutdown cycle for the channel. You should set an adequately high read-back time if the channel switches high capacitive loads. We recommend that you keep the read-back time as low as possible by testing, but high enough that the channel is not passivated. Settings of the safety-related 4/8 F-DI and 4 F-DO The same statements apply by analogy for the safety-related 4F-DI/3F-DO. The actuators and sensors of HA2 are connected here. A&D Safety Integrated Page 27/50 AS-FE-I-015-V10-EN

28 5 Key performance data Load memory and RAM of the master CPU (315F-2DP) Total Of which: S7 standard blocks Of which: F-blocks Load memory 68 KB 2 KB 66 KB RAM 49 KB 1 KB 48 KB Load memory and RAM of the slave CPU (IM 151-7F) Total Of which: S7 standard blocks Of which: F-blocks Load memory 71 KB 2 KB 69 KB RAM 49 KB 1 KB 48 KB Cycle time for the master CPU (315F-2DP) and slave CPU (IM 151-7F) Typical total cycle time (standard program and safety program) Maximum runtime safety program Time approx. 2 ms Remark Measurement in the S7-CPU ("Module status CPU"/"Cycle time") 12 ms Calculation with an Excel file available for S7 Distributed Safety. Use the Excel file that is available for S7 Distributed Safety V5.4 to calculate the maximum response time of your F system. You can find this file on the Internet at: A&D Safety Integrated Page 28/50 AS-FE-I-015-V10-EN

29 6 Example code 6.1 Download Preliminary remark The STEP 7 project supplied for the present safety function example contains the hardware configuration and the example code. The example code is described below. The example code implements the required functionality and is always assigned to the components used in the safety function example. Any tasks beyond this scope must be implemented by the user. The example code can be used as a basis. Password The password for all cases is: siemens Download You can find the following file with the STEP 7 project among the downloads on the HTML page of the safety function example: _as_fe_i_015_v10_code_fcomm.zip Save this file to any folder on your PC/PG. Start STEP 7 and de-archive the file to any folder. Requirements for loading: There are empty MMCs in the S7 CPUs The S7-CPUs have been reset Proceed as follows in STEP 7 to load the STEP 7 project into the relevant S7 CPU: First step: Loading onto DP master (hazard area 1) First: connect the PG via MPI to the S7 CPU. To do so: In STEP 7, change the PG interface to MPI (auto: MPI=2). Then: Load the hardware configuration onto the S7 CPU Change to SIMATIC Manager Select the block container belonging to the master CPU Select "Edit Safety Program" in the "Tools" menu. Click on "Load" to load the example code (F and standard blocks) into the master CPU. A&D Safety Integrated Page 29/50 AS-FE-I-015-V10-EN

30 Second step: Loading onto I slave (hazard area 2) First: connect the PG via DP to the S7-CPU. To do so: in STEP 7, change the PG interface to PROFIBUS Then: Load the hardware configuration first onto the S7-CPU Change to SIMATIC Manager Select the block container belonging to the I slave CPU Select "Edit Safety Program" in the "Tools" menu. Click on "Load" to load the example code (F and standard blocks) into the I slave CPU 6.2 Functionality of the STEP 7 project Use of the STEP 7 project The STEP 7 project shows the use of F communication for exchanging safety-related data. Functionality within a hazard area The following functionality is implemented with the STEP 7 project: Start of the machine Only possible if the machine is in the basic position. For the first time only after acknowledgement Operational stopping of the machine The machine is also safely switched off if: The basic position is reached (limit switch: "1->0") Local detection zone violated (in addition, drive to basic position in the external hazard area) Local and emergency stop of the external hazard area actuated Reintegration of the passivated F module takes place only after the F module is ready for reintegration and an acknowledge signal has been set. A&D Safety Integrated Page 30/50 AS-FE-I-015-V10-EN

31 Functionality between the hazard areas Triggering of safety equipment in a hazard area results in the following behavior: Safe shutdown of the machine in this local hazard area The response in the external hazard area depends on the action triggered by the safety equipment: Emergency stop in the local hazard area Also results in safe shutdown in the external hazard area Detection zone violation in the local hazard area Results in basic position in the external hazard area The following states of a hazard area are transferred to the other hazard area (via F communication): Operating status of the machine: Normal speed Low speed Drive to basic position (at minimum speed) Emergency stop pushbutton actuated/not actuated Detection zone laser scanner: violated/not violated Laser scanner warning zone violated/not violated Machine in basic position yes/no A&D Safety Integrated Page 31/50 AS-FE-I-015-V10-EN

32 6.3 Overview of the program structure The statements made in this chapter apply both for the master CPU (315F-2DP) and for the slave CPU (IM 151-7F). Overview of the program structure The standard program consists essentially of the state machine introduced in Section 2.3. The safety program consists essentially of the following modular program blocks: Send and receive blocks for safety-related communication (F_SENDDP and F_RCVDP) Programming of the safety equipment (emergency stop, detection zone of the laser scanner, limit switch monitoring) Depassivation (reintegration) of passivated F modules The following figure provides an overview: DP master and I slaves The program structure of both F-CPUs is identical. The two S7 projects differ in programming only in the variable names and the constants to be parameterized in blocks: START1 is, for example, the start request in hazard area 1 START2 is, for example, the start request in hazard area 2 For this reason, only the program execution of the DP master (315F-2DP) for hazard area 1 is considered in the following. A&D Safety Integrated Page 32/50 AS-FE-I-015-V10-EN

33 6.4 Program execution of the standard program OB1 The state machine is called in OB 1. Note The state machine is explained in Section 2.3. A&D Safety Integrated Page 33/50 AS-FE-I-015-V10-EN

34 6.5 Program execution of the safety program F-CALL (FC1) F-CALL (FC1) is the F-runtime group and is called from the watchdog interrupt OB (OB35). F-CALL (FC1) calls the F-program block (in this case: FB1). FB F_MAIN_PRG (FB1, DB1) The following F-blocks are then called consecutively: Network 1: FB F_RCVDP (FB 224, DB 224) Network 2: FB F_EVENTS (FB 2, DB 2) Network 3: FB DEPASS (FC 2) Network 4: FB F_SENDDP (FB 223, DB 223) FB F_RCVDP (FB 224, DB 224) The FB is a certified block from the library of S7 Distributed Safety. In the block shown below, the data from hazard area 2 is safely received. A&D Safety Integrated Page 34/50 AS-FE-I-015-V10-EN

35 Explanation of the TIMEOUT parameter Time monitoring is carried out in the F application blocks F_SENDDP and F_RCVDP with the same monitoring time that has to be parameterized on both F application blocks. To avoid the monitor responding when there is no fault, a sufficiently high TIMEOUT monitoring time must be selected. You can calculate the value as follows: Using a formula or direct Using the Excel file for S7 Distributed Safety V 5.4: Calculation using formula: The following applies for safety-related master-i-slave communication: You will find the formula in the system manual Safety Engineering in SIMATIC S7: Calculation using the Excel file for S7 Distributed Safety V 5.4: You will find the Excel file via the following link: Go to the tab min. F monitoring times, select the version, and enter the relevant time values. The result is displayed in the field minimum value for TIMEOUT. A&D Safety Integrated Page 35/50 AS-FE-I-015-V10-EN

36 FB F_EVENTS (FB 2, DB 2) Call This FB contains the safety equipment of hazard area 1. Variable ESTP1 OSSD1 ACK1 STATE_M1_FAST STATE_M1_DRIVE_TO_BASPOS STATE_M1_SLOW M1_FAST M1_SLOW M1_BAS_POS Emergency stop Note Detection zone laser scanner Acknowledgement State in accordance with state machine (Chap. 2.3) Speed normal Speed low Speed minimum A&D Safety Integrated Page 36/50 AS-FE-I-015-V10-EN

37 Network 1-4 The F outputs are switched on and safely switched off in dependence on the current state from the state machine and the release of the safety equipment. FC DEPASS (FC 2) The FC DEPASS (FC 2) is called here. In the case of passivation of the F-DI or F-DO, depassivation (reintegration) is implemented in FC2. Passivation is indicated by the "SF" LED lighting up on the F module. Reintegration of an F module can take approximately one minute. A&D Safety Integrated Page 37/50 AS-FE-I-015-V10-EN

38 FB F_SENDDP (FB 223, DB 223) The FB F_SENDDP (FB 223, DB 223) is called here. The FB F_SENDDP (FB 223, DB 223) is a certified block from the library of S7 Distributed Safety. In the block shown below, the data is sent safely from hazard area 1 to hazard area 2. Note To calculate the time value for TIMEOUT, the same statements apply as have been described above in the case of FB F_RCVDP (FB 224, DB 224). A&D Safety Integrated Page 38/50 AS-FE-I-015-V10-EN

39 6.6 Variable tables VAT For the two STEP 7 projects, there are two prepared variable tables with the help of which you can conveniently observe the data exchange between both F-CPUs: S7-Station DP_Master: F_Comm1 IOs1 Display S7-Station I_Slave: F_Comm2 IOs2 A&D Safety Integrated Page 39/50 AS-FE-I-015-V10-EN

40 6.7 Operating instructions Requirements The inputs and outputs have the default values specified in Section 4.3 ("Inputs and outputs used"). Note In the table below, hazard area is abbreviated to HA. Table No. Action Response HA1 HA2 1 HA1: Set basic position (END_SW1=0) 2 HA1: Acknowledgement (ACK1="0->1->0") 3 HA1: Start Start1= "0 -> 1 -> 0" and immediately END_SW1=1 4 No. 1 to 3 analogously for GFB2 5 HA1: Stop (STOP1="1->0->1") 6 HA1: Set basic position (END_SW1=0) M1_FAST M1_SLOW M1_BAS_POS M2_FAST M2_SLOW M2_BAS_POS 7 HA1: Start Start1= "0 -> 1 -> 0" and immediately END_SW1=1 8 No. 5 to 7 analogously for GFB2 9 HA1: Warning zone violated (LS4_WARN1=0) 10 HA2: Detection zone violated (OSSD2=0) 11 Detection zone or warning zone exited again: LS4_WARN1=1 and OSSD2=1 12 HA1: Set basic position (END_SW1=0) 13 As No. 2 to 3 14 As No HA2: Warning zone violated (LS4_WARN2=0) 16 HA1: Emergency stop pressed (ESTP1=0) A&D Safety Integrated Page 40/50 AS-FE-I-015-V10-EN

41 6.8 Diagnostics options in the event of a communication error How do you recognize a communication error? If a communication error occurs, the outputs ERROR and SUBS_ON are set to 1 signal on both F application blocks. Note Please note that the ERROR output (1=communication error) is set for the first time in the case of a communication error when communication between the connection partners F_SENDDP and F_RCVDP has already been established once. How does the receiver behave in the case of a communication error? F_RCVDP outputs substitute values parameterized at its inputs SUBBO_xx. While the output SUBS_ON = 1, the output SENDMODE is not updated. How does the sender behave in the case of a communication error? The send data of F_SENDDP that are present at the inputs SD_BO_xx and SUBI_xx are only output again when no communication error is detected anymore (ACK_REQ = 1) and if acknowledgement is made with a positive edge at the input ACK_REI. Further aids If communication cannot be established after startup of the sending and receiving F system, please check the following: Configuration of the safety-related CPU-CPU communication Parameterization of F-SENDDP and F_RCVDP The bus connection You can also obtain information on possible error causes by evaluating the outputs RETVAL14 or RETVAL15. Note In general, always evaluate RETVAL14 and RETVAL15 as it may be that only one of the two outputs contains error information. A&D Safety Integrated Page 41/50 AS-FE-I-015-V10-EN

42 7 Background information What is found here? This chapter provides you with additional information designed to support you in setting up F communication to suit your individual requirements. The points listed below are already integrated into the supplied STEP 7 project. Connection between master CPU and I slave Information on the F application blocks (SEND/RECEIVE) Parameterization of the F connection 7.1 Connection between master CPU and I slave Objective Setting up a PROFIBUS DP connection between a DP master and an intelligent DP slave. Basic principle DP master and I slave must be connected via a shared data area. The settings for this are made in the hardware configuration of STEP 7. Safety aspect A PROFIBUS DP connection between a DP master with safety-related functionality and an intelligent DP slave with safety-related functionality is set up in the same way as with standard components. Table of steps The table below shows the steps for setting up the PROFIBUS DP connection. No. Action 1 Enter the DP Slave (I slave) into the SIMATIC Manager: Menu: Insert -> Station -> SIMATIC 300 Station Screen/information 2 Rename the station. A&D Safety Integrated Page 42/50 AS-FE-I-015-V10-EN

43 No. Action 3 Enter the I slave (here: IM151-7F- CPU) from the catalog of the Hardware Configuration of STEP 7 by dragging and dropping. Screen/information 4 Enter the relevant ET 200S modules. 5 Set the PROFIBUS connection (double-click on MPI/DP). 6 Check whether DP slave is set. 7 Select the Configuration tab. A&D Safety Integrated Page 43/50 AS-FE-I-015-V10-EN

44 No. Action 8 Configure (for non-safe data exchange) the input of the slave (via New) Screen/information 9 Configure (for non-safe data exchange) the output of the slave (via New) 10 Hardware configuration of STEP 7: Double-click CPU -> Protection tab -> Password->CPU contains safety program Menu: Edit -> Save and Compile 11 Enter the DP master including the rack with the associated ET 200S modules in the same way as the previous steps. A&D Safety Integrated Page 44/50 AS-FE-I-015-V10-EN

45 No. Action 12 From the Catalog: Enter Already configured stations by dragging and dropping: ET200S / CPU Screen/information 13 Connection tab -> Connect 14 Change to the Configuration tab. 15 Enter the partner address (for nonsafe data exchange) via Edit (or by double-clicking) (for "Line 1" and "Line 2" from No. 14). A&D Safety Integrated Page 45/50 AS-FE-I-015-V10-EN

46 No. Action 16 Parameterization of the F connection Screen/information See next Section 6.2.2: "Table of steps" 17 In the hardware configuration of STEP7: Double-click CPU -> Protection tab -> Password->CPU contains safety program -> Save & Compile 18 Load the hardware configuration of STEP 7 (DP slave) into the IM 151-7F-CPU (download). 19 Load the hardware configuration of STEP 7 (DP master) into the CPU 315F-2DP (download). Check the set PG/PC interface: Menu: Options -> Set PG/PC interface -> PROFIBUS A&D Safety Integrated Page 46/50 AS-FE-I-015-V10-EN

47 7.2 Structure of F communication What is found here? The chapter shows how to handle the F application blocks FB F_RCVDP (FB 224) and FB F_SENDDP (FB 223) General information on the F application blocks Call sequence From the F program block, FB F_RCVDP (FB 224) mustbe called as the first and FB F_SENDDP (FB 223) as the last. Calling both blocks from a different program block than the F program block is not possible! Volume of data to be sent The F application block F_SENDDP sends the following data in a fail-safe way via PROFIBUS DP to another F-CPU: 16 data items of data type BOOL 2 data items of data type INT There the data is received by the associated F-application block F_RCVDP. A&D Safety Integrated Page 47/50 AS-FE-I-015-V10-EN

48 7.2.2 Parameterization of the F connection Requirements A connection has been set up between a safety-related DP master and a safety-related I slave (see Section 7.1). Table of steps for parameterizing the F connection No. Action 1 Double-click in the hardware configuration of STEP 7 (for the I slave) MPI/DP. 2 Go to the F Communication tab. 3 Enter the password siemens. 4 Click on the New button 5 Click on the line highlighted in the figure and set the mode F-MS-R. 6 Conclude with <OK>. Screen/information 7 Click on New. 8 Click on the line highlighted in the figure and set the mode F-MS-R. 9 Conclude with <OK>. A&D Safety Integrated Page 48/50 AS-FE-I-015-V10-EN

49 7.2.3 Configuration and F Configuration tabs The Configuration tab has the following appearance: The first two entries result from the parameterization of the address communication area between DP master and I slave. Entries 3 to 6 are created automatically. It is very important to observe the following information: Note In the object properties of the I slave, entries from the F Configuration tab are automatically made in the Configuration tab. These entries should not be changed. Otherwise, safety-related master-i-slave communication will not be possible. You can see the assigned address areas in the DP master and I slave from the Configuration tab Important assignments The following deals with the values parameterized at the formal parameters DP_DP_ID and LADDR of FB F_RCVDP and FB F_SENDDP. Assigning F-CPU to DP_DP_ID The assignment shown in the figure below applies: The value for the relevant address relationship (input parameter! DP_DP_ID; data type:int) is freely selectable but must be unique for WARNING all safety-related communication connections on the network. A&D Safety Integrated Page 49/50 AS-FE-I-015-V10-EN

50 Assigning F-CPU to LADDR LADDR is the starting address of the assigned logic address area via which the data is exchanged. Each of the local and partner addresses represents a starting address of an address area of output and input data. The address areas are assigned automatically once the local and partner addresses have been configured. The following applies for the DP master: The partner address for sending is created at F_SENDDP. Line mode: F-MS-R The partner address for receiving is created at F_RCVDP. Line mode: F-MS-S The following applies for the I slave: The local address for sending is created at F_SENDDP. Line mode: F-MS-S The local address for receiving is created at F_RCVDP. Line mode: F-MS-R Hardware configuration of STEP 7 The following thus always applies for safety-related master-i-slave communication: Enter the partner addresses for the communication connections at F_SENDDP or F_RCVDP of the DP master. Enter the local address for the communication connections at F_SENDDP or F_RCVDP of the DP slave. 8 History Version Date Differences V / 2008 First edition A&D Safety Integrated Page 50/50 AS-FE-I-015-V10-EN