IST Intelligent Safety Technology. Application Manual SYSTEM200 DOK-CONTRL-IST********-AW01-EN-P

Transcription

1 IST Intelligent Safety Technology Application Manual SYSTEM200

2 About this Documentation IST Intelligent Safety Technology Title Type of Documentation IST Intelligent Safety Technology Application Manual Document Typecode Internal File Reference Document Number B315-01/EN Purpose of Documentation This documentation is used as description and project planning instruction for using the Intelligent Safety Technology. Record of Revisions Description Release Date Notes B315-01/EN First Issue Copyright 2003 Bosch Rexroth AG Copying this document, giving it to others and the use or communication of the contents thereof without express authority, are forbidden. Offenders are liable for the payment of damages. All rights are reserved in the event of the grant of a patent or the registration of a utility model or design (DIN 34-1). Validity The specified data is for product description purposes only and may not be deemed to be guaranteed unless expressly confirmed in the contract. All rights are reserved with respect to the content of this documentation and the availability of the product. Published by Bosch Rexroth AG Bgm.-Dr.-Nebel-Str. 2 D Lohr a. Main Telephone +49 (0)93 52/40-0 Tx Fax +49 (0)93 52/ Dept. BRC/ESM3 (MaMu) Dept. BRC/ESM6 (DiHa) Note This document has been printed on chlorine-free bleached paper.

3 IST Intelligent Safety Technology Contents I Contents 1 Preface Documentation BG-PRÜFZERT Symbol Prototype Test Certification Important Directions for Use Appropriate Use Introduction Areas of Use and Application Inappropriate Use Safety Instructions for Electric Drives and Controls Introduction Explanations Hazards by Improper Use General Information Protection Against Contact with Electrical Parts Protection Against Electric Shock by Protective Low Voltage (PELV) Protection Against Dangerous Movements Protection Against Magnetic and Electromagnetic Fields During Operation and Mounting Protection Against Contact with Hot Parts Protection During Handling and Mounting Battery Safety Protection Against Pressurized Systems Safety Technology Basics General Analysis of Dangers and Risk Assessment Safety-Relevant Standards and Regulations Component-Relevant Standards Machine-Relevant Standards Overview of Required Safety Categories in C Standards Definition of Terms Intelligent Safety Technology (IST) Bosch Rexroth Control and Drive System with Intelligent Safety Technology Basic Structure and Functions Comparison with Conventional Safety Technology

4 II Contents IST Intelligent Safety Technology 5.3 Overview of Safety Functions Functioning of Intelligent Safety Technology Dual Channel Structure Two-way Data Comparison Forced dynamics IST Safety Functions Overview of Safety Functions for Protection of Persons Safe Stop Safe Operation Stop Safely Reduced Speed Safely Limited Absolute Positions Safe Cams Consent Safe Referencing Switching between Two Safety Functions Description of Safety Parameters Password Protection Transferring Safety I/O Signals Technical Data of RMP12.2 Safety I/O Module Processing of Safety Output Signals Starting Lockout as a Shutdown Circuit of the CNC Reaction Times and Braking Paths Introduction Basic Procedure Determining the Drive Reaction / Using an Intermediate Circuit Short-Circuit Reaction Times and Braking Paths When Monitors within Safety Function Safe Stop are Activated Reaction Times and Braking Paths When Monitors within Safety Function Safe Operating Stop are Activated Reaction Times and Braking Paths Determined by the Control Reaction Times and Braking Paths Determined by the Drive Overall Reaction Times and Braking Paths Reaction Times and Braking Paths when Monitors within Safety Function Safely Reduced Speed with Safely Limited Absolute Position are Activated Reaction Times and Braking Paths Determined by the Control Reaction Times and Braking Paths Determined by the Drive Overall Reaction Times and Braking Paths Installation Guidelines for Drive Control Devices Planning a System with Bosch Rexroth IST Rules for Using the Safety Functions Residual Risks Sample Application General Sample switching setup

5 IST Intelligent Safety Technology Contents III CNC Shutdown Circuit Emergency Stop Chain PLC Program Safety Parameters Commissioning of Intelligent Safety Technology Notes Regarding Safety General Notes Instructions for First-Time Commissioning Serial commissioning Acceptance and Logging the Safety Functions Complete Acceptance Test Partial Acceptance Test Acceptance report Sample Machine and Axis Report Commissioning of IST for Series Machines Subsequent System Modifications Making Modifications Logging and Acceptance Procedure for Software and Firmware Updates Error Messages and Error Elimination CNC Error Messages (Channel 1) Error Messages for Drives (Channel 2) FB DYNAM Forced Dynamics Error Messages Appendix Selection Lists for IST Components Control Modules in PC Format (MTC200-P) Control Modules in RECO Format (MTC200-R) Firmware for Intelligent Safety Technology Version Firmware for Intelligent Safety Technology as of Version Safety I/O Module DIAX04 Drive Components Explanations of Configurations Overview of Safety Parameters for MTC200 and DIAX04 Drives Acceptance Report Machine Report Axis Report Acceptance Report, Machine Acceptance Inspection of Safety Functions of the Axis Index Service & Support 14-1

6 IV Contents IST Intelligent Safety Technology 14.1 Helpdesk Service-Hotline Internet Vor der Kontaktaufnahme... - Before contacting us Kundenbetreuungsstellen - Sales & Service Facilities

7 IST Intelligent Safety Technology Preface Preface 1.1 Documentation 1.2 BG-PRÜFZERT Symbol This documentation describes the design and utilization of Intelligent Safety Technology (IST). In addition to the general safety technology, the safety functions and the required hardware and software components are described. The planning and commissioning of Intelligent Safety Technology are also covered in this documentation. Additional documentation is available for user-based activities such as general design and parts programming. In this case, contact your local sales partner. Fig. 1-1: BG-PRÜFZERT symbol with certification number BG-Zeichen.tif

8 1-2 Preface IST Intelligent Safety Technology 1.3 Prototype Test Certification Fig. 1-2: Prototype test certification BG-Baumuster.jpg

9 IST Intelligent Safety Technology Important Directions for Use Important Directions for Use 2.1 Appropriate Use Introduction Bosch Rexroth products represent state-of-the-art developments and manufacturing. They are tested prior to delivery to ensure operating safety and reliability. The products may only be used in the manner that is defined as appropriate. If they are used in an inappropriate manner, then situations can develop that may lead to property damage or injury to personnel. Note: Bosch Rexroth, as manufacturer, is not liable for any damages resulting from inappropriate use. In such cases, the guarantee and the right to payment of damages resulting from inappropriate use are forfeited. The user alone carries all responsibility of the risks. Before using Bosch Rexroth products, make sure that all the prerequisites for appropriate use of the products are satisfied: Personnel that in any way, shape or form uses our products must first read and understand the relevant safety instructions and be familiar with appropriate use. If the product takes the form of hardware, then they must remain in their original state, in other words, no structural changes are permitted. It is not permitted to decompile software products or alter source codes. Do not mount damaged or faulty products or use them in operation. Make sure that the products have been installed in the manner described in the relevant documentation.

10 2-2 Important Directions for Use IST Intelligent Safety Technology Areas of Use and Application For Intelligent Safety Technology IST Bosch Rexroth defines appropriate use as..[outline the basic purpose and/or use of the product described]. Control and monitoring of (the) IST may require additional sensors and actors. Note: Intelligent Safety Technology IST may only be used with the accessories and parts specified in this document. If a component has not been specifically named, then it may not be either mounted or connected. The same applies to cables and lines. Operation is only permitted in the specified configurations and combinations of components using the software and firmware as specified in the relevant function descriptions. 2.2 Inappropriate Use Every drive controller has to be programmed before starting it up, making it possible for the motor to execute the specific functions of an application. Intelligent Safety Technology IST belonging to line IST have been developed for use in single or multiple-axis drives and control tasks. Available for application-specific use of IST are unit types with differing drive power and different interfaces. Typical applications of IST of line IST are: [Handling and assembly systems], [Packaging and foodstuff machines], [Printing and paper processing machines] and [Machine tools]. The Intelligent Safety Technology IST may only be operated under the assembly, installation and ambient conditions as described here (temperature, system of protection, humidity, EMC requirements, etc.) and in the position specified. Using the Intelligent Safety Technology IST outside of the abovereferenced areas of application or under operating conditions other than described in the document and the technical data specified is defined as inappropriate use". Intelligent Safety Technology IST may not be used if they are subject to operating conditions that do not meet the above specified ambient conditions. This includes, for example, operation under water, in the case of extreme temperature fluctuations or extremely high maximum temperatures or if Bosch Rexroth has not specifically released them for that intended purpose. Please note the specifications outlined in the general Safety Guidelines!

11 IST Intelligent Safety Technology Safety Instructions for Electric Drives and Controls Safety Instructions for Electric Drives and Controls 3.1 Introduction Read these instructions before the initial startup of the equipment in order to eliminate the risk of bodily harm or material damage. Follow these safety instructions at all times. Do not attempt to install or start up this equipment without first reading all documentation provided with the product. Read and understand these safety instructions and all user documentation of the equipment prior to working with the equipment at any time. If you do not have the user documentation for your equipment, contact your local Bosch Rexroth representative to send this documentation immediately to the person or persons responsible for the safe operation of this equipment. If the equipment is resold, rented or transferred or passed on to others, then these safety instructions must be delivered with the equipment. WARNING Improper use of this equipment, failure to follow the safety instructions in this document or tampering with the product, including disabling of safety devices, may result in material damage, bodily harm, electric shock or even death! 3.2 Explanations The safety instructions describe the following degrees of hazard seriousness in compliance with ANSI Z535. The degree of hazard seriousness informs about the consequences resulting from noncompliance with the safety instructions. Warning symbol with signal word Degree of hazard seriousness according to ANSI Death or severe bodily harm will occur. DANGER Death or severe bodily harm may occur. WARNING Bodily harm or material damage may occur. CAUTION Fig. 3-1: Hazard classification (according to ANSI Z535)

12 3-2 Safety Instructions for Electric Drives and Controls IST Intelligent Safety Technology 3.3 Hazards by Improper Use DANGER High voltage and high discharge current! Danger to life or severe bodily harm by electric shock! DANGER Dangerous movements! Danger to life, severe bodily harm or material damage by unintentional motor movements! WARNING High electrical voltage due to wrong connections! Danger to life or bodily harm by electric shock! WARNING Health hazard for persons with heart pacemakers, metal implants and hearing aids in proximity to electrical equipment! Surface of machine housing could be extremely hot! Danger of injury! Danger of burns! CAUTION CAUTION Risk of injury due to improper handling! Bodily harm caused by crushing, shearing, cutting and mechanical shock or incorrect handling of pressurized systems! Risk of injury due to incorrect handling of batteries! CAUTION

13 IST Intelligent Safety Technology Safety Instructions for Electric Drives and Controls General Information Bosch Rexroth AG is not liable for damages resulting from failure to observe the warnings provided in this documentation. Read the operating, maintenance and safety instructions in your language before starting up the machine. If you find that you cannot completely understand the documentation for your product, please ask your supplier to clarify. Proper and correct transport, storage, assembly and installation as well as care in operation and maintenance are prerequisites for optimal and safe operation of this equipment. Only persons who are trained and qualified for the use and operation of the equipment may work on this equipment or within its proximity. The persons are qualified if they have sufficient knowledge of the assembly, installation and operation of the equipment as well as an understanding of all warnings and precautionary measures noted in these instructions. Furthermore, they must be trained, instructed and qualified to switch electrical circuits and equipment on and off in accordance with technical safety regulations, to ground them and to mark them according to the requirements of safe work practices. They must have adequate safety equipment and be trained in first aid. Only use spare parts and accessories approved by the manufacturer. Follow all safety regulations and requirements for the specific application as practiced in the country of use. The equipment is designed for installation in industrial machinery. The ambient conditions given in the product documentation must be observed. Use only safety features and applications that are clearly and explicitly approved in the Project Planning Manual. For example, the following areas of use are not permitted: construction cranes, elevators used for people or freight, devices and vehicles to transport people, medical applications, refinery plants, transport of hazardous goods, nuclear applications, applications sensitive to high frequency, mining, food processing, control of protection equipment (also in a machine). The information given in the documentation of the product with regard to the use of the delivered components contains only examples of applications and suggestions. The machine and installation manufacturer must make sure that the delivered components are suited for his individual application and check the information given in this documentation with regard to the use of the components, make sure that his application complies with the applicable safety regulations and standards and carry out the required measures, modifications and complements. Startup of the delivered components is only permitted once it is sure that the machine or installation in which they are installed complies with the national regulations, safety specifications and standards of the application.

14 3-4 Safety Instructions for Electric Drives and Controls IST Intelligent Safety Technology Operation is only permitted if the national EMC regulations for the application are met. The instructions for installation in accordance with EMC requirements can be found in the documentation "EMC in Drive and Control Systems". The machine or installation manufacturer is responsible for compliance with the limiting values as prescribed in the national regulations. Technical data, connections and operational conditions are specified in the product documentation and must be followed at all times.

15 IST Intelligent Safety Technology Safety Instructions for Electric Drives and Controls Protection Against Contact with Electrical Parts Note: This section refers to equipment and drive components with voltages above 50 Volts. Touching live parts with voltages of 50 Volts and more with bare hands or conductive tools or touching ungrounded housings can be dangerous and cause electric shock. In order to operate electrical equipment, certain parts must unavoidably have dangerous voltages applied to them. DANGER High electrical voltage! Danger to life, severe bodily harm by electric shock! Ÿ Only those trained and qualified to work with or on electrical equipment are permitted to operate, maintain or repair this equipment. Ÿ Follow general construction and safety regulations when working on high voltage installations. Ÿ Before switching on power the ground wire must be permanently connected to all electrical units according to the connection diagram. Ÿ Do not operate electrical equipment at any time, even for brief measurements or tests, if the ground wire is not permanently connected to the points of the components provided for this purpose. Ÿ Before working with electrical parts with voltage higher than 50 V, the equipment must be disconnected from the mains voltage or power supply. Make sure the equipment cannot be switched on again unintended. Ÿ The following should be observed with electrical drive and filter components: Ÿ Wait five (5) minutes after switching off power to allow capacitors to discharge before beginning to work. Measure the voltage on the capacitors before beginning to work to make sure that the equipment is safe to touch. Ÿ Never touch the electrical connection points of a component while power is turned on. Ÿ Install the covers and guards provided with the equipment properly before switching the equipment on. Prevent contact with live parts at any time. Ÿ A residual-current-operated protective device (RCD) must not be used on electric drives! Indirect contact must be prevented by other means, for example, by an overcurrent protective device. Ÿ Electrical components with exposed live parts and uncovered high voltage terminals must be installed in a protective housing, for example, in a control cabinet.

16 3-6 Safety Instructions for Electric Drives and Controls IST Intelligent Safety Technology To be observed with electrical drive and filter components: DANGER High electrical voltage on the housing! High leakage current! Danger to life, danger of injury by electric shock! Ÿ Connect the electrical equipment, the housings of all electrical units and motors permanently with the safety conductor at the ground points before power is switched on. Look at the connection diagram. This is even necessary for brief tests. Ÿ Connect the safety conductor of the electrical equipment always permanently and firmly to the supply mains. Leakage current exceeds 3.5 ma in normal operation. Ÿ Use a copper conductor with at least 10 mm² cross section over its entire course for this safety conductor connection! Ÿ Prior to startups, even for brief tests, always connect the protective conductor or connect with ground wire. Otherwise, high voltages can occur on the housing that lead to electric shock. 3.6 Protection Against Electric Shock by Protective Low Voltage (PELV) All connections and terminals with voltages between 0 and 50 Volts on Rexroth products are protective low voltages designed in accordance with international standards on electrical safety. WARNING High electrical voltage due to wrong connections! Danger to life, bodily harm by electric shock! Ÿ Only connect equipment, electrical components and cables of the protective low voltage type (PELV = Protective Extra Low Voltage) to all terminals and clamps with voltages of 0 to 50 Volts. Ÿ Only electrical circuits may be connected which are safely isolated against high voltage circuits. Safe isolation is achieved, for example, with an isolating transformer, an opto-electronic coupler or when battery-operated.

17 IST Intelligent Safety Technology Safety Instructions for Electric Drives and Controls Protection Against Dangerous Movements Dangerous movements can be caused by faulty control of the connected motors. Some common examples are: improper or wrong wiring of cable connections incorrect operation of the equipment components wrong input of parameters before operation malfunction of sensors, encoders and monitoring devices defective components software or firmware errors Dangerous movements can occur immediately after equipment is switched on or even after an unspecified time of trouble-free operation. The monitoring in the drive components will normally be sufficient to avoid faulty operation in the connected drives. Regarding personal safety, especially the danger of bodily injury and material damage, this alone cannot be relied upon to ensure complete safety. Until the integrated monitoring functions become effective, it must be assumed in any case that faulty drive movements will occur. The extent of faulty drive movements depends upon the type of control and the state of operation.

18 3-8 Safety Instructions for Electric Drives and Controls IST Intelligent Safety Technology DANGER Dangerous movements! Danger to life, risk of injury, severe bodily harm or material damage! Ÿ Ensure personal safety by means of qualified and tested higher-level monitoring devices or measures integrated in the installation. Unintended machine motion is possible if monitoring devices are disabled, bypassed or not activated. Ÿ Pay attention to unintended machine motion or other malfunction in any mode of operation. Ÿ Keep free and clear of the machine s range of motion and moving parts. Possible measures to prevent people from accidentally entering the machine s range of motion: - use safety fences - use safety guards - use protective coverings - install light curtains or light barriers Ÿ Fences and coverings must be strong enough to resist maximum possible momentum, especially if there is a possibility of loose parts flying off. Ÿ Mount the emergency stop switch in the immediate reach of the operator. Verify that the emergency stop works before startup. Don t operate the machine if the emergency stop is not working. Ÿ Isolate the drive power connection by means of an emergency stop circuit or use a starting lockout to prevent unintentional start. Ÿ Make sure that the drives are brought to a safe standstill before accessing or entering the danger zone. Safe standstill can be achieved by switching off the power supply contactor or by safe mechanical locking of moving parts. Ÿ Secure vertical axes against falling or dropping after switching off the motor power by, for example: - mechanically securing the vertical axes - adding an external braking/ arrester/ clamping mechanism - ensuring sufficient equilibration of the vertical axes The standard equipment motor brake or an external brake controlled directly by the drive controller are not sufficient to guarantee personal safety!

19 IST Intelligent Safety Technology Safety Instructions for Electric Drives and Controls 3-9 Ÿ Disconnect electrical power to the equipment using a master switch and secure the switch against reconnection for: - maintenance and repair work - cleaning of equipment - long periods of discontinued equipment use Ÿ Prevent the operation of high-frequency, remote control and radio equipment near electronics circuits and supply leads. If the use of such equipment cannot be avoided, verify the system and the installation for possible malfunctions in all possible positions of normal use before initial startup. If necessary, perform a special electromagnetic compatibility (EMC) test on the installation. 3.8 Protection Against Magnetic and Electromagnetic Fields During Operation and Mounting Magnetic and electromagnetic fields generated near current-carrying conductors and permanent magnets in motors represent a serious health hazard to persons with heart pacemakers, metal implants and hearing aids. WARNING Health hazard for persons with heart pacemakers, metal implants and hearing aids in proximity to electrical equipment! Ÿ Persons with heart pacemakers, hearing aids and metal implants are not permitted to enter the following areas: - Areas in which electrical equipment and parts are mounted, being operated or started up. - Areas in which parts of motors with permanent magnets are being stored, operated, repaired or mounted. Ÿ If it is necessary for a person with a heart pacemaker to enter such an area, then a doctor must be consulted prior to doing so. Heart pacemakers that are already implanted or will be implanted in the future, have a considerable variation in their electrical noise immunity. Therefore there are no rules with general validity. Ÿ Persons with hearing aids, metal implants or metal pieces must consult a doctor before they enter the areas described above. Otherwise, health hazards will occur.

20 3-10 Safety Instructions for Electric Drives and Controls IST Intelligent Safety Technology 3.9 Protection Against Contact with Hot Parts CAUTION Housing surfaces could be extremely hot! Danger of injury! Danger of burns! Ÿ Do not touch housing surfaces near sources of heat! Danger of burns! Ÿ After switching the equipment off, wait at least ten (10) minutes to allow it to cool down before touching it. Ÿ Do not touch hot parts of the equipment, such as housings with integrated heat sinks and resistors. Danger of burns! 3.10 Protection During Handling and Mounting Under certain conditions, incorrect handling and mounting of parts and components may cause injuries. CAUTION Risk of injury by incorrect handling! Bodily harm caused by crushing, shearing, cutting and mechanical shock! Ÿ Observe general installation and safety instructions with regard to handling and mounting. Ÿ Use appropriate mounting and transport equipment. Ÿ Take precautions to avoid pinching and crushing. Ÿ Use only appropriate tools. If specified by the product documentation, special tools must be used. Ÿ Use lifting devices and tools correctly and safely. Ÿ For safe protection wear appropriate protective clothing, e.g. safety glasses, safety shoes and safety gloves. Ÿ Never stand under suspended loads. Ÿ Clean up liquids from the floor immediately to prevent slipping.

21 IST Intelligent Safety Technology Safety Instructions for Electric Drives and Controls Battery Safety Batteries contain reactive chemicals in a solid housing. Inappropriate handling may result in injuries or material damage. CAUTION Risk of injury by incorrect handling! Ÿ Do not attempt to reactivate discharged batteries by heating or other methods (danger of explosion and cauterization). Ÿ Never charge non-chargeable batteries (danger of leakage and explosion). Ÿ Never throw batteries into a fire. Ÿ Do not dismantle batteries. Ÿ Do not damage electrical components installed in the equipment. Note: Be aware of environmental protection and disposal! The batteries contained in the product should be considered as hazardous material for land, air and sea transport in the sense of the legal requirements (danger of explosion). Dispose batteries separately from other waste. Observe the legal requirements in the country of installation Protection Against Pressurized Systems Certain motors and drive controllers, corresponding to the information in the respective Project Planning Manual, must be provided with pressurized media, such as compressed air, hydraulic oil, cooling fluid and cooling lubricant supplied by external systems. Incorrect handling of the supply and connections of pressurized systems can lead to injuries or accidents. In these cases, improper handling of external supply systems, supply lines or connections can cause injuries or material damage. CAUTION Danger of injury by incorrect handling of pressurized systems! Ÿ Do not attempt to disassemble, to open or to cut a pressurized system (danger of explosion). Ÿ Observe the operation instructions of the respective manufacturer. Ÿ Before disassembling pressurized systems, release pressure and drain off the fluid or gas. Ÿ Use suitable protective clothing (for example safety glasses, safety shoes and safety gloves) Ÿ Remove any fluid that has leaked out onto the floor immediately. Note: Environmental protection and disposal! The media used in the operation of the pressurized system equipment may not be environmentally compatible. Media that are damaging the environment must be disposed separately from normal waste. Observe the legal requirements in the country of installation.

22 3-12 Safety Instructions for Electric Drives and Controls IST Intelligent Safety Technology

23 IST Intelligent Safety Technology Safety Technology Basics Safety Technology Basics 4.1 General The working safety of a machine is determined to a large part by to what degree dangerous movements are generated by this machine. When a machine is in automatic operation, protective equipment prevents human access to points of danger. When machines and systems are in set-up mode, it often happens that persons must be in areas of danger at a time when the entire system cannot be removed from power. In these situations, the machine operator must be protected by internal drive and control mechanisms. Bosch Rexroth Intelligent Safety Technology (IST) provides the user the control- and drive-side requirements for implementing protective functions for persons and machines with a minimum of effort in planning and installation. By using Intelligent Safety Technology, the functioning and availability of the machine is increased significantly compared to the use of conventional safety technology. 4.2 Analysis of Dangers and Risk Assessment In order to bring a machine into operation, the manufacturer must subject the machine to an analysis of dangers according to machine guideline 89/392/EWG to determine the dangers involved in using the machine. In order to attain a degree of safety that is as high as possible, three principles are listed in the guideline: elimination/minimization of the dangers due to the construction itself, taking the required protective measures against dangers that cannot be eliminated, and documentation of the existing residual risks and informing the user of these risks. The analysis of dangers is a multi-step iterative process that is described in more detail in EN 1050 [4] Guiding Principles for Risk Assessment. Within the framework of this documentation, only a very brief overview can be given regarding the analysis of dangers. Otherwise, the user of Intelligent Safety Technology must intensively occupy himself with standards and the legal situation. Completion of the analysis of dangers fulfills a requirement for specifying the category for safety-related controls according to EN 954-1, which the safety-oriented parts of the machine control must satisfy. More information regarding these categories can be found, other than in the standard itself, in BIA report Categories for Safety-Related Controls According to EN The safety-related parts of the MTC200 control family and/or the DIAX04 drive family corresponds to the use of IST category 3 of EN With the certification of both systems by a accredited liboratory, the user has the possibility to execute the certification of his machines himself with IST.

24 4-2 Safety Technology Basics IST Intelligent Safety Technology Category ) Summary of requirements System behavior ) Principles for attaining safety B The safety-related parts of controls and/or their protective equipment, as well as their components, must be designed, built, selected, assembled and combined in agreement with the applicable standards in such a manner that they can withstand the expected influences. 1 Requirements of category B must be fulfilled. Tried-and-tested components and safety principles used. 2 The requirements of category B and the use of tried-and-tested safety principles must be fulfilled. The safety function must be checked at suitable intervals by the machine control. 3 The requirements of category B and the use of tried-and-tested safety principles must be fulfilled. Safety-related parts must be designed in such a manner that a single error in each of these parts does not lead to loss of the safety function; the single error is always detected during tests at suitable intervals. 4 The requirements of category B and the use of tried-and-tested safety principles must be fulfilled. Safety-related parts must be designed in such a manner that a single error in each of these parts does not lead to loss of the safety function; the single error is detected during or before the next test of the safety function; if this is not possible, an accumulation of undetected errors must not lead to loss of the safety function. The occurrence of an error can lead to loss of the safety function. The occurrence of an error can lead to loss of the safety function, but the possibility of occurrence is less than in category B. The occurrence of an error can lead to loss of the safety function between the testing times. The loss of the safety function is detected by the test. If the single error occurs, the safety function is always retained. Certain, but not all, errors are detected. An accumulation of undetected errors can lead to loss of the safety function. If errors occur, the safety function is always retained. The errors are detected in time to prevent loss of the safety function. Characterized mainly by the selection of components. Characterized mainly by the structure. 1 ) The categories are not to be used in any given sequence or hierarchic arrangement in terms of the safety-related requirements. 2 ) The risk assessment will demonstrate whether complete or partial loss of the safety function(s) due to errors is acceptable. Fig. 4-1: Summary of requirements for safety categories (excerpted from EN 954-1: 1996, sequence 6)

25 IST Intelligent Safety Technology Safety Technology Basics Safety-Relevant Standards and Regulations The following provides the user with a brief overview of standards relevant for the use of safety-related controls. In this regard, this documentation makes no claim for completeness. The user himself must determine which regulations apply to a certain application. Component-Relevant Standards Product group Standard Title Date of issue Electric motors EN Turning Electric Machines, Part Supply devices and modules EN Turning Electric Machines, Part EN Equipment of Power Installations with Electronic Equipment Drive control devices EN Equipment of Power Installations with Electronic Equipment Controls EN Equipment of Power Installations with Electronic Equipment Power packs EN Equipment of Power Installations with Electronic Equipment Systems EN Equipment of Power Installations with Electronic Equipment Electric drives IEC 22G/52CD (IEC ) Speed-modifiable electric drives part 5: Requests to the electric, thermic and functional safety Fig. 4-2: Component-relevant standards for IST Machine-Relevant Standards Standard Title Date of issue EN Safety of Machines, Electrical Equipment of Machines EN Electrical Equipment of Industrial Machines IEC Serial Data Transfer in Real Time between Controls and Drives (SERCOS interface Specifications) EN Safety of Machines, EN Basic Terms, General Guiding Principles for Design EN Safety of Machines, Safety-Related Parts of Controls EN 1921 Safety of Integrated Manufacturing Systems pren 775 Safety of Industrial Robots pren 1037 Safety of Machines. Prevention of Accidental Startup DIN V VDE 0801 Basic Principles for Computers in Systems with Safety-Related Duties pren Safety of Machine Tools Small, Numerically-Controlled Lathes and Turning Centers pren Safety of Machine Tools Processing Centers Fig. 4-3: Machine-relevant standards for IST

26 4-4 Safety Technology Basics IST Intelligent Safety Technology Overview of Required Safety Categories in C Standards Following is an overview of the required safety categories for safetyrelated parts of controls in C standards. Approval switching equipment Speed reduction, incl. protection against accidental startup (n=0) Protective equipment locks pren Processing centers pren Automatic lathes EN 775 Industrial robots pren 1921 Automatic manufacturing systems Category 3 Category 3 Category 3 Category 3 Category 3 Category 3 Category 3 Category 3 Category B and Consent switch Category B and Consent switch Category 3 Category 3 Category 3 Category 3 Category 1 for maintenance doors End position limits - - Category 3 Category 3 Emergency stop Acc. to EN Category 3 Category 3 Acc. to EN Fig. 4-4: Requirements of safety-related controls in C standards Note: Standards EN775 and pren 1921 do not contain any direct references to EN 954-1; however, the requirements are similar to those in this standard.

27 IST Intelligent Safety Technology Safety Technology Basics Definition of Terms Electric drive system Safe In terms of safety technology, an electric drive system includes all of the hardware and software components that can affect the movements of the machine. An electric drive system includes, for example, PLC, CNC, APR, 1 drive controller and firmware. In terms of drive functions such as safe shutdown and safe stopping, safe means that a risk assessment according to EN applies for the behavior of the control parts that are relevant for these functions if an error occurs. SERCOS interface The connection between the CNC and the DIAX04 drive controls is implemented using fiber optics. A SERCOS ring according to IEC 1491 is used as the bus topology. The ring starts and ends at the CNC control; the optical output of the control is connected with the optical input of the first drive. The optical input of the CNC is connected with the optical output of the last drive. Interbus connection The PLC control is connected with machine operating terminal BTA and the external RECO I/O units using an Interbus connection according to DIN Here, the PLC control acts as the Interbus master, while the BTA and RECOs act as Interbus slaves. Each interface is electrically isolated and contains an RS485 duplex connection. Intelligent Safety Technology Intelligent Safety Technology (IST) means the hardware and software characteristics that permit safety-relevant drive functions to be implemented. A maximum amount of safety can be implemented for persons and machines. IST corresponds to the current state of the art for safety-related controls of category 3 according to EN in the area of highly dynamic drives. 1 acc. to position paper DKE-AK

28 4-6 Safety Technology Basics IST Intelligent Safety Technology

29 IST Intelligent Safety Technology Intelligent Safety Technology (IST) Intelligent Safety Technology (IST) 5.1 Bosch Rexroth Control and Drive System with Intelligent Safety Technology Basic Structure and Functions A Bosch Rexroth control and drive system with Intelligent Safety Technology basically consists of components of the MTC200 control family and DIAX04 drive family. Intelligent Safety Technology consists of hardware and software components that work together to provide the safety functions. MTC200 controller family DIAX04 drive family Interbus-S BTV and BTA Standard Reco modules Safety I/O modules Drive controller SERCOS interface Drives System200.FH7 Fig. 5-1: SYSTEM200 with Intelligent Safety Technology To use IST, only one additional hardware component is required for each axis: a safety I/O module. This module, which is based on RECO I/O modules, provides electrically isolated safety inputs and potential-free safety outputs. All other IST components are software components. These consist of firmware parts in the CNC and drive as well as PLC user program parts. The PLC user program must not exceed the maximum cycle time of 75ms. The component lists for Intelligent Safety Technology can be found in the Appendix of this documentation. Intelligent Safety Technology can be used with software version 19 or as of software version 22.

30 5-2 Intelligent Safety Technology (IST) IST Intelligent Safety Technology MTC200 control family The MTC200 control family consists of the BTV, an industrial PC that is usually equipped with the CNC module MTC-P and the PLC module MTS- P (ISA bus plug-in cards). However, RECO variants MTC-R or MTS-R can also be used with IST. The CNC module consists of the CNC processor and the axis processor(s). An axis processor card can control up to 7 digital drives using a SERCOS fiber optic ring. Safety-relevant signals are transferred to the control using safety input/output units that are connected using Interbus-S. DIAX04 drive family The DIAX04 drive system consists of an HVE or HVR power supply unit that is connected to the power supply as well as several connected drives. Each drive is equipped with an HDS or HDD drive controller and one of the following motor types: MKD / MHD synchronous motor or 2AD asynchronous motor or 1MB built-in asynchronous motor or LSF, LAF or LAR built-in linear motor. The drive controllers are connected to the CNC control using the SERCOS interface.

31 IST Intelligent Safety Technology Intelligent Safety Technology (IST) Comparison with Conventional Safety Technology The difference between a control and drive system with Intelligent Safety Technology and systems with conventional security technology is that the safety functions are integrated directly into the intelligent drives and the control is integrated as hardware and software. This allows increased functionality at maximum security to be achieved in all operating modes. Intelligent Safety Technology is not primarily intended for replacing conventional safety technology components such as emergency stop switch devices and protection door monitors. The following conventional security technology components are not required: motor standstill monitor for observing safe operating stops speed monitor for observing safely reduced speeds power contactor between controllers and motors limit switch or position cams for area detection At the same time, the available personnel and machine safety is increased since, for example, the total reaction time of the system to an error event has been considerably reduced compared to similar systems with conventional security technology. The safety signals are transferred using the Interbus-S / SERCOS interface field busses, which significantly simplifies the cabling structure of the machine. No special drive controllers or control modules are required.

32 5-4 Intelligent Safety Technology (IST) IST Intelligent Safety Technology 5.3 Overview of Safety Functions Intelligent Safety Technology (IST) provides the following functions for the protection of machines and personnel: Safe stop Safe stop protects a machine axis against unintentionally starting. In case of a safe stop, the power supply to the drive system is safely interrupted. Safe operation stop Like the safe stop, the safe operation stop also protects the machine axis against unintentionally starting. The drive system is stopped at a natural point in the production process. All controlling functions between the control and the drive motor are maintained. Due to Intelligent Safety Technology, undesired, dangerous movements as a result of errors are safely prevented. Safely reduced speed Intelligent Safety Technology safely prevents a drive from exceeding the speed limit value set in the parameters. Safely limited absolute position Safety measures in the CNC control and drive system prevent an axis from moving out of the admissible travel range set in the parameters. Safe cams Safe cams allow a safe division of the axis travel range. They can be used for switching between various safety functions or for releasing external safety mechanisms.

33 IST Intelligent Safety Technology Intelligent Safety Technology (IST) Functioning of Intelligent Safety Technology Dual Channel Structure The safety functions are monitored by the control and drive system during operation. In this regard, three principles for detecting sleeping errors have been implemented: dual channel data processing two-way comparison of safety-relevant data forced dynamics These measures ensure that a single error cannot lead to a loss of the safety functions. All safety-relevant data are transferred and processed by two independent channels. The CNC control, consisting of the PLC and CNC, are the first monitoring channel, while the drive controllers, in cooperation with the safety I/O components, are the second channel. MTC200 DIAX04 Saftey function in control Safety function in drive PLC Standard I/O module Safety I/O module Machine peripherals Channels.FH7 Fig. 5-2: Dual channel data processing Safety channel 1 The safety signals of the first monitoring channel (CNC) are processed with the standard I/O level. The input signals are processed in the PLC user program using logic programmed by the user; they are then transferred via the image memory to the CNC. Safety channel 2 The safety I/Os for the drive (channel 2) are exchanged directly between the safety I/O module and the drive via the PLC and the CNC.

34 5-6 Intelligent Safety Technology (IST) IST Intelligent Safety Technology Two-way Data Comparison The relevant monitoring functions for representing the safety functions run independently in the NC control and in the drive. In order to ensure that these functions work with the correct (equal) limit values, two-way data comparison must be executed. The foundation for two-way data comparison is a special data exchange mechanism (multiplex channel) using the SERCOS interface. If differences between the monitored parameters of the NC and of the corresponding drive are determined, a corresponding error reaction occurs. Safety I/O Channel 1 NC control (PLC/CNC/APR) Shutdown Channel 1 Two-way data comparison Safety I/O Channel 2 Drive controller Shutdown Channel 2 Kreuzvgl.FH7 Fig. 5-3: Two-way data comparison (schematic) Cyclic two-way data comparison Two-way data comparison is started when the SERCOS ring is started. Two-way data comparison starts as soon as the operating mode has been reached. If safety parameters of the NC and of the drive are not identical during operation and if the system is under power, stopping of the axis/axes is initiated. Additional two-way data comparison when activating safety functions Switching safety functions on and off If one or more safety functions are switched on, the safety monitors are immediately activated. After a pause, another two-way data comparison, in addition to the one that is always running, is carried out. This occurs only if no safety function was active beforehand, not for the dynamic switching on and off of additional safety functions. During the pause, the two monitoring systems in the CNC and in the drives are in a safe operating stop. As long as safety functions are active, the dynamic switching on and off of additional safety functions is permitted. After a set switching time, the status of the activation inputs in both systems must have been brought in line. Otherwise, an error reaction occurs. Safety output signal Safety function active remains on the value 1 even during the transition status while additional safety functions are being switched on and off. Output signal Switching complete takes on the value 0 during this period.

35 IST Intelligent Safety Technology Intelligent Safety Technology (IST) 5-7 Deactivation of safety functions The deactivation of all safety functions must also be carried out according to the transition time set in the parameters. During deactivation, safety output signal Safety function active is immediately reset. If the status signals in Status of safety functions in both systems are identical when the safety functions have been activated and if the Transition time for switching the safety functions has elapsed, both systems set safety output signal Switch complete to 1. Errors that can be detected using two-way data comparison The following errors can be detected using two-way data comparison: safety function has been activated on only one system. activation of the incorrect safety functions. addressing of the incorrect drive (danger of mix-up). monitoring the incorrect datum (actual position). use of different monitoring parameters. safety function does not work (life counter). random hardware error. random software error. Note: Chapter 11 "Error Messages and Error Elimination" provides more information regarding problem localization of an error that has occurred using two-way data comparison!

36 5-8 Intelligent Safety Technology (IST) IST Intelligent Safety Technology Forced dynamics The shutdown circuits for switching on the power of drives that are activated when a safety function detects an error must be tested if they function before a safety function is activated for the first time and at regular intervals thereafter. Accordingly, the tests are carried out with protective doors closed and safety functions inactive. The goal of forced dynamics is to discover static error states, so-called sleeping errors, in the shutdown circuits. Shutdown circuits Both the MTC200 (CNC control) and the drives have their own shutdown circuits: Shutdown circuits of drive Shutdown reaction Internal controller enablement Controller enablement is shut down Error message on supply module Power contactor is shut down Error message via SERCOS Depending on reaction of NC Shutdown circuits of CNC control Controller enablement via SERCOS interface Controller enablement is shut down Error message on PLC Shutdown via SERCOS interface Fig. 5-4: Intelligent Safety Technology shutdown circuits Testing shutdown circuits Testing of shutdown circuits is carried out in two parts. In the first part, the safe operation stop on the drive is activated. Then the interpolator on the CNC control simulates a movement of the corresponding axis, thus triggering stopping by the safety monitor on the drive. The response of the shutdown circuits is tested by the drive, the CNC control and the PLC user program. In the second part, the safe operation stop on the CNC control is activated. Then the drive sends a simulated incorrect actual position value to the CNC control. The safety monitor of the CNC control detects the error and initiates the stopping of the drive on its part. The function of the shutdown circuits is again tested by the drive, the CNC control and the PLC user program. Note: The axes remain stopped in any case during the forced dynamics! Test of Consent key The Consent key is also tested within the framework of forced dynamics. The Consent key must not be pressed during forced dynamics!

37 IST Intelligent Safety Technology Intelligent Safety Technology (IST) 5-9 Forced dynamics procedure Forced dynamics is controlled by the PLC user program. For this purpose, the DYNAM standard function module is provided by Bosch Rexroth. This function module monitors the execution of forced dynamics. Only after all the shutdown circuits have been successfully tested is the timer reset and the use of safety functions with this drive released. If an error occurs during forced dynamics, this is curtailed immediately. Regardless of whether safety functions were active before the error or not, safety functions can no longer be used with the corresponding axis after forced dynamics is curtailed by an error. The forced dynamics timer is reset after the error is detected Note: The use of the DYNAM function module in the PLC user program is described in detail in section 8.3 "Sample Application". A short description of the module can be found in the Appendix.

38 5-10 Intelligent Safety Technology (IST) IST Intelligent Safety Technology

39 IST Intelligent Safety Technology IST Safety Functions IST Safety Functions 6.1 Overview of Safety Functions for Protection of Persons Safety function for protection of persons Description of functions Implemented in Safe stop In case of a safe stop, the power supply to the drive is safely interrupted. Safe operation stop The drive system is stopped at a natural point in the production process (operation stop). All control functions between the electronic control and the drive motor are maintained. Control measures prevent the drive from executing dangerous movements as a result of errors. Safely reduced speed (2) Control measures safely prevent the drive from exceeding the given speed limit values. Safely limited absolute positions (2) Control measures shut the drive system down when it reaches a given absolute position limit value. Safe cams Safe activation of valves, solenoid switches, etc. at certain positions of the axis, for example for rotary tables. Consent key Procedure in manual operation while persons are in the danger zone (with open door) so that this can be shut down safely in a critical dangerous situation. NC/ PLC and drive NC/ PLC and drive NC/ PLC and drive NC/ PLC and drive NC/ PLC and drive NC/ PLC and drive 2-channel processing and connection (1) Yes Yes Yes Yes Yes Yes (1) according to safety category 3 of EN Fig. 6-1: Overview of Safety Functions (2) These safety functions are combined in safely reduced speed with safely limited absolute positions.

40 6-2 IST Safety Functions IST Intelligent Safety Technology 6.2 Safe Stop Application Safeguard against accidental startup. The drive does not generate torque and thus does not generate dangerous movements. The safe shutdown is carried out by pressing the starting lockout found in the Bosch Rexroth drive module. The starting lockout safely switches off the power in the drive on the software and hardware sides. Note: Safety function safe stop should not be used to stop a moving axis. Conditions The following conditions must be fulfilled before safety function safe stop can be selected: The safety function must be enabled in the safety parameters of the CNC and in the drive. Forced dynamics has been carried out or is valid. Safe stop must be selected using two channels in the CNC and in the drive via the Safe stop deactivation signals (signal status 0 ). Signals Activate starting lockout and Starting lockout active must be wired to/from the drive. The starting lockout must be activated by the PLC user program and the feedback must be passed on to the CNC by the PLC user program. Selecting and deselecting safe stop Safe stop must be selected/deselected using two channels in the CNC and in the drive. If only one channel is used to select/deselect the safety function, the drives are shut down by the shutdown circuits. 1. Channel (CNC) 2. Channel (drive) Meaning Safe stop deactivation signal = Safe stop deactivation signal = 0 0 Safe stop has been selected 1 1 Safe stop has been deselected Fig. 6-2: Selecting and deselecting safe stop Note: If safe stop has been selected, the axis can be manually moved out of the position. The starting lockout is described in detail in section "Starting Lockout as a Shutdown Circuit of the CNC" (p. 6-39).

41 IST Intelligent Safety Technology IST Safety Functions 6-3 In the case of vertical axes in manual operation, observe the following: DANGER Dangerous movements! Persons endangered by falling or descending axes! Ÿ The motor brake that is supplied as standard is not suitable by itself for the protection of persons, even if the motor is not under power! Ÿ An external brake that is activated and monitored solely by the drive controller is also unsuitable for the protection of persons! Ÿ Ensure the protection of persons using superordinate error-proof measures: Cordon off the hazardous area by means of a safety fence or a safety screen. Secure vertical axes against falling or slipping after switching off the motor power by, for example: - mechanically locking the vertical axis - external brake/catching/clamping mechanisms or - adequately counterbalancing the axis.

42 6-4 IST Safety Functions IST Intelligent Safety Technology 6.3 Safe Operation Stop Application Safeguard against accidental startup. In certain operating states of a system, it may be necessary to stop the production process at specific points and then to continue the process without switching the system off. If no one is in the danger zone of the machine in these operating states, the safe stop has no relevance to safety and does not require any additional safety mechanisms. However, if a person must move within the danger zone in the described operating state, protection of persons is ensured by selecting function safe operation stop. Any accidental startup of the axis is immediately detected by the two monitoring systems in the drive and in the CNC, leading to the drive being shut down. Conditions The following conditions must be fulfilled before safety function safe operation stop can be selected: The safety function must be enabled and set in the safety parameters of the CNC and in the drive. Forced dynamics has been carried out or is valid. The function must have been selected using the safety input signals of the CNC and the drive (signal status 0 ). Selecting and deselecting safe operation stop Safety function safe operation stop must be selected/deselected in the CNC and in the drive. A discrepancy is detected by the two-way data comparison, leading to a shutdown of the drives by the shutdown circuits. If only safety function safe operation stop is to be implemented without switching to safety function safely reduced speed, selection/deselection is carried out using the following safety input signals: 1. Channel (CNC) 2. Channel (drive) Meaning Safe operation stop deactivation signal = Safe operation stop deactivation signal = 0 0 Safe operation stop has been selected 1 1 Safe operation stop has been deselected Fig. 6-3: Selecting and deselecting safe operational stop

43 IST Intelligent Safety Technology IST Safety Functions 6-5 Position monitoring window When the safety function is switched on in operating mode Position control, the safety monitor stores the currently output position setpoint. Modification of the cyclic position setpoint results in the drive being switched off immediately by the switch-off paths. The actual position value is compared with the stored position setpoint. Variance within the position window that is defined by parameter Position monitoring window for safe operation stop is permitted here. In operating mode Speed control the current actual position value is stored when safe operation stop is started. The current actual position value is continuously compared to the stored position value; it may not leave the position window. Only a value of 0 is permitted for the speed setpoint. DANGER Uncontrolled axis movements! If an error occurs, jolting of the motor shaft can occur. Ÿ If there is a defect in the power electronics in the drive and safety function safe operation stop is selected, brief jolting of the motor shaft can occur, depending on the construction of the motor.

44 6-6 IST Safety Functions IST Intelligent Safety Technology 6.4 Safely Reduced Speed Application Monitoring of safely reduced speed is part of safety function safely reduced speed with safely limited absolute positions 1 and 2. IST provides a combination of the two safety functions. In order to satisfy differing conditions, two switchable sets of safety parameters can be selected. In the function safely reduced speed, exceedance of a specified speed limit value is observed by monitoring functions in the CNC and in the drives. Activation of the monitor leads to a shutdown of the drive system. Note: If a transmission gear is used, a second encoder is required. Note: Monitoring of safely reduced speed always refers only to the individual axis. Resulting path velocities could be greater than safely reduced speed. Conditions The following conditions must be fulfilled before safely reduced speed can be selected: Safety function safely reduced speed must be set in the safety parameters of the CNC and in the drive. Forced dynamics has been carried out or is valid. Safety input signals Deactivation of safely reduced speed with safely limited absolute positions in the CNC and in the drive have signal status 0 (selected).

45 IST Intelligent Safety Technology IST Safety Functions 6-7 Selecting and deselecting safely reduced speed Safety function safely reduced speed must be selected/deselected using two channels in the CNC and in the drive. After selection, safety function safe stop or safe operation stop is preselected at first. Which of the two safety functions is activated can be set in safety parameter Selection of safety functions. If safety input signal Consent (Consent key) is now switched on in both channels, the axis can be moved using safely reduced speed. 1. Channel (CNC) 2. Channel (drive) Meaning Safely reduced speed deactivation signal = Consent = Safely reduced speed deactivation signal = Consent = Safe stop or safe operation stop has been selected Safely reduced Speed has been selected 1 0 / / 1 Safety function has been deselected Fig. 6-4: Selecting and deselecting safely reduced speed Switching off safely reduced speed Monitoring of safely reduced speed with safety function safely reduced speed with safely limited absolute positions selected can be switched off only if safely limited absolute positions is used. To do this, safety parameter Maximum speed for safety function of the CNC and of the drive are to be set to a value of 0. Limit values for speeds The limit values for the individual techniques (milling, turning, grinding, etc.) are specified in the C standards (product standards). Possible limit values for lathes in the Setup operating mode: 2m/min for axis movements 50 rpm for spindle rotations Note: The machine manufacturer is responsible for the correct selection of speed limit values, depending on utilization and operating mode.

46 6-8 IST Safety Functions IST Intelligent Safety Technology 6.5 Safely Limited Absolute Positions Application Monitor safely limited absolute positions is part of safety function safely reduced speed with safely limited absolute positions 1 and 2. The safety function ensures that the drive system is switched off when defined absolute position limit values are exceeded. Due to safely limited absolute positions, axis-specific protective measures for persons and machines can be implemented, as can working area limitations without hardware limit switches. Note: The specification of position limit values must take the maximum technically possible coasting down of the axis into account. Unexpected drive movements must be taken into account within the limited range. Conditions The safety function can be switched on only under the following conditions: The safety function must be set in the safety parameters of the CNC and in the drive. Safety input signals Deactivation of safely reduced speed with safely limited absolute position in the CNC and in the drive have signal status 0 (deselected). Forced dynamics has been carried out or is valid. Safe referencing must be carried out by the user. If no safe reference exists or if forced dynamics has not been carried out, the drive is shut down when the safety function is activated.

47 IST Intelligent Safety Technology IST Safety Functions 6-9 Selecting and deselecting safely limited absolute position The safety function must be selected/deselected using two channels in the CNC and in the drive. In the following figure, it is assumed that the Consent key is not pressed. Pressing the Consent key would result in switching from safety function safe stop or safe operation stop to safety function safely reduced speed. Consent has no influence on safely limited absolute positions. 1. Channel (CNC) 2. Channel (drive) Meaning Deactivation signal safely reduced speed with safely limited absolute position = Deactivation signal safely reduced speed with safely limited absolute position = 0 0 Safe stop or Safe operation stop and safely limited absolute position have been selected 1 1 Safety function has been deselected Fig. 6-5: Selecting and deselecting safely reduced speed with safely limited absolute position Switching off safely limited absolute positions Monitoring of safely limited absolute position with safety function safely reduced speed with safely limited absolute positions selected can be switched off only if safely reduced speed is used. To do this, the two safety parameters Upper position limit for safety function and Lower position limit for safety function of the CNC and of the drive are to be set to a value of 0.

48 6-10 IST Safety Functions IST Intelligent Safety Technology 6.6 Safe Cams Application With the help of position switch points, output signals are used to indicate that the axis is within a certain position range. 4 pairs of cams are available for each axis. Each pair of cams consists of two position switch points that are defined by parameters Upper limit for position switch point and Lower limit for position switch point. Safe cams replaces the following hardware-based solutions: area detection working area limitations shelter limitations Signal evaluation The signals of the position switch points are generated using two channels in the CNC and in the drive. The validity of the signal is ensured only if both channels have set the position switch point signal to 1. Only a signal status of 1 may be evaluated for safety-related jobs. Note: The position switch points of safe cams must be processed further according to category 3 of EN An example of further processing of safe cams can be found in section "Transferring Safety I/O Signals", p Conditions Safety function safe cams has the following requirements: Safe cams must be designed in the safety parameters of the CNC and in the drive. Safe referencing must be carried out for the axis. Forced dynamics is not a requirement for safe cams. Note: The signals of safety function safe cams are issued and thus go into effect only after safe referencing has been carried out.

49 IST Intelligent Safety Technology IST Safety Functions Consent When safety function safely reduced speed with safely limited absolute positions is active, each axis movement is blocked by a consent signal. The user can move axes as long as he presses the Consent key. When the key is released, safety function safely reduced speed with safely limited absolute positions switches to safe stop or safe operation stop. Switching from safely reduced speed to safe stop or safe operation stop Which safety function is active when the Consent key is not pressed can be preset in the safety parameters. Which of the two safety functions is to be used is specified in safety parameter Cxx.117 in the control and P in the drive Selecting safety functions. Consent key in manual operation In manual operation of a system, a Consent key may be required if the operator has to safely switch off the existing axis (axes) in a dangerous situation. This is also the case if he does not press the Jog keys for jogging or does not turn the handwheel in manual operation. Activation Safety function safely reduced speed with safely limited absolute positions is preselected in jogging or manual operation. An axis movement is permitted by the safety functions in the CNC and in the drive only if the signal from the Consent key also arrives via the input. Otherwise, the axis is shut down using the shutdown circuits. Note: Consent must have the highest priority for an axis movement. This means that consent must be present before movement can be triggered, e.g. by a jog command. In the PLC user program, the Consent signal can be linked to the process enablement (PXXC.ENABL). This ensures that movement is triggered only if the Consent key is pressed first and a movement command is issued thereafter.

50 6-12 IST Safety Functions IST Intelligent Safety Technology Internal processing The signals from the Consent key are laid out in two channels on the two Consent key safety inputs of the CNC and of the drive of the participating axes. As soon as the safety functions in the CNC and in the drive have received an enablement from the Consent key, they acknowledge the enablement. If the acknowledgement is in both channels, the CNC generates an overall Movement enabled acknowledgement signal that is transferred to the PLC as an axis status signal (AXXS.SAFEN). In the PLC user program, movement should be blocked with axis control signal AXXC.MHOLD until the Movement enabled acknowledgement or the consent signal is present. Movement without acknowledgement always leads to the drive being shut down using the shutdown circuits. The following figure shows the monitoring of safely reduced speed depending on the Consent signal. If consent exists (signal status 1 ), the speed of the axis is monitored for safely reduced speed. If consent is now removed (signal status 0 ), monitoring of safely reduced speed switches to safe operation stop. The speed value for monitoring safely reduced speed is reduced to a value of 0 over a ramp, depending on safety parameter Transition time for switching safety functions. If consent is removed during an axis movement and if a motion hold is not issued for the axis, the axis movement leads to a malfunction reaction. In this case, the drives are switched off using the shutdown circuits with error message Monitoring of safely reduced speed. In the PLC user program, movement should be prevented by the motion hold (AXXC.MHOLD) as long as there is no consent signal and safety function safely reduced speed is selected. v Fault reaction Safely reduced speed vist 1 Consent tb tü t 0 1 AXXC.MHOLD t 0 tb: Braking time tü: Transition time for switching the safety funtions Zustimmung.FH7 t Fig. 6-6: Consent and motion hold

51 IST Intelligent Safety Technology IST Safety Functions 6-13 Braking time calculation t V = a act B = Axis ( Cxx.101orCxx.104 )* 1000 Cxx.018* 60 L: t B = Braking time in s V act = Actual speed in mm/min a Axis = Acceleration in mm/s 2 Cxx.101= maximum speed for safety function 1 in mm/s Cxx.104= maximum speed for safety function in mm/s Cxx.018= maximum acceleration mm/s 2 xx = Axis number - Fig. 6-7: Formula for calculating the braking time If safety functions safely reduced speed 1 and 2 are used, the larger speed limit value must always be used to calculate the braking time. Calculation of transition time for switching safety functions ü ( t + t t ) Cxx.118 = t = 1,2* + where: b PLC 1000 t ZL = 5* Kv[1000 / min]* 16,6 L: Cxx.118= transition time for switching the safety functions in ms t b = Braking time in ms t PLC = maximum PLC cycle time in ms t ZL = time constant position controller in ms K v = position controller K v factor (S ) in 1000/min xx = Axis number - Fig. 6-8: Formula for calculating Transition time for switching the safety functions ZL Safety parameter "Transition time for switching safety functions" is described in section "Description of Safety Parameters" (p. 6-23).

52 6-14 IST Safety Functions IST Intelligent Safety Technology 6.8 Safe Referencing Description Safety functions safely reduced speed with safely limited absolute positions and safe cams require safe referencing. The effectiveness of these safety functions is guaranteed only if the safe referencing procedure has been used to ensure that the axis mechanical system is really at the position that is displayed using the measurement system(s). Automatically executed safe referencing Safe referencing can be implemented either automatically or with manual user consent. If safe referencing is implemented automatically, an additional switch is required on the axis mechanical system. This switch is connected, using two channels, to the Reference cam for safe referencing safety inputs of the NC and of the drives. The switch is activated at the position of a short cam that is specified by safety parameter Reference position for safe referencing. In this way, the mechanical reference can be controlled to some extent. Zero pulse of the relative indirect measurement system +24V Reference point switch Switch for safe referencing Standard I/O module Control Channel 1 Channel 2 RMP safety I/O module Drive control device Command: Drive-guided referencing Drive guided referencing & & Error Error S R S R Q Q Axis safely referenced Sichere_Referenz.FH7 Fig. 6-9: Automatically executed safe referencing

53 IST Intelligent Safety Technology IST Safety Functions 6-15 Safe referencing with manual user consent In safe referencing with manual user consent, the machine operator generates the cam signal with, for example, a dual-channel key. The machine operator must determine if the axis position is correct after referencing. Then he acknowledges that the axis position is correct using the dual-channel key. The switch is connected, using two channels, to the two Reference cam for safe referencing safety inputs of the CNC and of the drive. Referencing procedure Safe referencing is a function that is carried out within the framework of referencing (G74 command) that is required for operation. The process of the G74 command is administrated in the CNC. When a G74 block is processed, the CNC calls up SERCOS command Drive-guided referencing in the drive if there is not already a reference. The drive executes referencing on its own and reports the successful completion of referencing back to the CNC. Two reference status signals exist in the drive and in the CNC: Reference status signal Drive being referenced Reference status signal Drive safely referenced Reference status signal Drive being referenced is set by the drive and the CNC after successful completion of referencing. Reference status signal Drive safely referenced is set and stored after the additional check for the correct mechanical axis position (described above). The check is initiated by the CNC before and after command Driveguided referencing within the G74 block. To do this, SERCOS command Reference check is triggered on the drive at the beginning (block start position) of the G74 block or at the end (block end position) of Driveguided referencing if the drive is being referenced at this time. With the command, the drive and the NC carry the following checks out: Is referencing available for the drive? Is the position of the drive the same as that in safety parameter Reference position for safe referencing? Is safety input signal Reference cam for safe referencing present (cam activated)? Only if all 3 conditions have been fulfilled is status signal Drive safely referenced set in the CNC and in the drive. Only then are safety functions safe cams and safely limited absolute positions of safety function safely reduced speed valid. Note: The comparison of the position of the drive with safety parameter Reference position for safe referencing is carried out using the position window of safety parameter Position monitoring window for safe operation stop.

54 6-16 IST Safety Functions IST Intelligent Safety Technology G74 for drive reference After the drive reference has been established with the first G74 block, each additional G74 call merely starts the safe reference check. Movement is no longer triggered by starting command Drive-guided referencing. After referencing has been carried out, a G74 command is permitted only if the axis is on Reference position for safe reference. Note: Safe referencing of an axis is lost if the control and drive do not recognize the cam signal on Reference position for safe referencing after another G74 command. Test of safety input Reference cam for safe referencing Safety input Reference cam for safe referencing is checked for a status of not activated if the axis is not located on the reference cam. It is assumed that the cam does not cover a range larger than 0.1m (linear axis) or 10 (rotary axis). A check is always carried out if: the drive is at a standstill (setpoint speed = 0) safe reference is active the actual position of the drive is further than 0.1m or 10 from the Reference position for safe referencing In the case of an error, safe referencing is lost and an error message is generated. Note: Reference status bits Drive being referenced and Drive safely referenced in the control and in the drive are valid until the reference is lost due to an error, the control or the drive is switched off or if the drive is switched to Phase 2.

55 IST Intelligent Safety Technology IST Safety Functions 6-17 Safe referencing for axes with relative measuring system Safe referencing with a relative measuring system must be carried out in two steps. First, a G74 command (e.g. in the NC home program) must be used to establish a reference to the measuring system. Then the axes must be moved to the Reference position for safe referencing position. The next G74 command triggers the safe reference check. It is required that both channels recognize the cam signal on this position and that the position is the same as that in safety parameter Reference position for safe referencing in the control and in the drive. N0000.HOME N0001 G74 X0 Y0 Z0 ;X-, Y- and Z axis referencing N0002 G01 X5 Y5 Z100 F1000 ;Approach safe reference position N0003 G74 X0 Y0 Z0 ;Axes safe referencing N0004 RET N0005 END OF PROGRAM Fig. 6-10: Safe referencing with relative measuring system Safe referencing for axes with absolute measuring system In normal operation, a referencing procedure is not required for axes with an absolute measuring system. The machine reference is already active after the control and the drive control device have been switched on. In order to place an axis in the safely referenced status, the CNC is to be used to move the drive (e.g. in the NC Home program) to the position stored in safety parameter Reference position for safe referencing. Then a G74 block is called. Subsequently, the safe reference check is started in the control and in the drive. The drive position must agree with the position in the safety parameter and the cam must be activated. If the result of the check is positive, safe reference is set. N0000.HOME N0001 G01 X5 Y5 Z100 F1000 ;Approach safe reference position N0002 G74 X0 Y0 Z0 ;Axes safe referencing N0003 RET N0004 END OF PROGRAM Fig. 6-11: Safe referencing with absolute measuring system

56 6-18 IST Safety Functions IST Intelligent Safety Technology Safe referencing for axes with distance-coded measuring system The referencing procedure is carried out twice for axes with a distancecoded measuring system. The first reference movement establishes the reference of the scale. Then the control is used to move the drive (e.g. in the NC Home program) to the position stored in safety parameter Reference position for safe referencing. Then another G74 block is called. The CNC starts the safe reference check in the CNC and in the drive. The drive position must agree with the position in the safety parameter and the cam must be activated. If the result of the check is positive, safe reference is set. N0000.HOME N0001 G74 X0 Y0 Z0 ;X-, Y- and Z axis referencing N0002 G01 X5 Y5 Z100 F1000 ;Approach safe reference position N0003 G74 X0 Y0 Z0 ;Axes safe referencing N0004 RET N0005 END OF PROGRAM Fig. 6-12: Safe referencing with distance-coded measuring system

57 IST Intelligent Safety Technology IST Safety Functions Switching between Two Safety Functions General When switching between two safety functions, it must be ensured that the deactivation signals are switched overlappingly. Otherwise, when all safety functions are switched off for a brief time, this is interpreted by the safety monitors as an intentional shutdown of the safety functions. Several safety functions can be activated simultaneously. For example, it is possible to permanently activate safety function safely reduced speed with safely limited absolute positions 2 (V_Max_2 > V_Max_1) with the highest degrees of freedom. When additional safety functions are activated, the possible movements of the axes may be limited (e.g. activation of safely reduced speed with safely limited absolute positions 1). Alternating switching of safety functions The safety functions are alternatingly switched on. This results in the danger that all safety functions are briefly deselected during switching. For the safety monitors, this is the same as a shutdown of the safety functions. Safety output signal Safety function active is immediately reset. Signal Safety function active takes on the value of 1 again only after the activation sequence runs through again. In the figure, safety functions safely reduced speed with safely limited absolute positions 1 and safe operation stop are switched off for time t1. Both safety functions are deselected (signal status 1 ) via the deactivation signals. When the safe operation stop function is selected again, no safety function is reported as being active for time t2. Deactivation of safely reduced speed with safely lim. abs. position 1 Deactivation of safe operation stop Safety function active Switching correct t1 Switching incorrect. Shutdown of safety function t2=300ms Reactivation of safety function Saf. red. Speed 1 Safely red. speed 1 Safe operation stop t t t Fig. 6-13: Alternating switching of safety functions Note: The activation sequence of a safety function, from its selection to the Safety function active report, requires 300 ms.

58 6-20 IST Safety Functions IST Intelligent Safety Technology This problem can be avoided using additive switching. Additive switching of safety functions The safety function with the highest degrees of freedom (safely reduced speed with safely limited absolute position 1 in the example) is permanently activated. The other safety functions are also activated if they are required. In this way, at least one safety function is always in effect. There is no danger of accidental shutdown. Deactivation of safely reduced speed with safely limited abs. positions 1 Safely reduced speed 1 always activated Switching correct Switching correct t Deactivation of safe operation stop t Safety function active Saf. red. speed 1 Safe operation stop Safely red. speed 1 t Fig. 6-14: Additive switching of safety functions

59 IST Intelligent Safety Technology IST Safety Functions 6-21 Transition time for switching safety functions Each time that the maximum permitted speed is reduced from V_Max_1 to V_Max_2 (V_Max_1 > V_Max_2) when the safety functions are switched, the new speed threshold goes into effect only after the time specified in safety parameter Transition time for switching safety functions has elapsed. The permitted speed drops continuously from speed V_Max_1 to V_Max_2. This allows NC Interpolator to adapt to the new speed threshold. In the opposite case (V_Max_1 < V_Max_2), the new speed threshold goes into effect immediately. Transitions with transition time: safely reduced speed 1 --> safely reduced speed 2 (V 1 > V 2) safely reduced speed 2 --> safely reduced speed 1 (V 1 < V 2) safely reduced speed 1 or 2 --> safe stop safely reduced speed 1 or 2 --> safe operation stop safely reduced speed 1 or 2 --> safely reduced speed 1 or 2 and Consent key = 0 (not activated) V_Max V_Max_1 V_Max_2 Safely reduced speed 1 Safely reduced speed 2 Safely reduced speed 2 Safely reduced speed 1 Transition time t Fig. 6-15: Temporal progression of the speed threshold

60 6-22 IST Safety Functions IST Intelligent Safety Technology Deselecting safety functions In order to deselect safety functions, all used deactivation signals of the safety functions to the control and the drive must be wired with 24V levels. The following then occurs in the control and the drives: The control and the drives internally deactivate the safety functions. The Safety function active enablement signals of the control and the drives are reset. Selecting safety functions In order to select safety functions, all used deactivation signals of the safety functions to the control and the drive must be wired with 0V levels. Before safety functions can be switched on, the drives must be at a standstill. Otherwise, switching safety functions on leads to an immediate shutdown of the drives. Note: When a safety function is selected, the safe operation stop is always activated in the control and the drives during a transition time of 300ms. This does not apply for switching between two safety functions.

61 IST Intelligent Safety Technology IST Safety Functions Description of Safety Parameters For each safety parameter, one is in the control and one is in the drive. The safety parameters of the control are in the Axis parameters menu of the machine parameters, while the safety parameters of the drive are in the SERCOS parameters menu of the drive. The safety parameters must always be set in the same way in both channels. Incorrect entries are detected by two-way data comparison, leading to a shutdown of the drive system when the power is switched on. Safety parameters Control parameter Drive parameter Safety function Cxx.100 P Maximum speed 1 for the safety function Cxx.101 P Upper position limit 1 for the safety function Cxx.102 P Lower position limit 1 for the safety function Cxx.103 P Maximum speed 2 for the safety function Cxx.104 P Upper position limit 2 for the safety function Cxx.105 P Lower position limit 2 for the safety function Cxx.106 P Upper position limit for position switching point 1 Cxx.107 P Lower position limit for position switching point 1 Cxx.108 P Upper position limit for position switching point 2 Cxx.109 P Lower position limit for position switching point 2 Cxx.110 P Upper position limit for position switching point 3 Cxx.111 P Lower position limit for position switching point 3 Cxx.112 P Upper position limit for position switching point 4 Cxx.113 P Lower position limit for position switching point 4 Cxx.114 P Position monitoring window for Safe operation stop Cxx.115 P Reference position for Safe referencing Cxx.116 P Selection of safety functions Cxx.1117 P Transition time for switching safety functions Cxx.118 P Time interval for forced dynamics Cxx.119 P Checksum of the weighting data Cxx.120 P Fig. 6-16: Safety parameter

62 6-24 IST Safety Functions IST Intelligent Safety Technology Safety function Safety parameter control: Cxx.100 Safety parameter drive: P The Safety function safety parameter opens or activates the safety parameter menu in the control and in the drive. By setting the parameter to yes, safety function parameters Cxx.101 to Cxx.120 are added to the axis parameters in the control. In the same way, the 1 st bit (bit 0) of the bit bar is to be set to 1 in the Drive parameters menu. Example: P = Maximum speed for safety function Safety parameter control: Cxx.101, Cxx.104 Safety parameter drive: P , P This parameter defines the maximum permissible speed when the monitoring function safely reduced speed with safely limited absolute positions has been selected. Exceeding the entered value results in the drive being switched off by the shutdown circuits. If safety functions safely reduced speed 1 and 2 are selected, the lower maximum speed value is always used for monitoring. Monitoring of safely reduced speed can be switched off if only safely limited absolute positions is used in the combined safety function safely reduced speed with safely limited absolute positions. In this case, safety parameter Maximum speed for safety function is to be set to 0. If safety function safely reduced speed with safely limited absolute positions is selected in this combination, only the monitoring of safely limited absolute positions is activated. Upper and lower position limits for safety function Safety parameter control: Cxx.102, Cxx.103, Cxx.105, Cxx.106 Safety parameter drive: P , P , P , P The Upper and lower position limit for the safety function safety parameters define the safely limited absolute positions of the combined safety function safely reduced speed with safely limited absolute positions. Exceeding the absolute positions leads to a shutdown of the drive system when safety function safely reduced speed with safely limited absolute positions is selected. Axis parameters Positive travel limit (Cxx.011) and Negative travel limit (Cxx.012) are to be set in such a manner that they are located before safely limited absolute positions. The advantage of this is that the travel limits are reached before the absolute positions, so that the drive system is not switched off. Monitoring of safely limited absolute positions with safety function safely reduced speed with safely limited absolute positions selected can be switched off if only safely reduced speed is used. In this case, safety parameter Upper and lower position limit for the safety function is to be set to 0.

63 IST Intelligent Safety Technology IST Safety Functions 6-25 Upper and lower position limits for position switch points Safety function control: Cxx.107 bis Cxx.114 Safety parameter drive: P to P The range of a safe cam is defined by safety parameter Upper position limit for position switch points and Lower position limit for position switch points. If the axis is within the defined range, then the controller and the drive set the corresponding position switch points. The position switch points of an axis are issued only if safe referencing has been carried out for the drive. Safe cams is switched off if safety parameters Upper position limit for position switch points and Lower position limit for position switch points are set to 0. Note: The position switch points of safe cams must safely undergo further processing; only signal status 1 may be evaluated for safety-relevant jobs. An example of further processing of safe cams can be found in section "Transferring Safety I/O Signals", p Position monitoring window for Safe operation stop Safety parameter control: Cxx.115 Safety parameter drive: P This parameter sets the position window that must not be exceeded when the safety function safe operation has been selected. When safe operation stop is selected, the setpoint position value must not change at all; the actual position value may change no more than the value entered in parameter Position monitoring window for safe operation stop. If an axis is manually pressed or turned out of this position, the drives are immediately shut down by the shutdown circuits. Reference position for Safe referencing Safety parameter control: Cxx.116 Safety parameter drive: P The Reference position for safe referencing is the position at which the control system and the drive expects the cam signal or the manual user acknowledgement to check the position after referencing. The comparison of the position of the drive with safety parameter Reference position for safe referencing is carried out using the position window of safety parameter Position monitoring window for safe operation stop. This means that the position of the drive may differ from Reference position for safe referencing no more than this amount.

64 6-26 IST Safety Functions IST Intelligent Safety Technology Selection of safety functions Safety parameter control: Cxx.117 Safety parameter drive: P The safety functions to be used for an axis are set in safety parameter "Selection of safety functions". To keep wiring to a minimum, safety functions that are not used can be hidden using this parameter. Hidden safety functions therefore do not have to be deselected using the deactivation signals in both channels. A safety function that is not hidden (Hide = No) is automatically selected until it is deselected using the deactivation signals in both channels. The Safety function selection safety parameter makes it possible to hide safety functions safe stop, safe operation stop and safely reduced speed with safely limited absolute positions 1 and 2. Furthermore, this parameter is used to specify which safety function is selected when safely reduced speed is selected and the Consent key is not activated. Option SOS switch is used to specify whether safe stop or safe operation stop is selected if there is no consent. The following example shows the setting in the control and in the drive for switching between safe stop and safely reduced speed 1. Cxx.117 Selecting safety functions Bit Meaning Value 00 Hide safe stop Yes 01 Hide safe operation stop Yes 02 Hide safely reduced speed 1 No 03 Hide safely reduced speed 2 Yes 04 Hide SOS switch Yes Fig. 6-17: Selection of safety functions for switching between safe stop and safely reduced speed 1 in the control In the drive, a safety function is hidden by setting the corresponding bit to 1. P = Hide "SOS switch" Hide "Safely reduced speed 2" Hide "Safely reduced speed 1" Hide "Safe operation stop" Hide "Safe stop" Antrieb_SH_SRG.FH7 Fig. 6-18: Selection of safety functions for switching between safe stop and safely reduced speed 1 in the drive

65 IST Intelligent Safety Technology IST Safety Functions 6-27 The following example shows the setting in the control and in the drive for switching between safe operation stop and safely reduced speed 1. Cxx.117 Selecting safety functions Bit Meaning Value 00 Hide safe stop Yes 01 Hide safe operation stop Yes 02 Hide safely reduced speed 1 No 03 Hide safely reduced speed 2 Yes 04 Hide SOS switch No Fig. 6-19: Selection of safety functions for switching between safe operational stop and safely reduced speed 1 in the control P = Hide "SOS switch" Hide "Safely reduced speed 2" Hide "Safely reduced speed 1" Hide "Safe operation stop" Hide "Safe stop" Antrieb_SBH_SRG.FH7 Fig. 6-20: Selection of safety functions for switching between safe operational stop and safely reduced speed 1 in the drive Note: When safely reduced speed is used with a switch to safe stop or safe operation stop, the switch occurs solely using the Consent signal. In this case, safe stop and safe operation stop must be hidden.

66 6-28 IST Safety Functions IST Intelligent Safety Technology Transition time for switching safety functions Safety parameter control: Cxx.118 Safety parameter drive: P This safety parameter defines the time it takes for a new safety function to be active when a switch-over is made from one safety function to another. The transition time is only taken into consideration when the new safety function allows a lower speed than the function that was previously active. The transition time must be precisely set, especially in the case of a switch from safely reduced speed to safe stop or safe operation stop using the Consent signal. For example, if a switch is made from safely reduced speed to safe operation stop and the axis is still moving, the safety monitor of the safe operation stop triggers the shutdown of the drive system if the axis leaves the position monitoring window for safe operation stop. The transition time is calculated from the sum of the: braking time, maximum PLC cycle time and the position regulation time constants plus a variance factor of 20 percent. ( t + t t ) Cxx.118 = P = 1,2* B PLC + ZL ( Cxx101orCxx104 )* 1000 With t B = Cxx018* and: t ZL = 5* Kv[1000 / min]* 16,6 L: Cxx.118= transition time for switching the safety functions in the control in ms P = Transition time for switching the safety functions in Drive in ms t b = Braking time in ms t PLC = maximum PLC cycle time in ms t ZL = time constant position controller in ms Cxx101 = maximum speed for safety function 1 in mm/s Cxx104 = maximum speed for safety function 5.08 cm mm/s Cxx018 = acceleration in mm/s 2 K v = position controller K v factor (S ) in 1000/min xx = Axis number - Fig. 6-21: Formula Transition time for switching the safety functions The maximum PLC cycle time (t PLC ) can be found in the PLC programming interface under menu item Diagnostics / PLC info. Note: If safety functions safely reduced speed 1 and 2 are used, the larger speed limit value must always be used to calculate the braking time.

67 IST Intelligent Safety Technology IST Safety Functions 6-29 Time interval for forced dynamics Safety parameter control: Cxx.119 Safety parameter drive: P This safety parameter determines the time intervals in which the switchoff paths are checked by the controller and the drive. Forced dynamics should be carried out at least once every eight hours. A reason for a value greater than eight hours must be provided in writing in the acceptance report. Note: The selection of safety functions safe stop, safe operation stop or safely reduced speed with safely limited absolute positions requires that forced dynamics be carried out beforehand or that forced dynamics is still in effect. Checksum of the weighting data Safety parameter control: Cxx.120 Safety parameter drive: P A checksum (P ) covers the values of all the parameters that have an effect on the actual position value generated by the drive. This checksum, which is generated by the drive, must be entered in safety parameter Checksum of weighting data (Cxx.120) on the control side if safety functions are used. The parameter is calculated in the drive only after operation is switched from the parameter-setting mode to the operation mode. This parameter ensures that subsequent changes to the drive parameters are recognized by the control. A manipulation of the drive parameters is thereby recognized by comparing the data and results in a shutdown of the drive system.

68 6-30 IST Safety Functions IST Intelligent Safety Technology 6.11 Password Protection Safety parameters Cxx.100 to Cxx.120 of the control are protected by their own password. This ensures that only personnel especially authorized by the machine and system manufacturer (safety officers) are able to edit safety parameters. Password hierarchy Supervisor ID data User ID data User name and password Password protection for software version 19 In software version 19, the safety parameters of the control are protected by their own password and a security diskette. Differentiation is made between a supervisor and a normal user. The supervisor, along with his ID data, is already specified during the installation of the user interface. The supervisor is the only one who has the right to specify additional users and their access rights. During installation of the user interface, the ID data (user name and password) of the supervisor are entered. Access rights for all functions are automatically assigned to him in the key list. After installation, only the supervisor has the right to modify safety parameters in the control. Function Modify IST safety parameters in the key list is enabled for the supervisor. The supervisor must specify ID data with a limited CNC user interface operating scope for each user. For the security of the control data, these persons are generally allowed only certain operating functions. The supervisor must specify which users obtain the right to modify safety parameters. The safety parameters in the control can be edited only if function Modify IST safety parameters has been enabled for the user in the key list and if he can also identify himself with the security diskette. After the user name and password have been entered successfully, they remain valid until the user interface is terminated, another user logs on or the time limit of the user has elapsed. Passworteingabe.bmp Fig. 6-22: User name and password entry Security diskette The security diskette can be created solely by the supervisor. To do this, proceed as follows: 1. Open the Password management menu and log on using the user name and password. 2. Activate function Modify IST safety parameters in the key list. The user obtains the right to modify safety parameters. 3. Insert an empty formatted diskette. 4. Press function key F4 IST diskette. The diskette is created. Note: In order to ensure that the security diskette is not accidentally deleted, write protection of the diskette should then be activated.

69 IST Intelligent Safety Technology IST Safety Functions 6-31 Safety parameters for drives The security diskette must be inserted into drive A each time that a safety parameter is edited in the control. The ID data of the user who is currently logged on is compared each time with the ID data stored on the security diskette. A safety parameter can be edited only after a positive check. The safety parameters of the drives are secured, as is the case for all drive parameters, by the standard password management. Function Drive parameters must be enabled for editing in the key list. For more information regarding password management, see documentation folder 2, MTCNC/MTC200 User Interface under General Information and Password Management. Password protection as of software version 22 As of software version 22, password protection is organized in User management. The procedure is described in Chapter 3 (User Management) of documentation MTC200/ISP200/TRANS200 Setup.

70 6-32 IST Safety Functions IST Intelligent Safety Technology 6.12 Transferring Safety I/O Signals Safety I/O of NC Interface signals of safety I/O of NC The safety-relevant input and output signals of the control (abbreviated safety I/O) are transferred using two channels to the safety functions in the NC/drive. The safety I/Os of the NC form channel 1 and those of the drive form channel 2 (also see previous chapter). The safety I/Os for the safety functions of the NC are transferred in the same manner as non-safety-relevant I/Os. To do this, the corresponding hardware I/Os (RECO I/Os) are to be copied to the internal safety I/O area of the NC. This information is transferred to the safety functions of the NC. An area for the safety I/Os of the NC is reserved for each axis in the I/O area between the NC and the PLC (axis interface signals). The NC signals to the PLC are designated as axis status signals, while the PLC signals to the NC are designated as axis control signals. Axis status signal Name Meaning AxxS.SAFAC Safety functions active Safety functions are active AxxS.SAFRY Switching complete Switching safety function(s) on or off is complete AxxS.SAFP1 Position switch point 1 Position switch point 1 has been attained AxxS.SAFP2 Position switch point 2 Position switch point 2 has been attained AxxS.SAFP3 Position switch point 3 Position switch point 3 has been attained AxxS.SAFP4 Position switch point 4 Position switch point 4 has been attained AxxS.SAFSL Activate starting lockout The PLC is to activate the starting lockout for the corresponding drive AxxS.SAFEN Enable movement Drive movement enabled by safety function Fig. 6-23: Axis status signals for safety functions Axis control signal Name Meaning AxxC.SAFSS Deactivation of safe stop Deactivate safety function safe stop for drive AxxC.SAFOS Deactivation of safe operation stop Deactivate safety function safe operation stop for drive AxxC.SAFA1 Deactivation of safely reduced speed with safely limited absolute position 1 AxxC.SAFA2 Deactivation of safely reduced speed with safely limited absolute position 2 Deactivate safety function safely reduced speed with safely limited absolute position 1 for drive Deactivate safety function safely reduced speed with safely limited absolute position 2 for drive AxxC.SAFAG Consent key Signal for status Consent key activated AxxC.SAFRS Reference cam for safe referencing Reference cam for safe referencing has been activated AxxC.SAFSL Starting lockout active Transfer acknowledgement (Starting lockout active) to CNC Fig. 6-24: Axis control signals for safety functions

71 IST Intelligent Safety Technology IST Safety Functions 6-33 Safety I/Os of drives A RECO RMP12.2-8E-8A safety I/O module must be provided for every drive for which safety functions are to be used. The RMP E-8A RECO module is a digital input/output module for the Interbus-S RECO system. The module is operated as a participant in the local bus on carrying bar RMB or RMB in connection with bus terminal RMK 12.2-IBS-BKL. RMP12_2.wmf Fig. 6-25: Safety I/O module RMP12.2-8E-8A The module has 8 floating input channels and 8 output channels in the form of potential-free relay contacts. The input and output channels are not directly served by the local bus connection, but rather by the interposed microprocessor, which also processes the safety-relevant programs for use in the IST system. The safety module has its own watchdog for controlling the microprocessor; if an error occurs, Module error is displayed on the Interbus. Diagnostic LEDs BA Bus active display green LED lit: Interbus active green LED off: no data telegram exchange Status Status display yellow LED lit: communication with drive OK yellow LED flashing: communication with drive faulty yellow LED off: safety module not working Address selection switch The data of the safety module are permanently assigned to the drive with the same SERCOS address using the address selection switches on the module.

72 6-34 IST Safety Functions IST Intelligent Safety Technology Safety inputs of drives The safety input signals consist of the deactivation signals for the 4 safety functions, the signal for the Consent key and the signal for the reference cam for safe referencing. The information of the safety inputs is compressed directly by the safety I/O module, is assigned additional safety mechanisms, and is transferred via the PLC and the NC to the drive. The safety mechanisms ensure that only the drive that belongs to the module receives the safety signals. Input bit Allocation IX.5.0 Deactivation of safe stop IX.5.1 Deactivation of safe operation stop IX.5.2 Deactivation of safely reduced speed with safely limited absolute position 1 IX.5.3 Deactivation of safely reduced speed with safely limited absolute position 2 IX.5.4 Consent key IX.5.5 Reference cam safe referencing IX.5.6 IX.5.7 Reserved Reserved Fig. 6-26: Allocation of RMP12.2-8E-8A safety inputs Optocoupler Inputs 1-8 +UL red LED X1 RMP E-8A 0VL 9,10 RMP12_E.FH7 Fig. 6-27: Internal RMP12.2-8E-8A input switching

73 IST Intelligent Safety Technology IST Safety Functions 6-35 Safety outputs of drives The safety output signals are gathered together by the drive and are also compressed and assigned safety mechanisms. The data package is transferred via the CNC and PLC directly to the corresponding safety module. The safety mechanisms ensure that only the module that belongs to the drive receives the safety signals of the drive. Output bit Allocation QX.1.0 Safety function active QX.1.1 Switching complete QX.1.2 Position switch point 1 QX.1.3 Position switch point 2 QX.1.4 Position switch point 3 QX.1.5 Position switch point 4 QX.1.6 Reserved QX.1.7 Reserved Fig. 6-28: Allocation of RMP12.2-8E-8A safety outputs Relay 1a - 8a F=2A max. +UL RL X2 1b - 8b RMP E-8A RMP12_A.FH7 Fig. 6-29: Internal RMP12.2-8E-8A output switching

74 6-36 IST Safety Functions IST Intelligent Safety Technology Technical Data of RMP12.2 Safety I/O Module Input data Input voltage range Low -10V V Input voltage range High +17V V Input current 2,5mA... 8mA Output data Potential-free relay contacts Switching voltage Umax 230V Switching capacity Pmax. 220W Switching current Imax. 2A Ambient conditions Operational temperature range 0-50 C ambient temperature

75 IST Intelligent Safety Technology IST Safety Functions 6-37 Processing of Safety Output Signals If the output signals of the safety I/O module are to be used for safetyrelevant functions, further processing must also correspond to safety category 3 according to EN Since dual-channel monitoring of further processing is impossible, 2- channel signaling with 1-channel monitoring must be used to attain the safety category. The purpose of the following examples is to demonstrate the possible ways that such further processing can take place. RMP supply PLC output signal "Q K1 " +U L RMP safety +U L output "Q K2 " K1 K2 PLC "I K1 " input signals "I K2 " Enabl. circ. for safety function Fig. 6-30: Discrete 2-channel processing of a safety output signal The fig. above shows the circuit diagram for 2-channel processing of safety output Q K2. The enablement circuit for the safety-relevant function is formed by relays K1 and K2. Relay K1 is activated by an ordinary PLC Q K1 output signal; K2 is activated by the safety output itself. The PLC monitors the feedback of the two switching channels using signals I K1 and I K2. If an error occurs in relay K1 or in the upstream PLC output, there is no direct way of preventing the safety output from being reactivated; in such a case, it must be possible to switch off the power supply of the safety output by the PLC. Another relay, K0, is used for this purpose, as shown in fig. below. +U L PLC output Q K0: ctivation of power for RMP outputs +24V PLC inputi K0: Feedback status K0 RMP power Fig. 6-31: Shutdown circuit for power supply of safety outputs

76 6-38 IST Safety Functions IST Intelligent Safety Technology The PLC user program monitors the relays. For this purpose, the following logic must be programmed: 1 (*Monitor relay functions, error if feedback equals output!* = QK0- >=1 IK = QK1- IK = QK1- IK MK0OFF QK0... Power supply of RMP module... %Q12. IK0... Power supply of RMP module OFF... %I11. QK1... Safety function switching channel 1... %Q12. IK1... PLC switching channel 1 OFF... %I11. QK1... Safety function switching channel 1... %Q12. IK2... RMP switching channel 2 OFF... %I11. MK0OFF... Switch off RMP power (*In case of error, switch off power supply of safety output fbrs & IK0- RS IRESET- +- S_ fbton TON MK0OFF- IN_ Q_+- R_1 Q_1+-QK0 tab- PT_ ET_ fbrs... Shutdown of RMP supply IK0... Power supply of RMP module OFF... %I11. IRESET... Power supply reset... %I11. fbton... Shutdown delay MK0OFF... Switch off RMP power QK0... Power supply of RMP module... %Q12. tab... Delay time (*Process request of safety function*) & P00SAFP1- QK0- +-QK P00SAFP1... Position switch point 1 has been attained. %I11. QK0... Power supply of RMP module... %Q12. QK1... Safety function switching channel 1... %Q12. Fig. 6-32: Monitoring of relay switching in the PLC In the example, position switch point 1 of axis 1, i.e. axis status signal A01S.SAFP1, is used in a safety-relevant function. When the signal is requested, Q K1 is switched on via the PLC (network 3). However, this occurs only if no errors were detected in the relay switch by the comparator circuit in network 1. The error message regarding Q K0 shutdown must be delayed by the switching times of the relay, the PLC cycle time and the transfer times of the bus systems. We recommend a delay time T of 300ms. Note: When the residual risks that result from further processing of the safety output signals are considered, the reaction time of the downstream equipment, e.g. the hydraulic system, must be taken into account.

77 IST Intelligent Safety Technology IST Safety Functions 6-39 WARNING Injuries due to errors in activating motors and moving elements! Ÿ Safe design of software and hardware Ÿ Output signals QK0 and QK1 may be programmed in only one location of the PLC user program as shown above. (Must be checked using cross-check list.) Ÿ The wiring of the relay switch must be checked during the safety-related inspection; functioning must also be tested. These inspections must also be entered in the acceptance report Starting Lockout as a Shutdown Circuit of the CNC The starting lockout serves the control as a shutdown circuit if a safety monitor in the control triggers a shutdown of the drive system. Furthermore, the starting lockout is activated in the drive control device when safety function safe stop is selected. Activate starting lockout The starting lockout is activated by the PLC user program. The following processes must always be observed: The CNC requests the PLC user program to activate the starting lockout in the drive if a safety monitor triggers a shutdown of the drive system or if safety function safe stop is selected (AXXC.SAFSS). The PLC user program activates the starting lockout in the drive (AS) in the fast PLC program (2ms implementation) via a digital output. The drive acknowledges the activation of the starting lockout (ASQ) of the PLC. In the PLC user program, the acknowledgement is passed on to the CNC with axis control signal AXXC.SAFSL via the cycle interface. +24V Drive module PLC input module RME12.2 Start inhibitor active (ASQ) PLC output module RMA12.2 Start inhibitor active (AS) PLC-I/O RMB12.2 INTERBUS-S PLC-I/O PLC AXXC.SAFSS AXXC.SAFSL AS of CNC 2ms implementation Cycle interface Cycle interface CNC 0V Anlaufsperre_Demo.FH7 Fig. 6-33: Activation of the starting lockout by the PLC user program Switching example for starting lockout In order to keep wiring to a minimum, the acknowledgement of the starting lockout of several drive modules can be guided to the PLC by a signal line. Further information can be found in Section 8.3 "Sample Application" " CNC Shutdown Circuit". The activation of the starting lockout by the PLC user program is described in detail in section 8.3 "Sample Application" "PLC Program". Designing thestarting lockout Further information regarding the design of the starting lockout on the drive module can be found in function description DIAX04 Drive with Servofunctions, Section 7.5 Starting Lockout.

78 6-40 IST Safety Functions IST Intelligent Safety Technology

79 IST Intelligent Safety Technology Reaction Times and Braking Paths Reaction Times and Braking Paths 7.1 Introduction 7.2 Basic Procedure The purpose of this chapter is to determine the relevant reaction times and the resulting brake paths when the monitors of the safety functions are activated. This chapter first describes the basic procedure and then provides more detail about the specific conditions for the various safety functions. Basic shutdown principles Procedure The shutdown circuits are served both by the control (by shutting down the EMERGENCY STOP safety circuits / triggering the starting lockout drive reaction) and by the drives; this is specified by their parameters. The following basic procedure is recommended to determine the reaction times and brake paths when the monitors of the safety functions are activated: determine the relevant safety functions that are to be used. specify the drive reaction using drive parameters P , P and P specify whether an intermediate circuit short-circuit is to be used. determine the reaction times and the corresponding braking paths when the monitors within the relevant safety functions are activated when the drive and control are functioning. determine the reaction times and the corresponding braking paths when the monitors within the relevant safety functions are activated when the drive is functioning and the control is malfunctioning. determine the reaction times and the corresponding braking paths when the monitors within the relevant safety functions are activated when the drive is malfunctioning and the control is functioning. The corresponding worst-case scenario is then to be used to derive the relevant measures, such as determining the minimum distance between a protective door and a moving machine part, or to clarify whether a protective door lock is to be used.

80 7-2 Reaction Times and Braking Paths IST Intelligent Safety Technology Determining the Drive Reaction / Using an Intermediate Circuit Short- Circuit Drive parameter P Activation of NC reaction during malfunction Drive parameter P Power shutdown during malfunction Drive parameter P Bestpossible shutdown Drive parameters P Activation of NC reaction during malfunction, P Power shutdown during malfunction or P Best possible shutdown and the associated drive parameters are used to specify the drive reaction to activation of the monitors within the safety functions. For more information, see the documentation DIAX04, Drive with Servofunction, SSE03VRS Function Description with type designation DOK-DIAX04-SSE03VRS**-FKB1-EN-P or DIAX04, Drive with Main Spindle Function, SHS03VRS Function Description with type designation DOK-DIAX04-SHS03VRS**-FKB1-EN-P. Following is a short explanation of the parameters. This drive parameter is used to specify whether a control-side reaction or a drive-internal reaction is to occur when a malfunction is determined in a drive. For use with Intelligent Safety Technology, only the drive-internal reaction is currently meaningful. For more information, see the documentation DIAX04, Drive with Servofunction, SSE03VRS Function Description with type designation DOK-DIAX04-SSE03VRS**-FKB1-EN- P or DIAX04, Drive with Main Spindle Function, SHS03VRS Function Description with type designation DOK-DIAX04-SHS03VRS**-FKB1-EN- P. This drive parameter is used to specify as a priority how all other drives on the same power supply are to react with Best-possible shutdown when a malfunction is determined in a drive. This must normally be set for applications with Intelligent Safety Technology. For more information, see the documentation DIAX04, Drive with Servofunction, SSE03VRS Function Description with type designation DOK-DIAX04-SSE03VRS**- FKB1-EN-P or DIAX04, Drive with Main Spindle Function, SHS03VRS Function Description with type designation DOK-DIAX04-SHS03VRS**- FKB1-EN-P. This drive parameter is used to specify what the reaction should be when a malfunction is determined in a drive. The following possibilities are available: Switching the setpoint speed to zero. The drive brakes with the maximum possible torque/force. Switching the setpoint torque/force to zero. This frees the drive of torque/force. The drive is braked solely by friction and any braking equipment that may be present (brake integrated in motor or attached externally and separately to the mechanical system). Switching the setpoint speed to zero with filter and ramp. The drive brakes with the set ramp. Retract movement. The affected drive attempts to move along a defined path in a defined direction. This function is often used in gear manufacturing machines so that, if a malfunction occurs, axes in the roller coupling can be separated and then shut down without damaging the tool, workpiece or machine. For more information, see the documentation DIAX04, Drive with Servofunction, SSE03VRS Function Description with type designation DOK-DIAX04-SSE03VRS**-FKB1-EN-P or DIAX04, Drive with Main Spindle Function, SHS03VRS Function Description with type designation DOK-DIAX04-SHS03VRS**-FKB1-EN-P.

81 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-3 Using the intermediate circuit short-circuit Using the intermediate circuit short-circuit leads to a shutdown reaction by the counter-emf of the intermediate circuit in the case of drive malfunctions. However, use of this function is not safe for persons, but only for machines. Its use is advantageous without limitations for synchronous motors, but with limitations for induction motors. When an intermediate circuit short-circuit is activated, induction motors slow down only by braking due to friction and due to the activation of any existing brakes. If this does not pose a danger to the machine, the intermediate circuit short-circuit can be used. 7.3 Reaction Times and Braking Paths When Monitors within Safety Function Safe Stop are Activated Explanation Malfunction scenario Reaction times and braking paths Monitor reaction time Reaction time until shutdown circuits are operated Within safety function Safe Stop, the Starting lockout function is used on the hardware side in the drive; on the software side, the drive enablement is removed. In the control, the axis is blocked on the software side. Using the Starting lockout acknowledgement contact on the drive control device, the correct functioning in the shutdown circuit of the drive and control activation is monitored on the hardware side. When the monitoring functions within safety function Safe Stop are activated, the shutdown circuit of the drive and control activation is thus served on the hardware side. On the software side, the starting lockout of the control-side axis block and the drive-side removal of the drive enablement remain if there is a malfunction in the activation system. Due to errors within the PLC program, the starting lockout can be deactivated even if a safety function on the drive is activated. The reaction times are determined mainly by specifying the removal of the starting lockout and the associated triggering of the shutdown circuit. The braking path does not need to be considered because no movements can occur due to the redundant software-side and hardware-side monitoring of safety function safe stop. The reaction time of the monitor in the control is t = 4 ms. The reaction time of the monitor in the drive is t = 6 to 8 ms. The reaction time of the control for operating the shutdown circuits is: t = processing time + 6 x Interbus transfer time + delay time for starting lockout relay The processing time is 6 ms. Typical values for the Interbus transfer time are 2 to 9 ms. You can calculate this more precisely using the following formula. For the number of user data bytes, please use the larger of the input or the output information. The delay time for the starting lockout relay is 25 ms for HVE / HVR supply devices. Interbus transfer time 1 t ü = [ 13 1,15 (6 + n ) + 3 m] tbit tsw L: t ü = transition time in ms n = number of user data bytes m = number of remote bus and local bus participants t bit = bit duration in µs (currently 2 µs at 500 kbit/s) t sw = software running time in ms (generation 4: 0,7 ms) Fig. 7-1: Determining the Interbus transfer time The reaction time of the drive for operating the shutdown circuits is t = 2 ms.

82 7-4 Reaction Times and Braking Paths IST Intelligent Safety Technology Overall reaction time The following results: Overall reaction time control: t 1.1 = t t Overall reaction time drive: t 1.1 = t t It can be seen that the shutdown circuit is operated via the drive with a max. reaction time of 10 ms. 7.4 Reaction Times and Braking Paths When Monitors within Safety Function Safe Operating Stop are Activated Explanation Error scenarios Within safety function Safe Operating Stop, the axis is monitored for maintenance of the Position monitoring window for safe operating stop, both in the drive and in the control. When the position monitoring window is exceeded, the shutdown circuits are operated both via the drive and via the control. Drive parameters P Activation of NC reaction during malfunction, P Power shutdown during malfunction and P Best-possible shutdown are relevant for the shutdown circuit via the drive. Due to errors within the drive, e.g. incorrect assignment of commutation for synchronous motors or incorrect entry of field parameters by the user for induction motors, the drive can be accelerated to a final speed that is specified by the counter-emf of the intermediate circuit. This is the worstcase scenario. Due to errors within the control, incorrect command values can be preset which could initiate movement. The drive then follows the incorrect command values until it is detected that the position monitoring window has been exceeded. Reaction Times and Braking Paths Determined by the Control Monitor reaction time Control reaction time The reaction times and braking paths are determined mainly by detecting that the position monitoring window for safe operating stop has been exceeded and the resulting triggering of the shutdown circuit using the Starting lockout function via the control. In the above-mentioned error scenario, where the drive is accelerated to a final speed, the following reaction times and braking paths result: The reaction time of the monitor is t = 4 ms. The reaction time of the control for operating the shutdown circuit using the Starting lockout function is: t = processing time +6 x Interbus transfer time + delay time for starting lockout relay The processing time is 6 ms. Typical values for the Interbus transfer time are 2 to 9 ms. You can calculate the values more precisely using the following formula. For the number of user data bytes, please use the larger of the input or the output information. The delay time of the starting lockout relay is 25 ms. Interbus transfer time 1 t ü = [ 13 1,15 (6 + n ) + 3 m] tbit tsw L: t ü = transition time in ms n = number of user data bytes m = number of remote bus and local bus participants t bit = bit duration in µs (currently 2 µs at 500 kbit/s) t sw = software running time in ms (generation 4: 0,7 ms) Fig. 7-2: Determining the Interbus transfer time

83 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-5 Overall reaction time The following results: Overall reaction time: t 2.1 = t t Working path within the reaction time (assuming constant acceleration without attaining the final speed) For translation axes: S = aacc t2.1 v = 2.1 a acc t2. 1 L: S 2.1 = acceleration path in m a acc = acceleration in m/s 2 t 2.1 = reaction time in s v 2.1 = speed in m/s Fig. 7-3: Calculation of working path within the reaction time, assuming constant acceleration for translation axes For rotary axes: ϕ 2.1 = α acc t ω = α acc t2. 1 L: ϕ 2.1 = Acceleration angle in rad α acc = Acceleration in rad/s 2 t 2.1 = reaction time in s ω 2.1 = Angle speed in rad/s Fig. 7-4: Calculation of working path within the reaction time, assuming constant acceleration for rotatory axes Under the following conditions: v 2.1 nlimit hv 60 or v or ω 2.1 vlimit 2.1 π n i 60 2 limit L: v 2.1 = speed in m/s n limit = limit speed (can be seen in torquespeed diagram of the associated motor documentation) in min -1 h v = feed constant in m/revolution v limit = limit speed (can be seen in force-velocity diagram of the corresponding motor documentation) in m/s ω 2.1 = Angle speed in rad/s i = calculation of transformation ratio - Fig. 7-5: Conditions for translation / rotary axes for calculating the acceleration path/angle within the reaction time

84 7-6 Reaction Times and Braking Paths IST Intelligent Safety Technology The acceleration for translation axes is calculated as follows: a acc = ( M M ) max 2 π J frict ges h v or a acc = ( F F ) L: a acc = acceleration in m/s 2 M max = max. motor torque in Nm M frict = friction torque in Nm h v = feed constant in m/revolution J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 F max = max. motor power in N F frict = friction force in N m ges = total mass (m load+m mot) in kg Fig. 7-6: Calculation of acceleration for translation axes max m ges frict The acceleration for rotary axes is calculated as follows: α acc ( M M ) max i J L: α acc = acceleration in rad/s 2 M max = max. motor torque in Nm M frict = friction torque in Nm i = calculation of transformation ratio - J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 Fig. 7-7: Calculation of acceleration for rotatory axes = ges frict

85 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-7 Working path within the reaction time (assuming constant acceleration with attaining of the final speed) For translation axes: S 1 n h n h S.1 = v + 2 nlimit hv v with: tacc = or t acc = 60 aacc a nlimit hv and: v2.1 = or 60 ( t ) = or limit v lim it v 2.1 tacc 2.1 tacc ( t ) 2 limit tacc vlimit 2.1 tacc limit acc v 2.1 = v grenz L: S 2.1 = acceleration path in m n limit = limit speed (can be seen in torquespeed diagram of the associated motor documentation) in min -1 h v = feed constant in m/revolution t acc = Acceleration time in s t 2.1 = reaction time in s v limit = limit speed (can be seen in force-velocity diagram of the corresponding motor documentation) in m/s a acc = acceleration in m/s 2 v 2.1 = speed in m/s Fig. 7-8: Calculation of working path within the reaction time, assuming constant acceleration and attaining of the final speed for translation axes For rotary axes: ϕ 1 2 π n 2 π n = + 2 i 60 i 60 2 π nlimit with: tacc = and ω 2.1 = i 60 α ( t ) limit limit 2.1 tacc 2.1 tacc acc π n i 60 2 limit L: ϕ 2.1 = Acceleration angle in rad n limit = limit speed (can be seen in torquespeed diagram of the associated motor documentation) in min -1 i = calculation of transformation ratio - t acc = Acceleration time in s t 2.1 = reaction time in s α acc = Acceleration in rad/s 2 ω 2.1 = Angle speed in rad/s Fig. 7-9: Calculation of working path within the reaction time, assuming constant acceleration and attaining of the final speed for rotatory axes

86 7-8 Reaction Times and Braking Paths IST Intelligent Safety Technology The braking path resulting from triggering of the shutdown circuits by the control using the Starting lockout function is determined by friction and any external brakes that may be used. Using the intermediate circuit short-circuit results in a further reduction of the braking path. However, use of this function is not safe for persons, but only for machines. Furthermore, use with induction motors is possible only to a degree. When an intermediate circuit short-circuit is activated, induction motors slow down only by braking due to friction and due to the activation of any existing brakes. Braking path to shutdown after triggering the shutdown circuits by the control (without intermediate circuit short-circuit / decisive for protection of persons) For translation axes: a dec S = 1 = with: v2.1 tdec ( M + M ) ext.bremse 2 π J ges frict h v t dec or v 2.1 = and: a dec a dec = ( F + F ) ext.bremse L: s 2.2f = deceleration path in m v 2.1 = speed in (see above) in m/s t dec = deceleration time in s a dec = deceleration in m/s 2 M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm h v = feed constant in m/revolution J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 F ext. Bremse= braking force of external brake in N F frict = friction force in N m ges = total mass (m load+m mot) in kg Fig. 7-10: Calculation of braking path to shutdown of axis after triggering the shutdown circuits by the control (without intermediate circuit shortcircuit / decisive for protection of persons) for translation axes m ges frict For rotary axes: = ω 2.1 tdec ϕ with and: α dec = t dec = ω 2. 1 α dec ( M + M ) ext.bremse i J L: ϕ 2.2 = deceleration angle in rad ω 2.1 = Angle speed in rad/s t dec = deceleration time in s α dec = deceleration in rad/s 2 M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm i = calculation of transformation ratio - J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 Fig. 7-11: Calculation of braking path to shutdown of axis after triggering the shutdown circuits by the control (without intermediate circuit shortcircuit / decisive for protection of persons) for rotatory axes ges frict

87 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-9 Braking path to shutdown after triggering the shutdown circuits by the control (with intermediate circuit short-circuit / decisive for protection of machinery only) For translation axes: S 2.2 v 2.1 1,8 h v = M + M S 2.2 M zks zks 2 2 π h J ext.bremse 1,8 v v + M ges frict ( F + F + F ) zks m ext.bremse ges = with: = F zks ( R + R ) = A M I e 2 dn dn 2 frict 2 π v h 2 π v + hv v p L 2 ( R + R ) + ( v p L ) 2 A F I L: s 2.2f = deceleration path in m v 2.1 = speed in (see above) in m/s h v = feed constant in m/revolution J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 M zks = intermediate circuit shourt-circuit braking torque in Nm M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm m ges = total mass (m load+m mot) in kg F zks = intermediate circuit short-circuit braking force in N F ext. Bremse= braking force of external brake in N F frict = friction force in N N dn = continuous torque at standstill in Nm I dn = continuous current at standstill in A R A = motor winding resistance in Ω Re = bleeder resistance in Ω (bei HVE/HVR: 6Ω) p = number/width of pole pairs in - or m L A = coil inductivity in H Fig. 7-12: Calculation of braking path to shutdown of axis after triggering the shutdown circuits by the control (with intermediate circuit short-circuit / decisive for protection of machinery only) for translation axes e dn dn 2 v A A 2 or or

88 7-10 Reaction Times and Braking Paths IST Intelligent Safety Technology For rotary axes: ϕ with: 2.2 = 2 M zks 1,8 ω ( M + M + M ) = zks J ges ext.bremse i frict 2 ( R + R ) + ( ω p L ) 2 A M I e dn dn 2 ω L: ϕ 2.2 = braking angle in rad ω 2.1 = Angle speed in (see above) in rad/s J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 i = calculation of transformation ratio - M zks = intermediate circuit shourt-circuit braking torque in Nm M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm N dn = continuous torque at standstill in Nm I dn = continuous current at standstill in A R A = motor winding resistance in Ω Re = bleeder resistance in Ω (bei HVE/HVR: 6Ω) p = number/width of pole pairs in - or m L A = coil inductivity in H Fig. 7-13: Calculation of braking path to shutdown of axis after triggering the shutdown circuits by the control (with intermediate circuit short-circuit / decisive for protection of machinery only) for rotatory axes A Overall working path The following results: Overall working path: s 2 = s s 2.2

89 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-11 Reaction Times and Braking Paths Determined by the Drive Monitor reaction time Reaction time of drive Overall reaction time The reaction times are determined mainly by specifying the exceedance of the position monitoring window for safe operation stop and the resulting triggering of the shutdown circuit of the drive. Drive parameters P Activation of NC reaction during malfunction, P Power shutdown during malfunction and P Best-possible shutdown play a large role in determining this behavior. In the above-mentioned error scenario, where the control generates incorrect command values, the following reaction times and braking paths result: The reaction time of the monitor is t = 6 to 8 ms. The reaction time of the drive for operating the shutdown circuit is t = 2 ms. The following results: Overall reaction time: t 2.2 = t t Working path within the reaction time (assuming constant acceleration without attaining the programmed final speed) For translation axes: S acnc t2.2 = with: under the following conditions: v = 2.2 a CNC t2.2 v2.2 v CNC L: S 2.3 acceleration path in m a CNC = programmable acceleration in m/s 2 t 2.2 = reaction time in s v 2.2 = speed in m/s v CNC = Programmable CNC speed m/s Fig. 7-14: Calculation of working path within the reaction time, assuming programmed acceleration without attaining the programmed final speed for translation axes For rotary axes: = αcnc t2.2 ϕ with: ω under the following conditions: = α 2.2 CNC t2.2 ω CNC π n 60 L: ϕ 2.3 = Acceleration angle in rad α CNC = programmable acceleration in rad/s 2 t 2.2 = reaction time in s ω 2.2 = Angle speed in rad/s n CNC = programmed CNC speed in min -1 Fig. 7-15: Calculation of working path within the reaction time, assuming programmed acceleration without attaining the programmed final speed for rotatory axes

90 7-12 Reaction Times and Braking Paths IST Intelligent Safety Technology Working path within the reaction time (assuming constant acceleration with attaining of the final speed) For translation axes: S CNC v = 2 a CNC + v CNC t 2.2 under following condition: v a CNC CNC v 2.2 = v CNC L: S 2.3 acceleration path in m v CNC = Programmable CNC speed m/s a CNC = programmable acceleration in m/s 2 t 2.2 = reaction time in s v 2.2 = speed in m/s Fig. 7-16: Calculation of working path within the reaction time, assuming programmed acceleration and attaining the programmed final speed for translation axes For rotary axes: ϕ = 2 α CNC 2 π n 60 CNC 2 2 π n + 60 under following condition: CNC π n t2.2 α CNC 60 2 π ncnc = 60 L: ϕ 2.3 = Acceleration angle in rad α CNC = programmable acceleration in rad/s 2 n CNC = programmed CNC speed in min -1 t 2.2 = reaction time in s ω 2.2 = Angle speed in rad/s Fig. 7-17: Calculation of working path within the reaction time, assuming programmed acceleration and attaining the programmed final speed for translation axes ω CNC The shutdown circuit of the drive is operated after the reaction time elapses. Drive parameters P Activation of NC reaction during malfunction, P Power shutdown during malfunction and P Best-possible shutdown determine the braking behavior. Drive parameter P Activation of NC reaction during malfunction is usually set to a drive-internal reaction in applications with the MTC200. The CNC-side reaction will no longer be considered here. Parameter P Power shutdown during malfunction mainly affects only how the other drives operated on the same drive package are to behave. It has no effect on the movement of the axis affected by the activation of the safety functions.

91 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-13 Braking path to shutdown after operating the shutdown circuits via the drive For translation axes: S 1 = with: v2.2 tdec t dec v 2.2 = and: dec a dec a = F m ges a dec M h = 2 π J L: s 2.4 = deceleration path in m v 2.2 = speed in (see above) in m/s t dec = deceleration time in s a dec = deceleration in m/s 2 M = braking torque in Nm h v = feed constant in m/revolution J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 F = intermediate circuit short-circuit N m ges = total mass (m load+m mot) in kg Fig. 7-18: Calculation of the braking path to shutdown of the axis after operating the shutdown circuits of the drive for translation axes v ges or For rotary axes: 1 = ω 2 ϕ with tdec and: dec t dec M = i J ges = ω 2. 2 α L: ϕ 2.4 = deceleration angle in rad ω 2.2 = Angle speed in (see above) in rad/s t dec = deceleration time in s α dec = deceleration in rad/s 2 M = braking torque in Nm i = calculation of transformation ratio - J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 Fig. 7-19:Calculation of the braking path to shutdown of the axis after operating the shutdown circuits of the drive for rotatory axes α dec Depending on the setting of drive parameter P Best-possible shutdown, the following correlations result: P set to setpoint speed value of zero: M = M max + M frict or F = F max + F frict L: M = braking torque in Nm M max = max. torque of drive in Nm M frict = friction torque in Nm F = intermediate circuit short-circuit N F max = max. force of drive in Nm F frict = friction force in N Fig. 7-20: Calculation of braking torque/force if P is set to setpoint speed value of zero

92 7-14 Reaction Times and Braking Paths IST Intelligent Safety Technology P set to setpoint force/torque value of zero: M M ext + M = or.bremse frict F = F ext + F.Bremse L: M = braking torque in Nm M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm F = intermediate circuit short-circuit N F ext.brake = braking force of external brake N F frict = friction force in N Fig. 7-21: Calculation of braking torque/force if P set to setpoint force/torque value of zero frict P set to setpoint speed value of zero with filter and ramp: a or dec = a P α dec = α P L: a dec = deceleration in m/s 2 a P = deceleration ramp in parameter P in m/s 2 α dec = deceleration in rad/s 2 α P = deceleration ramp in parameter P in rad/s 2 Fig. 7-22: Calculation of deceleration if P is set to setpoint speed value of zero with filter and ramp P set on retract movement: s scurrent sretraction = or ϕ = ϕcurrent ϕ retraction L: s 2.4 = deceleration path in m s current = current position in m s retraction = retraction path in m ϕ 2.4 = deceleration angle in rad ϕ current = current position in rad ϕ retraction = retraction path in rad Fig. 7-23: Calculation of deceleration path if P is set on retract movement Overall working path The overall working path results: s 2 = s s 2.4

93 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-15 Overall Reaction Times and Braking Paths Reaction times and braking paths with functioning drive and control The overall reaction times and braking paths are specified by the interplay of the two shutdown circuits. The shorter of the two reaction times determined above and the shorter braking path apply. Reaction times and braking paths with functioning drive and malfunctioning control The overall reaction times and braking paths are specified solely by the shutdown circuit via the drive. Reaction times and braking paths with malfunctioning drive and functioning control The overall reaction times and braking paths are specified solely by the shutdown circuit via the control. 7.5 Reaction Times and Braking Paths when Monitors within Safety Function Safely Reduced Speed with Safely Limited Absolute Position are Activated Explanation Error scenarios Within safety function safely reduced speed with safely limited absolute position, the axis is monitored for maintenance of the Maximum speed for safety function 1 / 2, the Upper position limit for safety function 1 / 2 and the Lower position limit for safety function 1 / 2 both in the drive and in the control. When the speed / position limit is exceeded, the shutdown circuits are operated both via the drive and via the control. Drive parameters P Activation of NC reaction during malfunction, P Power shutdown during malfunction and P Best-possible shutdown are relevant for the shutdown circuit via the drive. Due to errors within the drive, e.g. incorrect assignment of commutation for synchronous motors or incorrect entry of field parameters by the user for induction motors, the drive can be accelerated from the safely reduced speed to a final speed that is specified by the counter-emf of the intermediate circuit. This is the worst-case scenario. Due to errors within the control, incorrect command values can be preset which could initiate a movement speed that is larger than the safely reduced speed or outside the position limit. The drive then follows the incorrect command values until it is detected that the speed or the position limit has been exceeded.

94 7-16 Reaction Times and Braking Paths IST Intelligent Safety Technology Reaction Times and Braking Paths Determined by the Control Monitor reaction time Control reaction time The reaction times and braking paths are determined mainly by detecting that the speed / position limit for safely reduced speed with safely limited absolute position has been exceeded and the resulting triggering of the shutdown circuit using the Starting lockout function via the control. In the above-mentioned error scenario, where the drive is accelerated to a final speed, the following reaction times and braking paths result: The reaction time of the monitor is t = 4 ms. The reaction time of the control for operating the shutdown circuit using the Starting lockout function is: t = processing time + 3 x Interbus transfer time + delay time for starting lockout relay The processing time is 6 ms. Typical values for the Interbus transfer time are 2 to 9 ms. You can calculate this more precisely using the following formula. For the number of user data bytes, please use the larger of the input or the output information. The delay time of the starting lockout relay is 25 ms.

95 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-17 Interbus transfer time 1 t ü = [ 13 1,15 (6 + n ) + 3 m] tbit tsw L: t ü = transition time in ms n = number of user data bytes m = number of remote bus and local bus participants t bit = bit duration in µs (currently 2 µs at 500 kbit/s) t sw = software running time in ms (generation 4: 0,7 ms) Fig. 7-24: Determining the Interbus transfer time Overall reaction time The following results: Overall reaction time: t 3.1 = t t Working path within the reaction time (assuming constant acceleration without attaining the final speed) For translation axes: s = aacc t3.1 + vred t3.1 with: a acc = ( M M ) max 2 π J frict ges under the following conditions: h v v 3.1 v = aacc t3. 1 v red or a acc = nlimit hv 60 or ( F F ) max v m ges frict 3.1 vlimit L: S 3.1 = working path in reaction time in m a acc = acceleration in m/s 2 t 3.1 = reaction time in s v red = reduced speed in m/s v 3.1 = speed in m/s M max = max. motor torque in Nm M frict = friction torque in Nm h v = feed constant in m/revolution J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 F max = max. motor power in N F frict = friction force in N m ges = total mass (m load+m mot) in kg n limit = limit speed (can be seen in torquespeed diagram of the associated motor documentation) in min -1 Fig. 7-25: Calculation of working path within the reaction time, assuming constant acceleration in translation axes

96 7-18 Reaction Times and Braking Paths IST Intelligent Safety Technology For rotary axes: ϕ π n 60 2 red 3.1 = α acc t3.1 + t3.1 with: α acc ω 3.1 = α acc ( M M ) max under the following conditions: = i J ges 3.1 frict t 3.1 π n 60 2 π n limit L: ϕ 3.1 = working angle in reaction time in rad α acc = Acceleration in rad/s 2 t 3.1 = reaction time in s n red = reduced speed in min -1 ω 3.1 = Angle speed in rad/s M max = max. motor torque in Nm M frict = friction torque in Nm i = calculation of transformation ratio - J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 n limit = limit speed (can be seen in torquespeed diagram of the associated motor documentation) in min -1 Fig. 7-26: Calculation of working path within the reaction time, assuming constant acceleration in rotatory axes ω red

97 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-19 Working path within the reaction time (assuming constant acceleration with attaining of the final speed) For translation axes: S n h 60 limit v 3.1 vred t3.1 tacc + vred t3.1 and: = or a S ( vlimit vred ) t3.1 tacc + vred = t acc and: = nlimit hv v M max M frict h 2 π J = or ( ) ges v or v = v limit 3.1 a acc = ( F F ) L: S 3.1 = working path in reaction time in m n limit = limit speed (can be seen in torquespeed diagram of the associated motor documentation) in min -1 h v = feed constant in m/revolution v red = reduced speed in m/s t 3.1 = reaction time in s t acc = Acceleration time in s v limit = limit speed (can be seen in force-velocity diagram of the corresponding motor documentation) in m/s v 3.1 = speed in m/s α acc = Acceleration in rad/s 2 M max = max. motor torque in Nm M frict = friction torque in Nm J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 F max = max. motor power in N F frict = friction force in N m ges = total mass (m load+m mot) in kg Fig. 7-27: Calculation of working path within the reaction time, assuming constant acceleration and attaining the final speed for translation axes max m ges frict

98 7-20 Reaction Times and Braking Paths IST Intelligent Safety Technology For rotary axes: ϕ 2 π ( n i n ) 2 π n 60 v = limit red red 3.1 = t3.1 tacc + t3.1 with: t i 60 limit tacc ( nlim it hv 60 vred ) acc = or aacc 60 aacc or t and: acc and: 1 2 ( n i n ) 2 π limit = i 60 α acc π nlim ω3.1 = i 60 M max M α acc = i J 2 it red ( ) ges frict v L: ϕ 3.1 = working angle in reaction time in rad n limit = limit speed (can be seen in torquespeed diagram of the associated motor documentation) in min -1 i = calculation of transformation ratio - n red = reduced speed in min -1 t 3.1 = reaction time in s t acc = Acceleration time in s h v = feed constant in m/revolution v red = reduced speed in m/s α acc = Acceleration in rad/s 2 v limit = limit speed (can be seen in force-velocity diagram of the corresponding motor documentation) in m/s ω 3.1 = Angle speed in rad/s M max = max. motor torque in Nm M frict = friction torque in Nm J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 Fig. 7-28: Calculation of working path within the reaction time, assuming constant acceleration and attaining the final speed for rotatory axes red

99 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-21 Braking path to shutdown after triggering the shutdown circuits by the control (without intermediate circuit short-circuit / decisive for protection of persons) The braking path resulting from triggering of the shutdown circuits by the control using the Starting lockout function is determined by friction and any external brakes that may be used. Using the intermediate circuit short-circuit results in a further reduction of the braking path. However, use of this function is not safe for persons, but only for machines. Furthermore, use with induction motors is possible only to a degree. When an intermediate circuit short-circuit is activated, induction motors slow down only by braking due to friction and due to the activation of any existing brakes. For translation axes: a dec S = 1 = with: v3.1 tdec ( M + M ) ext.bremse 2 π J ges frict h v t dec or v 3.1 = and: a dec a dec = ( F + F ) ext.bremse L: s 3.2 = deceleration path in m v 3.1 = speed in (see above) in m/s t dec = deceleration time in s a dec = deceleration in m/s 2 M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm h v = feed constant in m/revolution J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 F ext. Bremse= braking force of external brake in N F frict = friction force in N m ges = total mass (m load+m mot) in kg Fig. 7-29: Calculation of braking path to shutdown of axis after triggering the shutdown circuits by the control (without intermediate circuit shortcircuit / decisive for protection of persons) for translation axes m ges frict For rotary axes: = ω3.1 tdec ϕ with and: α dec = t dec = ω 3. 1 α dec ( M + M ) ext.bremse i J L: ϕ 3.1 = deceleration angle in rad ϖ 3.1 = Angle speed in (see above) in rad/s t dec = deceleration time in s α dec = deceleration in rad/s 2 M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm i = calculation of transformation ratio - J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 Fig. 7-30: Calculation of braking path to shutdown of axis after triggering the shutdown circuits by the control (without intermediate circuit shortcircuit / decisive for protection of persons) for rotatory axes ges frict

100 7-22 Reaction Times and Braking Paths IST Intelligent Safety Technology Braking path to shutdown after triggering the shutdown circuits by the control (with intermediate circuit short-circuit / decisive for protection of machinery only) For translation axes: with: S M 3.2 zks F v 3.1 1,8 h v = M + M S = zks 3.2 = zks = 2 2 π h J ext.bremse 1,8 v v + M ges frict or ( F + F + F ) zks ( R + R ) A M I e 2 dn dn m ext.bremse 2 ges 2 π v h 2 π v + hv v 3.1 frict 3.1 p L 2 ( R + R ) + ( v p L ) 2 A F I L: s 3.2 = deceleration path in m v 3.1 = speed in (see above) in m/s h v = feed constant in m/revolution J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 M zks = intermediate circuit shourt-circuit braking torque in Nm M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm m ges = total mass (m load+m mot) in kg F zks = intermediate circuit short-circuit braking force in N F ext. Bremse= braking force of external brake in N F frict = friction force in N N dn = continuous torque at standstill in Nm I dn = continuous current at standstill in A R A = motor winding resistance in Ω Re = bleeder resistance in Ω (bei HVE/HVR: 6Ω) p = number/width of pole pairs in - or m L A = coil inductivity in H F dn = braking force to a standstill in N Fig. 7-31: Calculation of braking path to shutdown of axis after triggering the shutdown circuits by the control (with intermediate circuit short-circuit / decisive for protection of machinery) for translation axes e dn dn 2 v A A 2 or

101 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-23 For rotary axes: 3.2 = 2 1,8 ω ( M + M + M ) zks J ges ext.bremse i ϕ where: M zks = frict 2 ( R + R ) + ( ω p L ) 2 A M I e dn dn 2 ω L: ϕ 3.2 = braking angle in rad ω 3.1 = Angle speed in (see above) in rad/s J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 i = calculation of transformation ratio - M zks = intermediate circuit shourt-circuit braking torque in Nm M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm N dn = continuous torque at standstill in Nm I dn = continuous current at standstill in A R A = motor winding resistance in Ω Re = bleeder resistance in Ω (bei HVE/HVR: 6Ω) p = number/width of pole pairs in - or m L A = coil inductivity in H Fig. 7-32: Calculation of braking path to shutdown of axis after triggering the shutdown circuits by the control (with intermediate circuit short-circuit / decisive for protection of machinery) for rotatory axes A Overall working path The following results: Overall working path: s 3 = s s 3.2

102 7-24 Reaction Times and Braking Paths IST Intelligent Safety Technology Reaction Times and Braking Paths Determined by the Drive Monitor reaction time Reaction time of drive Overall reaction time The reaction times are determined mainly by specifying the exceedance of the position monitoring window for safe operation stop and the resulting triggering of the shutdown circuit of the drive. Drive parameters P Activation of NC reaction during malfunction, P Power shutdown during malfunction and P Best-possible shutdown play a large role in determining this behavior. In the above-mentioned error scenario, where the control generates incorrect command values, the following reaction times and braking paths result: The reaction time of the monitor is t = 6 to 8 ms. The reaction time of the drive for operating the shutdown circuit is t = 2 ms. The following results: Overall reaction time: t 3.2 = t t Working path within the reaction time (assuming constant acceleration without attaining the programmed final speed) For translation axes: S acnc t3.2 = with: under the following conditions: v = 3.2 a CNC t3.2 v3.2 v CNC L: S 3.3 = acceleration path in m a CNC = programmable acceleration in m/s 2 t 3.2 = reaction time in s v 3.2 = speed in m/s v CNC = Programmable CNC speed m/s Fig. 7-33: Calculation of working path within the reaction time, assuming programmed acceleration without attaining the programmed final speed for translation axes For rotary axes: ϕ = αcnc t3.2 under following condition: ω CNC π n 60 L: ϕ 3.3 = Acceleration angle in rad α CNC = programmable acceleration in rad/s 2 t 3.2 = reaction time in s ω 3.2 = Angle speed in rad/s n CNC = programmed CNC speed in min -1 Fig. 7-34: Calculation of working path within the reaction time, assuming programmed acceleration without attaining the programmed final speed for rotatory axes

103 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-25 Working path within the reaction time (assuming constant acceleration with attaining of the final speed) For translation axes: S CNC v = 2 a CNC + v CNC t 3.2 under following condition: v a CNC CNC v3.2 v CNC L: S 3.3 = acceleration path in m v CNC = Programmable CNC speed m/s a CNC = programmable acceleration in m/s 2 t 3.2 = reaction time in s v 3.2 = speed in m/s Fig. 7-35: Calculation of working path within the reaction time, assuming programmed acceleration and attaining the programmed final speed for translation axes For rotary axes: ϕ = 2 α CNC 2 π n 60 CNC 2 2 π n + 60 under following condition: CNC π n t3.2 αcnc 60 2 π ncnc 60 L: ϕ 3.3 = Acceleration angle in rad α CNC = programmable acceleration in rad/s 2 n CNC = programmed CNC speed in min -1 t 3.2 = reaction time in s ω 3.2 = Angle speed in rad/s Fig. 7-36: Calculation of working path within the reaction time, assuming programmed acceleration and attaining the programmed final speed for translation axes ω CNC The shutdown circuit of the drive is operated after the reaction time elapses. Drive parameters P Activation of NC reaction during malfunction, P Power shutdown during malfunction and P Best-possible shutdown determine the braking behavior. Drive parameter P Activation of NC reaction during malfunction is usually set to a drive-internal reaction in applications with the MTC200. The CNC-side reaction will no longer be considered here. Parameter P Power shutdown during malfunction mainly affects only how the other drives operated on the same drive package are to behave. It has no effect on the movement of the axis affected by the activation of the safety functions.

104 7-26 Reaction Times and Braking Paths IST Intelligent Safety Technology Braking path to shutdown after operating the shutdown circuits via the drive For translation axes: S 1 = with: v3.2 tdec t dec v 3.2 = and: dec a dec a = F m ges a dec M h = 2 π J L: s 3.4 = deceleration path in m v 3.2 = speed in (see above) in m/s t dec = deceleration time in s a dec = deceleration in m/s 2 M = braking torque in Nm h v = feed constant in m/revolution J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 F = intermediate circuit short-circuit N m ges = total mass (m load+m mot) in kg Fig. 7-37: Calculation of the braking path to shutdown of the axis after operating the shutdown circuits of the drive for translation axes v ges or For rotary axes: 1 = ω 2 ϕ with tdec and: α dec t dec M = i J ges = ω 3. 2 α L: ϕ 3.4 = deceleration angle in rad ϖ 3.2 = Angle speed in (see above) in rad/s t dec = deceleration time in s α dec = deceleration in rad/s 2 M = braking torque in Nm i = calculation of transformation ratio - J ges = total moment of inertia reduced to the motor shaft (J load+j mot) in kgm 2 Fig. 7-38: Calculation of the braking path to shutdown of the axis after operating the shutdown circuits of the drive for rotatory axes dec Depending on the setting of drive parameter P Best-possible shutdown, the following correlations result: P set to setpoint speed value of zero: M = M max + M frict or F = F max + F frict L: M = braking torque in Nm M max = max. torque of drive in Nm M frict = friction torque in Nm F = intermediate circuit short-circuit N F max = maximum force in N F frict = friction force in N Fig. 7-39: Calculation of braking torque/force if P is set to setpoint speed value of zero

105 IST Intelligent Safety Technology Reaction Times and Braking Paths 7-27 P set to setpoint force/torque value of zero: M M ext + M = or.bremse frict F = F ext + F.Bremse L: M = braking torque in Nm M ext. Bremse= Torque of external brake in Nm M frict = friction torque in Nm F = intermediate circuit short-circuit N F ext. Bremse= braking force of external brake in N F frict = friction force in N Fig. 7-40: Calculation of braking torque/force if P set to setpoint force/torque value of zero frict P set to setpoint speed value of zero with filter and ramp: a or dec = a P α dec = α P L: a dec = deceleration in m/s 2 a P = deceleration ramp in parameter P in m/s 2 α dec = deceleration in rad/s 2 α P = deceleration ramp in parameter P in rad/s 2 Fig. 7-41: Calculation of deceleration if P is set to setpoint speed value of zero with filter and ramp P set on retract movement: s scurrent sretraction = or ϕ = ϕcurrent ϕ retraction L: s 3.4 = deceleration path in m s current = current position in m s retraction = retraction path in m ϕ 3.4 = deceleration angle in rad ϕ current = current position in rad ϕ retraction = retraction path in rad Fig. 7-42: Calculation of deceleration path or angle if P is set on retract movement Overall working path The following results: Overall working path: s 3 = s s 3.4

106 7-28 Reaction Times and Braking Paths IST Intelligent Safety Technology Overall Reaction Times and Braking Paths Reaction times and braking paths with functioning drive and control The overall reaction times and braking paths are specified by the interplay of the two shutdown circuits. The shorter of the two reaction times determined above and the shorter braking path apply. Reaction times and braking paths with functioning drive and malfunctioning control The overall reaction times and braking paths are specified solely by the shutdown circuit via the drive. Reaction times and braking paths with malfunctioning drive and functioning control The overall reaction times and braking paths are specified solely by the shutdown circuit via the control. 7.6 Installation Guidelines for Drive Control Devices Note: For the installation guidelines, see the design documents for the drive control devices.

107 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST Planning a System with Bosch Rexroth IST 8.1 Rules for Using the Safety Functions Gear shifting for spindles In the case of spindles or motors with gears that can be shifted, a second measuring system must be used so that the position or the speed of the load is reliably detected. Selecting and deselecting the safety functions The safety functions must be selected and deselected by the machine manufacturer over two channels. A setting example can be found in section "Sample Application", p Emergency stop chain The default structure of the emergency stop chain described in the Bosch Rexroth drive documents is modified when Intelligent Safety Technology is used. The following criteria must be heeded: The safety door lock is not a component of the emergency stop chain. Signals Power on and Power off must not be implemented directly using buttons, but rather via potential-free contacts of the PLC. Section "Sample Application" (p. 8-3) describes the structure of the emergency stop chain. Operation without forced dynamics Operation of a system with Intelligent Safety Technology without forced dynamics is permitted only if the system has separating protective equipment that is locked. Without separating locked protective equipment and without forced dynamics, the main contactor must be switched off immediately after the safety functions are selected. This shutdown must not be carried out using solely the PLC user program; instead it must be wired as discrete logic. Spindle drives Bosch Rexroth recommends that safety function safe stop be used for spindle drives. Generally, a defect in the drive electronics can cause short jolting of the motor shaft when other safety functions are used. Resolver A resolver is not permitted in single-encoder systems with Intelligent Safety Technology. CNC shutdown circuit The starting lockout located in the drive module must be used for every axis with which Intelligent Safety Technology safety functions are used. The starting lockout serves as a shutdown circuit for the control.

108 8-2 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology 8.2 Residual Risks The machine and system manufacturer is hereby reminded of residual risks that occur during the use of Intelligent Safety Technology. The following residual risks are known: A defect in the end stage located in the drive module can lead to a short-term rotation of the motor shaft by a maximum of 180 degrees, even when a safety function is active. A short-circuit or interruption in the encoder cables can cause a brief rotation of the motor shaft when safety function safe operation stop is selected. The following applies: 6-pole motors turn a maximum of 60 degrees, 2-pole motors turn a maximum of 180 degrees. The position switch points of safe cams are issued only after safe referencing. Only allow active signals (signal state 1 ) for safety functions to be processed further. When safety function safe operation stop is selected, an axis located in position control can be pressed out of the position by mechanical forces that are greater than the torque of the axis, causing a shutdown of the drive system. Inclined axes must be mechanically protected from activation of the starting lockout; see safety note "Dangerous movements!" in section 6.2. Safety functions always work in relation to the drive axis. In the case of interpolatory movement and mechanical transformations, divergent speeds may occur in the resulting movement under certain conditions. (Example: Scara robot, rod cinematics, etc.) In the case of an encoder shaft break, an asynchronous drive with a single-encoder system and safety function safe operation stop selected can move at asynchronous speed without being detected by the safety monitors. This does not apply for safety function safe stop.

109 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST Sample Application General Digital main spindle S (1. axis) Digital linear axis X (2. axis) Digital linear axis Y (3. axis) The following sample application shows a system with four axes where the safety functions can be activated in operating mode Setup. The safety functions must be selected before the electromagnetic protective door lock can be opened. The Safety functions active reports of the first (CNC) and the second channel (drives) are evaluated to activate the protective door lock. The position of the protective door is monitored by a protective door monitor with force-guided contacts. This is required for reliable two-channel selection and deselection of the safety functions. The following safety functions are used: Safe stop Safe operation stop Safely reduced speed with safely limited absolute positions 1 Safe referencing Digital rotary axis A (4. axis) Safely reduced speed 1 Safely reduced speed 2 Safe cams Safe referencing Use of safely limited absolute positions and safe cams requires the use of safe referencing. Safe referencing of digital linear axis Y and digital rotary axis A is carried out automatically using an additional cam. The safe cams of digital rotary axis A are used to switch between safely reduced speeds 1 and 2.

110 8-4 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Automatic operation Setup operation when protective door is closed Setup operation when protective door is open The safety functions are selected and deselected in operating modes Automatic and Setup as follows: In automatic operation, the safety functions are deselected using deactivation signals. The electromagnetic door lock prevents the protective door from being opened. Opening of the protective door in the Automatic operating mode in the case of, for example, a defective door lock is monitored via two channels; it always leads to the immediate activation of the safety functions. Automatic program processing when a protective door is open leads to an immediate shutdown of the drives and is therefore impossible. In operating mode Setup, the user can move the axes without limits and without activating the safety functions when a protective door is closed. The status of the protective door lock is monitored over two channels. As in Automatic operation, opening the protective door immediately activates the safety functions. An axis movement in turn leads to a shutdown of the drives. In operating mode Setup, the user can select the safety functions using a button. Preconditions for this are that the protective door be closed, the drives be at a standstill and operating mode Setup be preselected. After selection, the deactivation signals of the safety functions must be switched off and the electromagnetic door lock opened. The user can now manually move the Y- and A-axis with safely reduced speed with the protective door open. For this, it is required that the operator press a dualchannel Consent key. The axes can be moved with the protective door open only under the following conditions: Setup mode must be selected Safe operation must be selected with the protective door closed The Consent key must be pressed

111 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-5 Sample switching setup +24V auf zu Safety position switch with tumbler 3SE840-0XX00 PLC Input module RME12.2 Door open Door closed Ref. Axis 3 Ref. Axis 4 0V +24V PLC output module RMA V Door enablement K V K11.1 Protective door monitor PNOZ X2.1 Reference point switch Axis 4 +24V 0V K11 Reference point switch Axis 3 Safety module RMP12.2 Axis 1 Safe stop Safety function active Safety module RMP12.2 Axis 2 Safety function stop Safety function active PLC-I/O-sub-rack RMB12.2 Safety modul RMP12.2 Axis 3 () "Setup" operating mode +24V Machine operating terminal BTA20 Select safety function/ open door Safety area OK +24V +24V Consent +24V Safely red. speed 1 Reference cams Consent Safety function active K3 PLC PLC K3 PLC +24V PLC Safety module RMP12.2 Axis 4 Safely red. speed 1 Reference cams K4 +24V Consent Safely red. speed 2 0V K4 Pos. switch pt. 1 Safety function active Schaltungsbeispiel.FH7 Fig. 8-1: Sample switching setup

112 8-6 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Safety Channels The sample switching setup shown has a dual-channel structure. The functions of both channels are the same. The CNC safety channel is implemented by the PLC user program using software. The safety channel of the drives is implemented using hardware. A discrepancy in the two channels is detected by two-way data comparison, causing an error. Before the safety functions in the sample switching setup can be used, operating mode Setup must be selected. The safety functions are selected with the Select safety functions / open door button or with contactor K3 and are deselected with the Safety area OK button or with contactor K4. Safety channel 1 The safety signals for selecting and deselecting the safety functions of the 1 st channel (CNC) are guided via INTERBUS-S to the PLC. Standard input module RME 12.2: Report Door open Report Door closed Y-axis reference cams A-axis reference cams Machine operating terminal BTA20: Setup operating mode Select safety function / open door Safety area OK Consent key The input signals are processed by a function module in the PLC user program. In the function module, the signals are logically linked as in the sample switching setup of the 2 nd channel (drives). The function module switches the deactivation signals of the safety functions that are sent on to the CNC via the cycle interface. The cycle interface between the PLC and the CNC provides a separate I/O area for the safety signals for each axis. The reference cams for the safe referencing of the Y- and A-axes in the PLC user program are sent on by the cycle interface directly to the CNC.

113 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-7 Safety channel 2 The safety signals of the 2 nd channel (drive) are connected to special safety I/O modules. A safety module (S, X, Y, A) is assigned to every drive. The safety modules communicate directly with the assigned drives. The following safety inputs are used for the individual safety modules: S-axis: Safe stop X-axis: Safe operation stop Y-axis: Safely reduced speed with safely limited absolute positions 1 Reference cam safe referencing Consent key A-axis: Safely reduced speed 1 Safely reduced speed 2 Reference cam safe referencing Consent key Inputs safe stop and safe operation stop of the Y and A safety I/O module are unoccupied. To keep wiring to a minimum, the inputs are hidden in the safety parameters of the CNC and the drives. This means that selecting safely reduced speed automatically selects the safe stop of the Y-axis and the safe operation stop of the A-axis. Only after the Consent key is pressed does the monitor of the Y- and A-axes switch to safely reduced speed. Which safety function is selected when the Consent key is not pressed is specified in safety parameter Selection of safety functions in the CNC. Safety outputs The Safety functions active (door enablement) outputs of the CNC and the drives are switched in series. If both channels report that the safety functions are active, the door lock mechanism is activated (lock lifted). Output signal Position switch cabinet 1 of safety module RMP 12.2 of the 4 th axis is used to switch between safely reduced speeds 1 and 2 in the second channel. In the PLC user program, the switch is implemented by axis status signal AXXS.SAFP1 for the first channel.

114 8-8 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Protective door monitor Protective Door Monitor The electromagnet of the protective door monitor is activated by the safety outputs of the CNC ( Door enablement ) and of the drives ( Safety functions active ). If both channels signal that the safety functions are active (logic 1 ), the door lock can be opened. The activation of the door lock is implemented over one channel. This is sufficient because the feedback is certainly evaluated over two channels via the protective door monitor. Opening of the protective door immediately activates the safety functions, which leads to an immediate shutdown of the drives. The 1 st channel (NC) reacts to the safety input report Door closed (contact 11.2) and the 2 nd channel (drives) reacts to contact 11.1 of the protective door monitor. Opening contact 11.2 results in contactor K4 dropping out, which switches off the deactivation signals of the safety functions. Protective door monitor When the protective door is closed, contacts K11.1 and 11.2 of the protective door monitor are closed. The safety functions can be deactivated only in this position ( Safety area ok ). If the protective door is not closed, the safety functions cannot be deactivated. Note: The design of the protective door lock depends on both the risk assessment of the machine manufacturer for the machine and on its use.

115 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-9 Consent key Selecting Safety Functions The following conditions must be fulfilled before the safety functions can be selected: the drives must be at a standstill, the protective door must be closed/locked, operating mode Setup must be selected using the key-operated switch, and button Select safety functions must have been pressed. When operating mode Setup is selected and button Select safety functions / open door is pressed, contactor K3 picks up and contactor K4 drops off. The opening of K4 causes the signals for deactivating the safety functions to be switched off in the 2 nd channel (drives). Switch positions Setup and Select safety functions / open door are evaluated in the PLC, leading to the deactivation signals being switched off in the 1 st channel (CNC). If both channels signals that the safety functions are active, the electromagnet of the protective door is activated and the protective door can be opened. In order to move the Y- and A- axes with safely reduced speed with the protective door open, the Consent key must be pressed. Pressing the dual-channel Consent key signals the CNC and the drives that the monitor of the Y- and A- axes has been switched from safe stop / safe operation stop to safely reduced speed. The two axes can now be moved manually (jog mode) as long as the Consent key is pressed. Releasing the Consent key switches the monitor of the Y- and A- axes back to safe stop / safe operation stop. Deselecting safety functions The user can deactivate the safety functions only if the protective door is closed. The user must use button Safety area OK to acknowledge that the safety area is OK, i.e. the protective door is closed and there are no people in the danger zone within the system. The Safety area OK acknowledgement interrupts the activation of the door magnets (door enablement) in the PLC user program. Reports Door closed (K11.1) and Safety area OK are evaluated directly in the PLC user program, leading to deactivation of the safety functions in the 1 st channel (CNC). If the protective door is closed, the protective door monitor closes contact K11.2. Pressing button Safety area OK closes contactor K4 and deselects the safety functions in the 2 nd channel (drives) via the deactivation signals.

116 8-10 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology CNC Shutdown Circuit The starting lockout present in the drive must be used for each axis that is planned for use with safety functions. The starting lockout serves the control as a shutdown circuit if a safety monitor in the control triggers a shutdown of the drive system. Forced dynamics The starting lockout is checked within forced dynamics. The activation and feedback of the starting lockout is tested. Forced dynamics can be successfully executed only if the starting lockout is correctly wired. Activate starting lockout The starting lockout of each drive module must be activated separately by the PLC user program. A digital output of the I/O level must be provided for each drive. Starting lockout active acknowledgement The feedback Starting lockout active of all drive modules can be guided to the PLC as a collective signal. The acknowledgement signal is absolutely required for monitoring in the control. Safety function safe stop If safety function safe stop is selected, the starting lockout with the same signal lines is activated / the acknowledgement is monitored. Designing the starting lockout Further information regarding the design of the starting lockout on the drive module can be found in the DIAX04 function description, Section 7.5 Starting lockout.

117 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-11 Sample application The following digital input and output signals are required for the sample application: Standard input module RME 12.2: Starting lockout active collective message Standard output module RME 12.2: Activate S-axis starting lockout Activate X-axis starting lockout Activate Y-axis starting lockout Activate A-axis starting lockout The fig. below shows the switch setup for activating and evaluating the starting lockout of the sample application. +24V Drive module Axis 1 Drive module Axis 2 Drive module Axis 3 +24V PLC input module RME12.2 ASQ Axis 1, 2, 3, 4 PLC output module RMA12.2 AS current axis 1 AS current axis 2 AS current axis 3 PLC-I/O-sub-rack RMB12.2 AS current axis 4 Drive module Axis 4 0V Anlaufsperre.FH7 Fig. 8-2: Sample application: control shutdown circuit

118 8-12 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Emergency Stop Chain The following figure shows the modified structure of the emergency stop chain and the input power when using Intelligent Safety Technology. +24V X3/1 PLC PxxC24EXT CNC Supply module HVE or HVR S Safety limit switch X7/1 PLC AxxCOTRVL CNC Bb1 X7/2 PLC PxxCBBSUP CNC X3/2 X3/3 +24V K1 X3/4 X3/5 X3/6 Emergency stop NC ready PxxCESTAT PLC CNC PxxCEMACH PLC CNC X6/3 Power OFF kxxpowoff PLC CNC K1 Bb1 internal X6/4 Power ON kxxpowon PLC CNC A10.1 A10.1 A10.1 A10.2 A10.1 A10.2 A10.3 A10.2 A10.3 A10.3 A10.2 A10.3 A10.1 Emergency stop switching device 0V Not-Aus.FH7 Fig. 8-3: Emergency stop chain with Intelligent Safety Technology

119 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-13 Description The emergency-stop button, the NC ready signal (CNC enablement) and the Power off signal are monitored by an emergency-stop switching device. When the supply module is ready for power to be switched on, this can happen using PLC signal Power on. Further information on switching the power on can be found in the PLC interface description. Note: Signals Power on and Power off must be implemented via potential-free contacts of the PLC. The safety door lock is not a component of the emergency stop chain. Opening the protective door results in the safety functions being selected in both channels. When Intelligent Safety Technology is used, PLC control signals PxxCESTP1, PxxCESTP2 and PxxCESTP3 can not be used to monitor the protective doors. The signals must be set to logic 1 in the PLC user program. Note: The default structure of the emergency stop chain described in the Bosch Rexroth drive documents is modified when Intelligent Safety Technology is used. Intermediate circuit short-circuit As an additional safety feature for braking the drives to a standstill when the drive electronics malfunction, the intermediate circuit can be shortcircuited. With an intermediate circuit short-circuit, motors with permanent magnet excitation are always braked to a standstill, regardless of whether the drive electronics still function or not. Without an intermediate circuit short-circuit, motors with permanent magnet excitation come to an uncontrolled stop when the drive electronics malfunction. Note: Asynchronous drives do not brake with intermediate circuit short-circuiting. Further information regarding intermediate circuit short-circuits can be found in application description DIAX04 HVE and HVR Supply Devices, 2 nd Generation (Chapter 7).

120 8-14 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology PLC Program General The PLC user program undertakes the following duties during processing and transport of the safety signals: Logical linking and evaluation of the safety signals for selecting and deselecting the safety functions in the 1 st channel (CNC), corresponding to the hardware-side logic of the 2 nd channel (drives) for selecting and deselecting the safety functions. Transport of the safety input and output signals of the 2 nd channel (drives). Activation of the starting lockout for safely shutting down the drives (in a 2ms implementation in Version 19, in a time-controlled task as of Version 22). Execution of forced dynamics. Design of PLC program When designing the PLC program, note that the maximum PLC cycle time of 75 ms may not be exceeded. The determined PLC cycle time is to be documented in the acceptance report. Sequential Function Chart (SFC) All program parts that are relevant to the processing of the safety signals are implemented in step sinit in the sample application. Figure below shows a typical SFC structure of a Bosch Rexroth user program. Initialization step sinit is active after the program is started. The step is used for initialization events. The PLC cyclically processes step sinit until initialization is complete and transition condition tinit has been fulfilled. Fulfilling the transition starts step sprogram. Step sinit becomes inactive and step sprogram active. ÅÁØÁÁÁÁÁÁÁÈ ÂV,1,7ÛÛÛÛÂÛÛÛÛÛÛ6WHSÛV,1,7Û ËÁÕÁÁÁÁÁÁÁÎ ÛÛ ÀW,1,7ÛÛÛÛÛÛÛÛÛ7UDQVLWLRQ ÛÛ ¹ V3URJUDPÛ ÛÛÛÛÛÛ6WHSÛV3URJUDPÛ º» ÛÛ ÛÛÀW3URJUDPÛÛÛÛÛÛ7UDQVLWLRQÛW3URJUDPÛ ÛÛ ÛÛ9 ÛV,1,7ÛÛÛÛÛÛÛÛÛÛÛ-XPSÛWRÛVWHSÛV,1,7Û ÛÛ9 Fig. 8-4: Sample application: SFC structure user program

121 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-15 Action blocks in step sinit Step sinit is divided into three action blocks: asafe_1, asafe_2 and adynam. The initialization step usually contains additional action blocks for initialization; these are not listed here. ÛÛÛÛ ¾ ¾ ¹^` ÛÛÛÛ Û6ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛD6$)(BÛÛÛÛ 6DIHW\ÛVLJQDOVÛFKDQQHOÛ ÛÛÛÛ¼ À À ½ ÛÛÛÛ Û6ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛD6$)(BÛÛÛÛ 6DIHW\ÛVLJQDOVÛFKDQQHOÛ ÛÛÛÛ¼ À À ½ ÛÛÛÛ Û6ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛD'<1$0ÛÛÛÛÛ )RUFHGÛG\QDPLFV ÛÛÛÛº» ÛÛÛÛÛ,'ÛV\PEROÛ6ÛVHWÛLQÛPHPRU\ÛWKHÛDFWLRQVÛFDQÛFRQWLQXHÛWRÛEHÛF\FOLFDOO\ÛSURFHVVHG ÛÛÛÛÛÛÛE\ÛWKHÛSURJUDPÛHYHQÛDIWHUÛVWHSÛV,1,7ÛEHFRPHVÛLQDFWLYHÛ Fig. 8-5: Sample application: action blocks in step sinit Recommendation It is recommended that the processing of the safety signals be programmed in the initialization step of the PLC user program. This ensures that the transport and evaluation of the safety signals are carried out, because the first step (initial step) is processed at least once. S (set in memory) must be used as the ID symbol of the actions so that the actions can continue to be cyclically processed by programs even after the step becomes inactive. General Safety signals of channel 1 (CNC) The safety functions of the 1 st channel are selected and deselected in the PLC user program. Here, the same logic must be used when linking signals as that of the hardware structure of the 2 nd channel for selecting and deselecting the safety functions. The cycle interface between the PLC and the CNC provides a separate I/O area for the safety signals for each axis. The following status signals (signals from the CNC to the PLC) exist: Status signal Description AxxS.SAFAC Safety function active AxxS.SAFRY Switching complete AxxS.SAFP1 Position switch point 1 AxxS.SAFP2 Position switch point 2 AxxS.SAFP3 Position switch point 3 AxxS.SAFP4 Position switch point 4 AxxS.SAFSL Activate starting lockout AxxS.SAFEN Enable movement Fig. 8-6: Status signals (CNC to PLC, xx = axis number)

122 8-16 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Signals from the CNC to the PLC are called control signals: Control signals Description AxxC.SAFSS Deactivation of safe stop AxxC.SAFOS Deactivation of safe operation stop AxxC.SAFA1 Deactivation of safely reduced speed with safely limited absolute position 1 AxxC.SAFA2 Deactivation of safely reduced speed with safely limited absolute position 2 AxxC.SAFAG Consent key AxxC.SAFRS Reference cam for safe referencing AxxC.SAFSL Starting lockout active Fig. 8-7: Control signals (PLC to CNC, xx = axis number) Sample application The following input signals are evaluated in the PLC user program: Input signal Description ituerauf Message: protective door open ituerzu Message: protective door closed isaferefy Y-axis reference cams ISafeRefA A-axis reference cams iansp_all starting lockout active collective signal ieinricht Setup mode isafe_akt Select safety functions / open door isafe_ok Safety area OK izustimm Consent key Fig. 8-8: Safety input signals of channel 1 Five signals are required on the default output module. The outputs for activating the starting lockout are processed in the 2ms implementation in Version 19 and in a time-controlled task as of Version 22. Output signal Description qtuerfrei Door enablement / activation of door magnet qansp_y Activate S-axis starting lockout qansp_x Activate X-axis starting lockout qansp_y Activate Y-axis starting lockout qansp_a Activate A-axis starting lockout Fig. 8-9: Safety output signals of channel 1 FB_IST01 In the example, every axis is assigned to a user-defined function module FB_IST01. In this module, the input signals are logically linked in the same manner as in the hardware structure for activating the safety signals in the 2 nd channel (drives). As a result, the function module supplies a signal for activating the electromagnetic door lock (qtm) and the positions of the two contactors K3 (qk3) and K4 (qk4). Output qk3 is further processed in the PLC user program for generating messages and displays. The deactivation signals of the safety functions are switched depending on output qk4 and are sent on to the NC directly via the cycle interface.

123 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-17 Note: Function module FB_IST01 has been developed especially for this example; it is not included in the scope of delivery for Intelligent Safety Technology. starting lockout Safety function safe stop is designed for the S axis and, for the third axis (Y-axis), safely reduced speed with a switchover to safe stop if the Consent key is not pressed. Selecting safety function safe stop means that the starting lockout is activated by the PLC user program. The following steps are executed in the first channel: 1. Safety function safe stop is selected in the CNC with control signal AxxC.SAFSS (signal status 0 ). In the second channel, the safety function is selected directly on the corresponding safety I/O module. 2. The CNC requests the PLC user program to activate the starting lockout in the drive. 3. The PLC user program activates the starting lockout in the drive in the fast PLC program (in a 2ms implementation in Version 19 and in a time-controlled task as of Version 22) via a digital output. 4. The drive acknowledges the activation of the starting lockout of the PLC. 5. In the PLC user program, the acknowledgement is passed on to the CNC with axis control signal AXXC.SAFSL via the cycle interface. Steps two to five are identical with the shutdown circuit of the control. This means that, when a safety monitor in the control triggers a shutdown of the drive system, steps two to five are executed. Since the starting lockout must be designed as a shutdown circuit of the control for each axis with safety functions, steps two to five are executed automatically when safety function safe stop is selected. The activation of the starting lockout is described in detail in this chapter under "Safe shutdown of drives" (p. 8-31). 2ms implementation (Version 19) The 2ms implementation must be enabled/started in the PLC user program. To do this, system variable FastEnabl in the PLC user program must be set to logic 1. Time-controlled task (as of Version 22) The time-controlled task is to be declared in the area TASK of the resource with an INTERVAL of 4ms and enabled with a priority higher than the default program. Door magnet The signals for activating the door magnet are switched in series. Output qtuerfrei is set only after all function modules signal that the door lock is activated. Motion hold If safety function safe stop or safe operation stop is selected, a movement always leads to immediate shutdown of the axis by the shutdown circuits. This can be prevented by issuing a motion hold for the corresponding axis with control signal AxxC.MHOLD on the CNC. Note that the motion hold must be switched off when switching to safety function safely reduced speed.

124 8-18 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Note: The motion hold s sole purpose is to make the operation of systems and machines more comfortable. The motion hold is not a safety function. Safe referencing reference switch The input signals of reference switches isaferefy and isaferefa, for the safe referencing of the Y- and A-axes, in the PLC user program are sent on to control signals A03C.SAFRS / A04C.SAFRS. Consent key The input signal of Consent key izustimm is required to select safety function safely reduced speed of the Y- and A-axes. The signal for both axes is passed on directly to the CNC using the cycle interface. Note: Consent must have the highest priority for an axis movement. This means that consent must be present before movement can be triggered, e.g. by a jog command. In the PLC user program, the Consent signal can be linked to the process enablement (PxxC.ENABL). This ensures that movement is triggered only if the Consent key is pressed first and a movement command is issued thereafter. Starting lockout active acknowledgement The collective signal iansp_all of the four drive modules is passed on to control signal AxxC.SAFSL of the four axes.

125 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-19 Action block asafe_1 The following figure shows action block asafe_1. All the safety signals for selecting and deselecting the safety functions of the 1 st channel (CNC) are processed in the action block. ÛÛÛ (QDEOHPHQWÛRIÛPVÛLPSOHPHQWDWLRQÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ)DVW(QDEO ÛÛÛ¼ Û ½ ÛÛÛ)DV(QDEOÛ(QDEOHÛPVÛLPSOHPHQWDWLRQÛÛ%22/ ÛÛÛ $FWLYDWLRQÛRIÛSURWHFWLYHÛGRRUÛORFNÛGHSHQGLQJÛRQÛVDIHW\ ÛÛÛ VLJQDOVÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ P70B6ÛÛÛÛÛÛP70B;ÛÛÛÛÛÛP70B<ÛÛÛÛÛÛP70B$ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛT7XHU)UHL ÛÛÛ¼½Û¼ ½Û¼ ½Û¼ ½Û¼ Û ½ ÛÛÛP70B6Û$FWLYDWLRQÛRIÛSURWHFWLYHÛGRRUÛORFNÛRIÛ6ÛÛ%22/ ÛÛÛP70B;Û$FWLYDWLRQÛRIÛSURWHFWLYHÛGRRUÛORFNÛRIÛ;ÛÛ%22/ ÛÛÛP70B<Û$FWLYDWLRQÛRIÛSURWHFWLYHÛGRRUÛORFNÛRIÛ<ÛÛ%22/ ÛÛÛP70B$Û$FWLYDWLRQÛRIÛSURWHFWLYHÛGRRUÛORFNÛRIÛ$ÛÛ%22/ ÛÛÛT7XHU)UHLÛ6DIHW\ÛIXQFWLRQVÛDFWLYHGRRUÛHQDEOHPHQWÛà4Û%22/ ÛÛÛ 6DIHW\ÛVLJQDOVÛRIÛ6D[LVÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛIE,67B6ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ )%B,67ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L7XHUDXIÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP70B6ÛÛÛÛ ÛÛÛ¼½Û¼ ½L7B$8)ÛÛÛÛÛÛÛÛÛÛT70¼ Û ½ ÛÛÛ L7XHU]XÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP.B6ÛÛÛÛ ÛÛÛ¼½Û¼ ½L7B=8ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û ½ ÛÛÛ L$XWRÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)66 ÛÛÛ¼½¼ ½W(,15ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û ½ ÛÛÛ L6DIHB$NWÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½W6$)(B$.7ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L6DIHB2NÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½W6$)(B2.ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)$&Û ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½$[[66$)$&ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛIE,67B6Û6DIHW\ÛVLJQDOVÛVWÛFKDQQHOÛVSLQGOHÛÛ)%B,67 ÛÛÛL7XHUDXIÛ0HVVDJHÛÝ'RRUÛRSHQÝÛIURPÛ<Ûà,Û%22/ ÛÛÛP70B6Û$FWLYDWLRQÛSURWHFWLYHÛGRRUÛORFNÛVSLQGOÛÛ%22/ ÛÛÛL7XHU]XÛ0HVVDJHÛÝ'RRUÛFORVHGÝÛIURPÛ.Ûà,Û%22/ ÛÛÛP.B6Û&RQWDFWRUÛ.ÛÛ%22/ ÛÛÛL$XWRÛ$XWRPDWLFÛRSHUDWLRQÛà,Û%22/ ÛÛÛ$&6$)66Û'HDFWLYDWLRQÛRIÛVDIHÛVWRSÛÛ%22/ ÛÛÛL6DIHB$NWÛ6HOHFWÛVDIHW\ÛIXQFWLRQVÛà,Û%22/ ÛÛÛL6DIHB2NÛ6DIHW\ÛDUHDÛ2.Ûà,Û%22/ ÛÛÛ$66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛ /RFNÛD[LVÛPDUNHUÛLIÛWKHÛVDIHW\ÛIXQFWLRQÛLVÛDFWLYHÛRUÛLIÛVZLWFKLQJÛLVÛQRW ÛÛÛ \HWÛFRPSOHWHÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)$&ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP0+2/'B6Û ÛÛÛ¼½Û¼ ¾ Û ½ ÛÛÛ $66$)5< ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½¼»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ$66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛP0+2/'B6Û0RWLRQÛKROGÛ6D[LVÛÛ%22/ ÛÛÛ$66$)5<Û6ZLWFKLQJÛFRPSOHWHÛÛ%22/

126 8-20 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology ÛÛÛ 6DIHW\ÛVLJQDOVÛRIÛ;D[LVÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛIE,67B;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ )%B,67ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L7XHUDXIÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP70B;ÛÛÛÛ ÛÛÛ¼½Û¼ ½L7B$8)ÛÛÛÛÛÛÛÛÛÛT70¼ Û ½ ÛÛÛ L7XHU]XÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP.B;ÛÛÛÛ ÛÛÛ¼½Û¼ ½L7B=8ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û ½ ÛÛÛ L$XWRÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)26 ÛÛÛ¼½¼ ½W(,15ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û ½ ÛÛÛ L6DIHB$NWÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½W6$)(B$.7ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L6DIHB2NÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½W6$)(B2.ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)$&Û ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½$[[66$)$&ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛIE,67B;Û6DIHW\ÛVLJQDOVÛVWÛFKDQQHOÛ;D[LVÛÛ)%B,67 ÛÛÛL7XHUDXIÛ0HVVDJHÛÝ'RRUÛRSHQÝÛIURPÛ<Ûà,Û%22/ ÛÛÛP70B;Û$FWLYDWLRQÛRIÛSURWHFWLYHÛGRRUÛORFNÛRIÛ;ÛÛ%22/ ÛÛÛL7XHU]XÛ0HVVDJHÛÝ'RRUÛFORVHGÝÛIURPÛ.Ûà,Û%22/ ÛÛÛP.B;Û&RQWDFWRUÛ.ÛÛ%22/ ÛÛÛL$XWRÛ$XWRPDWLFÛRSHUDWLRQÛà,Û%22/ ÛÛÛ$&6$)26Û'HDFWLYDWLRQÛRIÛVDIHÛRSHUDWLRQÛVWRSÛÛ%22/ ÛÛÛL6DIHB$NWÛ6HOHFWÛVDIHW\ÛIXQFWLRQVÛà,Û%22/ ÛÛÛL6DIHB2NÛ6DIHW\ÛDUHDÛ2.Ûà,Û%22/ ÛÛÛ$66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛ /RFNÛD[LVÛPDUNHUÛLIÛWKHÛVDIHW\ÛIXQFWLRQÛLVÛDFWLYHÛRUÛLIÛVZLWFKLQJÛLVÛQRW ÛÛÛ \HWÛFRPSOHWHÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)$&ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP0+2/'B;Û ÛÛÛ¼½Û¼ ¾ Û ½ ÛÛÛ $66$)5< ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½¼»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ$66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛP0+2/'B;Û0RWLRQÛKROGÛ;D[LVÛÛ%22/ ÛÛÛ$66$)5<Û6ZLWFKLQJÛFRPSOHWHÛÛ%22/ ÛÛÛ 6DIHW\ÛVLJQDOVÛRIÛ<D[LVÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛIE,67B<ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ )%B,67ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L7XHUDXIÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP70B<ÛÛÛÛ ÛÛÛ¼½Û¼ ½L7B$8)ÛÛÛÛÛÛÛÛÛÛT70¼ Û ½ ÛÛÛ L7XHU]XÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP.B<ÛÛÛÛ ÛÛÛ¼½Û¼ ½L7B=8ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û ½ ÛÛÛ L$XWRÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)$ ÛÛÛ¼½¼ ½W(,15ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û ½ ÛÛÛ L6DIHB$NWÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½W6$)(B$.7ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L6DIHB2NÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½W6$)(B2.ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)$&Û ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½$[[66$)$&ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛIE,67B<Û6DIHW\ÛVLJQDOVÛVWÛFKDQQHOÛ<D[LVÛÛ)%B,67 ÛÛÛL7XHUDXIÛ0HVVDJHÛÝ'RRUÛRSHQÝÛIURPÛ<Ûà,Û%22/ ÛÛÛP70B<Û$FWLYDWLRQÛRIÛSURWHFWLYHÛGRRUÛORFNÛRIÛ<ÛÛ%22/ ÛÛÛL7XHU]XÛ0HVVDJHÛÝ'RRUÛFORVHGÝÛIURPÛ.Ûà,Û%22/ ÛÛÛP.B<Û&RQWDFWRUÛ.ÛÛ%22/ ÛÛÛL$XWRÛ$XWRPDWLFÛRSHUDWLRQÛà,Û%22/ ÛÛÛ$&6$)$Û'HDFWLYDWLRQÛRIÛVDIHO\ÛUHGÛVSHHGÛÛÛ%22/ ÛÛÛL6DIHB$NWÛ6HOHFWÛVDIHW\ÛIXQFWLRQVÛà,Û%22/ ÛÛÛL6DIHB2NÛ6DIHW\ÛDUHDÛ2.Ûà,Û%22/ ÛÛÛ$66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛ 7UDQVIHUÛ<D[LVÛUHIHUHQFHÛVZLWFKÛIRUÛVDIHÛUHIHUHQFLQJÛWRÛ1& ÛÛÛ L6DIH5HI<ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)56 ÛÛÛ¼½¼ Û ½ ÛÛÛL6DIH5HI<Û5HIHUHQFHÛVZLWFKÛ6DIHO\ÛUHIHUHQFHGÛ<Ûà,Û%22/ ÛÛÛ$&6$)56Û5HIHUHQFHÛFDPÛ6DIHÛUHIHUHQFLQJÛÛ%22/

127 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-21 ÛÛÛ/RFNÛD[LVÛPDUNHUÛLIÛWKHÛVDIHW\ÛIXQFWLRQÛLVÛDFWLYHÛRUÛLIÛVZLWFKLQJÛLVÛQRW ÛÛÛ \HWÛFRPSOHWHÛRUÛPRYHPHQWÛLVÛQRWÛHQDEOHGÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)$&ÛL=XVWLPPÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP0+2/'B<Û ÛÛÛ¼½Û¼ ½¼ ¾ Û ½ ÛÛÛ $66$)5<ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½¼ ½ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)(1ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½¼»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ$66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛL=XVWLPPÛ&RQVHQWÛNH\Ûà,Û%22/ ÛÛÛP0+2/'B<Û0RWLRQÛKROGÛ<D[LVÛÛ%22/ ÛÛÛ$66$)5<Û6ZLWFKLQJÛFRPSOHWHÛÛ%22/ ÛÛÛ$66$)5<Û0RYHPHQWÛHQDEOHGÛÛ%22/ ÛÛÛ 6DIHW\ÛVLJQDOVÛRIÛ$D[LVÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛIE,67B$ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ )%B,67ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L7XHUDXIÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP70B$ÛÛÛÛ ÛÛÛ¼½Û¼ ½L7B$8)ÛÛÛÛÛÛÛÛÛÛT70¼ Û ½ ÛÛÛ L7XHU]XÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP.B$ÛÛÛÛ ÛÛÛ¼½Û¼ ½L7B=8ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û ½ ÛÛÛ L$XWRÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)$ ÛÛÛ¼½¼ ½W(,15ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û ½ ÛÛÛ L6DIHB$NWÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½W6$)(B$.7ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L6DIHB2NÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½W6$)(B2.ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)$&Û ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼ ½$[[66$)$&ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛIE,67B$Û6DIHW\ÛVLJQDOVÛVWÛFKDQQHOÛ$D[LVÛÛ)%B,67 ÛÛÛL7XHUDXIÛ0HVVDJHÛÝ'RRUÛRSHQÝÛIURPÛ<Ûà,Û%22/ ÛÛÛP70B$Û$FWLYDWLRQÛSURWHFWLYHÛGRRUÛORFNÛ$ÛÛ%22/ ÛÛÛL7XHU]XÛ0HVVDJHÛÝ'RRUÛFORVHGÝÛIURPÛ.Ûà,Û%22/ ÛÛÛP.B$Û&RQWDFWRUÛ.ÛÛ%22/ ÛÛÛL$XWRÛ$XWRPDWLFÛRSHUDWLRQÛà,Û%22/ ÛÛÛ$&6$)$Û'HDFWLYDWLRQÛRIÛVDIHO\ÛUHGÛVSHHGÛÛÛ%22/ ÛÛÛL6DIHB$NWÛ6HOHFWÛVDIHW\ÛIXQFWLRQVÛà,Û%22/ ÛÛÛL6DIHB2NÛ6DIHW\ÛDUHDÛ2.Ûà,Û%22/ ÛÛÛ$66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛ 7UDQVIHUÛ$D[LVÛUHIHUHQFHÛVZLWFKÛIRUÛVDIHÛUHIHUHQFLQJÛWRÛ1& ÛÛÛ L6DIH5HI$ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)56 ÛÛÛ¼½¼ Û ½ ÛÛÛL6DIH5HI$Û5HIHUHQFHÛVZLWFKÛ6DIHO\ÛUHIHUHQFHGÛ$Ûà,Û%22/ ÛÛÛ$&6$)56Û5HIHUHQFHÛFDPÛ6DIHÛUHIHUHQFLQJÛÛ%22/ ÛÛÛ 6ZLWFKÛWRÛVDIHO\ÛUHGXFHGÛVSHHGÛÛLIÛSRVLWLRQÛVZLWFKLQJÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ SRLQWÛÛLVÛQRWÛVHWÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)3ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)$ ÛÛÛ¼½Û¼ ¾ Û ½ ÛÛÛ $&6$)$ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½Û¼»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ$66$)3Û3RVLWLRQÛVZLWFKLQJÛSRLQWÛÛÛ%22/ ÛÛÛ$&6$)$Û'HDFWLYDWLRQÛRIÛVDIHO\ÛUHGÛVSHHGÛÛ%22/ ÛÛÛ$&6$)$Û'HDFWLYDWLRQÛRIÛVDIHO\ÛUHGÛVSHHGÛÛÛ%22/ ÛÛÛ/RFNÛD[LVÛPDUNHUÛLIÛWKHÛVDIHW\ÛIXQFWLRQÛLVÛDFWLYHÛRUÛLIÛVZLWFKLQJÛLVÛQRW ÛÛÛ \HWÛFRPSOHWHÛRUÛPRYHPHQWÛLVÛQRWÛHQDEOHGÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)$&ÛL=XVWLPPÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛP0+2/'B$Û ÛÛÛ¼½Û¼ ½¼ ¾ Û ½ ÛÛÛ $66$)5<ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½¼ ½ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ $66$)(1ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ¼½¼»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ$66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛL=XVWLPPÛ&RQVHQWÛNH\Ûà,Û%22/ ÛÛÛP0+2/'B$Û0RWLRQÛKROGÛ$D[LVÛÛ%22/ ÛÛÛ$66$)5<Û6ZLWFKLQJÛFRPSOHWHÛÛ%22/ ÛÛÛ$66$)5<Û0RYHPHQWÛHQDEOHGÛÛ%22/ ÛÛÛ 7UDQVIHUÛFRQVHQWÛNH\ÛWRÛVWÛFKDQQHOÛ<ÛDQGÛ$D[HVÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛ L=XVWLPPÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)$* ÛÛÛ¼½Û¼ ¾Û ½ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ $&6$)$* ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛºÛ ½ ÛÛÛL=XVWLPPÛ&RQVHQWÛNH\ÛLQSXWÛà,Û%22/ ÛÛÛ$&6$)$*Û&RQVHQWÛNH\ÛÛ%22/ ÛÛÛ$&6$)$*Û&RQVHQWÛNH\ÛÛ%22/

128 8-22 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology ÛÛÛ 7UDQVIHUÛDFNQRZOHGJHPHQWÛVLJQDOÛÝ6WDUWÛLQKLELWRUÛDFWLYHÝÛWRÛ&1&ÛÛÛÛÛÛÛÛ ÛÛÛ L$163B$//ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ$&6$)6/ ÛÛÛ¼½Û¼ ¾Û ½ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ $&6$)6/ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ¼Û ½ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ $&6$)6/ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ¼Û ½ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ $&6$)6/ ÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛºÛ ½ ÛÛÛL$163B$//Û&ROOÛVLJQDOÛ6WDUWÛLQKLELWRUÛDFWLYHÛà,Û%22/ ÛÛÛ$&6$)6/Û6WDUWÛLQKLELWRUÛDFWLYHÛÛ%22/ ÛÛÛ$&6$)6/Û6WDUWÛLQKLELWRUÛDFWLYHÛÛ%22/ ÛÛÛ$&6$)6/Û6WDUWÛLQKLELWRUÛDFWLYHÛÛ%22/ ÛÛÛ$&6$)6/Û6WDUWÛLQKLELWRUÛDFWLYHÛÛ%22/ Fig. 8-10: Action block asafe_1 Interface overview of FB_IST01 ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ¹ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ )%B,67ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½L7B$8)ÛÛÛÛÛÛÛÛÛÛT70¼ Û%22/ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½L7B=8ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û%22/ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ Û ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½W(,15ÛÛÛÛÛÛÛÛÛÛÛT.¼ Û%22/ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½W6$)(B$.7ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½W6$)(B2.ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½$;;66$)$&ÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛº» Fig. 8-11: Interface overview of FB_IST01 Description of the identifiers Identifier Application Type Input variables it_open Report Door open BOOL it_closed Report Door closed BOOL tsetup Setup operating mode BOOL tsafe_akt Select safety functions BOOL tsafe_ok Safety area OK BOOL AxxS.SAFAC Safety function active status signal BOOL Output variables qtm Activation of door magnet BOOL qk3 Contactor K3 BOOL qk4 Safe operation deactivation signal BOOL Fig. 8-12: Description of the designator

129 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-23 Description The first two networks reproduce the positions of contactors K3 and K4. Both networks are structured according to the sample switching setup for selecting and deselecting the safety functions of the first channel (drives). The door magnet is activated depending on status signal Safety functions active (AxxS.SSAFAC). Activation of the door magnet is removed if status signal Safety functions active drops off or if the protective door is closed and acknowledgement signal Safety area OK is present. ÛÛÛÛ *HQHUDWHÛT.ÛFRQWDFWRUÛ.Û6DIHW\ÛIXQFWLRQVÛVHOHFWHGÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛ W6$)(B$.7ÛÛL7B=8ÛÛÛÛÛÛW(,15ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛT.ÛÛÛÛÛÛ ÛÛÛÛ¼½Û¼ ½Û¼ ½Û¼ Û ½ ÛÛÛÛW6$)(B$.7Û6HOHFWÛVDIHW\ÛIXQFWLRQVÛÛ%22/ ÛÛÛÛL7B=8Û'RRUÛFORVHGÛÛ%22/ ÛÛÛÛW(,15Û6HWXSÛRSHUDWLRQÛÛ%22/ ÛÛÛÛT.Û&RQWDFWRUÛ.ÛÛ%22/ ÛÛÛÛ *HQHUDWHÛT.ÛFRQWDFWRUÛ.Û6DIHW\ÛIXQFWLRQVÛGHVHOHFWHGÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛ L7B=8ÛÛÛÛÛÛT.ÛÛÛÛÛÛÛÛW6$)(B2.ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛT.ÛÛÛÛÛÛ ÛÛÛÛ¼½Û¼ ½¼ ¾½Û¼ ¾ Û ½ ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ T.ÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛº½Û¼»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛL7B=8Û'RRUÛFORVHGÛÛ%22/ ÛÛÛÛT.Û&RQWDFWRUÛ.ÛÛ%22/ ÛÛÛÛW6$)(B2.Û6DIHW\ÛDUHDÛ2.ÛÛ%22/ ÛÛÛÛT.Û6DIHW\ÛIXQFWLRQÛGHDFWLYDWHGÛÛ%22/ ÛÛÛÛT.Û6DIHW\ÛIXQFWLRQÛGHDFWLYDWHGÛÛ%22/ ÛÛÛÛ Û$FWLYDWLRQÛRIÛGRRUÛPDJQHWÛ ÛÛÛÛ $[[66$)$&ÛÛ0B70ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛT70ÛÛÛÛÛÛ ÛÛÛÛ¼½Û¼ ½¼ Û ½ ÛÛÛÛ$[[66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛÛ0B70Û0$5.(5Û5HVHWÛGRRUÛPDJQHWÛÛ%22/ ÛÛÛÛT70Û$FWLYDWLRQÛRIÛGRRUÛPDJQHWÛÛ%22/ ÛÛÛÛ *HQHUDWHÛPDUNHUÛ0B70Û$FWLYDWLRQÛRIÛGRRUÛPDJQHWÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛ $[[66$)$&ÛÛW6$)(B2.ÛÛÛL7B$8)ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B70ÛÛÛÛÛ ÛÛÛÛ¼½Û¼ ¾½Û¼ ½¼ ¾ Û ½ ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛ 0B70ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛº½Û¼»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛ$[[66$)$&Û6DIHW\ÛIXQFWLRQÛDFWLYHÛÛ%22/ ÛÛÛÛW6$)(B2.Û6DIHW\ÛDUHDÛ2.ÛÛ%22/ ÛÛÛÛL7B$8)Û'RRUÛRSHQÛÛ%22/ ÛÛÛÛ0B70Û0$5.(5Û5HVHWÛGRRUÛPDJQHWÛÛ%22/ ÛÛÛÛ0B70Û0$5.(5Û5HVHWÛGRRUÛPDJQHWÛÛ%22/ Fig. 8-13: Function block FB_IST01

130 8-24 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Description Safety signals of channel 2 (drive) To transport the data for the safety I/O of channel 2 (drive) through the control, function SAVE_IO (described in the following) must be programmed in the PLC user program for each axis designed for use with safety functions. The purpose of this function is to provide a secure transfer of the safety I/O signals between the used safety I/O module and the associated intelligent digital SERCOS drive. To ensure continuous communication between the safety I/O module and the drive, processing of the function must be ensured in every PLC program run. Therefore, it is a good idea to call the functions directly in the initialization in a saving step. Interface overview of function SAVE_IO ÛÛÛÛÛÛÛÛÛÛÛÛÛ ¹ ÛÛÛÛÛÛÛÛÛÛÛÛÛ 6$9(B,2Û ÛÛÛÛÛÛ86,17Û ½$;,6ÛÛÛÛ¼ Û8',17 ÛÛÛÛÛÛ8',17Û ½,1ÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛº» Û Fig. 8-14: Interface overview function SAVE_IO AXIS Input AXIS must be occupied with the drive address set on the safety I/O module. Values between 1 and 32 are possible here. The date must be of data type USINT. Providing this address specifies the drive that exchanges the safety I/O information with this module. IN The input information from the safety I/O module is stored on input IN. This input must be switched with the identifier of the safety I/O module inputs specified in the declaration. The input and output data are of type UDINT. Output SAVE_IO The output of function SAVE_IO provides the output information for the safety I/O module. This output is located directly on the output register of the assigned safety I/O module. When the function is switched, the relationship between the drive on the control and the safety I/O module on the field bus is created. The definition of the data contents for the safety I/O module ensures that the information is recognized as valid only by the drive / safety I/O module with the same addresses. This eliminates assignment errors due to programming an incorrect axis address 32-bit data consistency Before the safety I/O signals can be transferred between the used safety I/O modules and the associated digital drives, 32-bit data consistency must be switched on. If 32-bit data consistency is not active, communication between the safety I/O modules and the digital drives cannot be established. Note: Transport of the safety I/O signals between the safety I/O module and the digital drive is possible only if 32-bit data consistency is active.

131 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-25 Activation of 32-bit data consistency for Version bit data consistency is activated in the PLC programming interface of Version 19. To do this, open menu Project IO assignment. In the I/O configuration, select IBM2 (Interbus-S master) and confirm with the <Enter> key. Then use key combination <Alt><F10> to open menu IO Editor. In the IO Editor, open menu Interbus-S Parameter. Interbus-S Parameter.bmp Fig. 8-15: Interbus-S parameters for Version 19 In the Interbus-S Parameter window, 32-bit data consistency is activated by marking the field Data consistency under Parameter with an x. To do this, use the Tab key to select the field Data consistency and mark it using the Space key. Fig. 8-16: Activation of 32-bit data consistency for Version 19 Datenkonsistenz.bmp After successful activation, the PLC user program must be loaded into the control. 32-bit data consistency remains active until it is deactivated in menu Interbus-S Parameter. Sample application for Version 19 At the start of the actual programming, the I/O hardware configuration must be entered in the IO tables in the programming system. The IO table records the participants of a bus. Only after this specification has been made can the linkage of inputs and outputs to absolute addresses be sensibly carried out. Before the program is loaded into the PLC, the data generated here are compared to the actual hardware data of the control. I/O Editor for Version 19 Four safety I/O modules, with logical numbers 20, 21, 22 and 23, have been entered In the following IO table.

132 8-26 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology 5LQJÛPRGXOHÛÛÛ,QWHUEXV6ÛULQJ 1RÛ/RJÛOHYHOÛ,%6Û1RÛÛÛ,'ÛÛ8VHUÛ,'ÛÛÛÛ%\WHVÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛFRGHÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛà¹ÛÛÛSSÛ50.,%6%./ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛà ÛÛÛSS%)Û503Û($ÛÛÛÛÛÛ4444,,,,ÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛà ÛÛÛSS%)Û503Û($ÛÛÛÛÛÛ4444,,,,ÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛà ÛÛÛSS%)Û503Û($ÛÛÛÛÛÛ4444,,,,ÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛà ÛÛÛSS%)Û503Û($ÛÛÛÛÛÛ4444,,,,ÛÛÛÛ Fig. 8-17: Field bus assignment in the I/O Editor for Version 19 Declaration for Version 19 In the declaration part, the symbolic names of the input and output variables, the addresses and the data type are agreed upon.,ghqwlilhuûû$7ûûûûûûûûûûûû7<3(ûûûûûûûû ÛÛÛÛÛÛÛÛÛÛ&RPPHQW 352*5$0ÛÛÛÛÛ,67 Û,QSXWÛVLJQDOVÛIRUÛVDIHW\Û,2Û 9$5B,1387 ÛL6DIH6ÛÛÛÛÛà,'ÛÛÛÛÛÛÛ8',17 6DIHW\ÛLQSXWÛVLJQDOVÛ6D[LV ÛL6DIH;ÛÛÛÛÛà,'ÛÛÛÛÛÛÛ8',17 6DIHW\ÛLQSXWÛVLJQDOVÛ;D[LV ÛL6DIH<ÛÛÛÛÛà,'ÛÛÛÛÛÛÛ8',17 6DIHW\ÛLQSXWÛVLJQDOVÛ<D[LV ÛL6DIH$ÛÛÛÛÛà,'ÛÛÛÛÛÛÛ8',17 6DIHW\ÛLQSXWÛVLJQDOVÛ$D[LV (1'B9$5 Û2XWSXWÛVLJQDOVÛIRUÛVDIHW\Û,2Û 9$5B ÛT6DIH6ÛÛÛÛÛà4'ÛÛÛÛÛÛÛ8',17 ÛT6DIH;ÛÛÛÛÛà4'ÛÛÛÛÛÛÛ8',17 ÛT6DIH<ÛÛÛÛÛà4'ÛÛÛÛÛÛÛ8',17 ÛT6DIH$ÛÛÛÛÛà4'ÛÛÛÛÛÛÛ8',17 (1'B9$5 6DIHW\ÛRXWSXWÛVLJQDOVÛ6D[LV 6DIHW\ÛRXWSXWÛVLJQDOVÛ;D[LV 6DIHW\ÛRXWSXWÛVLJQDOVÛ<D[LV 6DIHW\ÛRXWSXWÛVLJQDOVÛ$D[LV Fig. 8-18: Declaration of safety I/O modules for Version 19

133 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-27 Implementation for Version 19 In the user program, the input and output variables are transferred directly to function SAVE_IO in action asafe_2. Û6DIHW\ÛVLJQDOVÛ6D[LVÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ¹ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ 6$9(B,2Û ÛÛÛÛÛÛÛÛÛÛÛÛÛ ½$;,6ÛÛÛÛ¼ ÛT6DIH6 ÛÛÛÛÛÛÛL6DIH6Û ½,1ÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛº» Û6DIHW\ÛVLJQDOVÛ;D[LVÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ¹ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ 6$9(B,2Û ÛÛÛÛÛÛÛÛÛÛÛÛÛ ½$;,6ÛÛÛÛ¼ ÛT6DIH; ÛÛÛÛÛÛÛL6DIH;Û ½,1ÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛº» Û6DIHW\ÛVLJQDOVÛ<D[LVÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ¹ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ 6$9(B,2Û ÛÛÛÛÛÛÛÛÛÛÛÛÛ ½$;,6ÛÛÛÛ¼ ÛT6DIH< ÛÛÛÛÛÛÛL6DIH<Û ½,1ÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛº» Û6DIHW\ÛVLJQDOVÛ$D[LVÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ¹ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ 6$9(B,2Û ÛÛÛÛÛÛÛÛÛÛÛÛÛ ½$;,6ÛÛÛÛ¼ ÛT6DIH$ ÛÛÛÛÛÛÛL6DIH$Û ½,1ÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛº» Û Fig. 8-19: Implementation function SAVE_IO in action asafe_1 for Version 19

134 8-28 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Activation of 32-bit data consistency as of Version 22 As of Version 22, 32-bit data consistency is activated in the PLC programming interface by selecting activation Interbus/M/CON in the I/O Editor of the resource for RMP12 safety I/O modules (see Fig. 7-21). Sample application as of Version 22 As of Version 22, the I/O hardware configuration is declared using tool CMD. The following figure shows a typical application. Operator terminal BTA20 (participant 30) and a RMK12 RECO bus terminal are connected via the Interbus activation. Two standard output modules (RMA12), a standard input module (RME12) and 4 safety I/O modules (RMP12) are connected on the RECO bus terminal. CMD configuration as of Version 22 The Interbus activation is to be configured in the CMD system configurator as follows: CMD_Konf.bmp Fig. 8-20: Interbus activation configuration as of Version 22 I/O Editor as of Version 22 The existing modules are declared in the I/O Editor of the resource as follows.

135 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-29 Fig. 8-21: I/O Editor of the resource as of Version 22 IO_Edit.bmp Note: Each safety I/O module occupies 4-byte inputs and 4-byte outputs in the I/O reproduction. All safety I/O modules must be declared in the I/O Editor as one participant (in the example above, as participant 86). Declaration as of Version 22 The inputs and outputs of the safety I/O modules must be declared between VAR and END_VAR in the declaration of the program. Dekl.bmp Fig. 8-22: Safety signals declaration as of Version 22

136 8-30 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Implementation as of Version 22 In the user program, the input and output variables are transferred directly to function SAVE_IO in action asafe_2. (*Safety signals S axis*) SAVE_IO 1 (*Safety inputs S axis*) %ID86.4 isaves (*Function input IN: Inputs of safety I/O module*) AXIS (*Drive address 1 to 32*) IN SAVE_IO (*Safety outputs S axis*) %QD86.0 qsaves isaves...(*safety inputs S axis*)...%id udint qsaves...(*safety outputs S axis*)...%qd udint (*Safety signals X axis*) 2 (*Safety inputs X axis*) %ID86.8 isavex SAVE_IO (*Function input IN: Inputs of safety I/O module*) AXIS (*Drive address 1 to 32*) IN SAVE_IO (*Safety outputs X axis*) %QD86.4 qsavex isavex...(*safety inputs X axis*)...%id udint qsavex...(*safety outputs X axis*)...%qd udint (*Safety signals Y axis*) 3 (*Safety inputs Y axis*) %ID86.12 isavey SAVE_IO (*Function input IN: Inputs of safety I/O module*) AXIS (*Drive address 1 to 32*) IN SAVE_IO (*Safety outputs Y axis*) %QD86.8 qsavey isavey...(*safety inputs Y axis*)...%id udint qsavey...(*safety outputs Y axis*)...%qd udint (*Safety signals A axis*) 4 (*Safety inputs A axis*) %ID86.16 isavey SAVE_IO (*Function input IN: Inputs of safety I/O module*) AXIS (*Drive address 1 to 32*) IN SAVE_IO (*Safety outputs A axis*) %QD86.12 qsavea isavea...(*safety inputs A axis*)...%id udint qsavea...(*safety outputs A axis*)...%qd udint Implementation V22.FH7 Fig. 8-23: Implementation function SAVE_IO in action asafe_1 as of Version 22

137 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-31 Safe shutdown of drives Safe shutdown must be implemented (in Version 19 by a fast PLC program (2ms implementation) and as of Version 22 by a time-controlled task) for every axis that is designed for use with safety functions. If a safety monitor in the control triggers the shutdown of the drive system, the CNC uses the cycle interface of the PLC to signal that the starting lockout must be activated. In order to ensure that the safe shutdown of the drives is not delayed by the PLC cycling time, the drives must be shut down or the starting lockout activated (for Version 19 in the 2ms implementation and as of Version 22 by a time-controlled task). Safe stop When safety function safe stop is selected, the starting lockout is also activated by the safe shutdown of the drives in the 2ms implementation (for Version 19) or using a time-controlled task (as of Version 22). 2ms implementation (for Version 19) In Version 19, the PLC program is divided into two areas that run at different speeds. One area contains the PLC program. The cycle time varies based on the length of the PLC user program. The second area, the fast PLC program, is called every 2 ms if it has been enabled by FastEnabl = True. The symbolic name FastEnabl is permanently specified to activate the 2ms implementation. Further information regarding 2ms implementation can be found in the PLC Programming Instructions. Addresses in Version 19 Via the following fixed physical input addresses, the CNC requests the PLC to activate the starting lockout: Address axis number , 2, 3, 4, 5, 6, 7, , 10, 11, 12, 13, 14, 15, , 18, 19, 20, 21, 22, 23, , 26, 27, 28, 29, 30, 31, 32 Fig. 8-24: PLC input addresses for activating the starting lockout for Version 19 Direct access to peripherals in Version 19 In order to ensure that the request for activating the starting lockout does not depend on the input reproduction of the PLC program cycle, the inputs must be addressed as fast input bytes or input words. Direct access to peripherals is implemented in the declaration by character P in the physical address. Example: %IBP Correspondingly, the outputs for activating the starting lockout must be addressed as fast output bytes or output words. Note: Only type BYTE or WORD can be used for the direct access to peripherals.

138 8-32 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Sample application for Version 19 In the declaration part, the symbolic name of the input and output byte for activating the starting lockout is agreed upon. Character P in the physical address declares both bytes as fast inputs/outputs (direct access to peripherals). Û,GHQWLILHUÛÛ$7ÛÛÛÛÛÛÛÛÛÛÛÛ7<3(ÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ&RPPHQW Û Û352*5$0ÛÛÛÛÛ35B,67 Û9$5B,1387 Û5HTXHVWÛWRÛDFWLYDWHÛVWDUWXSÛLQKLELWRUÛIURPÛ&1& ÛL+2/'B$;ÛÛÛà,%3ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ,QSXWÛE\WHÛ$FWLYDWHÛVWDUWXSÛLQKLELWRUÛIURPÛ&1& Û(1'B9$5 Û Û9$5B Û$FWLYDWHÛVWDUWXSÛLQKLELWRU ÛT+2/'B$;ÛÛÛà4%3ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ2XWSXWÛE\WHÛ$FWLYDWHÛVWDUWXSÛLQKLELWRU Û(1'B9$5 ÛÛ Fig. 8-25: Declaration example direct peripheral access for Version 19 Implementation part for Version 19 In the 2ms implementation, input byte ihold_ax is copied directly to output byte qhold_ax. The CNC requests the PLC user program to activate the starting lockout with ihold_ax. Signal status 1 means that the starting lockout must be activated. If the outlet byte activates only the starting lockout of the drives and no outlet bits are used for other duties (danger of overwriting), the inlet byte (ihold_ax) can be copied directly to the output byte (qhold_ax). Û Û &RS\ÛLQSXWÛE\WHÛIURPÛ&1&ÛWRÛRXWSXWÛE\WHÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ Û ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ Û ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ Û ÛÛL+2/'B$; ½ÛÛÛÛÛÛÛÛ¼ T+2/'B$;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ Û ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛL+2/'B$;Û5HTXHVWÛWRÛDFWLYDWHÛVWDUWXSÛLQKLELWRUÛIURPÛ&1&Ûà,%3Û%<7( ÛT+2/'B$;Û$FWLYDWHÛVWDUWXSÛLQKLELWRUÛRXWSXWVÛà4%3Û%<7( Fig. 8-26: Activation of the starting lockout in the 2 ms implementation of Version 19

139 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-33 Time-controlled task as of Version 22 In Version 22, the PLC program is divided into two tasks: a cyclic task (TSK1) and a time-controlled one (TSK2). The time-controlled task is to be declared with an INTERVAL of 4ms and enabled with a priority higher than the cyclic task. RES_IST.bmp Fig. 8-27: Task division in Version 22 Note: Detailed notes regarding the function of task administration can be found in Section 11.3 of the documentation Operating and Programming Instructions for WinPCL 04VRS. Addresses as of Version 22 Via the following fixed physical input addresses, the CNC requests the PLC to activate the starting lockout: Address Axis number , 2, 3, 4, 5, 6, 7, , 10, 11, 12, 13, 14, 15, , 18, 19, 20, 21, 22, 23, , 26, 27, 28, 29, 30, 31, 32 Fig. 8-28: PLC input addresses for activating the starting lockout as of Version 22 Sample application for Version 22 In the declaration part, the symbolic name of the input and output byte for activating the starting lockout is agreed upon in the area between VAR and END_VAR.

140 8-34 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Declaration part as of Version 22 In the declaration part, the signals for the starting lockout are declared as follows: DEKL_ZEIT.bmp Fig. 8-29: Declaration part of time-controlled task as of Version 22 Implementation part as of Version 22 In the time-controlled task, input byte ihold_ax is copied directly to output byte qhold_ax. The CNC requests the PLC user program to activate the starting lockout with ihold_ax. Signal status 1 means that the starting lockout must be activated. If the outlet byte activates only the starting lockout of the drives and no outlet bits are used for other duties (danger of overwriting), the inlet byte (ihold_ax) can be copied directly to the output byte (qhold_ax). Fig. 8-30: Implementation part of time-controlled task as of Version 22 IMPL_ZEIT.bmp

141 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-35 Description Forced dynamics In order to provide the machine manufacturers as much freedom as possible in the handling of forced dynamics, forced dynamics is activated using the PLC user program. The machine manufacturer is thus able to determine the optimum time for forced dynamics himself. Therefore, for example, it is possible to execute forced dynamics automatically when the system is started, after a certain time between workpiece processing cycles has elapsed, or manually by the machine operator using a switch. Forced dynamics must be executed in the CNC and the drive after the system is started but before the first activation of a safety function and after the forced dynamics timer has elapsed. The time interval of forced dynamics is specified by the machine manufacturer in the Forced dynamics time interval safety parameters of the CNC and the drive. Forced dynamics should be carried out at least once every eight hours. Forced dynamics tests the Consent key and checks the shutdown circuits of the CNC and the drive. After successful execution, the forced dynamics timers in the CNC and the drive are restarted. In the case of an error, forced dynamics is cancelled and an error message is generated. Conditions The following conditions must be fulfilled before forced dynamics can be started: Safety functions are deselected (deactivation signals have signal status 1 ). The Consent key must not be pressed Power must be switched on or must be able to be switched on using function module DYNAM. Forced dynamics must not be active. Note: Automatic program processing is impossible during forced dynamics. During forced dynamics, axis movement always causes an error and thus the cancellation of forced dynamics.

142 8-36 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Function module DYNAM Bosch Rexroth provides a standard DYNAM function module for forced dynamics. The function module must be designed once in the PLC user program for each axis that is to be used with safety functions. It must be ensured that forced dynamics be carried out separately for each axis. The interfaces of the function module must merely be correctly switched in the PLC user program; forced dynamics itself is carried out automatically by function module DYNAM. The forced dynamics procedure is divided into nine steps that are started by function module DYNAM using a step provision and checked by feedback. Each step is monitored by a timer. Feedback must be detected by the DYNAM module within ten seconds. In the case of an error, forced dynamics is cancelled after ten seconds and an error is output and described at output ERR_FLG / ERR_NR. Start Switch on Power Activate safe operating stop on drive Test Consent key Activate safe operationg stop on drive Record incorrect actual value, check shutdown circuits Movement simulation Check shutdown circuits Deactivate safe operating stop on NC, start timer Deactivate safe operation stop on drive Turn power back on End Zwangsdynamisierung.FH7 Fig. 8-31: Forced dynamics step sequence

143 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-37 Interface overview of function module DYNAM The figure below shows the interfaces of function module DYNAM. ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ¹ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ '<1$0ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½(1$%/(ÛÛÛÛÛÛÛÛ7,0(B¼ Û7,0( ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½67$57ÛÛÛÛÛÛÛÛ5($'<B¼ Û%22/ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛ,17Û ½$;,6ÛÛÛÛÛÛÛÛÛ$&7,9(¼ Û%22/ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½3;;632:(5ÛÛ32:(5B21¼ Û%22/ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½$;;65)ÛÛÛÛÛÛÛ55B)/*¼ Û%22/ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ7,0(Û ½7,0(B0$;ÛÛÛÛÛ(55B15¼ Û,17 ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ%22/Û ½5(6(7ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛº»ÛÛ Fig. 8-32: Interface overview of DYNAM Description of the identifiers Identifier Application Type Input variables ENABLE Activation input BOOL START Start forced dynamics BOOL AXIS Axis number (1-32) INT PXXSPOWER Status signal Power ON BOOL AXXSRF Controller enablement BOOL TIME_MAX Forced dynamics time interval TIME RESET Error acknowledgement BOOL Output variables TIME_ Elapsed time (max.: TIME_MAX) TIME READY_ Forced dynamics ready BOOL ACTIVE Forced dynamics active BOOL POWER_ON Switch power on BOOL ERR_FLG Error flag BOOL ERR_NR Error description INT Fig. 8-33: Description of the designator

144 8-38 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology ENABLE START AXIS PXXSPOWER AXXSRF TIME_MAX RESET Inputs Activation input ENABLE releases processing of function module FB_DYNAM (logic 1 ). If the input is logic 0, the module is not processed and forced dynamics is invalid for the function module. Forced dynamics is required after every activation. A positive flank on inlet START starts forced dynamics, assuming that there is no error and that the module is active. Inlet AXIS is used to assign the axis number of the axis to the function module. Process status signal PXXS.POWER applied to inlet PXXSPOWER. The function module uses this inlet to check, before and during forced dynamics, if power has been switched on. The function module detects on input AXXSRF whether controller enablement is present for the affected axis. Controller enablement is required to start forced dynamics. Input TIME_MAX describes the time interval of forced dynamics. The value should be selected so that it is lower than or equal to that in the Forced dynamics time interval safety parameters in the CNC and the drive. The RESET input acknowledges/deletes error messages that have been issued. TIME_ READY_ ACTIVE POWER_ON ERR_FLG ERR_NR Outputs Output TIME_ shows the time that has elapsed since the last valid forced dynamics. The time is shown regardless of the forced dynamics timers of the CNC and the drive. The maximum value at this output corresponds to the value set in input TIME_MAX. Time measurement is reset only after successful forced dynamics. In the PLC program, the timer can be used to, for example, generate a message that forced dynamics must be carried out within the next hour. Output READY_ signals that forced dynamics was successfully carried out and is valid. The outlet is set to logic 1 until the forced dynamics time interval has elapsed (TIME_=TIME_MAX). The user can use this inlet to interlink several function modules so that forced dynamics can be started sequentially. The outlet signals that forced dynamics is being carried out. Before forced dynamics is started, the function module uses this outlet to signal the PLC user program that power is to be switched on if power is currently switched off. The outlet must be taken into account in the logic of the power startup. Outlet ERR_FLG signals that an error has occurred. Outlet ERR_NR describes an error that has occurred. The error numbers are described in section 11.3 "FB DYNAM Forced Dynamics Error Messages".

145 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-39 Sample application In the example, one function module of type DYNAM is assigned to each of the axes S, X, Y and A. Using a button (input istart ), forced dynamics of spindle S is started (function module FB_DYNAMS). After forced dynamics finishes successfully, the function module starts time measurement TIME_ and sets output READY_. Using flag M_READY_S, forced dynamics of the X-axis is now started on function module FB_DYNAMX, and so on. The time interval of forced dynamics (CNC and drive safety parameters) is eight hours in the example. The time interval of the DYNAM function modules is also set to eight hours (input TIME_MAX ). Outputs TIME_ and READY_ help the PLC programmer in the execution of forced dynamics. Time interval TIME_MAX and output TIME_ of the elapsed time do not depend on the safety parameters of the CNC and the drive. The time output is merely started when the function module has carried out all the required steps and the CNC and drive restart their forced dynamics timers. If forced dynamics in the drive becomes invalid due to an error, e.g. because the drive is shut down, this is not automatically recognized by the function module. In this case, forced dynamics can be made invalid using input ENABLE (logic 0 ). Note: Output POWER_ON must be taken into account in the logic of the power startup in the PLC user program.

146 8-40 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology ÛÛÛÛÛ)RUFHGÛG\QDPLFVÛRIÛ6Û;Û<ÛDQGÛ$D[HVÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ)%B'<1$06ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ '<1$0ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ¼ ½(1$%/(ÛÛÛÛÛÛÛÛ7,0(B¼ 7,0(B6ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ L67$57ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B5($'<B6 ÛÛÛÛÛ¼½Û¼ ½67$57ÛÛÛÛÛÛÛÛ5($'<B¼ Û ½ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B'<1$&B6 ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ½$;,6ÛÛÛÛÛÛÛÛÛ$&7,9(¼ Û ½ ÛÛÛÛÛ 3632:(5Û ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B32:21B6 ÛÛÛÛÛ¼½Û¼ ½3;;632:(5ÛÛ32:(5B21¼ Û ½ ÛÛÛÛÛ $65)ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B(55)/*6 ÛÛÛÛÛ¼½Û¼ ½$;;65)ÛÛÛÛÛÛ(55B)/*¼ Û ½ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛ7 K ½7,0(B0$;ÛÛÛÛÛ(55B15¼ 0B(55B6ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ L5(6(7ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ¼½Û¼ ½5(6(7ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ)%B'<1$06Û)0Û)RUFHGÛG\QDPLFVÛ6D[LVÛÛ'<1$0 ÛÛÛÛÛ7,0(B6Û7LPHUÛ6D[LVÛÛ7,0( ÛÛÛÛÛL67$57Û%XWWRQÛ6WDUWÛIRUFHGÛG\QDPLFVÛà,Û%22/ ÛÛÛÛÛ0B5($'<B6Û0DUNHUÛ6$;,6ÛUHDG\ÛÛ%22/ ÛÛÛÛÛÛ$[LVÛQXPEHUÛÛ$1<B,17 ÛÛÛÛÛ0B'<1$&B6Û0DUNHUÛ)RUFHGÛG\QDPLFVÛDFWLYHÛÛ%22/ ÛÛÛÛÛ3632:(5Û3RZHUÛHQDEOHGÛÛ%22/ ÛÛÛÛÛ0B32:21B6Û0DUNHUÛ3/&ÛSRZHUÛUHTXHVWÛÛ%22/ ÛÛÛÛÛ$65)Û&RQWUROÛHQDEOHPHQWÛÛ%22/ ÛÛÛÛÛ0B(55)/*6Û0DUNHUÛ(UURUÛIRUFHGÛG\QDPLFVÛ6ÛÛ%22/ ÛÛÛÛÛ7 KÛ7LPHÛLQWHUYDOÛIRUÛIRUFHGÛG\QDPLFVÛÛ7,0( ÛÛÛÛÛ0B(55B6Û0DUNHUÛ(UURUÛQXPEHUÛ6ÛÛ,17 ÛÛÛÛÛL5(6(7Û%XWWRQÛ5HVHWÛà,Û%22/ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ)%B'<1$0;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ '<1$0ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ¼ ½(1$%/(ÛÛÛÛÛÛÛÛ7,0(B¼ 7,0(B;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ 0B5($'<B6ÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B5($'<B; ÛÛÛÛÛ¼½Û¼ ½67$57ÛÛÛÛÛÛÛÛ5($'<B¼ Û ½ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B'<1$&B; ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ½$;,6ÛÛÛÛÛÛÛÛÛ$&7,9(¼ Û ½ ÛÛÛÛÛ 3632:(5Û ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B32:21B; ÛÛÛÛÛ¼½Û¼ ½3;;632:(5ÛÛ32:(5B21¼ Û ½ ÛÛÛÛÛ $65)ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B(55)/*; ÛÛÛÛÛ¼½Û¼ ½$;;65)ÛÛÛÛÛÛ(55B)/*¼ Û ½ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛ7 K ½7,0(B0$;ÛÛÛÛÛ(55B15¼ 0B(55B;ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ L5(6(7ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ¼½Û¼ ½5(6(7ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ)%B'<1$0;Û)0Û)RUFHGÛG\QDPLFVÛ;D[LVÛÛ'<1$0 ÛÛÛÛÛ7,0(B;Û7LPHUÛ;D[LVÛÛ7,0( ÛÛÛÛÛ0B5($'<B6Û0DUNHUÛ6$;,6ÛUHDG\ÛÛ%22/ ÛÛÛÛÛ0B5($'<B;Û0DUNHUÛ;D[LVÛUHDG\ÛÛ%22/ ÛÛÛÛÛÛ$[LVÛQXPEHUÛÛ$1<B,17 ÛÛÛÛÛ0B'<1$&B;Û0DUNHUÛ)RUFHGÛG\QDPLFVÛDFWLYHÛÛ%22/ ÛÛÛÛÛ3632:(5Û3RZHUÛHQDEOHGÛÛ%22/ ÛÛÛÛÛ0B32:21B;Û0DUNHUÛ3/&ÛSRZHUÛUHTXHVWÛÛ%22/ ÛÛÛÛÛ$65)Û&RQWUROÛHQDEOHPHQWÛÛ%22/ ÛÛÛÛÛ0B(55)/*;Û0DUNHUÛ(UURUÛIRUFHGÛG\QDPLFVÛ;ÛÛ%22/ ÛÛÛÛÛ7 KÛ7LPHÛLQWHUYDOÛIRUÛIRUFHGÛG\QDPLFVÛÛ7,0( ÛÛÛÛÛ0B(55B;Û0DUNHUÛ(UURUÛQXPEHUÛ;ÛÛ,17 ÛÛÛÛÛL5(6(7Û%XWWRQÛ5HVHWÛà,Û%22/

147 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-41 ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ)%B'<1$0<ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ '<1$0ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ¼ ½(1$%/(ÛÛÛÛÛÛÛÛ7,0(B¼ 7,0(B<ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ 0B5($'<B;ÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B5($'<B< ÛÛÛÛÛ¼½Û¼ ½67$57ÛÛÛÛÛÛÛÛ5($'<B¼ Û ½ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B'<1$&B< ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ½$;,6ÛÛÛÛÛÛÛÛÛ$&7,9(¼ Û ½ ÛÛÛÛÛ 3632:(5Û ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B32:21B< ÛÛÛÛÛ¼½Û¼ ½3;;632:(5ÛÛ32:(5B21¼ Û ½ ÛÛÛÛÛ $65)ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B(55)/*< ÛÛÛÛÛ¼½Û¼ ½$;;65)ÛÛÛÛÛÛ(55B)/*¼ Û ½ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛ7 K ½7,0(B0$;ÛÛÛÛÛ(55B15¼ 0B(55B<ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ L5(6(7ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ¼½Û¼ ½5(6(7ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ)%B'<1$0<Û)0Û)RUFHGÛG\QDPLFVÛ<D[LVÛÛ'<1$0 ÛÛÛÛÛ7,0(B<Û7LPHUÛ<D[LVÛÛ7,0( ÛÛÛÛÛ0B5($'<B;Û0DUNHUÛ;D[LVÛUHDG\ÛÛ%22/ ÛÛÛÛÛ0B5($'<B<Û0DUNHUÛ<D[LVÛUHDG\ÛÛ%22/ ÛÛÛÛÛÛ$[LVÛQXPEHUÛÛ$1<B,17 ÛÛÛÛÛ0B'<1$&B<Û0DUNHUÛ)RUFHGÛG\QDPLFVÛDFWLYHÛÛ%22/ ÛÛÛÛÛ3632:(5Û3RZHUÛHQDEOHGÛÛ%22/ ÛÛÛÛÛ0B32:21B<Û0DUNHUÛ3/&ÛSRZHUÛUHTXHVWÛÛ%22/ ÛÛÛÛÛ$65)Û&RQWUROÛHQDEOHPHQWÛÛ%22/ ÛÛÛÛÛ0B(55)/*<Û0DUNHUÛ(UURUÛIRUFHGÛG\QDPLFVÛ<ÛÛ%22/ ÛÛÛÛÛ7 KÛ7LPHÛLQWHUYDOÛIRUÛIRUFHGÛG\QDPLFVÛÛ7,0( ÛÛÛÛÛ0B(55B<Û0DUNHUÛ(UURUÛQXPEHUÛ<ÛÛ,17 ÛÛÛÛÛL5(6(7Û%XWWRQÛ5HVHWÛà,Û%22/ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ)%B'<1$0$ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ¹ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ '<1$0ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ¼ ½(1$%/(ÛÛÛÛÛÛÛÛ7,0(B¼ 7,0(B$ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ 0B5($'<B<ÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B5($'<B$ ÛÛÛÛÛ¼½Û¼ ½67$57ÛÛÛÛÛÛÛÛ5($'<B¼ Û ½ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B'<1$&B$ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛ ½$;,6ÛÛÛÛÛÛÛÛÛ$&7,9(¼ Û ½ ÛÛÛÛÛ 3632:(5Û ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B32:21B$ ÛÛÛÛÛ¼½Û¼ ½3;;632:(5ÛÛ32:(5B21¼ Û ½ ÛÛÛÛÛ $65)ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ0B(55)/*$ ÛÛÛÛÛ¼½Û¼ ½$;;65)ÛÛÛÛÛÛ(55B)/*¼ Û ½ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛ7 K ½7,0(B0$;ÛÛÛÛÛ(55B15¼ 0B(55B$ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ L5(6(7ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ¼½Û¼ ½5(6(7ÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛÛº»ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ ÛÛÛÛÛ)%B'<1$0$Û)0Û)RUFHGÛG\QDPLFVÛ$D[LVÛÛ'<1$0 ÛÛÛÛÛ7,0(B$Û7LPHUÛ=D[LVÛÛ7,0( ÛÛÛÛÛ0B5($'<B<Û0DUNHUÛ<D[LVÛUHDG\ÛÛ%22/ ÛÛÛÛÛ0B5($'<B$Û0DUNHUÛ$D[LVÛUHDG\ÛÛ%22/ ÛÛÛÛÛÛ$[LVÛQXPEHUÛÛ$1<B,17 ÛÛÛÛÛ0B'<1$&B$Û0DUNHUÛ)RUFHGÛG\QDPLFVÛDFWLYHÛÛ%22/ ÛÛÛÛÛ3632:(5Û3RZHUÛHQDEOHGÛÛ%22/ ÛÛÛÛÛ0B32:21B$Û0DUNHUÛ3/&ÛSRZHUÛUHTXHVWÛÛ%22/ ÛÛÛÛÛ$65)Û&RQWUROÛHQDEOHPHQWÛÛ%22/ ÛÛÛÛÛ0B(55)/*$Û0DUNHUÛ(UURUÛIRUFHGÛG\QDPLFVÛ$ÛÛ%22/ ÛÛÛÛÛ7 KÛ7LPHÛLQWHUYDOÛIRUÛIRUFHGÛG\QDPLFVÛÛ7,0( ÛÛÛÛÛ0B(55B$Û0DUNHUÛ(UURUÛQXPEHUÛ$ÛÛ,17 ÛÛÛÛÛL5(6(7Û%XWWRQÛ5HVHWÛà,Û%22/ Fig. 8-34: Sample application: function block DYNAM in action block adynam

148 8-42 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Safety Parameters Two-way data comparison Safely limited absolute positions / safe cams Position monitoring window for Safe operation stop Safe referencing reference position Transition time for switching safety functions This section describes the safety parameters of the control and drives in the sample application. It must be ensured that each safety parameter is present in the control and in the drive. If a parameter is not entered in the same way in both channels, e.g. due to incorrect entry, the drives are shut down using the shutdown circuits. In this case, the control and the drive issue error message Two-way data comparison incorrect with the corresponding axis number. Safely limited absolute positions and safe cams are not evaluated if the upper and lower position limits are set to a value of 0. The parameters are always internally evaluated, regardless of which safety function is selected. Safety parameter Position monitoring window for safe operation stop must not be set so that it is too small. Parameter Safe referencing reference position is evaluated only if safely limited absolute positions and safe cams are used. If only safety function safe stop or safe operation stop is used without switching to another safety function, parameter Transition time for switching safety functions can be set to 0. Note: Unused safety parameters are to be set to a value of 0 in both channels! Time interval for forced dynamics The time interval for forced dynamics is 8 hours for all four axes. Note: A reason for a value greater than 8 hours for the time interval for forced dynamics must be provided by the machine manufacturer in the acceptance report!

149 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-43 Safety function Selection of safety functions S-Axis (1 st Axis) Safe stop In safety parameter C01.117, safe stop is not hidden in the control. Therefore, safe stop is planned for the S axis on the control side. C Selection of safety functions Bit Meaning Value 00 Hide safe stop No 01 Hide safe operation stop Yes 02 Hide safely reduced speed 1 Yes 03 Hide safely reduced speed 2 Yes 04 Hide SOS switch Yes Fig. 8-35: Mask of the unused safety inputs, S-axis In the drive, bits 1, 2, 3 and 4 of parameter P must be correspondingly set to a value of 1. Control parameters: Parameter Description Value Unit C Safety function Yes - C Maximum speed 1 for safety function rpm C Upper position limit 1 for safety funct deg C Lower position limit 1 for safety funct deg C Maximum speed 2 for safety function rpm C Upper position limit 2 for safety funct deg C Lower position limit 2 for safety funct deg C Upper pos. limit for pos. switch pt deg C Lower pos. limit for pos. switch pt deg C Upper pos. limit for pos. switch pt deg C Lower pos. limit for pos. switch pt deg C Upper pos. limit for pos. switch pt deg C Lower pos. limit for pos. switch pt deg C Upper pos. limit for pos. switch pt deg C Lower pos. limit for pos. switch pt deg C Position monitoring window for safe operation stop C Reference position for Safe referencing deg deg C Selection of safety functions 30 - C Transition time for switching safety functions 0 ms C Time interval for forced dynamics 8 h C Checksum of the weighting data Fig. 8-36: CNC safety parameters, S-axis

150 8-44 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Drive parameters: Parameter Description Value Unit P Checksum via weighting data, drive P Activation of safety functions P Maximum speed 2 for safety function rpm P Upper position limit 1 for the safety function Degrees P Lower position limit 1 for the safety function Degrees P Maximum speed for the 2 nd safety function rpm P Upper position limit 2 for the safety function Degrees P Lower position limit 2 for the safety function Degrees P Upper position limit for position switch point Degrees P Lower position limit for position switch point Degrees P Upper position limit for position switch point Degrees P Lower position limit for position switch point Degrees P Upper position limit for position switch point Degrees P Lower position limit for position switch point Degrees P Upper position limit for position switch point Degrees P Lower position limit for position switch point Degrees P Position monitoring window for Safe operation stop Degrees P Reference position for Safe referencing Degrees P Selection of safety functions P Transition time for switching safety functions 0 ms P Time interval for forced dynamics, drive 8 h Fig. 8-37: Drive safety parameters, S-axis

151 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-45 Safety function Selection of safety functions X-Axis (2 nd Axis) Safe operation stop In safety parameter C02.117, safe operation stop is not hidden in the control. Therefore, safe operation stop is planned for the X axis on the control side. C Selection of safety functions Bit Meaning Value 00 Hide safe stop Yes 01 Hide safe operation stop No 02 Hide safely reduced speed 1 Yes 03 Hide safely reduced speed 2 Yes 04 Hide SOS switch Yes Fig. 8-38: Mask of the unused safety inputs, X-axis In the drive, bits 0, 2, 3 and 4 of parameter P must be correspondingly set to a value of 1. Control parameters: Parameter Description Value Unit C Safety function Yes - C Maximum speed 1 for safety function mm/min C Upper position limit 1 for safety funct mm C Lower position limit 1 for safety funct mm C Maximum speed 2 for safety function 0.0 mm/min C Upper position limit 2 for safety funct mm C Lower position limit 2 for safety funct mm C Upper pos. limit for pos. switch pt mm C Lower pos. limit for pos. switch pt mm C Upper pos. limit for pos. switch pt mm C Lower pos. limit for pos. switch pt mm C Upper pos. limit for pos. switch pt mm C Lower pos. limit for pos. switch pt mm C Upper pos. limit for pos. switch pt mm C Lower pos. limit for pos. switch pt mm C Position monitoring window for safe operation stop C Reference position for Safe referencing mm mm C Selection of safety functions 29 - C Transition time for switching safety functions 0 ms C Time interval for forced dynamics 8 h C Checksum of the weighting data Fig. 8-39: CNC safety parameters, X-axis

152 8-46 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Drive parameters: Parameter Description Value Unit P Checksum via weighting data, drive P Activation of safety functions P Maximum speed 2 for safety function mm/min P Upper position limit 1 for the safety function mm P Lower position limit 1 for the safety function mm P Maximum speed for the 2 nd safety function mm/min P Upper position limit 2 for the safety function mm P Lower position limit 2 for the safety function mm P Upper position limit for position switch point mm P Lower position limit for position switch point mm P Upper position limit for position switch point mm P Lower position limit for position switch point mm P Upper position limit for position switch point mm P Lower position limit for position switch point mm P Upper position limit for position switch point mm P Lower position limit for position switch point mm P Position monitoring window for Safe operation stop mm P Reference position for Safe referencing mm P Selection of safety functions P Transition time for switching safety functions 0 ms P Time interval for forced dynamics, drive 8 h Fig. 8-40: Drive safety parameters, X-axis

153 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-47 Safety function Maximum speed 2 for safety function Y Axis (2 nd Axis) Safely reduced speed with safely limited absolute positions 1 The maximum safely reduced speed of the Y-axis is specified at mm/min. Note: The machine manufacturer is responsible for the correct selection of speed limit values, depending on utilization and operating mode. Upper/lower position limit 1 for the safety function Reference position for safe referencing Selection of safety functions Exceeding the position limit results in the drive being shut down immediately by the shutdown circuits. Control parameters Positive travel limit (Cxx.011) and Negative travel limit (Cxx.012) are to be set correspondingly lower. In this example, the settings C = 200 and C = -200 are sufficient. Safely limited absolute positions can be selected only if safe reference has been carried out. After referencing, the control and drive expect acknowledgment Reference cam for safe referencing on position In safety parameter C03.117, safely reduced speed is not hidden in the control. Therefore, safely reduced speed is planned for the Y axis on the control side. Hiding Switch safe operation stop selects safety function safe stop if the Consent key is not pressed. C Selection of safety functions Bit Meaning Value 00 Hide safe stop Yes 01 Hide safe operation stop Yes 02 Hide safely reduced speed 1 No 03 Hide safely reduced speed 2 Yes 04 Hide SOS switch Yes Fig. 8-41: Mask of the unused safety inputs, Y-axis In the drive, bits 0, 1, 3 and 4 of parameter P must be correspondingly set to a value of 1.

154 8-48 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Transition time for switching safety functions Parameter Transition time for switching safety functions is calculated as follows: ( t + t t )[ ms ] Cxx.118 = P = 1,2* B PLC + ZL ( Cxx.101orCxx.104 )* 1000 with: t B = Cxx.018* and: t ZL = 5* Kv *16,6 L: Cxx.118= transition time for switching the safety functions in the control in ms P = transition time for switching the safety functions in Drive in ms Cxx.101 = maximum speed for safety function 2 in mm/min Cxx.104 = maximum speed for safety function 2 in mm/min Cxx.018 = maximum acceleration mm/s 2 t b = Braking time in ms t PLC = maximum PLC cycle time in ms t ZL = time constant position controller in ms K v = position controller K v factor (S ) in 1000/min xx = Axis number - Fig. 8-42: Formula Transition time for switching the safety functions Parameters of the Y-axis for calculating the transition time for switching safety functions: Parameter Designation Value C Max. safe speed 2000 [mm/min] C Max. axis acceleration 5000 [mm/(s*s)] t PLC PLC cycle time 20 [ms] S K v factor 1 [1000 rpm] Fig. 8-43: Y-axis parameters for calculating C The maximum PLC cycle time can be found in the PLC programming interface under menu item Diagnostics / PLC info. C = P = 1,2* C = P = 1,2* ( )[ms] = 392ms C = P = ca.400ms 2000* * 5000* * 16,6 ¹ [ ms ] L: C03.118= transition time for switching the safety functions in the control in ms P = transition time for switching the safety functions in Drive in ms Fig. 8-44: Calculation of Transition time for switching safety functions, Y-axis

155 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-49 Control parameters: Parameter Description Value Unit C Safety function Yes - C Maximum speed 1 for safety function mm/min C Upper position limit 1 for safety funct mm C Lower position limit 1 for safety funct mm C Maximum speed 2 for safety function mm/min C Upper position limit 2 for safety funct mm C Lower position limit 2 for safety funct mm C Upper pos. limit for pos. switch pt mm C Lower pos. limit for pos. switch pt mm C Upper pos. limit for pos. switch pt mm C Lower pos. limit for pos. switch pt mm C Upper pos. limit for pos. switch pt mm C Lower pos. limit for pos. switch pt mm C Upper pos. limit for pos. switch pt mm C Lower pos. limit for pos. switch pt mm C Position monitoring window for safe operation stop C Reference position for Safe referencing mm mm C Selection of safety functions 27 - C Transition time for switching safety functions 400 ms C Time interval for forced dynamics 8 h C Checksum of the weighting data Fig. 8-45: CNC safety parameters, Y-axis

156 8-50 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Drive parameters: Parameter Description Value Unit P Checksum via weighting data, drive P Activation of safety functions P Maximum speed 2 for safety function mm/min P Upper position limit 1 for the safety function mm P Lower position limit 1 for the safety function mm P Maximum speed for the 2 nd safety function mm/min P Upper position limit 2 for the safety function mm P Lower position limit 2 for the safety function mm P Upper position limit for position switch point mm P Lower position limit for position switch point mm P Upper position limit for position switch point mm P Lower position limit for position switch point mm P Upper position limit for position switch point mm P Lower position limit for position switch point mm P Upper position limit for position switch point mm P Lower position limit for position switch point mm P Position monitoring window for Safe operation stop mm P Reference position for Safe referencing mm P Selection of safety functions P Transition time for switching safety functions 400 ms P Time interval for forced dynamics, drive 8 h Fig. 8-46: Drive safety parameters, Y-axis

157 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-51 Safety function Maximum speed 1 for safety function Maximum speed 2 for safety function A-Axis (4 th Axis) Safely reduced speed 1 Safely reduced speed 2 Safe cams 1 The maximum safely reduced speed 1 of the A-axis is specified at units/min. The maximum safely reduced speed 2 of the A-axis is specified at 1080 units/min. Note: The machine manufacturer is responsible for the correct selection of speed limit values, depending on utilization and operating mode. Safe cams 1 Cam pair 1 of the A-axis is evaluated for switching between safety functions safely reduced speed 1 and 2. Note: The position switch points of safe cams must undergo further processing according to Category 3 of EN ; only signal status 1 may be evaluated for safety-relevant jobs. Reference position for safe referencing Selection of safety functions Safe cams is output only if safe reference has been carried out. After referencing, the control and drive expect acknowledgment Reference cam for safe referencing on position 0. In safety parameter C04.117, safely reduced speeds 1 and 2 are not hidden in the control. Therefore, safely reduced speeds 1 and 2 are planned for the A-axis on the control side. Because safe operation stop is not hidden, switching between safe operation stop and safely reduced speed occurs by pressing the Consent key. C Selection of safety functions Bit Meaning Value 00 Hide safe stop Yes 01 Hide safe operation stop Yes 02 Hide safely reduced speed 1 No 03 Hide safely reduced speed 2 No 04 Hide SOS switch No Fig. 8-47: Mask of the unused safety inputs, A-axis In the drive, bits 0 and 1 of parameter P must be correspondingly set to a value of 1.

158 8-52 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Transition time for switching safety functions Parameter Transition time for switching safety functions is calculated according to the following formula: ( t + t t )[ ms ] Cxx.118 = P = 1,2* B PLC + ZL ( Cxx.101orCxx.104 )* 1000 with: t B = Cxx.018* and: t ZL = 5* Kv *16,6 L: Cxx.118= transition time for switching the safety functions in the control in ms P = transition time for switching the safety functions in Drive in ms Cxx.101 = maximum speed for safety function 1 in mm/min Cxx.104 = maximum speed for safety function 2 in mm/min Cxx.018 = maximum acceleration mm/s 2 t b = Braking time in ms t PLC = maximum PLC cycle time in ms t ZL = time constant position controller in ms K v = position controller K v factor (S ) in 1000/min xx = Axis number - Fig. 8-48: Formula Transition time for switching the safety functions Parameters of the A-axis for calculating the transition time for switching safety functions: Parameter Designation Value C Max. safe speed [units/min] C Max. axis acceleration 3600 [units/s*s] t PLC PLC cycle time 20 [ms] S K v factor 1 [1000 rpm] Fig. 8-49: A-axis parameters for calculating C If safety functions safely reduced speed 1 and 2 are used, the larger speed limit value must be used to calculate the transition time for safety parameter Switching safety functions. The PLC cycle time can be found in the PLC programming interface under menu item Diagnostics / PLC info. C = P = 1,2* C = P = 1,2* ( )[ ms ] = 445ms C = P = ca.450ms 10800* * 3600* * 16,6 ¹ [ ms ] L: C04.118= transition time for switching the safety functions in the control in ms P = transition time for switching the safety functions in Drive in ms Fig. 8-50: Calculation of Transition time for switching safety functions, A-axis

159 IST Intelligent Safety Technology Planning a System with Bosch Rexroth IST 8-53 Control parameters: Parameter Description Value Unit C Safety function Yes - C Maximum speed 1 for safety function Units/min C Upper position limit 1 for safety funct units C Lower position limit 1 for safety funct units C Maximum speed 2 for safety function Units/min C Upper position limit 2 for safety funct units C Lower position limit 2 for safety funct units C Upper pos. limit for pos. switch pt units C Lower pos. limit for pos. switch pt units C Upper pos. limit for pos. switch pt units C Lower pos. limit for pos. switch pt units C Upper pos. limit for pos. switch pt units C Lower pos. limit for pos. switch pt units C Upper pos. limit for pos. switch pt units C Lower pos. limit for pos. switch pt units C Position monitoring window for Safe operation stop C Reference position for Safe referencing units units C Selection of safety functions 3 - C Transition time for switching safety functions 450 ms C Time interval for forced dynamics 8 h C Checksum of the weighting data Fig. 8-51: CNC safety parameters, A-axis

160 8-54 Planning a System with Bosch Rexroth IST IST Intelligent Safety Technology Drive parameters: Parameter Description Value Unit P Checksum via weighting data, drive P Activation of safety functions P Maximum speed 2 for safety function rpm P Upper position limit 1 for the safety function Degrees P Lower position limit 1 for the safety function Degrees P Maximum speed for the 2 nd safety function rpm P Upper position limit 2 for the safety function Degrees P Lower position limit 2 for the safety function Degrees P Upper position limit for position switch point Degrees P Lower position limit for position switch point Degrees P Upper position limit for position switch point Degrees P Lower position limit for position switch point Degrees P Upper position limit for position switch point Degrees P Lower position limit for position switch point Degrees P Upper position limit for position switch point Degrees P Lower position limit for position switch point Degrees P Position monitoring window for Safe operation stop Degrees P Reference position for Safe referencing Degrees P Selection of safety functions P Transition time for switching safety functions 450 ms P Time interval for forced dynamics, drive 8 h Fig. 8-52: Drive safety parameters, A-axis

161 IST Intelligent Safety Technology Commissioning of Intelligent Safety Technology Commissioning of Intelligent Safety Technology 9.1 Notes Regarding Safety 9.2 General Notes Before commissioning Intelligent Safety Technology, read and observe the general notes regarding use and safety in chapters 1 and 2 of this documentation. Furthermore, observe the notes regarding the individual commissioning steps. Commissioning of Intelligent Safety Technology is divided into several sections. Before the Intelligent Safety Technology functions are activated, the electrical installation, the commissioning of the mechanical system and the installation of safety-relevant components must be complete. Note: The commissioning and acceptance of the safety technology must be carried out only by appropriately trained personnel that are authorized by the machine manufacturer. Note: The machine manufacturer is responsible for the proper commissioning, acceptance and logging of the safety technology.

162 9-2 Commissioning of Intelligent Safety Technology IST Intelligent Safety Technology 9.3 Instructions for First-Time Commissioning Before the safety functions are activated, the commissioning and optimization of the axes must be complete. For this, observe the function description of drive controller DIAX04. This has the advantage that the monitoring functions can be tested immediately under real conditions after the activation and the input of data. Observe the following steps during the first-time commissioning of the safety functions: 1. step: Open the menus of the safety parameters in the control The menu of the safety parameters in the control is opened in the machine parameters. To do this, axis parameter Cxx.100 Safety function must be set to yes. The entry adds safety parameters Cxx.101 to Cxx.120 to the axis parameters. 2. step: Hide the unused safety inputs of the control Safety parameter Cxx.117 Selection of safety functions is used to specify which safety function is to be used for the affected axis. When the Enter key is pressed, the selection window for hiding the safety functions is displayed. The unused safety inputs / safety functions must be hidden. A safety function is not used by setting Hide to Yes. You can switch between Yes and No by pressing the Space key. As an example of safety parameter Selection of safety functions, the figure below shows the unused safety inputs in the control. Safe operation stop is not hidden. Hide safe operation stop is set to No. This means that only safety input Safe operation stop is evaluated, i.e. safety function Safe operation stop is used. Cxx.1117 Selecting safety functions Bit Meaning Value 00 Hide safe stop Yes 01 Hide safe operation stop No 02 Hide safely reduced speed 1 Yes 03 Hide safely reduced speed 2 Yes 04 Hide SOS switch Yes Fig. 9-1: Mask off the unused safety inputs in the control 3. step: Setting safety parameters in the control The data of safety parameters Cxx.101 to Cxx.116, Cxx.118 and Cxx.119 must be entered. The associated safety parameters are to be set to a value of 0 for unused safety functions.

163 IST Intelligent Safety Technology Commissioning of Intelligent Safety Technology step: Repeat steps 1 to 3 for all axes Repeat steps 1 to 3 for all the axes for which safety functions are to be used. 5. step: Load machine parameters into the control The modified set of machine parameters must be loaded into the control. 6. step: Activate the safety functions in the drive Use safety parameter P Activation of safety functions to activate the safety functions in the drive. For activation, the 1 st bit (bit 0) is set to 1. First, you must switch to Parameter-setting mode. Example: P = step: Hide unused safety inputs in the drive The safety inputs of the drive are hidden using safety parameter P Selection of safety functions. The safety inputs are displayed/hidden using a bit bar. A safety input is hidden by setting it to 1. The figure below shows an example of the unused safety inputs in the drive. Safe operation stop is not hidden. Hide safe operation stop is set to 0. This means that only safety input Safe operation stop is evaluated, i.e. safety function Safe operation stop is used. P = Hide "SOS switch" Hide "safe reduced speed 2" Hide "safe reduced speed 1" Hide "safe operation stop" Hide "safe stop" Fig. 9-2: Mask off the unused safety inputs in the drive Antrieb_SBH.FH7 8. step: Set the safety parameters in the drive The data of safety parameters P to P , P and P must be entered. The same values as in the control must be entered. The associated safety parameters are to be set to a value of 0 for unused safety functions. The safety parameters previously entered in the control are displayed in drive parameters P to P for checking. Using the parameters, the data entered in the control and in the drive can be compared. Drive parameters P to P cannot be modified.

164 9-4 Commissioning of Intelligent Safety Technology IST Intelligent Safety Technology 9. step: Note the checksum of weighting data in the drive The value of drive parameter P Checksum of weighting data, drive must be noted. To calculate the parameter, you must switch out of the Parameter-setting mode to the Operating mode. 10. step: Repeat steps 6 to 9 for all axes Repeat steps 6 to 9 for all the axes for which safety functions are to be used. 11. step: Enter the checksum of weighting data in the control The previously noted value of drive parameter P Checksum of weighting data, drive must be entered in safety parameter Cxx.120 Checksum of weighting data, drive in the axis parameter menu of the control. The entry is to be made for all the axes for which safety functions are to be used. 12. step: Load machine parameters into the control The modified set of machine parameters must be loaded into the control. 13. step: Execute forced dynamics Before forced dynamics can be executed, the safety functions must be deselected. The safety functions are deselected if the deactivation signals of the safety functions are present in both channels (signal status 1 ). 14. step: Select and adapt the safety functions Before the safety functions can be selected, forced dynamics must be successfully executed. If position limits or position switch points are used, the corresponding axes must be safely referenced beforehand. The monitoring limits and times of the safety functions must be adapted: Position limits Position switch points Position monitoring window for Safe operation stop Reference position for Safe referencing Transition time for switching safety functions Note: Each modification of a safety parameter must be made in the axis parameter menu in the control and in the drive parameter menu of the drive; the modified set of machine parameters must be loaded into the control!

165 IST Intelligent Safety Technology Commissioning of Intelligent Safety Technology step: Execute an acceptance test The individual safety functions of each axis and spindle are to be checked for correct functioning; the results must be logged. See Section 6.4, Acceptance and Logging of Safety Functions. Note: The acceptance test of the safety functions requires that drive commissioning, drive optimization and the adaptation of the safety functions be complete. 16. step: Save the machine parameters, drive parameters and the PLC user program The machine parameters, drive parameters and the PLC user program are to be saved on the hard disk or a diskette. The data sets can be used for serial commissioning. Note: Remove old or double data sets to avoid future confusion. 9.4 Serial commissioning In serial commissioning, the machine parameters and drive parameters that were saved in the first-time commissioning can be loaded. The settings of the safety functions are used in the control and in the drive. Observe the following steps during serial commissioning: 1. step: Load the machine parameters The machine parameter set saved in the first-time commissioning is to be loaded into the control. 2. step: Load the drive parameters The drive parameters saved in the first-time commissioning are to be loaded. 3. step: Load the PLC user program The PLC user program saved in the first-time commissioning is to be loaded. 4. step: Execute forced dynamics Before forced dynamics can be executed, the safety functions must be deselected. The safety functions are deselected if the deactivation signals of the safety functions are present in both channels (signal status 1 ).

166 9-6 Commissioning of Intelligent Safety Technology IST Intelligent Safety Technology 5. step: Test the safety functions by sampling Commissioning of a new machine requires that the safety functions be tested by sampling in an acceptance inspection. 9.5 Acceptance and Logging the Safety Functions Complete Acceptance Test Partial Acceptance Test After Intelligent Safety Technology has been commissioned or after safety-related parameters have been modified, the proper functioning of the safety technology must be accepted and logged in an acceptance test. Note the difference between the acceptance of all safety functions and partial acceptance. A complete acceptance test, i.e. the inspection of all used safety functions for proper functioning, is always required during a first-time commissioning of a machine with IST. A complete acceptance test of the safety functions must also be made when the control system is updated to a new firmware or software version, or if the control hardware is modified. The complete acceptance test must be logged. A partial acceptance test must be made after modifying only a few saved data of the safety-relevant parameters. Here, only those safety functions that can influence the modification are checked. The partial acceptance test must also be logged. Acceptance report Machine report / acceptance report for machine The acceptance report of a machine with Intelligent Safety Technology consists of a machine report and one or more axis reports. The machine report is used to describe the machine/system, the control software and hardware, the safety-related equipment, the axes, the data backup and the type of acceptance. The acceptance report of the machine belongs to the machine report. All safety-relevant equipment, signals, parameters, etc. are verified and documented here. Axis report / acceptance report of safety functions of the axis The axis equipment, the safety functions used and the settings of the safety parameters of the first and second channels of an axis are documented in the axis report. A separate axis report must be provided in the machine report for every axis with IST. An acceptance report of the safety function must be made for every safety function that has been implemented on an axis. The safety function used is tested in acceptance report Safety function of axis and the results are documented. Acceptance report Safety function of axis is a component of the axis report and is to be included with it. Note: A separate axis report must be provided for every axis designed with IST. Copies of the acceptance report templates are included in Section 12.3 "Acceptance Report".

167 IST Intelligent Safety Technology Commissioning of Intelligent Safety Technology 9-7 Sample Machine and Axis Report The following machine and axis report has been filled in according to the sample application from chapter 8.3 "Sample Application". System: Reference machine Serial No.: 001 Machine type: Milling/lathing machine Manufacturer: Bosch Rexroth Number of axes: 4 Number of spindles: 1 CNC control: MTC-P01.2-M1-A2-A2-A2-FW PLC control: MTS-P01.2-D2-B1-NN-NN-NN-FW CNC firmware: FWC-CPU06* V00-NN PLC firmware: FWC-PLC06* V00-NN PLC cycle time: 20 ms Description Sample system for commissioning Intelligent Safety Technology, of the safety- with open spindle protective doors in Safe stop and axes in related Safe operation stop. With operator consent, operation of the axes equipment is possible with Safely reduced speed. For the A-axis, switching of Safely reduced speed depending on the axis position. Fig. 9-3: General part of machine report

168 9-8 Commissioning of Intelligent Safety Technology IST Intelligent Safety Technology Description of axes Axis No. Axis name Axis function IST Change 1 S Main spindle drive Yes 2 X Linear axis Yes 3 Y Linear axis Yes 4 A Rotary axis Yes For each IST axis, an individual axis report must be enclosed. Fig. 9-4: Description of axes machine report Data backup Data Medium Designation Archive Date CNC parameters 3 1 / 2 " disk IST parameters Department safe DIAX04 parameters 3 1 / 2 " disk IST-DIAX Department safe PLC program 3 1 / 2 " disk IST-PLC Department safe Abb. 9-5: Machine protocol "Data backup"

169 IST Intelligent Safety Technology Commissioning of Intelligent Safety Technology 9-9 Complete acceptance rep. Serial commissioning Partial acceptance report Changes made Acceptance report completed Name: Date: Company/department: Signature: Abb. 9-6: Machine protocol "Acceptance report completed" Name: Date: For the completeness and correctness of the acceptance report: Company/department: Signature: Abb. 9-7: Machine protocol "Acceptance report confirmed" System: Reference machine Serial No.: 001 Axis No.: 1 Axis name: S Axis function: Main spindle drive Fig. 9-8: General part of axis report for S-axis

170 9-10 Commissioning of Intelligent Safety Technology IST Intelligent Safety Technology Motor type: 2AD104 Motor measurement system: DSF External measurement system: --- Transmission ratio: --- Feed constant: --- Holding brake: --- Weight compensation: --- Power supply unit: HVE2 Drive control unit: HDS02 Description of the axis equipment Firmware version DIAX: FWC-HSM1.1-SHS-03VRS-MS Firmware version ISM: FWC-ISM03*-IST-19V02-NN Firmware version APR: FWC-APR06* V00-NN Fig. 9-9: Description of the axis equipment, S-axis Overview of the safety functions implemented in this axis Safe stop Safe operation stop X Safely reduced speed Safely limited absolute position Consent key Reference cam The acceptance report must include all implemented safety functions! Fig. 9-10: Overview of safety functions axis report of the S-axis Consent safe reference

171 IST Intelligent Safety Technology Commissioning of Intelligent Safety Technology 9-11 Axis parameters for safety functions in the CNC control (channel 1) No. Description of the parameter Parameter value Unit Cxx.100 Safety function (yes/no) Yes - Cxx.101 Maximum speed 1 for safety function 0 1 rpm Cxx.102 Upper position limit 1 for the safety function 0 deg Cxx.103 Lower position limit 1 for the safety function 0 deg Cxx.104 Maximum speed 2 for safety function 0 1 rpm Cxx.105 Upper position limit 2 for the safety function 0 deg Cxx.106 Lower position limit 2 for the safety function 0 deg Cxx.107 Upper position limit for position switching point 1 0 deg Cxx.108 Lower position limit for position switching point 1 0 deg Cxx.109 Upper position limit for position switching point 2 0 deg Cxx.110 Lower position limit for position switching point 2 0 deg Cxx.111 Upper position limit for position switching point 3 0 deg Cxx.112 Lower position limit for position switching point 3 0 deg Cxx.113 Upper position limit for position switching point 4 0 deg Cxx.114 Lower position limit for position switching point 4 0 deg Cxx.115 Position monitoring window for Safe operation stop 1 deg Cxx.116 Reference position for Safe referencing 0 deg Cxx.117 Mask of the unused safety inputs 30 - Cxx.118 Time for transition of the safety functions 0 ms Cxx.119 Time interval for forced dynamics 8 h Cxx.120 Checksum of the weighting data Fig. 9-11: "Safety parameters of channel 1" axis report

172 9-12 Commissioning of Intelligent Safety Technology IST Intelligent Safety Technology Drive parameters for safety functions in digital drive (channel 2) No. Description of the parameter Parameter value Unit P Checksum via weighting data P Activation of safety functions P Maximum speed 1 for safety function 0 rpm P Upper position limit 1 for the safety function 0 Degrees P Lower position limit 1 for the safety function 0 Degrees P Maximum speed 2 for safety function 0 Degrees P Upper position limit 2 for the safety function 0 Degrees P Lower position limit 2 for the safety function 0 Degrees P Upper position limit for position switching point 1 0 Degrees P Lower position limit for position switching point 1 0 Degrees P Upper position limit for position switching point 2 0 Degrees P Lower position limit for position switching point 2 0 Degrees P Upper position limit for position switching point 3 0 Degrees P Lower position limit for position switching point 3 0 Degrees P Upper position limit for position switching point 4 0 Degrees P Lower position limit for position switching point 4 0 Degrees P Position monitoring window for Safe operation stop 1 Degrees P Reference position for Safe referencing 0 Degrees P Mask of the unused safety inputs P Time for transition of the safety functions 0 ms P Time interval for forced dynamics 8 h Fig. 9-12: "Safety parameters of channel 2" axis report Name: Date: Data checked for conformance Company/depart ment: Signature: Fig. 9-13: Data checked axis report 9.6 Commissioning of IST for Series Machines For series machine, the acceptance test need not be repeated if a complete acceptance test has been made for a machine and if the safety parameters cannot be modified (see VDE801/A1 AK4 and DKE-AK ).

173 IST Intelligent Safety Technology Subsequent System Modifications Subsequent System Modifications 10.1 Making Modifications Modifications to a system equipped with IST may be carried out only by personnel authorized by the machine manufacturer if they affect safety functions. Such modifications especially include changing the safety parameters in the control and drive and changes to the safety-relevant wiring. Changing the safety parameters of the control requires a password. Only a user with the corresponding password diskette can modify these parameters. Modifications must be made with corresponding care. The modifications must be documented and logged and must be able to be traced at any time. After the machine is commissioned with the modified data, only the modified set of parameters may be present on the hard disk. In the case of modifications to the PLC program, only the modified program may be saved on the hard disk! 10.2 Logging and Acceptance The modified safety parameters are verified using an acceptance report. The scope of this acceptance report depends on the modifications that were made to the safety parameters / hardware. After a safety parameter is modified, the safety functions that are influenced by this parameter must be verified in a partial acceptance report.

174 10-2 Subsequent System Modifications IST Intelligent Safety Technology Example Parameters Cxx.101 and P were modified for safely reduced speed 1. To verify the modification, a partial acceptance report must be made and logged for safety function safely reduced speed 1: Test of safety function safely reduced speed System: Serial No.: Axis No.: Axis name: Axis function: Running No. Function or characteristic Activate power, deactive safety function Activate safety function Start motion without consent Start motion with consent (V=0.95 * Vmax ) Motion with consent and V = 1.05 * Vmax Disconnect axis RF and activate safety function Displace axis from its position by a distance greater than parameter Move axis with active safety function and maximum axis velocity Test performed Preselect automatic and activate power Preselect Setup and activate safety function Give jog command for axis Give consent and give jog command for axis Start special NC program for acceptance inspection Disconnect power, or activate RF through the PLC user program Move axis or motor from its position Activate power, activate safety function, give consent, start NC acceptance test program Expectation Result Comment AF is indicated, no SAFAC AF is indicated SAFAC active No motion Motion is performed Switch-off, fault diagnosis Ab is indicated Switch-off, fault diagnosis Switch-off, fault diagnosis Measuring of reaction time and reaction path Measuring of reaction time and reaction path Measuring of reaction time and reaction path Fig. 10-1: Test of safety function Safely reduced speed Accordingly, only the part of the acceptance report for safely reduced speed is to be filled in.

175 IST Intelligent Safety Technology Subsequent System Modifications Procedure for Software and Firmware Updates If an IST-equipped system is supplied with a new firmware version, a complete acceptance report of the safety function must be made for the entire safety technology, with corresponding logging. For series machine, a complete acceptance report must be made for only one machine (see section 9.5 "Acceptance and Logging the Safety Functions"). It must be able to be traced which firmware and software versions are used for which serial number of the machine.

176 10-4 Subsequent System Modifications IST Intelligent Safety Technology

177 IST Intelligent Safety Technology Error Messages and Error Elimination Error Messages and Error Elimination 11.1 CNC Error Messages (Channel 1) This chapter describes the error messages that can occur when using Intelligent Safety Technology. In addition, ways of eliminating the errors are described. character is used here as a wildcard. For example, the control shows the axis designation at this location Two-way data comparison, parameter The parameters for Intelligent Safety Technology differ for the NC (axis parameters) and the drive (drive parameters). These differences are detected using two-way data comparison. Affected SERCOS Recovery: Check and correct the displayed SERCOS parameter and the associated axis parameter Two-way data comparison, actual position Two-way data comparison of Intelligent Safety Technology has detected a transfer error during the check or the actual position. The check is always carried out when the axis is at a standstill. The cyclically transferred actual position is compared with the actual position obtained using the Multiplex channel. The amount of the difference of the two positions must not be greater than the value of parameter "Position monitoring window for safe operation stop". Recovery: 1. If parameter "Position monitoring window for safe operation stop" is too low, increase the parameter value. 2. If the axes move when the safety functions are activated, stop the axes before the safety functions are activated. 3. If the IST safety functions are faulty, notify the Bosch Rexroth customer service department Two-way data comparison, inputs Two-way data comparison of Intelligent Safety Technology has detected differences in switching during the check of the IST safety input signals of the NC and the drive. The input switching of the deactivation inputs and of the Consent key input of the NC and the drive must be identical. Recovery: Check the IST safety input signals of the NC and the drive Two-way data in general Two-way data comparison of Intelligent Safety Technology has detected an internal error in the NC or the drive. Recovery: Contact the Bosch Rexroth customer service department.

178 11-2 Error Messages and Error Elimination IST Intelligent Safety Technology 0494 No safe Activation of an IST safety function with safely limited absolute position without safe reference. An IST safety function with safely limited absolute position must be activated only after safe referencing. If no safe reference has been provided at the time of activation, this error message is issued. Recovery: Execute "Safe referencing" Forced dynamics Activation of an IST safety function without successful forced dynamics. Activation of an IST safety function is possible only if forced dynamics was carried out beforehand. Forced dynamics must also be carried out after the "Time interval for forced dynamics" elapses. Recovery: Execute forced dynamics Internal safety Monitoring of Intelligent Safety Technology has detected an internal error in the NC. Recovery: Contact the Bosch Rexroth customer service department Monitor safe Activation of safety monitor safe stop. While safety function safe stop is activated, safety output signal "Activate starting lockout" is set. Then the PLC must activate the starting lockout of the drive. In addition, the NC switches off the controller enablement. This is checked by the safety monitor. Recovery: 1. If the starting lockout is not activated, check the PLC program. 2. If there is an internal error, contact the Bosch Rexroth customer service department Monitor safe operation Activation of safety monitor safe operation stop. The axis was driven or moved without RF, although safe operation stop or safely reduced speed with safely limited absolute position without activation of the Consent key has been preselected. A transition to safe operation stop also occurs after the Consent key is released after the "transition time" elapses. Recovery: 1. If safety output signal "Enable movement" is not linked to the motion hold, check the PLC program. 2. If parameter Transition time for switching safety functions is too low, increase the parameter. 3. If parameter "Position monitoring window for safe operation stop" is too low, increase the parameter value.

179 IST Intelligent Safety Technology Error Messages and Error Elimination Monitor safely reduced Activation of monitor safely reduced speed. After safely reduced speed with safely limited absolute position is activated, the value of safety parameter safely reduced speed is exceeded. Recovery: Reduce the interpolation speed of the NC when the safety function has been activated. If the error message occurs when the Consent key is released, the "Transition time for switching safety functions" is too low or safety output signal "Enable movement" is not linked to the motion hold Monitor safely limited absolute Activation of monitor safely limited absolute position. With safety function safely reduced speed with safely limited absolute position activated, the position range bounded by the two position limits "Upper position limit for safety function" and "Lower position limit for safety function" was exited. Recovery: Limit the working range of the axis to the permitted position range when the safety function is activated Consent Consent key (for Intelligent Safety Technology) faulty. The Consent key is checked when starting the SERCOS ring and during forced dynamics. The consent key must not be pressed during the check. Recovery: 1. If the Consent key is always switched on, check the Consent key and the cables. 2. If the Consent key is pressed by the machine operator during the check, press the Consent key only to move the axis Forced dynamics Error during forced dynamics execution. To execute forced dynamics, the PLC must select steps 1 to 7 (APR-AXD parameter "Select forced dynamics") for each axis in the correct sequence. In addition, it must wait for the acknowledgement (APR-AXD parameter "Acknowledgement of forced dynamics") after every step. The controller must be enabled in steps 1, 2 and 5. Recovery: 1. If the sequence of steps is not observed, check the PLC program. 2. If the PLC does not wait for the acknowledgement, check the PLC program. 3. If there is no controller enablement in steps 1, 2 or 5, check the PLC program. 4. If the shutdown circuits are not activated, check the PLC program and the cables.

180 11-4 Error Messages and Error Elimination IST Intelligent Safety Technology 0503 Cam for safe Activation of the cam monitor for safe referencing. After "safe referencing", the cam for "safe referencing" must not be pressed if the axis is not in the vicinity (linear axis: 0.1m; rotary axis: 10 ) of the "Reference position for safe referencing". If a Consent key is used in place of the cam for "safe referencing", the Consent key must be pressed by the machine operator only for safe referencing. Recovery: 1. Check whether the reference cam or the cables are faulty. 2. If the reference cam is too long, modify it. 3. If the "Consent key for safe referencing" is pressed by the machine operator, press it only for referencing Shutdown of safety Monitor of shutdown of safety functions. As soon as all the safety functions on the safety inputs of the NC are shut down, all the safety functions on the safety inputs of the drive must also be shut down within 300ms. Recovery: Check the IST safety input signals of the NC and the drive No IST IST is supported only by real digital drives with IST functions! If you have further questions, contact the Bosch Rexroth customer service department.

181 IST Intelligent Safety Technology Error Messages and Error Elimination Error Messages for Drives (Channel 2) F501 Safe stop monitor Safety function safe stop is selected and the starting lockout is not active or controller enablement is provided by the control. Cause: 1. Error in activation of the starting lockout (plug X3). 2. Control malfunction. Recovery: 1. Check the wiring of the starting lockout. 2. Consult the control manufacturer. F502 Safe operation stop monitor The monitor of safe operation stop has been activated. The monitor is active in the following cases: When a safety function is activated, the monitor of safe operation stop is active for 300 msec. Safety function safe operation stop is active. Safety function safely reduced speed 1/2 with safely limited absolute position 1/2 is selected and the Consent key is not pressed. Cause: 1. If operating mode Position control is active, the control has modified the setpoint position. 2. If operating mode Speed control is active, the control has preset a setpoint speed value not equal to After the monitor of safe operation stop has been switched on, the axis has moved further than the position monitoring window for safe operation stop (P ). Recovery: Regarding 1: Consult the control manufacturer. Regarding 2: Consult the control manufacturer. Regarding 3: Prevent the axis from moving or increase parameter "Position monitoring window for safe operation stop" (P ).

182 11-6 Error Messages and Error Elimination IST Intelligent Safety Technology F503 Monitor of safely reduced speed 1 and absolute position 1 The monitor of safety function safely reduced speed 1 and absolute position 1 has been activated. Either maximum speed 1 (P ) has been exceeded or the position range specified by parameters Upper position limit 1 for safety function (P ) and Lower position limit 1 for safety function (P ) has been exited. If parameters P and P are not zero, the absence of safe reference also leads to this error. Cause: 1. The amount of the actual speed value has become greater than maximum speed If operating mode Position control is active, the amount of the setpoint position difference has become greater than maximum speed If operating mode Speed control is active, the amount of the setpoint speed value has become greater than maximum speed The command for checking the reference (P ) was not executed successfully. 5. The actual position value has exited absolute range If operating mode Position control is active, the setpoint position value has exited absolute range 1. Recovery: Regarding 1., 2., 3.: Reduce the jogging speed or increase maximum speed 1. Regarding 4.: Reference the axis and then issue command "Check reference". Regarding 5., 6.:Move the axis in the permitted range. Check the position limits (P and P ).

183 IST Intelligent Safety Technology Error Messages and Error Elimination 11-7 F504 Monitor of safely reduced speed 2 and absolute position 2 The monitor of safety function safely reduced speed 2 and absolute position 2 has been activated. Either maximum speed 2 (P ) has been exceeded or the position range specified by parameters Upper position limit 2 for safety function (P ) and Lower position limit 2 for safety function (P ) has been exited. If parameters P and P are not zero, the absence of safe reference also leads to this error. Cause: 1. The amount of the actual speed value has become greater than maximum speed If operating mode Position control is active, the amount of the setpoint position difference has become greater than maximum speed If operating mode Speed control is active, the amount of the setpoint speed value has become greater than maximum speed The command for checking the reference (P ) was not executed successfully. 5. The actual position value has exited absolute range If operating mode Position control is active, the setpoint position value has exited absolute range 2. Recovery: Regarding 1., 2., 3.: Reduce the jogging speed or increase maximum speed 2. Regarding 4.: Reference the axis and then issue command "Check reference". Regarding 5., 6.:Move the axis in the permitted range. Check the position limits (P and P ). F505 Incorrect activation of a safety function 300 msec after a safety function is activated, a check is made whether the acknowledgement bits for the input signals in the status words of the drive and the control (parameters P and P ) are identical. In addition, the difference of the monitored actual position values (parameter P and P ) must be lower than the position monitoring window for safe operation stop (parameter P ). Cause: 1. The safety function was activated in only one channel (drive). 2. The monitored actual position value of the control is incorrect. Recovery: Regarding 2.: Check the cabling of the safety I/O module. Regarding 2.: Consult the control manufacturer.

184 11-8 Error Messages and Error Elimination IST Intelligent Safety Technology F506 Forced dynamics required The time interval since the last time that forced dynamics was carried out is greater than that specified in parameter Time interval for forced dynamics (P ). After the system is switched on, forced dynamics must always be carried out before activating a safety function. The error is set only when the power is switched on. Cause: 1. A safety function was activated without carrying out forced dynamics. 2. The time interval for forced dynamics elapsed while the safety function is active. Recovery: Regarding 1.: Execute forced dynamics. Regarding 2.: Execute forced dynamics. Increase parameter Time interval for forced dynamics (P ). F507 Incorrect safety input signals, checksum The 8-bit CRC checksum that was transferred to the drive with the safety input signals (P ) is incorrect. Cause: 1. Incorrect assignment of I/O module and drive. 2. Error in safety I/O module Recovery: Regarding 1.: Check the address settings. Regarding 2.: Replace the safety I/O module. F508 Incorrect safety input signals, counter The 8-bit counters that are incremented every 100 msec in the drive and in the safety I/O module differ by more than 3 increments. Cause: Error in safety I/O module Recovery: Replace the safety I/O module.

185 IST Intelligent Safety Technology Error Messages and Error Elimination 11-9 F509 Incorrect two-way data comparison A lack of agreement has been detected during the comparison of drive parameters with those of the control. The error is set only when the power is switched on. Cause: 1. Static safety parameters are different. 2. The acknowledgement bits for the input signals in the status words of the drive (P ) and the control (P ) differ by more than 300 msec msec after the standstill was detected, the difference of the monitored actual position values of the drive and the control (parameters P and P ) are greater than the position monitoring window for safe operation stop (parameter P ). Recovery: Regarding 1.: The values of parameters P , P to P of the drive must correspond to those of the control (P , P to P ). Regarding 2.: Check the cabling of the safety I/O module. Regarding 3.: Check the standstill detector. A standstill is specified when the actual speed is lower than the value in parameter Standstill window (S ). Increase the position monitoring window for safe operation stop (P ). F510 Safe reference lost The signal for the safe reference cam is set in the input signals of the drive (bit 21, P ) although the actual position value of the axis is removed by more than 10 or 0.1 m from the reference position for safe referencing (P ). Requirements for the position comparison is that safe reference exists and that the axis is at a standstill ( actual speed < standstill window (S )). Cause: Incorrect activation of the input signal for the safe reference cam. Recovery: Check the input signal. If necessary, shorten the cam.

186 11-10 Error Messages and Error Elimination IST Intelligent Safety Technology F511 Monitor safely reduced speed while switching When a safety function is activated while another is already active, it may happen that a lower speed is permitted by the new safety function than by the old one. In this case, the active speed limit value is reduced over a ramp during the set transition time for the switch (P ). The error is set when the active speed limit value is exceeded. Cause: 1. The amount of the actual speed value has become greater than the active speed limit value. 2. If operating mode Position control is active, the amount of the setpoint position difference has become greater than the active speed limit value. 3. If operating mode Speed control is active, the amount of the setpoint speed value has become greater than the active speed limit value. Recovery: Regarding 1., 2., 3.: Increase parameter Transition time for switching safety functions (P0-0270).

187 IST Intelligent Safety Technology Error Messages and Error Elimination FB DYNAM Forced Dynamics Error Messages The following table describes the error message numbers that are issued by function module DYNAM. The error messages are not automatically displayed in the control. In the PLC user program, the error messages can be output using the user message or the ProVi messages. ERR_NR Description Error location 0 No error has been detected. 1 Process power or controller enablement absent (timeout message) Before forced dynamics can be started, the power must be switched on and the axis must report controller enablement 2 Drive or APR reports an error Step 0 of forced dynamics was cancelled 3 The preset for forced dynamics could not be written (timeout message) 4 Feedback of forced dynamics absent (timeout message) Step 0 of forced dynamics was cancelled Step 0 of forced dynamics was cancelled 5 Power has been switched off Input signal PXXSPOWER has dropped off in step 0 6 Drive or APR reports an error (Consent key is activated or power is not switched on) 7 The preset for forced dynamics could not be written (timeout message) 8 Feedback of forced dynamics absent (timeout message) Step 1 of forced dynamics was cancelled Step 1 of forced dynamics was cancelled Step 1 of forced dynamics was cancelled 9 Power has been switched off Input signal PXXSPOWER has dropped off in step 1 10 Drive or APR reports an error Step 2 of forced dynamics was cancelled 11 The preset for forced dynamics could not be written (timeout message) 12 Feedback of forced dynamics absent (timeout message) Step 2 of forced dynamics was cancelled Step 2 of forced dynamics was cancelled 13 Power has been switched off Input signal PXXSPOWER has dropped off in step 2 14 Drive or APR reports an error (shutdown circuits have not been triggered) 15 The preset for forced dynamics could not be written (timeout message) 16 Feedback of forced dynamics absent (timeout message) Step 3 of forced dynamics was cancelled Step 3 of forced dynamics was cancelled Step 3 of forced dynamics was cancelled 17 Power has been switched off Input signal PXXSPOWER has dropped off in step 3 18 Drive or APR reports an error Step 4 of forced dynamics was cancelled 19 The preset for forced dynamics could not be written (timeout message) 20 Feedback of forced dynamics absent (timeout message) Step 4 of forced dynamics was cancelled Step 4 of forced dynamics was cancelled

188 11-12 Error Messages and Error Elimination IST Intelligent Safety Technology 21 Power has been switched off Input signal PXXSPOWER has dropped off in step 4 22 Drive or APR reports an error (power not switched on) 23 The preset for forced dynamics could not be written (timeout message) 24 Feedback of forced dynamics absent (timeout message) Step 5 of forced dynamics was cancelled Step 5 of forced dynamics was cancelled Step 5 of forced dynamics was cancelled 25 Power has been switched off Input signal PXXSPOWER has dropped off in step 5 26 Drive or APR reports an error (shutdown circuits have not been triggered) 27 The preset for forced dynamics could not be written (timeout message) 28 Feedback of forced dynamics absent (timeout message) Step 6 of forced dynamics was cancelled Step 6 of forced dynamics was cancelled Step 6 of forced dynamics was cancelled 29 Power has been switched off Input signal PXXSPOWER has dropped off in step 6 30 Drive or APR reports an error Step 7 of forced dynamics was cancelled 31 The preset for forced dynamics could not be written (timeout message) 32 Feedback of forced dynamics absent (timeout message) Step 7 of forced dynamics was cancelled Step 7 of forced dynamics was cancelled 33 Power has been switched off Input signal PXXSPOWER has dropped off in step 7 34 Drive or APR reports an error Step 00 of forced dynamics was cancelled 35 The preset for forced dynamics could not be written (timeout message) 36 Feedback of forced dynamics absent (timeout message) Step 00 of forced dynamics was cancelled Step 00 of forced dynamics was cancelled 37 Power has been switched off Input signal PXXSPOWER has dropped off in step 00 Fig. 11-1: Description of function module DYNAM errors

189 IST Intelligent Safety Technology Appendix Appendix 12.1 Selection Lists for IST Components The selection lists provide an overview of certified IST components. Control Modules in PC Format (MTC200-P) CNC module MTC-P The MTC-P01.2 is a powerful CNC controller in an ISA bus plug-in card format for installation in an industrial PC. It belongs to the MTC200 product family. The MTC-P01.2 consists of a basic unit with the CNC processor system and an integrated axis processor. A maximum of 8 drives can be connected using the SERCOS fiber optics interface. By attaching additional (max. 3) axis processor modules, 32 drives that can be distributed over 7 processes can be controlled in the largest expansion level. In this case also, the drives communicate using the SERCOS fiber optics interface, so that a total of 4 fiber optics rings are used. Together with the MTS-P PLC control unit, this unit forms a compact and flexible solution for a classic tool machine control. A maximum of 3 CNC controller systems (with 8 axes each) can be integrated into operating and visualization terminal BTV20 or BTV30, which is provided for the MTC200 controller system. The MTC-P01.2 is available in two models: as MTC-P01.2-M, with an export limitation, for connecting 8 to 32 drives or as MTC-P01.2-E, without an export limitation, for connecting 8 to 32 drives; however, only 4 axes can be interpolated with each other. Fig. 12-1: CNC module MTC-P MTC-P.bmp

190 12-2 Appendix IST Intelligent Safety Technology Models: Type designation Export limitation RAM memory Max. number of axes MTC-P01.2-E1-NN-NN-NN-FW No 1 MB 8 MTC-P01.2-E1-A2-NN-NN-FW No 1 MB 16 MTC-P01.2-E1-A2-A2-NN-FW No 1 MB 24 MTC-P01.2-E1-A2-A2-A2-FW No 1 MB 32 MTC-P01.2-E2-NN-NN-NN-FW No 2 MB 8 MTC-P01.2-E2-A2-NN-NN-FW No 2 MB 16 MTC-P01.2-E2-A2-A2-NN-FW No 2 MB 24 MTC-P01.2-E2-A2-A2-A2-FW No 2 MB 32 MTC-P01.2-M1-NN-NN-NN-FW Yes 1 MB 8 MTC-P01.2-M1-A2-NN-NN-FW Yes 1 MB 16 MTC-P01.2-M1-A2-A2-NN-FW Yes 1 MB 24 MTC-P01.2-M1-A2-A2-A2-FW Yes 1 MB 32 MTC-P01.2-M2-NN-NN-NN-FW Yes 2 MB 8 MTC-P01.2-M2-A2-NN-NN-FW Yes 2 MB 16 MTC-P01.2-M2-A2-A2-NN-FW Yes 2 MB 24 MTC-P01.2-M2-A2-A2-A2-FW Yes 2 MB 32 Fig. 12-2: CNC modules in ISA bus format Note: CNC module PPC-P can not be used with Intelligent Safety Technology!

191 IST Intelligent Safety Technology Appendix 12-3 PLC modules MTS-P The MTS-P01.2 and MTS-P02.2 PLC modules are efficient PLC controls in ISA-bus plug-in card format, intended for being fitted in a BTV20730 or in a commercially available industrial PC. MTS-P02.2 is equipped with powerful hardware which, contrary to the MTS-P01.2, shows a performance increase by a factor of 2 to 2.5 (depending on the program structure). MTS-P consists of a basic unit, the PLC itself, and various PC104 plug-in modules. These plug-in modules are, for example, field bus connections, serial interfaces and I/O modules. Communication with decentralized I/O units or operating units is established by means of field-bus connections (which can be plugged on as an option) and/or serial interfaces. These optional connections and interfaces are designed as PC104 modules. The following are currently available: INTERBUS-master connection Serial interfaces (2x RS232 and 2x RS422) Profibus-master connectionup to 4 PC104 modules can be operated on an MTS-P. Fig. 12-3: PLC modules MTS-P MTS-P.bmp Models: Type designation With Interbus connection With 4 serial interfaces With Profibus connection MTS-P01.2-D2-B1-NN-NN-NN-FW Yes No No MTS-P01.2-D2-B1-S4-NN-NN-FW Yes Yes No MTS-P01.2-D2-B1-P1-NN-NN-FW Yes No Yes MTS-P01.2-D2-B1-P1-S4-NN-FW Yes Yes Yes MTS-P02.2-D2-B1-NN-NN-NN-FW Yes No No MTS-P02.2-D2-B1-S4-NN-NN-FW Yes Yes No MTS-P02.2-D2-B1-P1-NN-NN-FW Yes No Yes MTS-P02.2-D2-B1-P1-S4-NN-FW Yes Yes Yes Fig. 12-4: PLC modules in ISA bus format