Application of CIP Safety for functional safety inmotion applications - analysis of CIP Safety
motion application use case scenarios
Ludwig Leurs
Bosch Rexroth AGBob Hirschinger
Rockwell Automation

Technical Trackwww.odva.org

AgendaSafety Architecture and Standards Review

Drive Safety System Architecture Option Review
Safety Controller Activated Drive Safety
Function Overview and Application Use Cases
Safety Controller Executed Drive Safety
Function Overview and Application Use Cases

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 2www.odva.org

Safety Controller Architecture

Networked Safety
Based on EtherNet/IP
Safety Controller/PLC• Safety Task



Safety I/O Devices• Emergency Stop
• Safety Relays• Light Curtains• Safety Mats
• Door Lock Control

New Safety Device  CIP Safety Drives

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 3www.odva.org

Safety Standards
 There are many safety standards that provide guidelines for safetysystems.
 CIP Safety Drive Profile design focuses on EN61800-5-2, which defines
Safety Function requirements for adjustable speed drive systems.

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 4www.odva.org

EN61800-5-2 Drive Safety Functions
 EN61800-5-2 provides high level
functional description of drive safetyfunctions
 These are the safety functions that are
targeted for CIP Safety Drive Profile
supportFunctionality Grouping Disconnect Torque generating power tothe motor (STO) Safe stop (i.e. SS1, SS2)
 Safe speed monitoring (i.e. SSM)
 Safe acceleration monitoring (i.e. SLA) Safe torque monitoring (i.e. SLT) Safe position monitoring (i.e. SLP) Safe brake control (i.e. SBC)

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 5www.odva.org

Drive Safety Function Examples
STO (Safe Torque Off)
 Stop Request
 Wait Stop Delay Disable Motor Power
SS1 (Safe Stop 1)
 Stop Request
 Wait Stop Monitoring Delay Monitor Decel Until Standstill Disable Motor PowerSLS (Safe Limited Speed) Safe Limited Speed Request
 Wait Stop Monitoring Delay Monitor Speed < Safe Speed Limit

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 6www.odva.org

Drive Safety System Architecture Options
OPTION 1
Drive safety I/O activated drive safety functions

OPTION 2  Detail & application use case examples focus
Safety controller activated drive safety functions

OPTION 3
Safety controller configured & activated drive safety functions

OPTION 4  Detail & application use case examples focus
Safety controller executed drive safety functions

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 7www.odva.org

Safety Controller Activated Drive
Safety Functions (Option 2 Architecture) Drive safety configuration is storedin the drive•

Use case: preconfigured safety functions

 Safety function (SF) activation is
performed in the safety controller••

Safety IO owned by Safety Controller
SF activation transmitted via network

Technical Track© 2014 ODVA, Inc.

 SF execution is performed in thedrive• Safety functions are controlled locally Safety Controller safety input andsafety output network connection
to the drive(s)2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 8www.odva.org

Safety modes for Drive operation
Normaloperation

Safe stop 1(Emergency stop)Special mode
„safe motion(1-n)“Special mode
„safe standstill“Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 9www.odva.org

Safety modes and functions
Operating state

Safety Functions

Mode Selector

Normal mode

Safe direction
Safe maximum speed
Safely-limited position

Normal mode selectSafe standstill

Safe stop 1
Safe stop 2
Safe brake control

Special mode selectEmergency stop

Safe stop 1

Emergency stop buttonSafe motion

Safely-limited speed
Safe direction
Safely-limited increment
Safely-monitored position
Safe maximum speed
Safely-limited position

Special mode select +enabling control button

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 10www.odva.org

Benefits - Safety Controller Activated Drive
Safety Functions (Option 2 Architecture)

Safety functions pre-configured and pre-tested
without a safety controller
Easy migration path between option 1 (safety I/O
hardwired to the drive) and option 2Less CPU power needed in the safety controller.
Valuable in machines using a large number of safedrives
Less data used for safety communication.
Less load on the communication interface
 Less bandwidth on network used Relevant in applications using a large number of safe drivesShortest possible reaction time to events exceeding
limits. Especially for hydraulic applications this is inmany cases the only possible solution

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 11www.odva.org

Use Case - Single Axis Press-fit
ModuleLocal safety signals(option 1)

CIP Safety(option 2)Independent axis configuration
Flexible system integration

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 12www.odva.org

Use Case - Woodworking
Machinery
Zone mat

CIP Safety(option 2)

 Speed limit monitored in drive  fast reaction time Example shows separate safety controller

Easily implemented using CIP Safety

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 13www.odva.org

Use Case - Printing MachineLock…

 Speed limit monitored in drive  fast reaction time
 Group select enables flexible safety solution for a limited
number of monitoring combinations
 E.g. Changing print plates, speed limit depends on
direction of motion
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 14www.odva.org

Safety Controller Executed Drive Safety
Functions (Option 4 Architecture) Drive safety configuration isstored in the safety controller
Minimal safety configuration required Safety function activation is
performed in the safety task
User safety task application programwith embedded safety instructions
 Library of drive safety instructions
for a range of safety functions
 Safety function execution isperformed in the safetycontroller – Except STO
 Runtime execution of the safetyfunctions is managed in the safetycontroller
 Drive safety status data is used inthe instruction runtime

 Safety Controller safety input
and safety output network
connection to the drive(s)Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 15www.odva.org

Drive Safety Instructions Safe Torque Off Safe Brake Control
 Safe stop
i.e. SS1

 Safe speed
monitoring

i.e. SSM

 Safe acceleration
monitoring

i.e. SLA Safe torquemonitoring

i.e. SLT Safe position
monitoring

i.e. SLPTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 16www.odva.org

Safe Limited Speed Example
 SLS instruction is executed in
the safety task
Safety task logic enables SLSinstruction

 SLS request handshakereceived by the standard task

Request to command drive to SLS
setpoint.

 Safety task executes SLS
monitoring function


As defined by SLS instruction input
parameters -> Monitoring delay, safe
speed limit, speed tolerance,
discrepancy time
Safety feedback data from the drive(single or dual channel position,speed, acceleration)

 If a SLS fault occurs a STO
activation request is sent to thedrive
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 17www.odva.org

Benefits - Safety Controller Executed Drive
Safety Functions (Option 4 Architecture)Single software package for managing safety configuration, programming, commissioning, diagnostics, maintenance safety configuration is unified in the safety controller for all drivesFlexible, centralized safety function execution
supports complex safety logic
Coordinated safety function execution for an
unlimited number of drives
Runtime calculated or operator entered safetyfunction parameters
 i.e. speed, acceleration, torque, position limit setpoints

Support for safe stopping and safe limiting functions
on drives that only support STO“Path” based safe functions
 i.e. robot TCP safety monitoring which require multi-axis kinematicfunctionsTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 18
www.odva.org

Use Case– SLS Wind/Unwind Roll
 SLS monitoring of the surface speed on a Wind/Unwind rollTechnical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 19
www.odva.org

Solution
1. Open guard door input detected (safety task)
2. SLS setpoint is calculated using the analog inputs for roll diameter calculation– one time event or continuous (safety task)
3. SLS request with calculated setpoint handshake (safety task/standard task)
4. Drive ramped to speed < SLS setpoint (standard task)
SLS instruction is executed (safety task)
5. > monitoring delay time out & speed exceeds the SLS setpoint = fault present
output is set & STO activation request (Safety Task)

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 20www.odva.org

Use Case– Coordinated Web SS1 Coordinated safe line stop (SS1)

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 21www.odva.org

Solution
1. Line stop safety switch input detected (safety task)
2. SS1 request handshake (safety task/standard task)
3. Line master axis ramped stop is initiated – drives 1-4 follow (standard task)

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 22www.odva.org

Solution
4. SS1 monitoring instruction is executed for each drive (safety task)

5. STO activation request @ Standstill speed for each drive (safety task)
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 23www.odva.org

Conclusion

Drives with network safety connection support are a key component inemerging safety controller based safety architectures.
Recently published Safety Motion Device Profile addresses critical need fora networked “Safety Drive” CIP Safety standards
Reviewed Option 2 (Drive based) and Option 4 (Safety controller based)architectures and use case examples
Criteria

Option 2Option 4Configuration /Parameterization

Controller and each device
separately

Controller only

Multi-axis kinematics (TCP)

Not possible

Possible

Safety limit setpoints

15

Unlimited

Dynamic safety limit
calculation

Not possible

Possible

Drive functionality

STO, safe stop, safe limiting
functions

STO

Safety feedback

drive primary and auxiliary
port connected safety feedback
devices

Drive primary and auxiliary port
safety feedback devices and/or
local or network connected safety
feedback

Safety PLC CPU power

Low

Medium to high - increases withnumber of axes

<1ms>10msSafety response time
Technical TrackNetworkbandwidth© 2014 ODVA,Inc.

2014 Industry Conference & 16th Annual Meeting
Low reserved.
Medium to HighAll rights

page 24www.odva.org