Review of the CIP Safety
SafeMotion Profile Functionality
John Deinlein
Rockwell Automation

Mark Chaffee
Rockwell Automation

Technical Trackwww.odva.org

Safety Controller Architecture

Networked Safety
Based on EtherNet/IP
Safety Controller/PLC• Safety Task



Safety I/O Devices• Emergency Stop
• Safety Relays• Light Curtains• Safety Mats
• Door Lock Control



New Safety Device  CIP Safety Drives

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 2www.odva.org

Safety Standards••There are many safety standards that provide guidelines for safetysystems.
CIP Safety Drive Profile design focuses on EN61800-5-2, which defines
Safety Function requirements for adjustable speed drive systems.

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 3www.odva.org

EN61800-5-2 Drive Safety Functions••

EN61800-5-2 provides high level
functional description of drive safetyfunctions
These are the safety functions that are
targeted for CIP Safety Drive Profile
supportFunctionality Grouping• Disconnect Torque generating power tothe motor (STO)• Safe stop (i.e. SS1, SS2)
• Safe speed monitoring (i.e. SSM)
• Safe acceleration monitoring (i.e. SLA)
• Safe torque monitoring (i.e. SLT)• Safe position monitoring (i.e. SLP)
• Safe brake control (i.e. SBC)

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 4www.odva.org

Drive Safety Function Examples
STO (Safe Torque Off)• Stop Request• Wait Stop Delay• Disable Motor Power
SS1 (Safe Stop 1)• Stop Request• Wait Stop Monitoring Delay• Monitor Decel Until Standstill• Disable Motor PowerSLS (Safe Limited Speed)• Safe Limited Speed Request• Wait Stop Monitoring Delay• Monitor Speed < Safe Speed Limit

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 5www.odva.org

Typical Drive Safety CoreFeedback
Connector

Midrange Drive Enclosure

Control Board.

KMCLFPGAENETPort 1Connector

PHY#1

ENET
Port 2Connector

PHY#2

MII
Three
Port
SwitchEncoderInterface

Comms
Core
Local Display
Interface

EMIF_A

SharedRAMControl
Core

Drive Core (Host)

NAND
FlashVoltage
Regulators

SUP

Power – Control InterfacePower Board
Power Board Interface
Connector

DDR2
MemoryRMIIMIIPWMSPowerProcessor

ANALOG
CURRENT/VOLTAGE

Safety Core
MicroController
CH0MicroController
CH1
Safety Disable

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 6www.odva.org

Drive Safety System Architecture Options
OPTION 1
Drive safety I/O activated drive safety functions

OPTION 2  Safe Motion Subcommittee Target
Safety controller activated drive safety functions

OPTION 3
Safety controller configured & activated drive safety functions

OPTION 4  Safe Motion Subcommittee Target
Safety controller executed drive safety functions

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 7www.odva.org

Safety Controller Activated Safety Functions(Option 2)•••

CIP Safety network connection required.
Safety Functions are executed in theDrive.
Safety Function configuration data isstored in the Drive.
••

Safety Controller••••

Manages all safety I/O – local and distributed
Activates drive safety functions in drive & monitors
drive safety status
User programmable safety logic with access to broadrange of safety instructions and safety devices

Benefits••••

Local configuration tool with signature management.

Simple pre-defined Safety Functions in drive
Relatively Fast Safety Reaction Time.
Light impact on Safety Controller loading.

Deficiencies••

Drive safety function configuration is locked in drive,
so limited drive setpoint control.
No Support for Multi-axis Coordination.
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 8www.odva.org

Safety Controller Executed Drive SafetyFunctions (Option 4)•••

CIP Safety network connection required.
Safety functions are executed in thesafety controller (Except STO)
Safety function configuration is stored in
the Safety Controller.
••Safety Controller
•
•
•

•

Manages all safety I/O – local and distributed
Executes drive safety functions in Safety Task using
drive safety status data
User programmable safety logic with access to broad
range of safety instructions and safety devices

Benefits••••

Can be changed dynamically within Safety Program.

Support for Multi-axis Coordination.
Programmable drive safety function set-point control.
Flexible implementation of drive safety functions viasafety program.

Deficiencies•••

Relatively Slow Safety Reaction Time.
Heavier impact on Safety Controller loading.
Additional Safety Function programming required.
Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 9www.odva.org

Safety Motion Device Profile

New Profile Targets 2 Distinct Drive Types• CIP Motion Drives• Non-CIP Drives (SERCOS III)

Profile Adds 2 New Safety Drive Device Types• CIP Motion Safety Drive Device Type: 2Dhex• Safety Drive Device Type: 2EhexBoth Drive Device Types…
• Support CIP Safety Connections to Safety Controller.
• Share Common Safe Motion Objects.
• Share Common Safety I/O Assembly Definitions.
• Share Common Safety Supervisor State Model

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 10www.odva.org

Object Model for CIP Motion
Safety Drive Device


New Safe Motion Objects:
1.
2.
3.
4.



1.
2.
3.



Safety Validator Object
Safety I/O Assembly Object
Safety Supervisor Object

Identity
ObjectSafetySafetyDual
SafetyChannelIOIOFeedbackSafety
MotionSafety
DeviceIOIO
Axis Object*

Safety Output
Assembly

Time Sync
Object*Message
RouterMotion Device Axis Object
Time Sync Object
QoS Object
Identity Object
Message Router

SafetySafetySafetyIOIOFeedback

Safety Input
Assembly

SafetySupervisor

Link SpecificObjectSafetySafetySafetyIOIO
Validators
QoS
Object*SafetySafetyMotionIO
I/OIO

Basic CIP Objects:
1.
2.

SafetySafetySafety
Limit+IOIO
Functions

SafetySafetySafety
Stop+
IOIO
Functions

CIP Motion Objects:
1.
2.
3.

Safety Stop Functions Object
Safety Limit Functions Object
Safety Feedback Object
Safety Dual Channel Feedback Object

Basic CIP Safety Objects:

Same Message Router asshown below

Message
RouterSafetySafetyExplicit
IOIO
Message

SafetySafetySafetyIO
I/OIO
Connection Manager orConnection Object

optional* Applicable to CIP Motion
Safety Devices

required

CIP Network

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 11www.odva.org

Motion Device Axis Object StateModel

CIP Motion Drive
behavior is governedby the Motion Device
Axis Object StateModel.
Axis Object states are
mapped to Identity
Object states.
Identity Object states
govern Module Status
LED Behavior.

Enabled Operation
Transient StateTesting
Terminal State

Shutdown

Drive Enable
or TestDrive Disable

Major Fault

Disabled Operation

StandbyFaultedFault Reset

Aborting

Stopping
Major Fault

Inhibits Present

Fault Reset

Start
Inhibited

StoppedShutdown

Standby

Pre-Charge

Off2014 Industry Conference & 16th Annual Meeting
All rights reserved.

StandbyMajor Fault

Initialization
Fault

Bus Up!Bus Up
Shutdown
Reset

Fault Reset

Major
FaultedMajor Fault

Inhibits Cleared

Shutdown

Technical Track© 2014 ODVA, Inc.

RunningStartingInitialization
Complete

Initializing

Self Test

page 12www.odva.org

Safety Supervisor State Model

CIP Safety Device
behavior is governed by
the Safety Supervisor
State Model.
Safety Supervisor states
are mapped to Identity
Object states.
Safety Supervisor states
govern Module Status
LED Behavior.
Problem: A CIP Motion
Safety Drive has only 1
Identity Object and 1
Module Status LED. How
do we reconcile behavior?

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 13www.odva.org

Safety Drive State Precedence Identity state and Module Status LED behavior

can be reconciled by applying state precedence
rules to determine the drive’s Governing State:
1.
2.
3.
4.
5.
6.
7.
8.
9.

Self-Test
Unrecoverable Fault
Recoverable Fault
Safety Configuring
Safety Idle
Axis Standby
Axis Operational
Safety Executing
Safety Waiting for TUNID (Out of Box)

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 14www.odva.org

Safety Drive State Mapping
Safety StateAxis StateGoverning State

Identity State

Module Status LED

Self-Testing

Any State

Safety Supervisor

Device Self-TestingFlashing Red/GreenAny State*

Self-Test

Motion Axis

Device Self-TestingFlashing Red/Green

Self-Test Exception

Any State*

Safety Supervisor

Major Unrecoverable

Solid Red

Waiting for TUNID

Any State*

Safety Supervisor

StandbyFlashing Red/Green

Configuring

Any State*

Safety Supervisor

StandbyFlashing Red/GreenIdle

Any State*

Motion Axis

StandbyFlashing Green

Motion Axis

StandbyFlashing Green

Waiting for TUNID with
Torque Permitted,

Initializing
Pre-Charge
Shutdown
Start Inhibit
StoppedStopping
Starting
Running
Testing

Motion Axis

Operational

Solid GreenAny State*

Aborting

Motion Axis

Major Recoverable or
Major Unrecoverable

Flashing Red or
Solid RedAny State*

Major Faulted

Motion Axis

Major Recoverable or
Major Unrecoverable

Flashing Red or
Solid Red

Abort

Any State*

Safety Supervisor

Major Recoverable

Flashing Red

Critical Fault

Any State*

Safety Supervisor

Major Unrecoverable

Solid Red

Executing,Executing with TorquePermitted

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 15www.odva.org

New Safety Supervisor States forCommissioning & MaintenanceUnlike Safety I/O devices,
Safety Drives are
sophisticated devices that
require commissioning andmaintenance.
Commissioning requires thesafety drive be operational“Out of the Box” when there
is no Safety Configuration.
• Add “Waiting for TUNID withTorque Permitted state”.

Maintenance requires thesafety drive be permitted tooperate when the Safety
Output Connection is Idle.
• Add “Executing with TorquePermitted state”.

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 16www.odva.org

Safety Output Assemblies

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 17www.odva.org

Safety Input Assemblies

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 18
www.odva.org

Safety Input Assembly withFeedback Data

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 19
www.odva.org

Safety Input Assemblies with 2
Axis Instances

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 20www.odva.org

Safety Function Object
Interaction
Safety Limit Functions

Safety Stop Functions
Safety Limit Active

Safely-Limited SpeedSafe Stop 1

SS1 Complete

Output Assembly
Reset RequestSLS Request
SS1 Request
STO Output
SBC Output
Enc.
Enc.

Technical Track© 2014 ODVA, Inc.

SafetyFeedback
SafetyFeedback

Feedback Velocity

STO

Safe Torque Off

STO Status

Safe Brake Control

Safety Dual
ChannelFeedback

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

Brake

Input Assembly
SLS Active
SS1 Active
Torque Disabled
Brake Engaged
Safety Fault

page 21www.odva.org

Drive
StopDrive
EnableSafe Limited Speed Timing
Diagram
Monitor Speed
SLS Request

RequestSLS Active

ActiveMonitor Stop

Engage Brake & Disable Torque

ResartSLS Limit Active
SS1 Activation
SS1 Active0x00

0x010x00

ActiveSS1 Complete
STO Activation
STO Status
Torque Disabled
SBC Activation

0x00

0x020x00

Permit Torque Disable Torque
Torque Permitted Torque Disabled
0x00

0x02

SBC Status

Release Brake Engage Brake

Brake Engaged

Brake Released Brake Engaged

0x00

Function Reset

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 22www.odva.org

Group Safety Limit Function
Selection
Instance

Byte

Bit7

Bit6

Bit5

Bit4

184hex

0ResetRequestReservedReserved

SMTRequestReservedSOS
SS2
SS1Request Request
RequestReserved Group Select1Reserved

Bit3

Bit2

Bit1

Bit0

SBC
Output

STOOutput

Group Active
Group Select014 to 16
Decoder2-15

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

Function Select(22)

Instance 1

Select SLA
Select SLS
Select SDI Pos
Select SDI Neg
Select SSM

SLA RequestSLS Request
SDI Positive Request
SDI Negitive Request
SSM Request

Instances 2-15

page 23www.odva.org

Accessing Safety Status Data

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual MeetingAll rights reserved.

page 24www.odva.org

Conclusion

Drives with network safety connection support are a key
component in emerging safety controller based safetyarchitectures.
Recently published Safety Motion Device Profile addresses criticalneed for a networked “Safety Drive”.
Two new safety drive device types were defined, one serving CIP
Motion drives and one for non-CIP (SERCOS III) drives.
Merging existing CIP Motion behavior with CIP Safety behavior
created design challenges with respect to state behavior,commissioning, and maintenance.
Safety Motion Device I/O assemblies and new Safety Motion
Objects were the reviewed.
Finally, mechanisms to coordinate motion control functions withdrive safety functions were discussed, introducing the concept ofSafety Status Pass Thru.

Technical Track© 2014 ODVA, Inc.

2014 Industry Conference & 16th Annual Meeting
All rights reserved.

page 25www.odva.org