Application of CIP Safety for functional safety in motion
applications - analysis of CIP Safety motion application use
case scenarios
Ludwig Leurs
Project Director Ethernet Convergence
Bosch Rexroth AG
Bob Hirschinger
Principal Engineer
Rockwell Automation
Presented at the ODVA2014 ODVA Industry Conference & 16th Annual Meeting
March 11-13, 2014
Phoenix, Arizona, USA

Abstract
First released in 2003 to solve functional safety applications, CIP Safety has established itself as a key network
technology in achieving sustainability objectives of industry and is available for products implementing
DeviceNet™, EtherNet/IP™, and SERCOS III. The recently published (November 2013) CIP Safety™ SafeMotion
profile provides for inclusion of networked safe motion functionality in a broad range of functional safety
applications, unique in covering this application space. This paper presents a range of CIP Safety Safe Motion
application use case scenarios for both centralized and decentralized safety solutions. A detailed analysis of thesafety architecture, functionality, programming, and commissioning is provided for each use case.

Keywords
Safety Motion Profile, Safety Motion Objects
Definition of terms (optional):
TCP
Tool Center Point

Introduction
In the past, many applications deployed safety devices in a standalone, hardwired mode where safety was managed
locally at the device and safety network support was not required. For example, safe drives were equipped withdedicated local safety I/O and supported a range of safety functions like safe torque off, safe stopping, and safe
limited speed monitoring. Drive safety configuration was managed locally using web browsers or dedicated softwaretools, and the safety function activation was via safety I/O at the drive.
Today the trend is to implement fully programmable, flexible safety solutions using controllers with safety task
support with networked safety devices that are fully integrated into the machine process [1]. This safety controller
based architecture has distinct advantages over traditional standalone hardwired safety when:
1. Complex safety logic is required
2. Multiple safety zones have to be managed
3. Distributed safety I/O is required
2014 ODVA Industry Conference

1©2014 ODVA, Inc.

4.
5.
6.
7.

A large area/footprint is to be safe-guarded
Machine modularity and scalability is important
Diagnostic safety information is required
Advanced drive safety control is required

Networked safety drives are a critical safety component in the safety controller based architecture. Networked safety
drives can offer basic and advanced safety functions with safety configuration, safety function activation, and safety
status monitoring support via network safety connections. Modern safety network technology allows safety devices
like safety discrete I/O, safety analog I/O, drives with a safety core, and other devices with safety support to coexist
with standard control devices on a common network which support both safety connections and standard
connections.
Controllers are available that are dedicated safety controllers as well as controllers that offer both safety control andstandard control support. A controller with safety and standard control support typically includes safety task(s),standard task(s), and network support for safety and standard connections. Figure 1 is example of an architecture
utilizing a controller with safety and standard task support, safety and standard network connections, with support
for both safety and standard devices.

Figure 1 - Safety Controller Based Architecture
While there are published open CIP Safety profiles for “Safety Discrete I/O” and “Safety Analog I/O” available,
open profiles were not available for networked “Safety Drives”. This was identified as a critical need and as a result
a CIP Safety Safe Motion Sub-committee was formed to construct safety specification enhancements (SSE) for a
CIP Safety Safety Drive Profile and supporting Safe Motion objects Specification [2].
This paper examines functionality and architectures supported by the CIP Safety Safety Drive Profile and CIP
Safety Motion Objects specification. A number of application use case scenarios will be examined based on the
supported architectures.

2014 ODVA Industry Conference2©2014 ODVA, Inc.

Drive Safety Functions:
The CIP Safety Drive Profile and supporting CIP Safety Motion Objects support a broad range of drive safetyfunctions as listed in the EN61800-5-2 “Adjustable speed electrical power drive systems safety requirementsfunctional” standard [3]. Table 1 lists the drive safety functions.

Table 1 - EN61800-5-2 Drive Safety Functions
These 17 safety functions can be categorized into following general groups:• Disable power flow to the motor (i.e. STO)
• Safe brake control (i.e. SBC)
• Safe stop (i.e. SS1)
• Safe speed monitoring (i.e. SSM)
• Safe acceleration monitoring (i.e. SLA)
• Safe torque monitoring (i.e. SLT)• Safe position monitoring (i.e. SLP)

2014 ODVA Industry Conference

3©2014 ODVA, Inc.

An overview of “typical” functionality associated with a few of the common drive safety functions is provided infigure 2 through 4.

Safe Torque-off (STO)
STO is used to disable the torque generating power feed to the motor [3]. A typical implementation includes a safe
torque off request input and stop delay parameter. On occurrence of a STO safe torque off request a STO will be
initiated after the specified Stop Delay. Figure 2 shows a typical timing diagram for an STO sequence.

Figure 2 - Safe Torque Off (STO) Timing Diagram

Safe Stop 1 (SS1)
SS1 is used to decelerate the motor followed by an STO [3]. A typical implementation includes the SS1 stop request
input, stop monitoring delay parameter, stop delay parameter, deceleration tolerance parameter, and standstill speed
parameter. On occurrence of a SS1 safe stop request the deceleration ramp will be monitored after the stopmonitoring delay expires. An STO will be initiated as soon as the motor speed is below the Standstill speed or thestop delay time expires. Figure 3 shows a timing diagram for a typical SS1 sequence.

Figure 3 - Safe Stop 1 (SS1) Timing Diagram

Safe Limited Speed (SLS)SLS is used to insure the speed of the motor does not exceed a minimum value [3]. A typical implementation
includes the SLS monitoring request input, SLS monitoring delay parameter, and safe speed limit parameter. On
occurrence of a SLS monitoring request the motor speed will be monitored after the SLS monitoring delay expires toinsure it does not exceed the safe speed limit value. If the limit is exceeded a SLS fault will occur and an STO is
initiated. Figure 4 shows a timing diagram for a typical SLS.

2014 ODVA Industry Conference

4©2014 ODVA, Inc.

Figure 4 - Safe Limited Speed (SLS) Timing Diagram
Drives may support a subset of the 61800-5-2 safety functions with STO being a minimum requirement. The drive
includes a Safety Core to manage the safety function operation. The Safety Core is typically designed to meet ENISO 13849-1 PLe and up to and including EN61508 SIL 3.
The typical drive Safety Core includes the safety network interface, primary and secondary position/velocity
feedback, redundant processors with gate drive interface to disable torque producing current to the motor, andfirmware to support a range of drive safety functions. Single motor mounted feedback is typically used for SIL 2,
PLd while an additional secondary feedback is required for SIL 3, PLe (typically driven on the load side). The
functionality provided by the drive safety core differs based on the supported drive safety functions, and the safety
interface to the drive.

Drive Safety Architecture Deployment Options:
In the 2012 ODVA Conference paper “CIP Safety for Drives”, four different drive safety architecture deployment
options were defined. Key factors in differentiating these options are based on the following attributes:
1) Safety I/O owner – Drive or Safety Controller2) Drive Safety function activation source – Drive Safety I/O or Safety Controller3) Drive Safety Configuration – Drive configuration or Safety Controller based
configuration/programming4) Motion Profile Command – Drive or Motion Controller
The key attributes for the four options are listed in the table 2.

Table 2 - Safety Architecture Deployment Options

This paper will focus on use case analysis for Option 2 and Option 4. These will be referred to as Option 2 –Drive
Managed Motion Safety Functions, and Option 4 – Safety Controller Managed Motion Safety functions.
A review of the Option 2 and Option 4 control architecture is provided below:

2014 ODVA Industry Conference

5©2014 ODVA, Inc.

Option 2 – Drive Managed Motion Safety Functions
With option 2 the drive safety functions are activated and safety status is monitored by the safety controller using thedrive network safety connections. All safety functions are managed locally within the safety core of the drive. Drive
safety function configuration is entered and stored locally at the drive using a web browser, software utility, or
similar.
The safety controller activates and monitors safety functions in the drive via the safety network input and output
connections using one or more assemblies as defined in the Safety Motion Device Profile. Multiple input and output
assembly options are available depending on the safety functionality supported in the drive. Examples of safety
input/output assemblies supporting STO, and STO with safe stop/limit functions are shown in table 3 through 8.

Instance

Byte

Bit7

Bit6

Bit5

Bit4

Bit3

Bit2

Bit1

Bit0

180hex0

Reset
RequestReserved

Reserved

Reserved

Reserved

Reserved

Reserved

STO
OutputTable 3 - Safety Output Data with STO
Instance

Byte

Bit7

Bit6

Bit5

Bit4

Bit3

Bit2

Bit1

Bit0

1A0hex0

Reset
Required

SafetyFault

Reserved

Reserved

Reserved

Reserved

Reserved

TorqueDisabled

Table 4 - Safety Input Data with STO

Instance

Byte

Bit7

Bit6

Bit5

Bit4

Bit3

Bit2

Bit1

Bit0

183hex0

Reset
RequestReserved

SMT
RequestSOS
Request

SS2
Request

SS1
RequestSBC
OutputSTO
Output1

Reserved

Reserved

SDI–
RequestSDI+
RequestReserved

SLA
RequestSLS
RequestSSM
RequestTable 5 - Safety Output Data with Safe Stop/Limit Functions
Instance

Byte

Bit7

Bit6

Bit5

Bit4

Bit3

Bit2

Bit1

Bit0

1A3hex0

Reset
Required

SafetyFault

Safe Motor
Temp

Safe
Standstill

SS2
ActiveSS1
ActiveBrakeEngagedTorqueDisabled

1

Reserved

Reserved

MotionNegative

MotionPositive

SDI
ActiveSLA
ActiveSLS
ActiveSafe
Speed

Table 6 - Safety Input Data with Safe Stop/Limit Functions
Instance

Byte

Bit7

Bit6

Bit5

Bit4

Bit3

Bit2

Bit1

Bit0

184hex0

Reset
RequestReserved

SMT
RequestSOS
Request

SS2
Request

SS1
RequestSBC
OutputSTO
Output1

Reserved

Reserved

Reserved

Reserved

Group SelectTable 7 - Safety Output Data with Safe Stop and Safe Limit Groups
Instance

Byte

Bit7

Bit6

Bit5

Bit4

Bit3

Bit2

Bit1

Bit0

1A4hex0

Reset
Required

SafetyFault

Safe Motor
Temp

Safe
Standstill

SS2
ActiveSS1
ActiveBrakeEngagedTorqueDisabled

1

Reserved

Reserved

Reserved

Reserved

Group Active

Table 8 - Safety Input Data with Safe Stop and Safe Limit Groups

2014 ODVA Industry Conference

6©2014 ODVA, Inc.

Table 3 and table 4 apply to the simplest drive with STO only support. Table 5 and Table 6 apply to drives that
support STO and safe stop and safe limit functions. Table 7 and table 8 apply to drives that support preconfigured
sets of safe limit functions.

An option 2 control architecture example is shown in figure 5. The Safety controller owns and manages the safety
I/O and activates and monitors execution of drive safety functions via the drive network safety output/input
connections. After activation of a drive safety function, execution of the safety function is managed in the driveusing the drive safety configuration data and drive based safety feedback.

Figure 5 - Option 2 Architecture
An example safety function is SLS using the output assembly in table 5 and input assembly in table 6. The execution
sequence is:
1. Safety controller sets the SLS request bit
2. On receipt of the SLS request bit the drive safety core activates the SLS monitoring function
3. The drive safety core manages the SLS monitoring function execution using the SLS configuration datastored in the drive (i.e. monitoring delay, safe speed limit) and the drive safety feedback data (single or dual
channel position, speed, and acceleration)
4. The safety controller monitors the SLS status using the SLS Active, Safe Speed, and Safety Fault bits via
the network safety input connection to the drive.
Some applications require safety limit functions with different limit setpoints at different operating conditions. As an
example the speed limit for the safe limited speed could vary or could be combined with the Safe Direction function.
The implementation of this functionality in the drive (option 2) while still using a compact data interface to thesafety controller can be accomplished by grouping the safety functions regarding the operating cases.
In the hardwired case (option 1) all safety functions and the governing states have to be implemented in the drive
controller. The typical states are shown in Figure 6.

2014 ODVA Industry Conference

7©2014 ODVA, Inc.

Figure 6 - Safety technology operating states of a drive
These modes are:
1. “Normal operation” is the production state of the machine. Safety is usually guaranteed by locked doors,
but optionally some safety monitoring may be on.
2. “Safe stop 1” means that all actuators are disconnected from power. This inhibits the actuators from starting
to move. This mode has previously been the standard for safe manual interaction with machines. In case ofan error the devices go to the “safe stop 1” mode, where the actuators go to standstill with maximum
deceleration and power is cut off from the actuators.
3. “Safe standstill” means all actuators are stopped but still powered. This is used in case of some manualinteraction which should only cause minimal interruption of production. Special care must be taken tomonitor the actors in this state.
4. “Safe Motion” state: if there is manual interaction needed while still some parts of the machine need to
move, there are usually speed or position limits defined to guarantee safety. The limits depend on theoperating conditions of the machine. So there can be several safe motion modes necessary for a machine.
Table 9 shows the safety functions of a drive applicable in each operating state of the machine.
Operating state

Safety Functions

Comment

Normal mode

Safe direction
Safe maximum speed
Safely-limited position

On top of locking out users from dangerous
machine parts in Normal mode can have thesesafety functions which are implemented in thedrive safety controller in oprion 2.

Safe standstill

Safe stop 1
Safe stop 2
Safe break control

Depending on machine type different stopfunctions can guarantee standstill

Emergency stop

Safe stop 1

Emergency stop is activated by the Emergency
stop button or any safety monitoring function
detecting an error.

Safe motion

Safely-limited speed
Safe direction
Safely-limited increment
Safely-monitored position
Safe maximum speed
Safely-limited position

These safety functions can be combined andparameterized to form a set of 16 safe motion
groups.

Table 9 - Operating state and safety function

2014 ODVA Industry Conference

8©2014 ODVA, Inc.

Converting a safety drive solution for such a machine from option 1 to option 2 requires moving the safety statemachine and the governing safety signals to a safety controller. The safety limits configuration stays in the drive.
The assembly interface defined by the profile in Table 7 and Table 8 show that all stop functions stay at the same bit
positions as the direct select interface shown in Table 5 and Table 6. The 4 bit Group Select field enables theselection of 16 different safe motion modes.
Benefits of Drive Managed Motion Safety Functions – Option 2
1. Safety functions can be configured and pre-tested without a safety controller.
2. Easy migration path between option 1 (safety I/O hardwired to the drive) and option 2. Allows
sophisticated safety functions in the drive using statically configured combinations which are dynamicallyselected.
3. As use cases exclude TCP monitoring no tight coupling to the motion controller is needed. The safetycontroller (Originator) can be a separate device on the network or integrated into the motion controller.
4. No calculation of analogue values is needed in the safety controller. All position and speed calculations aredone in the drive device. This is valuable in machines using a large number of safe drives, allowing a lower
class of safety controller being used.
5. Less data used for safety communication. If more than 2 bytes are used the inverse data and a larger
checksum has to be exchanged. This adds load to the communication interface and is relevant inapplications using a large number of safe drives.
6. Shortest possible reaction time to events exceeding limits. Especially for hydraulic applications this is inmany cases the only possible solution.

Use Case example #1 - Single axis press-fit module
Description
In this example an OEM builds press-fit modules which implement a lot of functions including functional safety
using an intelligent drive. These modules are used by machine builders for a variety of applications. As cost does notallow a separate safety controller for this module, the drive integrated safety functions (option 1 or option 2) areused. The module can be completely tested at the OEM site and responsibility for module safety can be kept
separate from total machine safety. Different application dependent safety functions can be implemented by the
OEM and need only be selected by the local safety signals at the drive.

Figure 7 - Single axis press-fit module

2014 ODVA Industry Conference

9©2014 ODVA, Inc.

Solution
The single axis press-fit unit is controlled by a drive with integrated safety stop and limit functions. The machinesafety I/O is owned by the safety module of the PLC controlling the whole machine.
Safe Stop SS2 and Safe Limited Speed SLS functions are implemented in the drive. The safety PLC sends stop andSLS Signals when the condition of the machine requires this.

Use case example #2 - Woodworking machinery
Description
Woodworking machines usually have no housing or one open side. So there is need of safety functions under theconstraint of maximum productivity. A mat detects a person standing in the dangerous area. Depending on the area
the machine has to reduce speed or even do a full stop. As modern machines are operating at high speed, every msfrom detection of the person to finally reaching the reduced speed counts. Drive integrated functional safety allows
the signals to directly take effect on the control loop of the drive controller. This avoids delays of network and safetycontroller cycles. Depending on the distance of the person to the dangerous machine part the group select can choose
the appropriate safety reaction (e.g. different reduced speed levels, also depending from axis position).

Figure 8 - Woodworking machine
Solution
The machine is controlled by a CNC. The safety controller is a separate unit and communicates safety signals to the
network using CIP Safety. Safety I/O is connected locally to the safety controller but could also be connected
remotely via CIP Safety. Speed limiting and safe stopping functions are configured in the drives. The two zones ofthe detection mat map to different safe limit group selects. In machines capable of high acceleration and needing asafe operational stop (SS2) it is essential to detect problems and react fast to guarantee no motion. If some problem
in the motion controller leads to restart motion by command values, the drive detects this and can react within aposition control loop. If a speed limit is violated the drive can react performing a SS1.

2014 ODVA Industry Conference

10©2014 ODVA, Inc.

Figure 9 - Example structure of a woodworking machine

Use case example #3 - Printing machines
Description
Printing machines need manual interaction for exchange of printing plates, introducing a new paper web or cleaning
the roller. Depending on the situation there are different constraints as moving only in one direction and different
allowable speeds. Grouping the selected functions allows combinations of limiting functions for the operating
conditions e.g.:• Monitoring a maximum speed limit (SMS) for certain products at normal operation• Monitoring direction (SDI-) and speed limit (SLS) for cleaning cylinders• Monitoring a lower speed limit while changing printing plates. The speed limit is dependent on the
direction of the motion.

Figure 10 - Change of printing plate2014 ODVA Industry Conference
11©2014 ODVA, Inc.

Solution
One printing unit usually consist of many cylinders each driven by an electric drive and some auxiliary drives. A(non-safe) motion controller controls via virtual axis line shafting application. Its add-on safety controller module
owns the safety I/O. Due to the number of drive axis and limited performance of the safety controller, Safe Stop andlimiting functions are chosen to be implemented in the drive controllers. The different limit functions map to thegroup selection of safety functions.

Figure 11 - Control structure of printing unit

Option 4 – Safety Controller Managed Motion Safety functions
With option 4 the STO safety function is activated and drive safety status is monitored by the safety controller using
the drive network safety connections. Unlike Option 2 where the motion safety function execution is managed in
the drive, the motion safety functions with the exception of STO are executed directly in the safety controller safetytask application program using one or more motion safety instructions. Depending on the capability of the safetycontroller one or more safety instructions maybe available to support motion safety functions in the following
categories:
•
•
•
•
•
•
•

Disable power flow to the motor (i.e. STO)
Safe brake control (i.e. SBC)
Safe stop (i.e. SS1)
Safe speed monitoring (i.e. SLS)
Safe acceleration monitoring (i.e. SLA)
Safe torque monitoring (i.e. SLT)
Safe position monitoring (i.e. SLP)An example of a typical motion safety instruction is shown in figure 12 for safe stop 1 (SS1)2014 ODVA Industry Conference

12©2014 ODVA, Inc.

Figure 12 – SS1 Motion Safety Instruction
Safety data which may originate from a multitude of safety devices including the drive safety core and safetycontroller owned safety I/O is used during execution of the safety instructions. Safety data may include single ordual channel position, velocity, and acceleration information.
The safety controller sends STO activation request, monitors the drive safety status, and acquires drive safety data
via the drive safety network input and output connections using the assemblies as defined in the Safety Motion
Device Profile.
Examples of input/output assemblies supporting STO with drive supplied safety feedback position, velocity, andacceleration data are shown in table 10 and table 11.

Instance

Byte

Bit7

Bit6

Bit5

Bit4

Bit3

Bit2

Bit1

Bit0

180hex0

Reset
RequestReserved

Reserved

Reserved

Reserved

Reserved

Reserved

STO
Output

Bit2

Bit1

Bit0

Reserved

Reserved

TorqueDisabled

Table 10 - Safety Output Data with STO
Instance

Byte

1C0hex

0
1
2
3
4
5
6
7
8
9
10
11
12

Bit7

Bit6

Bit5

Bit4

Bit3

Feedback Position (DINT)

Feedback Velocity (DINT)

Feedback Acceleration (DINT)

Reset
Required

SafetyFault

Reserved

Reserved

Reserved

Table 11 - Safety Input Data with STO and Feedback Data
An option 4 controller architecture example is shown in figure 13. The Safety controller owns and manages thesafety I/O. The safety controller executes the safety functions directly via the safety task application code using
2014 ODVA Industry Conference

13©2014 ODVA, Inc.

safety instructions. Safety feedback data from the drive safety core and/or other safety feedback devices is used in
the safety instructions. If the drive safety core is the source of the safety data then the drive network safety input
connection with an input assembly as shown in table 10 would be used.

Figure 13 - Option 4 Control Architecture

An example safety function is SLS using the output assembly table 10, and input assembly in table 11. In this casethe safe feedback data source is the drive safety core. The sequence is:
1. SLS safety instruction is executed in the safety controller application program (Example SLS instruction isshown in figure 14)
2. An SLS request handshake is received by the drive motion controller application program (there are
multiple options for implementing the handshaking between the safety controller and Motion
controller…or safety task and standard task) which is interpreted as a request to ramp down to a speed
below the SLS monitoring speed setpoint
3. The safety controller manages the SLS monitoring function execution using the instruction input parameterdata (i.e. monitoring delay, safe speed limit, speed tolerance, discrepancy time) and the safety feedback
data from the drive (single or dual channel position, speed, acceleration)
4. If a safety fault is detected by the safety controller as the result of the SLS monitoring a STO activation
request is sent to the drive safety core
5. Drive safety core executes a STO
6. Safety controller monitors the STO status2014 ODVA Industry Conference

14©2014 ODVA, Inc.

Figure 14 - Option 4 SLS Instruction Example

Benefits of Safety Controller Managed Motion Safety Functions – Option 4
1. Single software package for managing safety – configuration, programming, commissioning, diagnostics,
maintenance
2. Eliminates the need for individual drive/device safety configuration …safety configuration is unified in thesafety controller
3. Flexible, centralized safety function execution supports complex safety logic
4. Coordinated safety function execution for an unlimited number of drives
5. Dynamic, runtime calculated or operator specification of safety function parameters for maximum flexibility andadapting to changing conditions and requirements…i.e. speed, acceleration, torque , position limit setpoints
6. Flexible safety feedback options – drive based feedback, network based device feedback, local I/O connected
feedback or any combination can be used to achieve PLd and PLe.
7. “Path” based safe functions…i.e. robot TCP safety monitoring which requires multi-axis kinematics functions
8. Support for safe stopping and safe limiting functions for drives/devices that only support the minimum STO
capability

2014 ODVA Industry Conference

15©2014 ODVA, Inc.

Use Case Examples for Option 4 – Safety Controller Managed Motion Safety functions

Use Case Example #1 – SLS for variable diameter wind/unwind roll
Description
This use case is SLS monitoring of the surface speed of a winder roll. This is a PLd rated solution with a single
motor mounted safety feedback device.
The Motor drives the winder roll at a variable speed to maintain a constant surface feet per minute (SFPM) as the
web is wound onto the winder roll. As the web is wound, the winder roll diameter increases. The instantaneouswinder roll diameter is used to derive the required motor speed to maintain the required SFPM web speed.
There are scenarios where the machine operator has to perform maintenance operations in the vicinity of the winderroll with the guard doors open. The maintenance operation requires jogging the winder roll with SLS monitoring of
the roll circumference speed (web speed).
The control architecture is shown below. The controller provides both standard control (standard control task) andsafety control (safety control task) of the drive/motor which rotates the winder roll. The standard control task
manages the position/velocity/acceleration profile of the drive while the safety control task manages the safety
monitoring functions. Safety I/O owned by the safety controller includes two analog inputs which are used todetermine the roll diameter for the SLS speed setpoint calculation.

Figure 15 - Winder Control Architecture

Solution
The controller application program provides dynamic SLS monitoring of the winder roll circumference speed. The
basic sequence in the controller safety task application program is:
1. Open guard door state is detected (safety task)

2014 ODVA Industry Conference

16©2014 ODVA, Inc.

2.

3.
4.
5.

6.
7.

SLS setpoint is calculated using analog inputs for the roll diameter calculation….the setpoint calculation
can be executed as a one-time event on request or on a continuous basis at some specific update rate (safetytask)
SLS request with the SLS setpoint is sent to the standard task (safety task/standard task)
The drive is ramped to speed < SLS speed setpoint calculated in (2) (standard task)
SLS monitoring instruction is executed with the following key parameters (safety task):a. Safe limited speedb. Monitoring delay timec. Variable SLS mode enabled
d. Speed tolerance
e. Discrepancy time
NOTE: Steps 4 and 5 are concurrent…SLS monitoring is active while the drive speed is being ramped
down, the monitoring delay time can be used to coordinate the two operations.
If after the monitoring delay time out the speed exceeds the SLS Speed Setpoint the Fault Present output
will be set (safety task)
Fault Present output generates an STO activation request to the drive (safety task)

Typical safety task application code for calculating the safe limited speed setpoint and enabling the SLS monitoringis shown figure 16. Typical standard task application code for changing the speed of the windup roll is shown infigure 17.

Figure 16 - Typical Logic for calculating the SLS setpoint using measured roll diameter andenabling SLS monitoring2014 ODVA Industry Conference

17©2014 ODVA, Inc.

Figure 17 - Typical Logic for coordinating action between the standard task motion profile
control (windup roll speed) and the safety task safety monitoring functions

Use Case Example #2 – Coordinated safe line stop (SS1)
Description
This use case is a coordinated safe line stop (SS1) of a web line.
There are four drives that are geared to a line master axis (typically a virtual axis) which propel the web. When theoperator pushes the line stop safety switch button the line will ramp to a coordinated, controlled stop, with SS1
safety monitoring in place for each of the four drives. The line ramp rate can be changed by the operator using an
operator interface or via a downloaded setpoint recipe.
The control architecture is shown in figure 18. The controller provides both standard control (standard control task)
and safety control (safety control task) of the four drives and the virtual line master axis. The standard control task
manages the position/velocity/acceleration profile of the drives while the safety control task manages the safety
monitoring functions for the drives. The four drives are geared to the line master axis, performing a controlled stopof the line master axis will result in the four drives stopping in full coordination with the line master axis and witheach other. Safety I/O is owned by the safety controller and includes the safety line stop switch input. The operator
is used to enter/change the line start/stop ramp rate and line speed.

2014 ODVA Industry Conference

18©2014 ODVA, Inc.

Figure 18 - Coordinated Line Control Architecture

Solution
The controller safety task application program provides SS1 monitoring of drives 1-4 in response to a safe line stop
request. The controller standard task application program provides a coordinated ramp down of the line in responseto the safe line stop request. The sequence in the safety task and standard task application program is:
1. Line stop safety switch input is detected (safety task)
2. SS1 request is sent to the controller standard task (safety task/standard task)…initiate line stop
3. A line master axis ramped stop is initiated…drives 1 through 4 will follow based on their geared
relationship to the line master axis resulting in a coordinated stop of the drives (standard task)
4. SS1 monitoring instruction is executed for each drive with the following key parameters (safety task):a. Monitor delay timeb. Maximum stop timec. Deceleration reference speedd. Standstill speed
NOTE: Steps 3 and 4 are concurrent…SS1 monitoring is active while the drive speeds are being ramped
down, the monitoring delay time can be used to coordinate the two operations.
5.
6.

Once standstill speed is detected on a drive a STO activation request is sent to that drive (safety
task)Assuming no safety faults, the line comes to a controlled stop via the line master axis stop, and theSS1 monitoring of drives 1-4 is satisfied, resulting in a STO final state for drives 1-4 (safety task)

Typical safety task application code for initiating SS1 monitoring for the 4 drives is shown in figure 20. Typicalstandard task application code for ramping the line to a controlled stop is shown in figure 19.

2014 ODVA Industry Conference

19©2014 ODVA, Inc.

Figure 19 - Typical standard task application program logic for initiating a controlled line stop
via the line master axis (Standard Task)

Figure 20 - Typical safety task logic for enabling SS1 monitoring on drives 1-4 (Safety Task)

2014 ODVA Industry Conference

20©2014 ODVA, Inc.

Comparison:
A summary of option 2 and option 4 key attributes is provided in Table 12.
Criteria

Option 2

Option 4

Configuration / Parameterization

Controller and each device separately

Controller only

Multi axis kinematics (TCP)

Not possible

Possiblenumber of safety limit setpoints

15

Unlimiteddynamic safety limit calculation-

Possiblerequired drive functionality

STO, safe stop, safe limiting functions

STO

Safety feedback

drive primary and aux port safety feedback
devices

Drive primary and aux port
safety feedback devices
and/or local or network
connected safety feedback.

Required safety PLC CPU power

Low

Medium to high - increases
with number of axes

Safety response time

<1ms

>10ms

Required network bandwidth

LowMedium to High

Table 12 – Option 2 and Option 4 Safety Architecture Comparison
Conclusion:
This paper discussed the migration from simple, hardwired safety solutions which provide basic machine
guarding/shutdown solutions to flexible, safety controller based safety solutions in which drives with networked
safety support are a key component. A review of the recently developed CIP Safety drive Profile and supporting safe
motion objects specification support for the EN 61800-5-2 safety functions was presented. Four different motion
safety architecture options were defined and reviewed with a more in-depth analysis of the option 2- Drive managed
motion safety functions, and option 4- Safety controller managed motion safety function architectures. A number ofapplication use cases were presented to illustrate typical system solution implementation characteristics for the
option 2 and option 4 architectures.

References:[1] P. Hampikian, B. Hirschinger und L. Leurs, CIP Safety for Drives, Stone Mountain: ODVA
Industry Conference, 2012.
[2] ODVA, The CIP Networks Library, Volume 5, CIP Safety, Edition 2.8, Ann Arbor: ODVA,
2013.
[3] IEC, EN61800-5-2 “Adjustable speed electrical power drive systems - safety requirements functional”, IEC, 2008.

2014 ODVA Industry Conference

21©2014 ODVA, Inc.

************************************************************************************The ideas, opinions, and recommendations expressed herein are intended to describe concepts of the author(s) for the possible use of CIP
Networks and do not reflect the ideas, opinions, and recommendation of ODVA per se. Because CIP Networks may be applied in many diverse
situations and in conjunction with products and systems from multiple vendors, the reader and those responsible for specifying CIP
Networks must determine for themselves the suitability and the suitability of ideas, opinions, and recommendations expressed herein for intended
use. Copyright ©2014 ODVA, Inc. All rights reserved. For permission to reproduce excerpts of this material, with appropriate attribution to theauthor(s), please contact ODVA on: TEL +1 734-975-8840 FAX +1 734-922-0027 EMAIL odva@odva.org WEB www.odva.org.
CIP, Common Industrial Protocol, CIP Energy, CIP Motion, CIP Safety, CIP Sync, CompoNet, ControlNet, DeviceNet, and EtherNet/IP aretrademarks of ODVA, Inc. All other trademarks are property of their respective owners.

2014 ODVA Industry Conference

22©2014 ODVA, Inc.