Technical Information

Safety-Related Control Technologyfor Machine Tools

Safety is becoming increasingly important in machine and plant construction. These high requirements mainly serve to protect humanbeings, but material assets and the environment are also receiving more consideration. The goal of functional safety is to minimize oreven eliminate risks that can occur during normal or impaired operation of machines or facilities. This is achieved primarily with redundant
systems. For example, axes that are moved in safety-oriented applications require redundant position information and dual-channel safetysystems in order to perform the corresponding safety functions.
Various system configurations can be realized in order to capture independent position values. One possibility is the use of two encoders
per axis. In many cases, however, a more economical solution requiring only one position encoder is preferred. HEIDENHAIN offers
safety-related position encoders as a purely serial, single-encoder solution.
The dual-channel safety system of HEIDENHAIN controls is achieved by a dual-channel control architecture. The two computers arelocated in the main computer and controller unit components, where two independent software processes run. These two processes
realize two safety channels, which capture and evaluate all safety-relevant signals in the two channels.

Basic principle
Controls and position encoders fromHEIDENHAIN with functional safety
meet safety integrity level 2 (SIL 2) as
per the EN 61 508 standard, as wellas the performance level “d” as per
EN ISO 13 849-1 (which replaced
EN 954-1). These standards describe theassessment of safety-related systems, forexample based on the failure probabilities
of integrated components andsubsystems. This modular approach helpsthe manufacturers of safety-related
systems to implement their systems,
because they can begin with subsystems
that have already been qualified. Safetyrelated position encoders and the TNC 640,
TNC 620 and iTNC 530 HSCI controls
accommodate this concept.

July 2013

Functional safety on machine tools– Safety-related controls

With its TNC 640, TNC 620 and iTNC 530
HSCI controls, HEIDENHAIN is offering NC
controls functional safety. Two redundantsafety channels that work independently ofeach other are the foundation for controls
with functional safety. All safety-relevant
signals are captured, processed and output
via two channels. Errors are detected bymutual comparison of the states and datain the two channels. In this way, theoccurrence of just one fault in the control
does not lead to the safety functions being
incapacitated. The concept described here
will also be used for other controls from
HEIDENHAIN in the future.
The HEIDENHAIN control system withfunctional safety consists of the following
subsystems:• HEIDENHAIN control with functionalsafety• HSCI system with main computer andcontroller unit
• PL 6000 FS for connecting safetyrelevant inputs and outputs• MB 7xx FS machine operating panel• TE 7xx keyboard unit
• BF 7xx display unit
• Power stages and drives for feed axesand spindles• Position and speed encoders• HR xxx FS handwheels
DesignThe safety-related controls fromHEIDENHAIN have a dual-channel design
with mutual monitoring. The SPLC (safetyrelated PLC) and SKERN (safe coresoftware) processes are the basis of thetwo redundant systems. The two software
processes run on the main computer (CPU)and controller unit (DSP) components.
The basic safety functions are permanently
defined in the SKERN software and cannot
be changed. The SKERN tasks include:• Triggering and monitoring stop reactions• Monitoring of the safe limited speeds inthe various safety-related operatingmodes• Cross-comparing the data and states of
the two safety channels• Monitoring of system conditions, such as
supply voltages, operating temperatures,etc.
The machine manufacturer adapts theSKERN functions to the respective
machine tool via the SPLC. The SPLC tasks
include:• Flexible adaptation of the functionalsafety to the respective machine• Capture, processing and output ofsafety-related signals• Requests for safety functions from theSKERN software

The dual-channel design of the main
computer and controller unit is continued in
the PL 6000 FS and MB 7xx FS input/
output systems: all safety-relevant signals(e.g. permissive buttons and keys, door
contacts, emergency stop button) arereceived via two channels, and are
evaluated independently of each other by
the main computer and controller unit.
They use separate channels to address thepower stages, and to stop the drives incase of an error.
Safety functions• Safe stop reactions (SS0/SS1/SS2)• Safe torque off (STO)• Safe operating stop (SOS)• Safely limited speed (SLS)• Safely limited position (SLP)• Safe brake control (SBC)• Safe operating modes according to EN
12 417
Safety-related operating modes
HEIDENHAIN controls with functionalsafety offer four safety-related operating
modes according to the EN 12 417
standard (safety of machine tools andmachining centers). The applicationoriented operation offered by this promises
a high level of acceptance, and therefore
safety. The goal is to enable the machine
operator to work at machining centers
during automated production runs, evenwhen protective measures are not in effect(such as when guard doors are open),without danger to the operator.

! Door contacts

The following safety-related operating
modes, as per EN 12 417, can be selected,
for example by a keylock switch:
Operating mode 1: Automated orproduction mode
• Operation only with closed guard door
• No machine motion possible if guard
door is open
Operating mode 2: Set-up mode
• Operation with open guard door
• Axis motions of no more than 2 m/min• Spindle stop within 2 revolutions• Only one axis can be moved at a time(no interpolating motions)• Spindle rotation only with permissive
buttonOperating mode 3: Manual intervention• Operation with open guard door
• Axis motions of no more than 5 m/min• Spindle stop within 5 revolutions• More than one axis can be moved at atime (interpolating motions)• Spindle rotation only with permissive
buttonOperating mode 4 – Advanced manualintervention, process monitoring• Operation with open guard door
• Axis motions of no more than 5 m/min• Spindle stop within 5 revolutions• More than one axis can be moved at atime (interpolating motions)• Spindle start only with permissive button

PL 6xxx FS

MB 7xx FS" Permissive buttons
 Emergency stop button

24 VµC A

1µC A

24 V

23µC BµC B

Channel A
Channel B
Cross comparisonof the data

HSCI

– Safety-related position encoders

The control requires reliable position
information for numerous safety functions,
including safe reduced velocity, safe
absolute position, safe controlled stop, etc.
Redundant information is required for this.
Diverse techniques sometimes come intouse for producing redundant position
values. Genuine dual-channel redundancy
can be ensured by installing two encoders
per axis. Economy, however, makes asolution requiring only one position
encoder preferable.
The trend toward purely digital drive
concepts will require single-encoder
solutions, which permit redundant position
value acquisition through purely serialtransmission, for safety-related
applications.
HEIDENHAIN offers a solution with its
safety-related position encoders. Single
encoder solutions for safety-related
applications according to EN ISO 13 849
and EN 61 508 are supported based on thepurely serial EnDat 2.2 interface. All thebenefits of serial data transmission are
now also available in safety-related
applications.

MC 6xxx

CC 6xxx

SKERN
SPLC

SKERN
SPLC

CPU

DSP

Safety-related position encoders withpurely serial data transmission via
EnDat 2.2
In a safe drive, the safety-related position
measuring system is a subsystem
consisting of:• Encoder with EnDat 2.2 transmission
component• Data transfer path with EnDat 2.2
communication and cable• EnDat 2.2 receiver component with
monitoring function (EnDat master)Integration of the position measuringsystemThe position measuring system isintegrated by a mechanical and an electricalinterface into the complete system. Theencoder is mechanically coupled to thedrive through the shaft connection and thecoupling, both of which are determined by
the geometry of the encoder. Including theEnDat master with monitoring functions inthe safe control ensures its electricalintegration. The necessary measures havealready been defined. The control
manufacturer must only implement them.
And so the safety-related position
measuring system can be incorporated asa subsystem with the corresponding failure
probabilities into the safety-related
evaluation of the plant’s or drive
manufacturer’s total system.

Function
The safety strategy of the position
measuring system is based on two
mutually independent position values andadditional error bits produced in theencoder and transmitted over the EnDat
2.2 protocol to the EnDat master. The
EnDat master assumes various monitoring
functions with which errors in the encoderand during transmission can be revealed.
For example, the two position values arethen compared. The EnDat master thenprovides the two position values andmutually independent error bits to the safe
control, for example over two processor
interfaces. In addition, the control monitors
the functionality of the safety-related
position measuring system and the EnDat
master through periodically released tests(forced dynamic sampling).
The architecture of the EnDat 2.2 protocol
makes it possible to conduct all safetyrelevant information or control mechanisms
during unconstrained controller operation.
This is possible because the safety-relevant
information is saved in the additional
information. With every sampling cycle thisadditional information can be requested by
the control in addition to the actualposition. According to EN 61 508, thearchitecture of the position measuringsystem is regarded as a single-channel
tested system.

Safety-related position encoder
EnDat master
EnDat 2.2 data transmission path
Encoder

Invertersystem

PWM

Poweramplifier

HSCI

EQN 1337 absolute multiturn encoder
Safety-related position encoder (single-encodersolution)

Comparison of systems with/without functional safety

A safety system for controls without
integrated functional safety is basedon a dual-channel structure.

HSCI
Inverter

Operating panel
HDLUSBCC 6110MC 6xxx

Safety relay
Safety contactor combinations:– Emergency stop
– Working envelopes– Tool magazine
Spindle-speed / axis monitoring

PL 62xx

Emergency stop button,
Permissive key,door contact,
keylock switches,
relay (no operation), etc.

HR xxxomitted in safety system with functional safety (FS)

Safety system without functional safety

HSCI
InverterElectrical cabinet

PSL

POWER MODULE
READY
RESET

Operating panel
HDL

USB

TE 7xx

MB 7xx FS







CC 6110MC 6xxx
Permissive key,
Keylock switch

PL 62xx FS

For catalogs, brochures and product information sheets, visit
www.heidenhain.de/docu

636223 · 04 · A · 02 · 7/2013 · PDF

BF 7xxSafety system with functional safety (FS)�����������������TE 7xx

MB 7xxLimit switch,
Emergency stop
button,door contact,relay (no operation)������������������������������������������������������������
������������������������� �������������� ���������������������������������������

BF 7xx

In the HEIDENHAIN safety system withfunctional safety (FS), the safety-relevant
functions are integrated in the hardware
and software. The wiring of the machine isgreatly simplified by using the following
dual-channel HEIDENHAIN components:
PL 6000 FS input/output module, MB 7xx FSmachine operating panel and the safe
HR xxx FS handwheel. There is no need for the safety contactor combinations, additional devices for spindle-speed and axis
monitoring or the wiring of the externalsafety channel. A safe PLC program permits ﬂexible adaptation of the integratedfunctional safety to different types of machines by the machine manufacturer.

POWER MODULEREADYRESETOne of the safety channels is realized
through external devices and wiring (e.g.
safety contactor combinations, safety
relays) for controlling the release of axes
and spindles in the inverters and axisrelease modules. The second channel
features the control consisting of the main
computer and the controller unit. It controls
the inverters via the PWM interface. The
external safety contactor combinations are
the central devices for measuring andevaluating all safety-relevant assemblies(e.g. keylock switch, emergency stopbutton) in this system. Additional external
assemblies are needed for monitoring thespindle speed or the axes. Using the input
information, the external devices generate
output signals that are received as input
signals by the two safety channels of thecontrol system.

Electrical cabinet

Axis-release module
PSL

For more information:• Brochure: iTNC 530 HSCI – Information for the Machine Tool Builder• Technical Information: Safety-Related Position Encoders• Brochure: TNC 640 – Information for the Machine Tool Builder• Brochure: TNC 620 – Information for the Machine Tool Builder

HR xxx FS