CIP Safety For Drives Pascal Hampikian Schneider Electric Bob Hirschinger Ludwig Leurs Bosch Rexroth Rockwell Automation Technical Track www.odva.org
Safety Controller/PLC Safety Solution Architecture Overview EN61800-5-2 Drive Safety Function Review Drive Safety System Architecture Option Review CIP Safety Safe Motion Sub-Committee Deliverables Technical Track © 2012 ODVA, Inc. 2012 ODVA Industry Conference & 15th Annual Meeting All rights reserved.
www.odva.org

manual release PB inside cell

Simple = Relay Focused
1. Achieving CAT 3 on small simple systems can be cost effective and relatively easily achieved without the use of a safety PLC 2. Hardwired safety devices with fixed or locally managed safety configuration 3. Modifications Difficult 4. Limited Special Functions Limited Machine states / Zone Control 6. Hard Wired Diagnostics / LEDS Only 7. Home Run Wiring Device to Relay Inputs & Actuators 89 Single Panel Limited distance 9. Redundant to Control system 10. Panel space many components Start Up / Check Out can be complex 11.
Complex = Safety Controller/PLC Focused
1. Achieving CAT 3 on a complex system is more difficult but can be made simpler by utilizing a safety controller/PLC. 2. Safety controller/PLC is a scalable solution that is easily, quickly modified when upgrades are desired 3. Wide range of networked safety devices 4. Many Special functions Including library for numerous applications 5. Unlimited machine states and Zones 6. Extensive diagnostics via HMI 7. Wire to nearest I/O Node oo Long lines, Multi-panel / multi controller 9. Reuse infrastructure of control system Reduced component count (space savings) 10. 5.

Safety conntrollers/ PLCs - Functionality
• Certified up to SIL 3 / Cat 4 - IEC 61311 Programming • Safety Specific Instructions 
マラル
||q|x;
Safety Control Functionality
2012 ODVA Industry Conference & 15th Annual Meeting All rights reserved.
. Fully programmable with safety task support ● Wide range of safety instruction support Basic Logic . Dual channel I/O . . Muting control Safety mat . Drive safety . • Application specific . Network connectivity for a broad range of standard and safety devices 2012 ODVA Industry Conference & 15th Annual Meeting All rights reserved.
. Full programmable with safety task support . Networked Safety Drives are a common device used in Safety Controller/PLC based safety solutions CIP Safety Drive Safety Profile standards are under development for use on networks that deploy CIP Safety o CIP Safety Profiles: Discrete safety I/O Analog safety I/O Drive safety (Available) (Available) (May 2013) Technical Track © 2012 ODVA, Inc. 2012 ODVA Industry Conference & 15th Annual Meeting All rights reserved. www.odva.org . 。 There are a number of safety standards that provide guidelines for safety systems EN61800-5-2 provides safety requirements for adjustable speed drive systems
page 9
。 EN61800-5-2 provides high level functional description of drive safety functions 。 These are the safety functions that are targeted for CIP Safety Drive Profile support
Eunctionality Grouping
• Disconnect Torque generating power feed to the motor (STO) • Safe stop (i.e. SS1) • Safe speed monitoring (i.e. SLS) • Safe acceleration monitoring (i.e. SLA) • Safe torque monitoring (i.e. SLT) • Safe position monitoring (i.e. SLP) • Safe brake control (i.e. SBC)

STO
. Stop Request 。 Wait Stop Delay 。 Disable Motor Power
SS1
. Stop Request 。 Wait Stop Monitoring Delay . 。 Monitor Decel Until Standstill Disable Motor Power
SLS
. . o Safe Limited Speed Request Wait Stop Monitoring Delay Monitor Speed < Safe Speed Limit 2012 ODVA Industry Conference & 15th Annual Meeting All rights reserved.
。 Manages drive safety functions o Dual channel safety I/O interface o Primary and secondary motor/load feedback interface 。 Dual redundant processor safety core 。 Gate driver interface to disable torque producing current to the motor 。 Safety input/output network connection support o Firmware support for a range of safety functions
OPTION 1 Drive safety I/O activated drive safety functions OPTION 2 Safety controller activated drive safety functions OPTION 3 Safety controller configured & activated drive safety functions OPTION 4 Safety controller executed drive safety functions
• Safety network connection not required . Safety functions are managed in the drive EN61500-5-8 and safety I/O sequencing . Safety configuration is stored in the drive •   Local configuration tool with signature management Drive specific and canned safety functions . o
Safety I/O is connected to the drive
. Safety function activation (input) . Safety device status monitoring (input) . Drive safety status (output) . Safety device control (output)
Considerations
.
. Safety network connection is not required . Limited “general” safety functions . Locked safety configuration (limited drive setpt control) . Extra/redundant wiring . Limited support for advanced safety functions . Machine states and zone control . Coordinated line control . Complex safety logic
Safety network connection required o o Safety functions are managed in the drive EN61500-5-8 o Safety configuration is stored in the drive • Local configuration tool with signature management o
Safety Controller
Manages all safety I/O – local and distributed . Activates drive safety functions & monitors drive safety . status User programmable safety logic with access to broad . range of safety instructions and safety devices o
Considerations
Safety network connection is required Broad range of “general” safety functions via safety . controller Locked drive safety configuration with limited drive . setpt control Broad support for advanced safety functions . • Machine states and zone control • Coordinated line control • Runtime “configured” safety functions All rights reserved.
。 。 Safety network connection required Safety functions are managed in the safety controller (Except STO) EN61500-5-8 . . Safety configuration is stored in the drive •   Local configuration tool with signature management 。
Safety Controller
Manages all safety I/O – local and distributed . Activates drive safety functions & monitors safety status . User programmable safety logic with access to broad . range of safety instructions and safety devices
。
Considerations
Safety network connection is required . Broad range of “general” safety functions via safety . controller Programmable drive safety set-point control – managed . in the safety controller Broad support for advanced safety functions . • Fully programmable drive safety function setpt control • Machine states and zone control • Coordinated line control • Runtime “configured” safety functions Technical Track © 2012 ODVA, Inc. 2012 ODVA Industry Conference & 15th Annual Meeting All rights reserved.
。 Safety network connection required 。 Safety functions are managed in the drive EN61500-5-8 . . Safety configuration is stored in the safety controller Via safety application program parameters . 。
Safety Controller
Manages all safety I/O – local and distributed . Executes drive safety functions using drive safety status . data User programmable safety logic with access to broad . range of safety instructions and safety devices
o
Considerations
Safety network connection is required . Broad range of “general” and “drive” safety functions . via safety controller . Broad support for advanced safety functions • Fully programmable drive safety function execution • Machine states and zone control • Coordinated line control • Runtime “configured” safety functions All rights reserved.
o
Drive SS1 stop request
management
•  Safety task application code recognizes and processes SS1 stop request •  Light curtain transition = SS1 request to drive 1 through drive 4 via network safety CIP Safety input connection safety function activation object o
SS1 stop management
•  SS1 request is received and managed by the drive(s) safety core •  SS1 stop as configured with stop monitoring delay, stop delay, deceleration tolerance, standstill speed parameters •  Drive safety status returned via network safety output connection CIP Safety drive safety status object Drive safety status is monitored in the Safety . Controller safety task application code Additional functions can be executed as defined . in the Safety Controller safety task application code

o
Line Stop request management
•  Safety task application code recognizes and processes safe coordinated line stop request •  Line Stop input transition = coordinated line stop, SS2 monitoring request for drive 1 through drive 4 •  Event sent to standard task – coordinated line stop request o
Coordinated line stop management
•  Virtual axis is ramped to a stop in the standard task application code •  Drive 1 through drive 4 are geared to the virtual axis and will follow….coordinated line stop
.
SS2 drive monitoring
Safety task application code provides SS2 . monitoring of drive 1 through drive 4 SS2 instruction per drive with appropriate . parameters - stop monitoring delay, stop delay, deceleration tolerance, standstill speed parameters Drive speed/position feedback is provided for use in . the safety task application code SS2 via network safety output connection CIP Safety feedback object
• Industry brief released 4/2012 •  New area of technical investigation – " Safe Motion" •  CIP Safety Safe Motion Sub-committee formed • CIP Safety Safe Motion Sub- committee goals •  Develop “Drive Safety Profile(s)” •  To be voted on by May 2013 •  Published in the fall 2013 CIPSE edition • Focus on the option 2 architecture •  Safety function activation and drive safety status monitoring
• Deliverables include:
•  Data model for drives safety •   Object interface and data assembly definition • Device profile
• CIP Safety Profiles
• Discrete I/O (Available Today) • Analog I/O •  Drive Safety (Available Today) (Fall 2013 CIPSE edition) Technical Track © 2012 ODVA, Inc. 2012 ODVA Industry Conference & 15th Annual Mo All rights reserved.
Drive Safety Function Activation Basic Control Word (Safety Function Activation) - Mandatory

Drive Safety Status
Basic Status Word (Safety Function Status)- Mandatory

Drive Safety Feedback

2012 ODVA Industry Conference & 15"' Annual Meeting All rights reserved. page 21 www.odva.org • There is increasing adoption of flexible safety solutions using a safety controller/PLC with networked safety device connectivity • A drive with safety core and network safety connection is a critical safety device in this type of safety solution • The EN61800-5-2 provides a comprehensive list of drive safety functions • Four different safety architectures can be considered based on safety network connection support and drive safety function execution and status monitoring approach • A CIP Safety “safe motion” sub-committee has been formed to develop a safe drive profile • Targeted for publication in the Fall 2013 CIPSE •  Applicable to any network that deploys CIP Safety – including SERCOS III and CIP Networks (EtherNet/IP, DeviceNet) •  Focus on option 2 drive safety architecture •  Drive Safety function activation •  Drive Safety status monitoring