The manual contains the complete information on the application as directed of the decentralised
controllers 8400
protec with drive-based safety (safety option 20 and 30).
Please read the mounting instructions supplied with the controller before you start
working!
The mounting instructions contain safety instructions that must be observed!
Target group
This manual is intended for all persons who want to parameterise, configure, and diagnose the
integrated safety systems in controllers of the 8400
engineering software.
Validity
The information given in this manual applies to 8400 protec controllers with the following
nameplate data:
protec series with the L-force »Engineer«
Product seriesType designationFrom software version
8400 protec StateLine
with safety option 20 E84DSWTxxxxxxN0xxx-xKxxS01.00
with safety option 30 E84DSWTxxxxxxN0xxx-xLxxS01.00
8400 protec HighLine
Screenshots/application examples
All screenshots provided in this documentation are application examples. Depending on the
software version of the controller and the version of the installed »Engineer« software, the
screenshots in this documentation may differ from the representation in the »Engineer«.
with safety option 20 E84DHWTxxxxxxN0xxx-xKxxS01.00
with safety option 30 E84DHWTxxxxxxN0xxx-xLxxS01.00
Tip!
Information and tools for Lenze products are provided in the download area at
http://www.Lenze.com
1.1Document history
Download
VersionDescription
2.405/2013TD05 Corrections
2.301/2013TD05 Converted to new layout
2.202/2010TD14 Corrections
2.111/2009TD14 Corrections
2.009/2009TD14 Corrections and extension by safety option SO20
»Engineer«Lenze PC software which supports you in "engineering" (parameterisation,
Application blockBlock for a technology application (e.g. actuating drive - speed)
CodeParameter used for controller parameterisation or monitoring.
Display codesParameter that displays the current status or value of a system block input/
FB EditorFunction block editor
Function blockGeneral designation of a function block for free interconnection (only
Lenze settingThis setting is the default factory setting of the device.
Port blockBlock for implementing the process data transfer via a fieldbus
SubcodeIf a code contains several parameters, these are stored in the "subcodes".
System blockSystem blocks provide interfaces to basic functions and to the hardware of
diagnostics and configuration) throughout the whole life cycle, i.e. from
planning to maintenance of the commissioned machine.
A technology application is a drive solution based on the experience and
know-how of Lenze in which function blocks interconnected to a signal flow
form the basis for implementing typical drive tasks.
The term is usually called "index".
output.
Graphical interconnection tool which is provided for FB interconnections in
the »Engineer« on the FB editor tab and by means of which the applications
integrated in the drive can also be reconfigured and extended by individual
functions.
HighLine).
A function block can be compared with an integrated circuit that contains a
certain control logic and delivers one or several values when being executed.
• Each function block has a unique identifier (the instance name) and a
processing number which defines the position at which the function
block is calculated during the task cycle.
This Manual uses a slash "/" as a separator between code and subcode
(e.g. "C00118/3").
The term is usually called "subindex".
the controller in the FB editor of the »Engineer« (e.g. to the digital inputs).
The safety concept of the decentralised frequency inverters 8400 protec provide three safety
options depending on the device version.
Safety option 10 (SO10):
• The drive-based safety implemented in the inverter permits to connect external safety
components, e.g. passive sensors. Active sensors with self-testing signals can be directly
connected without using further components.
Safety option 20 (SO20):
• The drive is switched off safely by a higher-level safety PLC via PROFIsafe/PROFINET.
Safety option 30 (SO30):
• The safe disconnection can both be carried out by a higher-level safety PLC via PROFIsafe/
PROFINET and through the connection of active or passive sensors.
Note!
Safety options 20 and 30 can be parameterised via the »Engineer«.
The motion functions are continued to be executed by the controller. The drive-based
safety monitors the safe compliance with the limit values. When the limit values are
exceeded, the drive-based safety starts the control functions according to EN 60204-1
directly in the controller.
The safety functions are suitable for applications according to IEC 61508 to SIL 3 and
achieve the performance level (PL) e according to EN ISO 13849-1.
The requirements of the EN 954-1 standard which was valid until 30 November 2009 are
fulfilled for safety option 10 to control category 4 and for safety option 20 and 30 to
control category 3.
Detailed information on technical data and electrical installation can be found in the
mounting instructions for the 8400 protec.
2.1Functional range of the functional safety (short overview)
The transmission of the pulse width modulation is safely (dis-)connected by the drive-based safety.
Hence the drivers do not create a rotating field. The motor is safely switched to torqueless operation
(STO).
Disconnecting paths of the drive-based safety
SO Safety option
xx Control terminals of the safety option 10 and 30 (M12 circular connector)
C Control section
μC Microcontroller
PWM Pulse width modulation
PPower section
M Motor
Safety status
When the controller is switched off by the safety system, it is changed to the "Safe torque off active"
status
• "Drive is torque-free" is entered in the logbook.
When a safety function is requested, the safety technology activates the corresponding safe
monitoring function. The only standstill function executed directly is the "safe torque off" (STO)
function. All other safety functions require a controller action which is safely monitored.
Note!
The execution of the corresponding action (e.g. braking, braking to standstill, holding
the standstill position) requires an appropriate application interconnection which must
be provided by the operator!
"LS_SMInterface" system block
The LS_SMInterface system block in the function block editor of the »Engineer« serves to transmit
the control and status information from the safety system to the application. ( 12)
Basic procedure
1. Activation of the safety function (e.g. SS1 - safe stop 1).
• Monitoring starts.
2. Via a control word, the safety system transmits the information to the controller that the safety
function has been activated.
3. The application evaluates the control word and starts the required motion sequence (e.g.
braking).
Internal communication
The drive-based safety system and the standard device communicate via an internal interface.
Note!
If the communication to the controller is interrupted, e.g. by switching off the controller,
the safety system responds with the following actions:
• Error stop with STO is activated.
• Error message "Warning" is transmitted.
• The LED "S-Error" on the front of the controller is on.
The required error acknowledgement (AIE) is possible via the safety bus and with SO30
via the error acknowledgement input (plug X62).
Further information can be found in chapter "Diagnostics & error management
The system block LS_SMInterface is the interface to the integrated safety system in the function
block editor of the »Engineer«.
Output
wState
wIOState
wControl
bPowerStageEnable
wModuleID
2.3.1.1Status information
The drive-based safety system transmits information about the status of the requested or active
safety functions with the bit coded status signal wState.
Data type
WORD
WORD
WORD
BOOL
WORD
Value/meaning
Bit coded status information of the drive-based safety
Status information
Bit coded I/O information of the drive-based safety
I/O-Status information
Bit coded control information of the drive-based safety
Control information
Transferring the control information to the application
Status signal "Inverter enable"
TRUE Inverter is enabled by the safety system.
ID of the safety system in the controller
0 No safety system available
1 Safety option 10 (SO10):
2 Reserved
3 Safety option 20 (SO20):
4 Safety option 30 (SO30):
( 12)
( 13)
( 13)
( 14)
12
BitNameMeaning
0STOFunction Safe torque off (STO)
3 EC_STOError stop category 0: Function Safe torque off (STO)
4 EC_SS1Error stop category 1: Function Safe stop 1 (SS1)
14 Error activeDrive-based safety system in error status (trouble or warning).
Unlisted bits are reserved for future extensions!
[2-1]Bit coding of the status signal wState
is active.
• The drive is safely switched to torqueless operation.
The bit-coded wIOState status signal serves to transfer the status the safe inputs and the safe
output:
BitNameMeaning
0 SD-In1Sensor input 1 in ON state.
1 SD-In2Sensor input 1 in ON state.
5 AISRestart is acknowledged via terminal (negative edge: 10).
6 AIEError is acknowledged via terminal (negative edge: 10).
8 PS_AISRestart is acknowledged via safety bus (positive edge: 01).
9 PS_AIEError is acknowledged via safety bus (positive edge: 01).
Unlisted bits are reserved for future extensions!
[2-2]Bit coding of the wIOState status signal
2.3.1.3Control information
The bit coded wControl control signal serves to transfer information about requested or active
safety functions. The application in the controller must evaluate the control signal and carry out the
corresponding action.
• It is possible to request/activate several safety functions at the same time.
BitNameMeaning
0SS1 activeSafe stop 1 (SS1)
2ES activeEnable switch (ES)
3OMSOperation mode selector (OMS)
4SSE activeEmergency stop function (SSE)
• Depending on the parameterisation of the emergency stop function, bit 1 (SS1
active) or bit 0 of the status signal SMI_wState (STO active) is set after the
function has ended.
5 OMS activeSpecial operation is active.
Unlisted bits are reserved for future extensions!
[2-3]Bit coding of the wControl control signal
is active.
function for motion functions in special operations is active.
function for special operations is requested.
is active.
Note!
The application in the controller must evaluate the control signal wControl and carry out
the corresponding action. The execution of the corresponding action (e.g. braking to
standstill) requires an appropriate application interconnection which must be provided
by the operator!
See the following subchapter "Transferring the control information to the application".
2.3.1.4Transferring the control information to the application
In the simplest case, you only have to go to the I/O level in the FB editor and connect the wControl
output of the LS_SMInterface system block with the wSMControl input of the application block:
On the application level, the wSMControl input is connected with the motion control kernel. The
motion control kernel evaluates the transmitted control information and activates the required
motion sequence (e.g. braking).
Note!
At present, the motion control kernel only evaluates bit 0 (SS1). When this safety
function is requested, the drive will be decelerated to standstill along the stop ramp set
in C02610/3.
... for decoding the status and control information of the drive-based safety system into single
boolean signals.
How to decode the status information into single boolean status signals:
1. Go to the I/O level
system block with one of the free inputs wFreeIn1 ... wFreeIn4 of the application block.
• In the following example, the wState output is connected with the free wFreeIn1 input
of the LA_NCtrl application block on the I/O level.
• For a better overview, all other connections of the LA_NCtrl application block are not
shown here.
in the FB editor and connect the wState output of the LS_SMInterface
2. Go to the application level
input of the L_SMStateDecoder_1 function block.
•The free inputs wFreeIn1 ... wFreeIn4 are outputs on the application level.
The L_SMStateDecoder_1 function block decodes the status signal assigned to the wState
input into single boolean status signals for further use in the FB interconnection.
and connect the selected free input wFreeIn with the wState
How to decode the I/O status information into single boolean status signals:
1. Go to the I/O level
system block with one of the free inputs wFreeIn1 ... wFreeIn4 of the application block.
• In the following example, the wIOState output is connected with the free wFreeIn2 input
of the LA_NCtrl application block on the I/O level.
• For a better overview, all other connections of the LA_NCtrl application block are not
shown here.
2. Go to the application level
input of the L_SMStateDecoderIO_1 function block.
•The free inputs wFreeIn1 ... wFreeIn4 are outputs on the application level.
in the FB editor and connect the wIOState output of the LS_SMInterface
and connect the selected free input wFreeIn with the wIOState
The L_SMStateDecoderIO_1 function block decodes the status signal assigned to the
wIOState input into single boolean status signals for further use in the FB interconnection.
How to decode the control information into single boolean control signals:
1. Go to the I/O level
system block with one of the free inputs wFreeIn1 ... wFreeIn4 of the application block.
• In the following example, the wControl output is connected with the free wFreeIn3 input
of the LA_NCtrl application block on the I/O level.
• For a better overview, all other connections of the LA_NCtrl application block are not
shown here.
2. Go to the application level
on this level, with the wControl input of the L_SMControlDecoder_1 function block.
•The free inputs wFreeIn1 ... wFreeIn4 are outputs on the application level.
in the FB editor and connect the wControl output of the LS_SMInterface
and connect the selected free input wFreeIn, which is an output
The L_SMControlDecoder_1 function block decodes the control signal assigned to the
wControl input into single boolean control signals for further use in the FB interconnection.
Safety-relevant parameters can only be transmitted to the drive-based safety system via
safe parameter setting with the »Engineer«.
The parameter set is stored in the memory module and in the drive-based safety system
with a unique module ID, which must correspond to the effective safety address in the
drive-based safety system.
If you select the safety option in the project view of the »Engineer«, different tabs for the safety
system are available in the workspace. The following illustration shows the tabs for safety
option
30:
[2-1]Tabs of the integrated safety system (here as an example for safety option 30)
TabInformationavailable for
Safe configurationThis tab serves to make the safe configuration of the drive-
FeaturesThis tab displays general information on the safety system,
DocumentationThis tab serves to add notes and electronic documents to the
Safe parameter transfer
By clicking Safe Transfer on the Safe configuration tab, the Safe Transfer dialog box opens which
provides the function for a safe parameter transfer.
Safe parameter transfer ( 44)
based safety.
Safe configuration
e.g. product name, version, etc.
drive-based safety system.
• Detailed information on adding documentations can be
found in the »Engineer« documentation in chapter
"Project structure".
If you request the "Send safe data to device" function in the Safe Transfer dialog box via the Send
button, the drive-based safety system changes to the "Service status" which is required for a safe
parameter setting.
Send safe data ( 45)
The service status means:
• The standard stop is active and the drive is safely switched to torqueless operation (STO).
• With safety option 30, the safe inputs are evaluated as OFF state.
• The communication via safety bus is - if possible - active, but passivated.
Note!
• The service status is also active if the parameter set in the memory module does not
correspond to the parameter set in the drive-based safety system during the
initialisation.
• The service status can be exited by reinitialising the drive-based safety system, i.e. the
communication via the safety bus is interrupted.
Supported interfaces for a safe parameter setting
A safe parameter setting with the »Engineer« is supported via the following interfaces:
In the "Safety" field in the middle of the LED display on the front of the controller you will get
information on the status of the drive-based safety system:
[2-2]LED display on the front of the controller
LabellingColourStatusDescription
LED status displays for the integrated safety system
S-StategreenoffCommunication between standard device and safety system
blinkingIntegrated safety system is in the service status
onCommunication between standard device and safety system
S-ErrorredoffError-free operation
blinkingIntegrated safety system is not accepted by standard device
S-AcknwyellowonParameter set acceptance must be acknowledged
S-EnableyellowblinkingSafety function active (non-safe display)
onWarning/fault/error
onController enabled
is not possible
has been established
Note!
The status of safety option 10 is only indicated via the "S-Enable" LED display.
Detected errors or maloperation of the drive are assigned to error states with definite responses.
The response can be co-ordinated with the complete drive via the error states.
FeaturesError status
System errorFaultWarning
EventFatal internal errorErrorMonitoring function
LED "S_Error"OnOnOn
State of the drive-based
safety system
The control category
according to EN 954-1...
ResponseThe motor is immediately
Acknowledgement after
event has been
eliminated
Lockout (CPU stopped)Error statusNormal operation
... has been abandoned... has not been abandoned
safely switched to torqueless
operation via
•STO
• Switching off and then on
again of the 24-V supply at
the safety module
The motor is immediately safely switched to torqueless
operation via
•STO
or shutdown via
• SS1 (parameterisable)
• Error acknowledgement (AIE) plug X62 (positive
signal pulse with a signal duration of 0.3 ... 10 s)
• Error acknowledgement (AIE) via safety bus (bit
"PS_AIE")
• Switching off and then on again of the 24-V supply
at the safety module
Note!
If the system error still occurs after switching the supply voltage, please contact the
Lenze service!
Error in PROFIsafe communication
When PROFIsafe is used as safety bus:
• If errors occur in the PROFIsafe communication, the data are passivated by the PROFIsafe driver.
• After the PROFIsafe communication is reinitialised, the drive reenabled if no standstill function
has been selected.
• Events which cause an error status are sent as a diagnostic telegram via the safety bus.
Logbook
The logbook function integrated in the controller records important events in the system in
chronological order, including error states of the drive-based safety system.
Tip!
When an online connection has been established, the logbook can be displayed in the
»Engineer« via the Logbook button on the Diagnostic tab for the controller.
Detailed information on the logbook can be found in the Online Help for the controller.
The drive-based safety system can be safely configured in the »Engineer« on the Safe configuration
tab for the SM301 safety module
[3-1]Example: Safe configuration tab for safety option 30
The parameters of the drive-based safety system are divided into different groups according to their
functions.
• A group is selected via the Parameter groups list field.
• Some parameter groups are divided into functional subgroups for a better overview which can
be selected via the buttons on the left.
• General parameters
• Safe inputs
(Safe inputs SD-In1 and SD-In2 are only available in connection with the safety option 30.)
• Stop functions
• Operation mode selection
• Safety bus
• In the parameter list all parameters of the parameter group/subgroup selected are displayed.
•The Value field serves to change the corresponding parameter value.
Change parameter settings
•The context menu (right mouse button) provides functions for the import/export of the
parameter settings.
Import/export parameter settings
( 42)
( 33)
( 25)
( 27)
( 31)
( 23)
( 24)
Tip!
If you put the mouse pointer over a parameter, further information on the parameter will
be displayed in a pop-up window.
If you select the entry "All parameters" in the Parameter groups list field, all parameters of
the drive-based safety system are displayed on the tab.
The FilePrint command in the »Engineer« menu bar serves to print all parameter settings
of the drive-based safety system for the purpose of documentation.
Changed parameters of the drive-based safety system are not transmitted automatically
to the device, even if an online connection has been established!
The parameter set for the drive-based safety system is only safely transmitted when
clicking the Send button in the Safe transfer dialog box!
Send safe data
How to change a parameter setting:
1. Select the parameter to be changed from the list.
2. Enter the new value into the Value column or select it from the defined options.
• Invalid or impermissible values are displayed in "red" in the input field.
• A selection from the list field may cause a deactivation of parameters which are now
irrelevant due to the selection (marked by a grey background colour).
3. Press <Return key> or click into another box to accept the changed value.
• By pressing the <Esc> key you can cancel the entry.
( 45)
Tip!
The parameter settings of the drive-based safety system can also be displayed in the
»Engineer« parameter list (tab All parameters category Safety option) and on the keypad.
Changes, however, are only possible via the Safe configuration tab!
For transmitting/copying the parameter settings of the drive-based safety system to other
controllers of the 8400 protec series with an identical safety option, the import/export functions
can be used which are available in the parameter list via the Context menu (right mouse button).
Command in the context menuInformation
Import...Import all parameter settings from the file.
Export...Export all parameter settings to the file.
UnlockingUnlock imported parameter settings.
• After the "Import" function has been executed, the imported parameter
settings are protected from change by the user. Only an explicit unlocking
enables a change again.
Import group...Import parameter settings of a group from a file.
• Only possible when selecting a parameter group.
Export group...Export parameter settings of a group to a file.
• Only possible when selecting a parameter group.
Unlock groupUnlock imported parameter settings of a group.
• After the "Import group" function has been executed, the imported
parameter settings are protected from change by the user. Only an
explicit unlocking enables a change again.
Before transmitting the parameter set to the drive-based safety system, a plausibility check always
takes place.
Note!
Only a plausible parameter set can be transmitted to the drive-based safety system
using the "Send safe data" function!
With the Plausibility check... command in the Context menu (right mouse button) of the parameter
list you can start the plausibility check manually, to check the changes made in the parameter
settings with regard to plausibility.
• After the plausibility check a status message indicates whether the plausibility check was
successful.
• If the plausibility check failed, the status message contains the parameters with implausible
settings.
Tip!
C15016
3.4General parameters
Short overview of "General" parameter group:
ParameterInformationLenze setting
-Module ID1
C15111
Module ID
Unique identification (1 ... 65534) for the safe device.
Safety address
The safety address serves as a unique identification of the drive-based safety system in systems
with several drives.
Setting of the safety address
displays the parameter set version of the drive-based safety system.
The safety address can be set via the "Safety address" parameter (C15111).
Setting via parameter setting
• Via the parameter "safety address" (C15111
Effective safety address
The effective safety address is the result of the setting via parameter setting.
• The effective safety address must match the module ID assigned in the safe parameter set.
• If "PROFIsafe" has been selected as safety bus, the effective safety address is accepted
simultaneously as the PROFIsafe target address. This address must match the corresponding
configuration of the safety PLC.
) addresses in the range of 0 ... 65534 can be set.
Stop functions with priority influence the process of already started subordinated functions.
1. Safe torque off (STO)
• The STO function has the highest priority and thus takes priority over all other functions.
Functions already started (e.g. SS1) are cancelled and the drive is switched off.
2. Safe stop 1 (SS1)
• Considering the stop time for SS1, the drive is switched to torque-free operation.
3. Monitoring functions
• The monitoring functions have the same priorities. They can be executed at the same time.
The restart behaviour of the drive after a stop function has been executed can be set via the
following parameters:
•"Restart behaviour - STO, SS1" (C15300/1
)
Danger!
If the request for the safety function is cancelled, the drive can restart automatically.
In case of an automatic restart, you have to provide external measures which ensure
that the drive only restarts after a confirmation (EN 60204).
Restart behaviour in case of setting "Acknowledged restart"
• After a standard stop the restart must be acknowledged (AIS) via terminal or safety bus.
• After an error stop, the error must be acknowledged first (AIE), before the restart is
acknowledged with AIS.
Acknowledgementvia terminalvia safety bus
AIS(Positive signal pulse with a signal duration
AIE(Positive signal pulse with a signal duration
Note!
The restart behaviour after an emergency stop corresponds to the restart behaviour
parameterised for the STO/SS1 stop function.
Restart behaviour in case of setting "Automatic restart"
The higher-level control must ensure that the drive only restarts after an acknowledgement. The
stop status of the drive is reported to the higher-level control via bit STO.
DescriptionThe emergency stop function starts STO or SS1, depending on the setting of the "emergency stop
ParameterC15205SSE: Emergency stop function
ActivationHow to activate the function:
function" parameter.
• In special operation the emergency stop cannot be avoided.
• Connect the emergency stop buttons, which must not be overruled by a special operation, to
the emergency stop function. For this purpose, parameterise the safe input as "emergency
stop" (C15031
• A data telegram with a corresponding content is sent to the controller via the safety bus.
Safety bus
• "OFF state" at a safe input which has been assigned to the function by parameter setting.
Safe inputs
).
• Selection of the function to be performed (STO
( 33)
( 42)
or SS1).
3.5.1.4Safe torque off (STO)
Safe torque off / STO (corresponds to a "Stop 0" according to EN 60204)
DescriptionBy using this function the power supply for the motor is safely interrupted immediately. The
PriorityPriority function: none
Function
ParameterFunction sequence and error response have no adjustable parameters.
ActivationHow to activate the function:
motor cannot generate a torque and thus no dangerous motions of the drive.
• Additional measures are required against movements caused by external forces, e.g.
mechanical brakes.
• The restart behaviour can be set. Restart behaviour
Subordinated function: SS1
• A data telegram with a corresponding content is sent to the controller via the safety bus.
Safety bus
• "OFF state" at a safe input which has been assigned to the function by parameter setting.
Safe stop 1 / SS1 (corresponds to a "Stop1" according to EN 60204)
DescriptionThe drive-based safety system monitors whether the drive has reached the set tolerance margin
PriorityPriority function: STO
Function
(n=0) within the parameterised stopping time and, after the stopping time has elapsed,
switches the drive to torque-free operation via the safety function STO
• The drive must be braked to standstill through the application!
• The speed is calculated from the standard device.
• Without an encoder, the function evaluates the speed status n=0 of the controller. In this
case the stopping time monitored by the drive-based safety system must be 0.5 s longer than
the stopping time parameterised on the controller.
• Additional measures are required against movements caused by external forces, e.g.
mechanical brakes. The application time of a brake must be considered when determining
the stopping time.
• A restart is only possible after the stopping time has elapsed completely. Restart behaviour
( 28)
.
Parameter C15305SS1, SS2: Stop time
ActivationHow to activate the function:
Normal
behaviour
Error behaviourIf standstill could not be reached when the stopping time has elapsed, an error message is
C15310
• A data telegram with a corresponding content is sent to the controller via the safety bus.
Safety bus
• "OFF state" at a safe input which has been assigned to the function by parameter setting.
Safe inputs
• As response to the error stop request.
• As response to the emergency stop request.
When the stopping time has elapsed, a standard stop is started.
• The power supply for the motor is safely interrupted immediately (STO
generate a torque and thus no dangerous movements of the drive.
generated and an error stop is started.
• The power supply for the motor is safely interrupted immediately (STO
generate a torque and thus no dangerous movements of the drive.
Short overview of "Safety functions Operation mode selection" parameter group:
ParameterInformationLenze setting
Value Unit
C15200OMS: Stop functionSTO
C15201
3.5.2.1Operation mode selector (OMS)
Operation Mode Selector / OMS
DescriptionThis function serves to switch between normal operation and "special operation" of the drive.
OMS: Motion functionFree traversing
The special operation enables the overriding of a standard stop (STO and SS1 ) by release
through an enable switch. Enable switch (ES)
( 32)
Conditions• A safe input must be parameterised and interconnected as an operation mode selector. You
Function
Parameter C15200OMS: Stop function
Requesting the
special operation
Deactivating the
special operation
Error behaviour• The emergency stop function can be triggered in both operating modes.
can only connect and parameterise one operation mode selector. The OMS bit of the safety
bus must be deactivated. (C15113
• The special operation can also be selected via the safety bus with the OMS bit unless a safety
input is set as an operation mode selector.
• The plausibility check rejects ambiguous settings until you have parameterised them
correctly.
Basic status of normal operation
If special operation is requested, the stop function parameterised for special operation
or SS1) is activated.
(STO
A release through the enable switch enables the motion function ( free traversing)
parameterised for the special operation.
C15201
How to request the special operation:
• " ON state " at a safe in put to which the "op eration mod e select or" function ha s be en assigned
by parameter setting. Safe inputs
• Only if no safe input is used, the function can be activated via the safety bus by sending a data
telegram with a corresponding content to the controller.
A change-over from special operation to normal operation is only possible when the drive is at
standstill (stop function STO
• For a restart, the restart must be acknowledged (AIS) via terminal or safety bus.
• The automatic restart is not permitted. If the "Automatic restart" is parameterised, this must
be prevented by special measures, e.g. programming in the master control.
OMS: Motion function
• The "Free traversing" setting must be suitable for the application!
This function enables overriding of the standard stop functions STO
operation.
A release via the enable switch activates the parameterised motion function during special
Conditions• A safe input must be parameterised and interconnected as an enable switch. You can only
ActivationHow to activate the function:
operation and the drive can be traversed.
The stopping times assigned to the stop functions are directly deactivated/stopped.
connect and parameterise one enable switch. The ES bit of the safety bus must be
deactivated (C15113
• The confirmation can also be selected via the safety bus using the ES bit unless a safe input
is set as an enable switch.
• The special operation must be activated. Operation mode selector (OMS)
• The plausibility check rejects ambiguous settings until you have parameterised them
correctly.
• "ON state" at a safe input to which the "enable switch" function has been assigned by
parameter setting. Safe inputs
• Only if no safe input is used, the function can be activated via the safety bus by sending a data
telegram with a corresponding content to the controller.
The drive-based safety system provides parameterisable interfaces for standardised safety bus
systems. By selecting the bus system, the corresponding parameters are made available.
Short overview of "Safety bus" parameter group:
ParameterInformationLenze setting
C15100
C15113
Unlisted bits are reserved for future extensions!
S bus: ConfigurationNo safety bus
S bus: Filter control data (bit-coded):
Bit 0 STO
Bit 1 SS1
Bit 9 ESPassing through
Bit 11 OMS
Bit 16 PS_AIS
Bit 17 PS_AIEPassing through
Bit 23 SSE
Passing through
Passing through
Passing through
Passing through
Passing through
S bus: Configuration
Selection of the safety bus system used. Communication modes that are currently being supported:
• Operation without safety bus
• Operation with PROFIsafe protocol
S bus: Filter control data
Unused functions in the control data of the safety bus must be set to "Inhibit" via this parameter.
Then, these functions cannot be activated anymore via the safety bus independently of the
transmitted control data.
The safety options 20 and 30 support the transmission of safe information via the PROFIsafe
protocol according to the specification "PROFIsafe -Profile for Safety Technology", version 2.0, of the
PROFIBUS Nutzerorganisation (PNO). The controller transmits the PROFIsafe information to the
drive-based safety system for safe evaluation.
The operation with PROFIsafe via PROFINET is only permissible in accordance with the
specification "PROFIsafe-Profile for Safety Technology", version 2.0.
Addressing
In order that a data telegram reaches the correct device, a unique PROFIsafe target address is
required. If "PROFIsafe" has been selected as safety bus, the safety address is accepted
simultaneously as the PROFIsafe target address. This address must match the corresponding
configuration of the safety PLC.
Setting of the safety address
PROFIsafe frame
( 26)
Note!
The PROFIsafe data is sent in the second slot of a PROFINET data telegram. This must be
observed for the hardware configuration of the safety PLC!
Unused functions in the control data of the safety bus must be set to "Inhibit" via the parameter
"S bus: Control data filter" (C15113
safety bus independently of the transmitted control data.
[3-2]Function example - filter
From version 1.2 of the drive-based safety system, the filtered control data is displayed in the
parameter "S bus: Control data display" (C15115
). Then, these functions cannot be activated anymore via the
Control data, incoming
(0 = active, 1 = inactive)
Control data filter
(Selection in the »Engineer«: a = "pass through", i = "inhibit")
Effective control data
(0 = active, 1 = inactive)
):
Parameter | Name:
C15115 | S bus: display control data
Display of the safety bus control data after being filtered via C15113
Value is bit-coded:Information
(From version 1.2 of the drive-based safety system)
Bit 0 STOSafe torque off
Bit 1 SS1 Safe stop 1
Bit 9 ESSafe enable switch
Bit 11 OMSSafe operation mode selector
Bit 16 PS_AISRestart acknowledgement via safety bus
Bit 17 PS_AIEError acknowledgement via safety bus
Bit 23 SSEEmergency stop function
Read access Write access CINH PLC-STOP No transfer
The PROFIsafe input data (status information) is transmitted from the drive-based safety system to
the control system.
BitNameValueMeaning
0 STO active1The STO function is active and the drive is safely switched to
1 SS1 active1The SS1 function is active.
9 ES active1ES function is active during special operation: Motion function
0ES function is not active during special operation: Stop function
11 OMS0Normal operation is requested.
23 SSE active1The SSE function is active.
24 SD-In11Sensor at I1A and I1B: Channels A and B are in ON state.
25 SD-In21Sensor at I2A and I2B: Channels A and B are in ON state.
29 OMS active1The OMS function is active: Special operation.
31 Error active1Error status is active (fault or warning).
Unlisted bits are reserved for future extensions and must be transmitted with "0"!
0The OMS function is not active: Normal operation.
torque-free operation.
• This bit is also set by SS1 after the stopping time has elapsed.
• At the end of the function the bit 0 (STO active) is set.
• When the emergency stop function STO is parameterised, bit 0
(STO active) is set as well.
• When the emergency stop function SS1 is parameterised, first
bit 1 (SS1 active) is set and at the end of the function bit 0 (STO
active) is set.
• In contrast to bit 11 (OMS), this bit remains set until the special
operation is cancelled and the change-over to normal operation
has taken place via the stop function.
[3-5]Detailed specification of the PROFIsafe input data
The safety option 30 provides interfaces for connecting active or passive sensors.
In the following chapter, the safe configuration of the safe inputs is explained.
5.1Safe inputs
General information
The following applies to the connection of safety sensors:
• Sensor type and function can be parameterised.
• A local evaluation is carried out if a corresponding parameter setting has been made.
• If a safety bus is activated, the sensor signals are sent as status information to the master
control.
• Deactivated sensor inputs must not be connected. The status of a non-connected input is in the
OFF state.
• If a signal is detected at a deactivated sensor input during initialisation, the drive remains
inhibited (STO
).
• Faulty inputs are evaluated as OFF state.
Note!
Make sure that an internal contact function test is carried out at the safe inputs:
• Safe input in the ON state
• A LOW level at one channel
monitoring starts simultaneously.
• A LOW level must be detected at both channels
otherwise a discrepancy error will be reported.
• To be able to confirm the discrepancy error, a LOW level must be detected before at
both channels
• Safe input in the OFF state
• A HIGH level at one channel
• A HIGH level must be detected at both channels
otherwise a discrepancy error will be reported.
• To be able to confirm the discrepancy error, a HIGH level must be detected before
at both channels
.
.
puts the input in the OFF state. The discrepancy
within the discrepancy time,
starts the discrepancy monitoring.
within the discrepancy time,
Tip!
Detailed information on the contact function test, the connection of passive/active sensors
and example circuits can be found in the manual for the drive-based safety system.
C15030/1...2SD-In1...2 sensor typeInput is deactivated
C15031/1...2
C15032/1...2
C15033/1...2SD-In1...2 discrepancy time10 ms
C15034/1...2
Sensor type/sensor function
Sensor type and function can be parameterised.
SD-In1...2 sensor functionFree assignment
SD-In1...2 free assignmentSTO
SD-In1...2 input delay0 ms
Note!
If an error (e.g. a discrepancy error) occurs at a safe input to which the "operation mode
selector" sensor function is assigned, then normal operation (corresponding to the OFF
state) is selected.
• The LED "S_Error" is blinking, no STO
• Special operation can only be selected again if the error has been eliminated and
acknowledged.
is tripped.
Tip!
Detailed information on sensor inputs, active and passive sensors can be found in the
manual for the drive-based safety system.
Free assignment
If "Free assignment" has been selected as sensor function, the safety function selected via this
parameter is assigned to the safe input. The following safety functions can be selected:
• Safe torque off (STO) ( 29)
• Safe stop 1 (SS1)
( 30)
Note!
If "No function" has been selected, no safety function is assigned to the safe input.
Function test and monitoring of the discrepancy time remain active and the status of
the input is transmitted to the control via the safety bus (if parameterised).
Discrepancy time
Maximum time for which both channels of a safe input may have non-equivalent states without
the safety engineering detecting an error.
Input delay
Time between the recognition of the signal change and the effective evaluation of an input signal.
As a result, multiple and short signal changes due to contact bounce of the components are not
taken into account.
The functions for a safe parameter transfer are
available in the Safe transfer dialog box.
The Safe transfer dialog box is opened via the Safe transfer button on the Safe configuration tab.
By clicking the More >> button in the Safe transfer
dialog box, the functions for password
management and general reset are displayed in
addition.
A renewed click on the button now labelled with
<< Reduce hides these functions again.
Note!
To execute the functions for a safe parameter transfer, you have to enter a device
password!
When the memory module is used for the first time together with the drive-based safety
system, the required password file for the safe parameter transfer is not yet available in
the memory module and the error message "Reading of the password file failed" is
displayed. In this case a general reset of the device is required!
With a general reset, the safe parameter set is deleted in the memory module and in the
drive-based safety system and the required password file is created in the memory
module. After this, the drive-based safety system must be re-parameterised. General
After the drive-based safety system has been completely parameterised via the Safe configuration
tab, the parameter set can be safely transmitted to the device using this function.
Note!
This function serves to overwrite the current parameter settings of the safety system
with the settings in the »Engineer«!
Before the parameter set is transferred to the drive-based safety system, a plausibility
check is always carried out. Only a plausible parameter set can be transferred to the
safety system of the controller!
Before the safe parameter set is transferred, the module ID is checked. If the module ID
defined in the parameter set does not
based system, a confirmation prompt appears in order to prevent an unintended change
of the module ID through parameter setting.
• If - after having checked the module IDs - you answer the confirmation prompt with
Yes, the module ID defined in the parameter set is stored in the non-volatile memory
of the controller.
• C15017
transfer.
• The module ID stored in the controller also remains available after a general reset.
displays the module ID stored in the controller at the last parameter set
correspond to the module ID saved in the drive-
How to transmit the parameter set to the device:
1. Unless there is an online connection, establish an online connection to the device.
2. Go to the Safe transfer dialog box and click Send.
• A confirmation prompt appears asking whether the parameter is really to be
transmitted to the device.
3. Answer the confirmation prompt with Yes to continue the action.
If you are not yet registered as a user, first the Password entry dialog box is displayed.
4. Enter the device password and confirm with OK.
• Unless an individual password has been defined, enter the standard password "Lenze
SM301".
• After the password has been entered, you are registered as a user for a time period of 30
minutes. Within this period, the password does not need to be entered again for calling
a password-protected function if the online connection to the device remains
established without any interruptions.
After the registration, the parameter set is transmitted to the device, and a status message
displays whether the action was successful.
After the parameter set has been transmitted, make a check of the item designation and
a check/acceptance of the safety functions!
Detailed information on the check/acceptance can be found in the manual for drive
based safety of the 8400 protec series.
6.2Read safe data from device
Note!
This function serves to overwrite the parameter settings in the »Engineer« with the
current settings of the drive-based safety system!
Only a valid parameter set can be read back from the drive-based safety system.
How to read the parameter set from the device:
1. Unless there is an online connection, establish an online connection to the device.
2. Go to the Safe transfer dialog box and click Upload.
• A confirmation prompt appears asking whether the parameter is really to be uploaded
from the device.
3. Answer the confirmation prompt with Yes to continue the action.
If you are not yet registered as a user, first the Password entry dialog box is displayed.
4. Enter the device password and confirm with OK.
• Unless an individual password has been defined, enter the standard password "Lenze
SM301".
• After the password has been entered, you are registered as a user for a time period of 30
minutes. Within this period, the password does not need to be entered again for calling
a password-protected function if the online connection to the device remains
established without any interruptions.
After the registration, the parameter set is uploaded from the device, and a status message
displays whether the action was successful.
1. Go to the Safe transfer dialog box and click Write file.
•The Safe parameter set dialog box is displayed.
2. Select the directory from the Save in list field, in which the file is to be saved.
3. Enter a file name into the File name input field.
4. Click Save.
• The current parameter settings are saved in the selected parameter set file (*.bin) and
the Save parameter set dialog box is closed.
• After this, a status message displays whether the action could be carried out
successfully.
5. Confirm the status message with OK.
6.4Read parameter set out of file
Note!
This function serves to overwrite the parameter settings in the »Engineer« with the
settings of the selected parameter set file (*.bin)!
How to read the parameter set out of the file:
1. Go to the Safe transfer dialog box and click Read file.
• A confirmation prompt appears asking whether the data is really to be uploaded and the
parameter settings in the »Engineer« are to be overwritten.
2. Answer the confirmation prompt with Yes to continue the action.
•The Read parameter set dialog box is displayed.
3. Select the directory which contains the file to be read from the Search in list field.
4. Enter the name of the file to be read into the File name input field.
5. Click Open.
• The current parameter settings are overwritten with the settings of the selected
parameter set file (*.bin) and the Open parameter set dialog box is closed.
• After this, a status message displays whether the action could be carried out
successfully.
A general reset is, among other things, required for initialising the memory module if the controller
(with the memory module) is used together with the drive-based safety system for the first time.
Note!
This function serves to reset the safety system to the delivery status.
• The safe parameter set in the memory module and in the drive-based safety system is
deleted.
• The password file required for the safe parameter transfer is re-created in the memory
module. This causes the individual device password defined before to be reset to the
standard password.
• Afterwards the drive-based safety system must be re-parameterised.
How to execute a general reset of the device:
1. Unless there is an online connection, establish an online connection to the device.
2. Go to the advanced Safe transfer dialog box and click As-delivered.
•The Standard password entry dialog box is displayed.
3. Enter the standard password and confirm with OK.
• The standard password is "Lenze SM301".
The general reset is executed and then a status message displays whether the action could
be carried out successfully.
For a safe parameter transfer, the device password must be entered.
• For initial commissioning, the standard password "Lenze SM301" has to be used as device
password.
•The Change Password function serves to define an individual device password.
Note!
After the password has been entered, you are registered as a user for a time period of 30
minutes.
• Within this period, the password does not need to be entered again for calling a
password-protected function if the online connection to the device remains
established without any interruptions.
• The status of registration is displayed in the bottom right corner of the Safe transfer
dialog box.
•Click the Logout User button to log out before the 30 minutes have elapsed.
Change Password
This function serves to define an individual device password.
How to change the device password:
1. Unless there is an online connection, establish an online connection to the device.
2. Go to the advanced Safe transfer dialog box and enter the new password into the New Password input field.
• The password must have at least 6 characters.
3. For verifying the new password re-enter it into the Verify Password input field.
• Only if this input matches the input in the New Password input field, the password can
be changed.
4. Click the Change Password button.
If you are not yet registered as a user, first the Password entry dialog box is displayed.
5. Enter the device password and confirm with OK.
• Unless an individual password has been defined, enter the standard password "Lenze
SM301".
After log-on the password is changed and then a status message displays whether the
action could be carried out successfully.
This chapter supplements the parameter list and the table of attributes provided in the
online documentation for the controller by parameters of drive-based safety system.
Tip!
General information on parameters can be found in the online documentation for the
controller.
7.1Parameter list
This chapter lists all parameters of the safety option 30 in numerically ascending order.
Note!
Parameter settings are only possible via the Safe configuration tab!
Safe configuration
Only read access is possible to the parameters of the drive-based safety system via the
»Engineer« parameter list (tab All parameters category Safety Option 30) and the
keypad!
• In the low byte the status is displayed:
0x00: No command
0x01: Command executed
0x02: Password invalid
0x03: Command in process
0x04: Command not known
0x05: Command error
Display range (min. value | unit | max. value)
02309
Read access Write access CINH PLC STOP No transfer Scaling factor: 1
Parameter | Name:
C15010 | Parameter set status
Selection list (read only)
0 No parameter set
1 Valid parameter set
2 Read error - memory module
3 Unequal parameter set
4 CRC error
5 Version error
6 Format error
7 Plausibility error
8 Assignment error
9 Local read error
10 Communication error standard
device
Read access Write access CINH PLC STOP No transfer Scaling factor: 1
Data type: UNSIGNED_16
Index: 9572
Data type: UNSIGNED_8
Index: 9565
= 2564
d
= 255D
d
h
h
C15011
C15012
52
Parameter | Name:
C15011 | Parameter CRC
Parameter checksum (CRC = Cyclic Redundancy Code)
Display range (min. value | unit | max. value)
04294967295
SubcodesInformation
C15011/1CRC safety system
C15011/2CRC memory module
Read access Write access CINH PLC STOP No transfer Scaling factor: 1
Parameter | Name:
C15012 | Password
This code is for device-internal use only and must not be written to by the user!
Maximum time for which both channels of a safe input may have non-equivalent states without the safety
engineering detecting an error.
Display range (min. value | unit | max. value)
0ms30000
SubcodesInformation
C15033/1SD-In1 discrepancy time
C15033/2SD-In2 discrepancy time
Read access Write access CINH PLC STOP No transfer Scaling factor: 1
Parameter | Name:
C15034 | SD-In Input delay
Data type: UNSIGNED_8
Index: 9541
d
Time between the recognition of the signal change and the effective evaluation of an input signal. As a result,
multiple and short signal changes due to contact bounce of the components are not taken into account.
Display range (min. value | unit | max. value)
0ms100
SubcodesInformation
C15034/1SD-In1 input delay
C15034/2SD-In2 input delay
Read access Write access CINH PLC STOP No transfer Scaling factor: 1
= 2546
= 2545
h
h
C15036
Parameter | Name:
C15035 | C15035
This code is for device-internal use only and must not be written to by the user!
Parameter | Name:
C15036 | C15036
This code is for device-internal use only and must not be written to by the user!
Parameter CRC (C15011) 52
Parameter list 50
Parameter set creation time (C15013) 53
Parameter set status (C15010) 52
Parameter set version (C15016) 53
Password file 44
Password management 49
Plausibility check 25, 45
PROFIsafe 34
R
Read parameter set from device 46
Read parameter set out of file 47
Read safe data from device 46
Restart behaviour (C15300) 60
S
S bus
Configuration (C15100)
Display control data (C15115) 59
Filter control data (C15113) 58
Safe torque off (STO) 29
Safety address (C15111) 57
Safety instructions 8
Safety system (status LEDs) 20
SD-In Discrepancy time (C15033) 55
SD-In Free assignment (C15032) 54
SD-In Input delay (C15034) 55
SD-In Sensor function (C15031) 54
SD-In Sensor type (C15030) 54
Send safe data 45
Sensor function 43
Sensor type 43
Service code (C15801) 62
Service code (C15805) 63
Service code (C15810) 63
SMS 34
SS1 30
Stop time (C15305) 60
SSE 29
Emergency stop function (C15205) 60
Standard password 49
Status displays for the safety system 20
Status of safety functions (C15000) 51
STO 29
Stored module ID (C15017) 53
System error 21
57
T
Target group 4
Time of RTC parameter setting (C15014) 53
Time of sec. parameter setting (C15015) 53