Siemens SIMATIC User manual

SIEMENS
SIMATIC
Fail-safe function blocks
for storage and retrieval machines
Distributed Safety/
TIA Safety Advanced
Manual
Important Notes
Table of Contents
Storage and retrieval
machines and safety functions
1
System and software
requirements
2
Fail-safe function blocks for
storage and retrieval
machines
3
Block interaction
4
Abbreviations
5
Support
6
Appendix
7
Notes
8
06/2014 Edition
Version v1.0

Safety notices Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - i -
Safety instructions
This manual contains information which you should observe in order to ensure your own personal safety, as well
as to avoid material damage. These notices are highlighted in the manual by a warning triangle and marked as
follows according to the level of danger:
Safety notes and instructions
is important information, which is of significance for the acceptance and the safety-related use of the
product.
Warning
indicates that death, severe injury or substantial property damage can result if proper precautions are
not taken.
Caution
indicates that minor personal injury or property damage may result if proper precautions are not taken.
Note
is important information about the product, the way to handle the product or the respective part of the
documentation and we wish to especially bring this to your notice.
Qualified personnel
Commissioning and operation of a device are to be carried out by qualified personnel only. Qualified personnel
under the terms of the safety instructions contained in this manual are defined as persons who are authorized to
commission, ground and label devices, systems and circuits in accordance with established safety practices and
standards.
Proper and intended use
Please observe the following:
Warning
The product may only be used for the applications specified in the catalog and technical description,
and only in conjunction with third-party equipment and components if these have been specifically
recommended or approved by Siemens.
This product can function correctly and reliably only if it is transported, stored, assembled, and in-
stalled correctly, and operated and maintained as recommended.
Trademarks
SIMATIC® is a registered trademark of Siemens AG.
Other designations used in this document may be registered trademarks; the owner’s rights may be
violated if they are used by third parties for their own purposes.
Copyright © Siemens AG 2014 All rights reserved
The reproduction, transmission, or use of this document or its content
is not permitted without express written authority. Offenders will be
liable for damages. All rights, including rights created by patent grant
or registration or a utility model or design, are reserved.
Siemens AG
Industry Sector
D-Erlangen
!
!
!
!

Safety notices Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - ii -
Warranty and liability regarding the application
examples
The application examples of the software library „RBG_Failsafe_DS_V5_4“ or
„RBG_Failsafe_TS_V13“ (following “application example”) of Siemens AG are a free
of charge service for our customers. The application examples are to be understood
as non-binding and they could be incomplete concerning configuration and
equipment. The application examples shall not constitute customized solutions, but
rather simply provide support for typical questions. Every customer is responsible
for appropriate conditions and operations of the products within the valid regulations
and has to control the results of the application examples and adapt them
individually to its system.
Any claims against us –based on whatever legal reason –resulting from the use of
the examples, information, programs, engineering and performance data etc.,
described in this Application Example shall be excluded. Such an exclusion shall not
apply in the case of mandatory liability, e.g. under the German Product Liability Act
(“Produkthaftungsgesetz”), in case of intent, gross negligence, or injury of life, body
or health, guarantee for the quality of a product, fraudulent concealment of a
deficiency or breach of a condition which goes to the root of the contract
(“wesentliche Vertragspflichten”). The damages for a breach of a substantial
contractual obligation are, however, limited to the foreseeable damage, typical for the
type of contract, except in the event of intent or gross negligence or injury to life,
body or health. The above provisions do not imply a change of the burden of proof to
your detriment.
When using these Application Examples, you recognize that we cannot be made
liable for any damage/claims beyond the liability clause described. We reserve the
right to make changes to these Application Examples at any time without prior
notice. If there are any deviations between the recommendations provided in these
application examples and other Siemens publications –e.g. Catalogs –the contents
of the other documents have priority.
We do not accept any liability for the information contained in this document.
Transfer and reproduction of these application examples or extracts of them are
forbidden if not explicit allowed by the Siemens AG.
Security information
Siemens provides products and solutions with industrial security functions that sup-
port the secure operation of plants, solutions, machines, equipment and/or networks.
They are important components in a holistic industrial security concept. With this in
mind, Siemens’ products and solutions undergo continuous development. Siemens
recommends strongly that you regularly check for product updates.
For the secure operation of Siemens products and solutions, it is necessary to take
suitable preventive action (e.g. cell protection concept) and integrate each compo-
nent into a holistic, state-of-the-art industrial security concept. Third-party products
that may be in use should also be considered. For more information about industrial
security, visit http://www.siemens.com/industrialsecurity.
To stay informed about product updates as they occur, sign up for a product-specific
newsletter. For more information, visit http://support.automation.siemens.com.

Table of contents
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - ii -
Table of contents
1Storage and retrieval machines and safety functions............................................. 1-6
1.1 General design for safety-related position sensing................................................................1-6
1.2 Supported encoder combinations and mechanical design versions......................................1-6
1.2.1 Safety-related motor encoder with positively-driven mechanical system.......................1-6
1.2.2 Two-encoder system with connection via SINAMICS S120...........................................1-7
1.2.3 Two-encoder system with connection via distributed I/O ...............................................1-7
1.2.4 Three-encoder system....................................................................................................1-8
1.2.5 Summary of the encoder versions..................................................................................1-9
1.2.6 Safety-related parameters of the encoder versions........................................................1-9
1.2.6.1 Subsystem C according to DIN EN 62061 (Chapter 6.7.8.2.4):............................1-10
1.2.6.2 Subsystem D according to DIN EN 62061 (Chapter 6.7.8.2.5):............................1-10
2System and software requirements.......................................................................... 2-0
2.1 General ..................................................................................................................................2-0
2.2 Safety requirements...............................................................................................................2-0
2.3 Software.................................................................................................................................2-0
2.4 Safety aspects when generating the blocks ..........................................................................2-1
2.5 Standards that are complied with...........................................................................................2-1
2.5.1 Demarcation of DIN EN 528 to the ASRS block library..................................................2-1
3Fail-safe function blocks for storage and retrieval machines ................................ 3-4
3.1 Overview ................................................................................................................................3-4
3.1.1 Safety notes and instructions..........................................................................................3-4
3.1.2 Fail-safe blocks...............................................................................................................3-4
3.1.3 Block connections...........................................................................................................3-5
3.1.4 Block numbers and signatures .......................................................................................3-6
3.1.5 Integration in cyclic interrupts - OBs...............................................................................3-6
3.1.6 Using data blocks/multi-instances ..................................................................................3-7
3.1.7 Response times..............................................................................................................3-7
3.1.8 Execution times...............................................................................................................3-7
3.2 Fail-safe function block F_SAFE_POS..................................................................................3-8
3.2.1 Introduction.....................................................................................................................3-8
3.2.2 Connections..................................................................................................................3-10
3.2.2.1 Inputs.....................................................................................................................3-10
3.2.2.2 Outputs..................................................................................................................3-11
3.2.2.3 Structure of DIAG ..................................................................................................3-12
3.2.3 Interrelationship between the assignment of the block inputs and the drive configuration
3-13
3.2.4 Principle of operation....................................................................................................3-15
3.2.4.1 Parameterization ...................................................................................................3-15
3.2.4.2 Starting characteristics..........................................................................................3-16
3.2.4.3 Actual position value..............................................................................................3-17
3.2.4.4 Actual velocity value..............................................................................................3-17
3.2.4.5 Referencing ...........................................................................................................3-18
3.2.4.6 Synchronizing encoders ........................................................................................3-18
3.2.4.7 Acknowledging faults.............................................................................................3-19
3.2.5 Additional diagnostic functions .....................................................................................3-19
3.3 Fail-safe function block F_SCALE_DINT.............................................................................3-20
3.3.1 Introduction...................................................................................................................3-20
3.3.2 Connections..................................................................................................................3-20
3.3.2.1 Inputs.....................................................................................................................3-20
3.3.2.2 Outputs..................................................................................................................3-21
3.3.3 Principle of operation....................................................................................................3-21
3.3.3.1 Parameterization ...................................................................................................3-21
3.3.3.2 Output of the scaling result....................................................................................3-22
3.3.3.3 Error response.......................................................................................................3-22
3.4 SCALE_DINT function .........................................................................................................3-23

Table of contents
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - iii -
3.4.1 Introduction...................................................................................................................3-23
3.4.2 Connections..................................................................................................................3-23
3.4.2.1 Inputs.....................................................................................................................3-23
3.4.2.2 Outputs..................................................................................................................3-23
3.4.3 Principle of operation....................................................................................................3-23
3.4.3.1 Parameterization ...................................................................................................3-23
3.4.3.2 Protective mechanisms and fault detection...........................................................3-24
3.4.3.3 Error response.......................................................................................................3-24
3.4.3.4 Timing....................................................................................................................3-24
3.5 Fail-safe function block F_SLP_MONITOR.........................................................................3-25
3.5.1 Introduction...................................................................................................................3-25
3.5.1 Connections..................................................................................................................3-25
3.5.1.1 Inputs.....................................................................................................................3-25
3.5.1.2 Outputs..................................................................................................................3-26
3.5.1.3 Structure of DIAG ..................................................................................................3-27
3.5.2 Principle of operation....................................................................................................3-28
3.5.2.1 Parameterization ...................................................................................................3-28
3.5.2.2 Position monitoring................................................................................................3-28
3.5.2.3 Retracting ..............................................................................................................3-28
3.5.2.4 Acknowledging faults.............................................................................................3-30
3.6 Fail-safe function block F_ENDZONE .................................................................................3-31
3.6.1 Introduction...................................................................................................................3-31
3.6.2 Connections..................................................................................................................3-32
3.6.2.1 Inputs.....................................................................................................................3-32
3.6.2.2 Outputs..................................................................................................................3-33
3.6.2.3 Structure of DIAG ..................................................................................................3-33
3.6.3 Principle of operation....................................................................................................3-34
3.6.3.1 Parameterization ...................................................................................................3-34
3.6.3.2 Position and velocity monitoring............................................................................3-35
3.6.3.3 Retracting ..............................................................................................................3-36
3.6.3.4 Acknowledging faults.............................................................................................3-37
3.7 Fail-safe function block F_SBR_MONITOR ........................................................................3-38
3.7.1 Introduction...................................................................................................................3-38
3.7.2 Connections..................................................................................................................3-38
3.7.2.1 Inputs.....................................................................................................................3-38
3.7.2.2 Outputs..................................................................................................................3-39
3.7.2.3 Structure of DIAG ..................................................................................................3-40
3.7.3 Principle of operation....................................................................................................3-40
3.7.3.1 Parameterization ...................................................................................................3-40
3.7.3.2 Ramp monitoring ...................................................................................................3-41
3.7.3.3 Acknowledging faults.............................................................................................3-41
3.8 Fail-safe function block F_BRAKE_TEST ...........................................................................3-42
3.8.1 Introduction...................................................................................................................3-42
3.8.1 Connections..................................................................................................................3-43
3.8.1.1 Inputs.....................................................................................................................3-43
3.8.1.2 Outputs..................................................................................................................3-45
3.8.1.3 Structure of DIAG ..................................................................................................3-46
3.8.2 Principle of operation....................................................................................................3-47
3.8.2.1 Parameterization ...................................................................................................3-47
3.8.2.2 Interface to the SINAMICS S120...........................................................................3-47
3.8.2.2.1 Communication direction F_BRAKE_TEST -> SINAMICS S120 ......................3-47
3.8.2.2.2 Communication direction, SINAMICS S120 -> F_BRAKE_TEST .....................3-48
3.8.2.2.3 Setting the safe brake test in the inverter..........................................................3-48
3.8.2.3 Test sequence and error handling.........................................................................3-49
3.8.2.4 Testing an external brake......................................................................................3-50
3.8.2.5 Testing a motor holding brake...............................................................................3-50
3.8.2.6 Test completed......................................................................................................3-51
3.8.2.7 Acknowledging faults.............................................................................................3-51
3.8.3 Application example for safely controlling external brakes...........................................3-51
3.9 Fail-safe function block F_LOAD_MONITOR......................................................................3-54
3.9.1 Introduction...................................................................................................................3-54
3.9.1 Connections..................................................................................................................3-55

Table of contents
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - iv -
3.9.1.1 Inputs.....................................................................................................................3-55
3.9.1.2 Outputs..................................................................................................................3-56
3.9.1.3 Structure of DIAG ..................................................................................................3-57
3.9.2 Scaling the input variables............................................................................................3-58
3.9.3 Principle of operation....................................................................................................3-58
3.9.3.1 Parameterization ...................................................................................................3-58
3.9.3.2 Load monitoring.....................................................................................................3-58
3.9.3.3 Retracting ..............................................................................................................3-59
3.9.3.4 Testing the measuring equipment.........................................................................3-59
3.9.3.4.1 Case a): Test with constant load .......................................................................3-60
3.9.3.4.2 Case b): Test with a defined load step ..............................................................3-60
3.9.3.5 Acknowledging faults:............................................................................................3-60
3.10 Fail-safe function F_MIN_MAX ........................................................................................3-61
3.10.1 Introduction...................................................................................................................3-61
3.10.2 Connections..................................................................................................................3-61
3.10.2.1 Inputs.....................................................................................................................3-61
3.10.2.2 Outputs..................................................................................................................3-61
3.10.3Principle of operation....................................................................................................3-61
3.10.3.1 Parameterization ...................................................................................................3-61
3.10.3.2 Determining the minimum/maximum value ...........................................................3-62
4Block interaction........................................................................................................ 4-1
4.1 Overview ................................................................................................................................4-1
4.2 Signal flow between the components ....................................................................................4-1
4.2.1 Automation task..............................................................................................................4-1
4.3 Response in the case of an error...........................................................................................4-2
4.4 Block interconnection.............................................................................................................4-3
4.4.4 Additionally required blocks............................................................................................4-0
4.4.5 Further information .........................................................................................................4-1
5Abbreviations............................................................................................................. 5-0
6Support....................................................................................................................... 6-1
7Appendix .................................................................................................................... 7-1
7.1 Table with the ASRS block runtimes......................................................................................7-1
8Notes........................................................................................................................... 8-1

Table of contents
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - v -
List of diagrams
Figure 1: Hardware structure ............................................................................................................................... 1-6
Figure 2: Single-encoder system........................................................................................................................... 1-7
Figure 3: Two-encoder system, version 1 ............................................................................................................. 1-7
Figure 4: Two-encoder system, version 2 ............................................................................................................. 1-7
Figure 5: Two-encoder system, version 3 ............................................................................................................. 1-8
Figure 6: Three encoder system, version 1 ........................................................................................................... 1-8
Figure 7: Three encoder system, version 2 ........................................................................................................... 1-8
Figure 8: Block signatures .................................................................................................................................... 3-6
Figure 9: Scaling factor p9574............................................................................................................................ 3-13
Figure 10: SI configuration ................................................................................................................................. 3-14
Figure 11: Encoder parameterization................................................................................................................. 3-14
Figure 12: Setting the safe brake test ................................................................................................................ 3-48
Figure 13: Block interconnection, Part 1 .............................................................................................................. 4-3
Figure 14: Block interconnection, Part 2 .............................................................................................................. 4-1
Figure 15: Block interconnection, Part 3 .............................................................................................................. 4-2
List of tables
Table 1: Overview of possible encoder combinations .......................................................................................... 1-9
Table 2: Parameters according to DIN EN 62061 ............................................................................................... 1-11
Table 3: Assessing common cause faults according to DIN EN 62061 Annex F.1............................................... 1-13
Table 4: DIN EN 62061 Annex F.2....................................................................................................................... 1-13

Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 1-6 -
1 Storage and retrieval machines and safety functions
This chapter schematically provides an overview of the application conditions of fail-safe function blocks for
storage and retrieval machines and the mechanical hardware versions that are supported.
1.1 General design for safety-related position sensing
The following components are essentially required for use in the fail-safety function blocks for storage and
retrieval machines known in the following as "ASRS blocks".
Fail-safe SIMATIC S7 control –Distributed Safety/Safety Advanced
SINAMICS S120 inverters with CU320-2 (from firmware release 4.6), called SINAMICS S120 in the
following, equipped with an encoder
oSMC20/SMC30
oor via DRIVE-CLiQ.
PROFIBUS/PROFINET data transfer between SINAMICS and F-CPU
F-DO module to control the brakes
F-AI module or comparable safety-related signal source for load measurement for overload/slack
cable detection
External mechanical brake and/or motor holding brake
An example of the hardware structure looks like this:
Figure 1: Hardware structure
The package of blocks addresses several versions of encoder combinations, also see Table 1. As a con-
sequence, the following components may be additionally required:
1.2 Supported encoder combinations and mechanical design versions
An overview of the encoder combinations supported by the ASRS blocks is provided in the following.
1.2.1 Safety-related motor encoder with positively-driven mechanical system
Sensing:
Safety-related sin/cos motor encoders with safety-related connection via PROFIsafe telegram 901
of SINAMICS S120.
The absolute position is transferred to the F-CPU from the SINAMICS S120 using a standard tele-
gram.
The position actual value of EPOS must be additionally transferred via the standard telegram to obtain the
two-channel structure for data transfer to the F-CPU. The position actual value of the motor encoder is
additionally determined by SI and is transferred to the F-CPU using a safety-related telegram. The motor
encoder must be a safety encoder (safety-related motor encoder with safety-related mounting).
As a consequence, the signal flow of the safety function looks like this:

Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 1-7 -
Figure 2: Single-encoder system
1.2.2 Two-encoder system with connection via SINAMICS S120
Sensing:
The sin/cos motor encoder is connected with the SINAMICS S120 via an SMC20 or a DRIVE CLiQ
interface (SMI), the direct measuring system (SSI) via an SMC30. The position control of the EPOS
is realized via the direct measuring system.
The position actual value of EPOS (basic positioner, drive function) must be transferred via the standard
telegram to obtain the two-channel structure for data transfer to the F-CPU. The position actual value of the
motor encoder is determined by SI and is transferred to the F-CPU using a safety-related telegram. The
motor encoder must be a safety-related encoder, suitable for safety applications. Safety-related mounting is
not required, as possible errors are monitored using the cross comparison with the second encoder.
Figure 3: Two-encoder system, version 1
1.2.3 Two-encoder system with connection via distributed I/O
Sensing:
a) Sin/cos motor encoder via PROFIsafe telegram from SINAMICS S120, direct measuring
system using a standard telegram of the SSI module (e.g. SM338) to the F-CPU.
Figure 4: Two-encoder system, version 2
b) Sin/cos motor encoder via PROFIsafe telegram from SINAMICS S120, direct encoder using a
standard telegram PROFIBUS/PROFINET-capable encoder.

Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 1-8 -
Figure 5: Two-encoder system, version 3
1.2.4 Three-encoder system
Sensing:
a) Sin/cos motor encoder via PROFIsafe telegram from SINAMICS S120. Two direct measuring sys-
tems using a standard telegram:
Position 1 via SINAMICS S120
Position 2 from distributed I/O with secure communication via an F module.
Figure 6: Three encoder system, version 1
b) Sin/cos motor encoder via PROFIsafe telegram from SINAMICS S120. Two direct measuring sys-
tems using a standard telegram:
Positions 1 and 2 via distributed I/O. One channel with secure communication via F mod-
ule.
Figure 7: Three encoder system, version 2
Three-encoder systems are used if a high degree of slip is to be expected, and as a result the motor en-
coder cannot be used to check the plausibility of the position. Instead, the plausibility of the position is
checked by making a cross comparison between the two direct measuring systems.
Safety notes and instructions
To identify a bus driver that has "frozen up", i.e. there is no longer any communi-
cation between the measuring system and CPU, there must be at least one fail-

Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 1-9 -
safe module in a channel in the station, via which the direct measuring system is
read-in. If the communication between the encoder and CPU is inadmissibly slow,
or completely fails, then the F module involved signals a communication error.
This is then evaluated in the safety program and must be used to initiate a stop
response.
Safety notes and instructions
Both direct measuring systems must be installed, opposing one another to
achieve the specified diagnostics coverage.
1.2.5 Summary of the encoder versions
The encoder combinations possible in principle and their ability to be used are summarized in the follow-
ing table. POS1, POS2 as well as POS_SI take reference to the interconnection at the "F_SAFE_POS"
block described in more detail under Chapter 3.2. Refer below for the legend.
A motor encoder (MSSI or MNSI) is always require to sense the safety-related position and velocity; the
encoder signals are acquired via the SI part of the drive.
The following encoder combinations should be provided depending on the particular application scenario:
POS1
POS2
POS_SI
Version 1: Safety-related motor encoder with
positively-driven mechanical system
LM-ST-NS
-
MNSI1/
MSSI
Version 2: Two-encoder system: Connected via
SINAMICS S120.
LM-SMx-
NS
-
MNSI / MSSI
Version 3: Two-encoder system: Connected via
the distributed I/O.
LD-DP-NS
-
MNSI / MSSI
Version 4 a): Three-encoder system. Position
encoder via SINAMCS 120 and distributed PLC
I/O. Secure communication via F module.
LM-SMx-
NS2
LD-DP-
KS2
MNSI / MSSI
Version 4) b): Three-encoder system. Position
encoder via PLC I/O. Secure communication via
F module.
LD-DP-NS2
LD-DP-
KS2
MNSI / MSSI
Table 1: Overview of possible encoder combinations
1 Not permissible with single-channel encoder connection to the motor shaft; permissible for two inde-
pendent encoders, e.g. for a double axis drive. LM-ST-NS via motor encoder 1 and MNSI via motor en-
coder 2.
2 Overwriting a process image must be detected using counter-rotating encoders
Legend:
MSSI: Motor encoder, safe connection via SI F telegram
MNSI: Motor encoder, no safe connection via SI F telegram
LM-ST-NS: Position actual value from the motor encoder via a standard 32-bit telegram (from Epos), not
safety related
LD-SMx-NS: Epos position actual value from a direct measuring system via SMC/SMI via 32-bit standard
telegram, not safety-related
LD-DP-NS: Position actual value from a direct measuring system via distributed I/O, no safety-related
communication (e.g. PROFINET encoder, SM338).
LD-DP-KS: Position actual value from a direct measuring system via distributed I/O, safety-related com-
munication using an F module connected to the backplane bus.
1.2.6 Safety-related parameters of the encoder versions
Chapter 1.2.5 lists the various encoder versions. Which of these versions is used depends on the particular
customer application; for the safety-related use of the subsequently descried software solution, it is manda-
tory that one of the described versions is used.

Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 1-10 -
As a result of the different encoder versions, and the resulting wide range of hardware versions that can be
used, the user must determine the safety integrity level of the safety function. To be in compliance with EN
528 (RN15, 2008), this must be at least SIL2/PLr d over the complete safety function (sense -> evaluate ->
respond).
To verify this, in this section, parameters are described that have a direct influence on the software solution
when calculating the safety integrity level based on DIN EN 62061 (RN01, 2005). Only the sense block is
discussed. The evaluate block corresponds to a SIMATIC F-CPU with Distributed Safety/Safety Advanced,
certified up to SIL3/PLe; the respond block is a SINAMICS S120, certified up to SIL2/PL d. The precise
parameters of the evaluate and respond blocks should be taken from the corresponding data sheets.
While versions 2-4 comply with the requirements according to subsystem D, version 1 fulfills the require-
ments according to subsystem C, as shown below:
1.2.6.1 Subsystem C according to DIN EN 62061 (Chapter 6.7.8.2.4):
1.2.6.2 Subsystem D according to DIN EN 62061 (Chapter 6.7.8.2.5):

Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 1-11 -
Subsys-
tem
(SFF/HFT)
SIL CL
limit
λDs1
λDs2
DC1
DC2
β
T1
T2
Version 1: Safety-related mo-
tor encoder with positively-
driven mechanical system
C ((≥0.991/
0)
Internal safety functions of the SINAMICS S120, certified according to SIL2/PLd
Version 2: Two-encoder sys-
tem: Connected via
SINAMICS S120.
D (≥0.991/
12)
33
Depend-
ent on the
hardware
Depend-
ent on the
hardware
99% with the
diagnostics
implemented
in the ASRS
block library
Corre-
sponding to
DC1
0.02 acc. to Table
3: Assessing com-
mon cause faults
according to DIN
EN 62061 Annex
F.1
Depend-
ent on the
hardware
Corresponding
to the call
interval of the
safety pro-
gram
Version 3: Two-encoder sys-
tem: Connected via the dis-
tributed I/O.
Version 4 a): Three-encoder
system. Position encoder via
SINAMCS 120 and distributed
PLC I/O. Secure communica-
tion via F module.
Version 4) b): Three-encoder
system. Position encoder via
PLC I/O. Secure communica-
tion via F module.
Table 2: Parameters according to DIN EN 62061
Comments regarding Table 2: Parameters according to DIN EN 62061:
1) As a result of the diagnostics implemented in the ASRS block library, all potentially dangerous faults are identified by the diagnostics, it follows:   
From the calculation of SFF (   
), SFF ≥0.99 is immediately obtained.
2) The failure of a subsystem element does not result in the loss of the SRCF, as this fault would be discovered by a comparison value –as well as by a
plausibility check (as a result of the redundant design). This directly means that HFT = 1.
3) According to DIN EN 62061 Table 5, for HFT = 1 and SFF = 1, an SIL CL limit of 3.
The evaluation of common cause faults according to DIN EN 62061 Annex F.1, is shown in the following table. In some instances, the measures applied against
common cause faults are implemented in the ASRS block library; in other instances, the appropriate measures must be taken by users. The measures that users
must always take (mandatory) are appropriately listed in the following table. If additional measures are to be taken, which are shown in gray in the table, then these
can improve the CCF factor or the βvalue, on the other hand measures that are not taken, reduce the CCF factor or βvalue.

Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 1-12 -
Property
Reference
Points
Reason
Separation/isolation
Are SRECS signal cables for the individual channels separated from other
channels at all locations –or are they adequately protected?
1a
5
Users must appropriately install the sensors
Is the detection of signal transfer errors adequate when using information cod-
ing/decoding?
1b
10
Provided by the solution implemented in the ASRS block
library
Are SRECS signal cables and electric power supply cables separated at all
locations –or adequately protected?
2
5
Are subsystem elements provided as physically separate units in local hous-
ings if they can contribute to a CCF?
3
5
Users must appropriately install the sensors
Diversity/redundancy
Are various electronic technologies used in the subsystem, for example in
some instances electronics or programmable electronics, and in other instanc-
es, an electromechanical relay?
4
8
Are elements used in the subsystem that employ different physical principles
(e.g. sensing elements at a protective door that employee mechanical and
magnetic sensing techniques)?
5
10
Are elements used in the subsystem that have different time responses with
reference to functional operation and/or failure types?
6
10
Provided by the solution implemented in the ASRS block
library
Do the subsystem elements have a diagnostics test interval of ≤ 1 min?
7
10
Provided by the solution implemented in the ASRS block
library.
Note: The safety program must be called at intervals less
than 1 min!
Complexity/design/application
Are cross connections between subsystem channels prevented, with the ex-
ception of cross connections that are used for diagnostics?
8
2
Provided by the solution implemented in the ASRS block
library
Assessment/analysis
Have the results of failure types and effect analyses been evaluated in order to
define sources of failures as a consequence of a common fault. Further, have
these types of sources –that have been previously determined –been elimi-
nated as a result of the design?
9
9
Provided by the solution implemented in the ASRS block
library
Are field failures analyzed and fed back into the design process?
10
9
Competence/training
Do the development engineers of the subsystems understand the reasons for
and effects of failures originating from a common cause?
11
4
Requirements placed on users

Storage and retrieval machines and safety functions
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 1-13 -
Monitoring ambient conditions
Is it probable that the subsystem elements always operate within the tempera-
ture, humidity, corrosion, dust and vibration range etc. in which they have
been tested, without the ambient conditions being externally monitored?
12
9
Users must appropriately select the sensors for the appli-
cation
Is the subsystem immune to negative electromagnetic influences up to and
including the limits defined in Annex E?
13
9
Users must appropriately select the sensors for the appli-
cation
Result
73
According to DIN EN 62061 Table F.2: β = 0.02
Table 3: Assessing common cause faults according to DIN EN 62061 Annex F.1
Total number
of points
Factor of the failures resulting
from a common cause (β)
< 35
10 % (0.1)
35 to 65
5 % (0.05)
65 to 85
2 % (0.02)
85 to 100
1 % (0.01)
Table 4: DIN EN 62061 Annex F.2

Fail-safe function blocks for storage and retrieval machines
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 2-0 -
2 System and software requirements
2.1 General
The fail-safe function blocks for storage and retrieval machines described in the following
chapters can be used in conjunction with the Siemens fail-safe automation system
IM 151-7 F-CPU,
IM 151-8F PN/DP CPU,
IM 154-8F CPU,
CPU 315F-2 DP,
CPU 315F-2 PN/DP,
CPU 317F-2DP,
CPU 317TF-2DP,
CPU 317F-2 PN/DP,
CPU 319F-3 PN/DP,
CPU 414F-3 PN/DP,
CPU 416F-2,
CPU 416F-3 PN/DP as well as
WinAC RTX F.
To be able to use the fail-safe function block F_ENDZONE (Chapter 3.6), the Siemens auto-
mation system that is being used must permit data blocks that require over 40 kbyte load
memory and 20 kByte work memory. This information is provided in the data sheet of the con-
trol system that you are using.
As introduction, the safety aspects when creating fail-safe function blocks are discussed be-
fore their properties are discussed in detail.
The fail-safe function blocks for storage and retrieval machines were developed to create indi-
vidual subfunctions in order to guarantee that the blocks can be used in a modular fashion.
2.2 Safety requirements
The S7-IM 151-7F CPU, IM 154-8F CPU, S7-315F, S7-317F, S7-319F, S7-414F, S7-416F au-
tomation systems as well as WinAC RTX comply with the following safety requirements:
Safety Integrity Levels SIL1 to SIL3 according to
IEC 61508
2.3 Software
The following Siemens SIMATIC software must be installed on the PC/PG when using fail-safe
functions for storage and retrieval machines:
SIMATIC STEP 7 Professional V5.5 + SP3 or higher
SIMATIC S7 Distributed Safety Programming V5.4 + SP5
SIMATIC S7 F ConfigurationPack
and/or
SIMATIC STEP 7 Professional V13 or higher
SIMATIC STEP 7 Safety Advanced V13
and for parameterizing the drives
SINAMICS MICROMASTER STARTER V4.3 SP3 or higher
The actual version as well as all predecessor versions of the SIMATIC S7 F Configuration-
Pack can be downloaded at the following link:
http://support.automation.siemens.com/CH/view/de/15208817

Fail-safe function blocks for storage and retrieval machines
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 2-1 -
The actual version as well as all predecessor versions of SINAMICS MICROMASTER
STARTER can be downloaded at the following link:
http://support.automation.siemens.com/WW/view/de/26233208
2.4 Safety aspects when generating the blocks
The blocks for the safety-related control of storage and retrieval machines were generated us-
ing the certified fail-safe function blocks in F-FBD. The development tool compiler generates
fail-safe blocks. These can then be loaded into libraries and called in any F- FBs and F- FCs.
Regarding the internal implementation and the software development process employed, the
fail-safe function blocks for storage and retrieval machines are compliant with PLd/SIL2.
However, it must also be verified that the function blocks from the ASRS block library used in
the user software are in compliance with the relevant standards regarding their behavior and
their principle of operation. Generally, this verification can be realized in the form of a function
test.
Also due to restrictions regarding the hardware components that can be used –specifically in-
verters –the safety level that can be achieved using the fail-safe function blocks for storage
and retrieval machines is restricted to PLd/SIL2.
For the verification of the safety-related parameters required for the hardware components,
please refer to Chapter 1.2.6.
2.5 Standards that are complied with
The ASRS block library was developed in compliance with the following standards:
DIN EN 528 (see Chapter 2.5.1)
DIN EN ISO 13849-1
DIN EN ISO 13849-2
DIN EN 62061
2.5.1 Demarcation of DIN EN 528 to the ASRS block library
Requirements according to EN528:2008 Table C.2
Covered by the ASRS
block library
Con-
secutive
No..
Safety function
Section
1
Function for monitoring access
through doors
5.3.3
5.3.4
5.10.3.3
5.10.3.6
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
2
Stop function
5.3.7
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
3
Emergency Stop function
5.3.8
5.3.8.1
5.3.8.3
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
4
Function to stop hoisting motion
at the end stop and for power
failure
5.4.1.1
5.4.2 a), b),
c)
Yes

Fail-safe function blocks for storage and retrieval machines
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 2-2 -
Requirements according to EN528:2008 Table C.2
Covered by the ASRS
block library
Con-
secutive
No..
Safety function
Section
5
Function to stop travel motion at
the end of a travel route (e.g. end
of the aisle), when the power fails,
for collisions, if more than one unit
is traveling on the same rails.
5.5.1.1
5.5.1.2
5.5.3
Yes
6
Function with additional brake and
velocity reduction, if the vehicle
must travel around curves with a
reduced velocity
5.5.1.2 a)
5.5.2
Yes
7
Function of the additional brake
and velocity reduction, if the end
buffers are not configured so that
the unit can approach them with
at least 70 % of the rated velocity
5.5.1.2 b)
5.5.2
Yes
8
Function to prevent the load and
the load suspension device from
colliding with the rack
5.4.6.6
5.6.2
5.6.3
5.6.5
5.6.7
5.6.8.2
5.10.7.1
Yes
9
Load suspension device –
interlocks
5.6.5 a), b)
Yes
10
Load suspension device –
Interlocks
5.6.5 c)
Yes
11
Load suspension device –
rack compartment occupied
5.6.5 d)
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
12
Load suspension device –
load position monitoring
5.6.7
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
13
Function of control devices for
dangerous motion (manual open-
loop control)
5.7.6
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
14
Interlocking function with imple-
mentation devices
5.8.2
5.8.3
5.8.4
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
15
Function, which only permits a
slow velocity when a person is
located on the emergency control
station
5.3.7
5.9.4
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
16
Function to stop the unit when it is
necessary to gain access through
emergency exits and covers
5.10.3.2 c)
5.10.3.2 e)
5.10.3.4
5.10.6.4
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)

Fail-safe function blocks for storage and retrieval machines
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 2-3 -
Requirements according to EN528:2008 Table C.2
Covered by the ASRS
block library
Con-
secutive
No..
Safety function
Section
17
In the environment of the unit,
securing against inadvertent mo-
tion of the load
Rack compartment sensor
5.10.7.1 a)
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
18
In the environment of the unit,
securing against inadvertent mo-
tion of the load
Slide-through guard
5.10.7.1 b)
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
19
In the environment of the unit,
securing against inadvertent mo-
tion of the load
Slide-through guard
5.10.7.1 c)
No
User interconnection required (e.g.
Distributed Safety/Safety Advanced
library)
Additional sections of the EN528:2008 that are covered by the ASRS block library:
5.4.3.1 –overload protection
5.4.3.2 - protection against slack cable state

Fail-safe function blocks for storage and retrieval machines
S7-Distributed Safety/SIMATIC Safety - fail-safe function blocks for storage and retrieval machines - 3-4 -
3 Fail-safe function blocks for storage and retrieval
machines
3.1 Overview
3.1.1 Safety notes and instructions
As stated in Chapter 2.5, the fail-safe function blocks for storage and retrieval machines cover the
requirements laid down in EN528:2008.
The safety integrity level of the various safety functions is only obtained through the correct intercon-
nection. For this reason, the correct interconnection of each fail-safe function block in this library and
the overall functionality of the safety functions must be validated against the relevant application-
specific hardware and software based on positive and negative tests.
The tests should first be carried out in a part of the system where there is sufficient clearance to the
fixed end stops (buffers). It must also be ensured that the system can be safely shutdown if an emer-
gency occurs during the various tests.
The tests should be documented, for example, using trace recordings, so that limit value violations,
shutdown conditions and stopping distances can be clearly identified. This therefore allows a clear
statement to be made about the correct function of each individual safety function.
3.1.2 Fail-safe blocks
The library "RBG_Failsafe_DS_V5_4" for SIMATIC S7 Distributed Safety Programming or
"RBG_Failsafe_TS_V13" for SIMATIC STEP 7 Safety Advanced includes the following blocks:
F_SAFE_POS Function block to generate a safety-related position and veloc-
ity actual value
F_SLP_MONITOR Function block for safe position monitoring
F_ENDZONE_DB Function block to monitor the velocity at the end of the travel
range
F_BRAKE_TEST Function block to perform a safe brake test in conjunction with
the SBT drive function
F_LOAD_MONITOR Function block to detect overload and slack cable condition
with the option of testing the measuring device
F_SBR_MONITOR Function block to monitor the brake ramp
F_SCALE_DINT,
SCALE_DINT Blocks to safely scale 32-bit values
F_MIN_MAX Function to select minimum/maximum value
The following fail-safe blocks are additionally required that are programmed using SIMATIC
S7 Distributed Safety Programming:
F_TP Generates a pulse with a specific duration
F_W_BO Converts a value in the WORD format into 16 pieces of data in the
bool data type