Indradrive MPX - 1x

Electric Drives Linear Motion and
and Controls Hydraulics Assembly Technologies Pneumatics Service

Bosch Rexroth AG DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P
Rexroth IndraDrive Integrated Safety Technology as of MPx-1x
Title Rexroth IndraDrive

Integrated Safety Technology
as of MPx-1x
Type of Documentation Original Instructions
Document Typecode DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P
Internal File Reference RS-9f12d2921c8c75d10a6846a0018b318c-1-en-US-6
Purpose of Documentation This documentation was compiled in accordance with the DIRECTIVE 2006/42/
EC; it contains the following pieces of information:
● Description of the integrated safety technology
● Data with regard to transport, handling and storage
● Instructions on mounting, assembly and connection
● Description of the appropriate use, maintenance and repair
Record of Revision Edition Release Date Notes

DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P 2010-10-18 See chapter "About This
Documentation", margin‐
al note "Editions of This
Documentation"
Copyright © Bosch Rexroth AG 2010

Copying this document, giving it to others and the use or communication of the
contents thereof without express authority, are forbidden. Offenders are liable
for the payment of damages. All rights are reserved in the event of the grant of
a patent or the registration of a utility model or design (DIN 34-1).
Validity The specified data is for product description purposes only and may not be
deemed to be guaranteed unless expressly confirmed in the contract. All rights
are reserved with respect to the content of this documentation and the availa‐
bility of the product.
Published by Bosch Rexroth AG
Bgm.-Dr.-Nebel-Str. 2 ■ 97816 Lohr a. Main, Germany
Telephone +49 (0)93 52/ 40-0 ■ Fax +49 (0)93 52/ 40-48 85
http://www.boschrexroth.com/
Dept. DC-IA/EDY1 (SA, US, RB, BB), DC-IA/EDH
Note This document has been printed on chlorine-free bleached paper.
DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P Bosch Rexroth AG I/87
Table of Contents
Table of Contents
Page
1 Introduction.................................................................................................................... 5
1.1 About This Documentation..................................................................................................................... 5
1.2 Reference Documentations.................................................................................................................... 6
1.2.1 Drive Systems, System Components.................................................................................................. 6
1.2.2 Motors.................................................................................................................................................. 6
1.2.3 Cables................................................................................................................................................. 7
1.2.4 Firmware.............................................................................................................................................. 7
2 Important Directions for Use ......................................................................................... 9

2.1 Appropriate Use ..................................................................................................................................... 9
2.1.1 Introduction.......................................................................................................................................... 9
2.1.2 Areas of Use and Application.............................................................................................................. 9
2.2 Inappropriate Use................................................................................................................................. 10
3 Safety Instructions for Electric Drives and Controls..................................................... 11

3.1 Definitions of Terms.............................................................................................................................. 11
3.2 General Information.............................................................................................................................. 12
3.2.1 Using the Safety Instructions and Passing Them on to Others......................................................... 12
3.2.2 Requirements for Safe Use............................................................................................................... 12
3.2.3 Hazards by Improper Use.................................................................................................................. 13
3.3 Instructions with Regard to Specific Dangers....................................................................................... 15
3.3.1 Protection Against Contact With Electrical Parts and Housings........................................................ 15
3.3.2 Protective Extra-Low Voltage as Protection Against Electric Shock ................................................ 16
3.3.3 Protection Against Dangerous Movements....................................................................................... 16
3.3.4 Protection Against Magnetic and Electromagnetic Fields During Operation and Mounting.............. 18
3.3.5 Protection Against Contact With Hot Parts........................................................................................ 18
3.3.6 Protection During Handling and Mounting......................................................................................... 19
3.3.7 Battery Safety.................................................................................................................................... 19
3.3.8 Protection Against Pressurized Systems........................................................................................... 20
3.4 Explanation of Signal Words and the Safety Alert Symbol................................................................... 20
4 System Overview......................................................................................................... 23
4.1 Introduction........................................................................................................................................... 23
4.1.1 Motivation and Objectives................................................................................................................. 23
Overview......................................................................................................................................... 23
Comparison With Conventional Safety Technology....................................................................... 23
4.1.2 Conceptual Overview........................................................................................................................ 24
4.1.3 Risk Analysis..................................................................................................................................... 24
4.2 Product Presentation............................................................................................................................ 25
4.2.1 What is "Integrated Safety Technology"?.......................................................................................... 25
4.2.2 Integrated Safety Technology as IndraDrive Platform Solution......................................................... 26
4.3 Safety-Relevant Standards and Regulations........................................................................................ 28
4.3.1 General Information........................................................................................................................... 28
II/87 Bosch Rexroth AG DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P
Table of Contents
Page
4.3.2 Standards Relevant to Components.................................................................................................. 28
4.3.3 Standards Relevant to Machinery..................................................................................................... 28
4.3.4 EC Directives..................................................................................................................................... 29
4.4 Overview of Functions and Characteristics.......................................................................................... 29
4.4.1 Characteristics of Integrated Safety Technology............................................................................... 29
Introduction..................................................................................................................................... 29
Drive System With Optional Safety Technology Module "Safe Torque Off"................................... 29
4.4.2 Supported Safety Technology Functions........................................................................................... 30
Introduction..................................................................................................................................... 30
4.4.3 Performance...................................................................................................................................... 30
Time Response and Reaction Times............................................................................................. 30
4.5 Safety Characteristics of the Safety System......................................................................................... 30
4.5.1 Introduction........................................................................................................................................ 30
4.5.2 Safe Torque Off................................................................................................................................. 31
5 Functional Principle of Integrated Safety Technology.................................................. 33

5.1 Basic Functions.................................................................................................................................... 33
5.1.1 Overview............................................................................................................................................ 33
5.1.2 Dynamization..................................................................................................................................... 34
Brief Description............................................................................................................................. 34
Functional Principle of Dynamization............................................................................................. 34
6 Integrated Safety Functions......................................................................................... 37

6.1 Overview of Safety Functions............................................................................................................... 37
6.1.2 Classification of Safety Functions...................................................................................................... 37
6.2 Safety Functions in Special Mode "Safe Standstill".............................................................................. 37
6.2.1 Safe Torque Off (STO)...................................................................................................................... 37
Safety Function............................................................................................................................... 39
Notes on Commissioning................................................................................................................ 41
Notes on Project Planning.............................................................................................................. 41
6.2.2 Safe Brake Control (SBC)................................................................................................................. 41
Safety Function............................................................................................................................... 43
Notes on Commissioning................................................................................................................ 44
Notes on Project Planning.............................................................................................................. 44
7 Examples of Application............................................................................................... 47
7.1 STO and SBC Functions When Selected by Means of Passive Safety Units ..................................... 47
7.1.1 Dual-Channel Wiring......................................................................................................................... 47
7.1.2 Single-Channel Wiring....................................................................................................................... 48
7.2 STO and SBC Function When Selected by Means of Active Safety Units........................................... 49
7.2.1 Dual-Channel Wiring......................................................................................................................... 49
Plus-Plus-Switching Safety Unit..................................................................................................... 49
DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P Bosch Rexroth AG III/87
Table of Contents
Page
Plus-Minus-Switching Safety Unit................................................................................................... 49
7.2.2 Single-Channel Wiring....................................................................................................................... 50
7.3 "SS1" Function With "L4" Option.......................................................................................................... 52
7.4 Mixed Operation of the Optional Safety Technology Modules "L2" and "L4"....................................... 53
7.4.1 Mixed Operation of the Optional Safety Technology Modules "L2" and "L4" at an Active Safety Unit. . .
53
7.4.2 Mixed Operation of the Optional Safety Technology Modules "L2" and "L4" at a Passive Safety Unit...
54
8 Commissioning the Safety Technology........................................................................ 57

8.1 Safety Instruction.................................................................................................................................. 57
8.2 Prerequisites for Using Integrated Safety Technology......................................................................... 57
8.2.1 Required Drive Firmware................................................................................................................... 57
8.2.2 Required Controller Configuration..................................................................................................... 57
General Information........................................................................................................................ 57
Optional Safety Technology Module "Safe Torque Off" (L4).......................................................... 57
8.2.3 Required Motors and Measuring Systems........................................................................................ 58
Motors by Rexroth.......................................................................................................................... 58
Third-Party Motors/Optional Measuring Systems........................................................................... 58
8.2.4 Allowed Motor Holding Brakes.......................................................................................................... 58
8.2.5 Required Commissioning Tools......................................................................................................... 58
8.3 Checks Before Initial Commissioning................................................................................................... 59
8.4 Commissioning the Function "Safe Torque Off" (Optional Safety Technology Module "L4") .............. 59
8.4.1 Overview............................................................................................................................................ 59
8.4.2 Commissioning Steps ....................................................................................................................... 60
8.5 Requirements to the Control Unit......................................................................................................... 61
9 Notes on Troubleshooting............................................................................................ 63
9.1 Introduction........................................................................................................................................... 63
9.2 Diagnostic System................................................................................................................................ 63
9.2.2 Diagnostic Messages of Integrated Safety Technology.................................................................... 64
Overview......................................................................................................................................... 64
Status Information of Integrated Safety Technology...................................................................... 64
Behavior in the Case of Non-Fatal Safety Technology Errors (F3xxx)........................................... 65
Behavior in the Case of Fatal Errors (F8xxx)................................................................................. 65
9.3 Removing Malfunctions, Maintenance Measures, Deactivating the Motors......................................... 66
9.4 Replacing Drive Components............................................................................................................... 67
9.4.2 Replacing the Motor.......................................................................................................................... 67
9.4.3 Replacing the Brake.......................................................................................................................... 68
9.4.4 Replacing the Controller.................................................................................................................... 68
Overview......................................................................................................................................... 68
How to Proceed When Replacing Controllers................................................................................ 68
Possible Problems During Controller Replacement....................................................................... 70
IV/87 Bosch Rexroth AG DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P
Table of Contents
Page
10 Decommissioning Drive Components.......................................................................... 71
11 Appendix...................................................................................................................... 73
11.1 Hardware Properties............................................................................................................................. 73
11.1.1 X6, Motor Temperature Monitoring and Motor Holding Brake .......................................................... 73
11.1.2 L4 - Safe Torque Off.......................................................................................................................... 74
Description...................................................................................................................................... 74
X49, L4 - Safe Torque Off.............................................................................................................. 75
11.1.3 Technical Data of the Inputs and Outputs......................................................................................... 76
Digital Inputs (L4 - Safe Torque Off)............................................................................................... 76
Digital Outputs (L4 - Safe Torque Off)............................................................................................ 76
11.2 Transport and Storage.......................................................................................................................... 77
11.2.1 Transport of the Components............................................................................................................ 77
11.2.2 Storage of the Components............................................................................................................... 77
11.3 Ambient and Operating Conditions....................................................................................................... 77
11.4 Declaration of Conformity..................................................................................................................... 80
12 Service and Support.................................................................................................... 83
Index............................................................................................................................ 85
DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P Bosch Rexroth AG 5/87
Introduction
1 Introduction
1.1 About This Documentation
Editions of This Documentation
Edition Release date Notes
DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P 2010-10-18 First edition
Fig.1-1: Record of Revisions

Means of Representation in This To make the reading of this documentation easier for you, the table below con‐
Documentation tains the means of representation and notations of recurring terms.
What? How? For example...
Important facts which are to be high‐ With the safety function "Safe parking axis", the following
Boldface
lighted in the body text monitoring functions are deactivated: ...
The missing speed information can be replaced via the control
Parameter names, diagnostic mes‐
Quotation marks bit "defined safety with parked axis" in
sage names, function designations
"P‑0‑3210, Safety technology configuration".
Fig.1-2: Conventions of Notation

Notes and tips are highlighted. A symbol tells you whether a note or a tip is
used in the text:
This box contains important information which you should take into
consideration.
This symbol highlights useful tips and tricks.
Signal words in accordance with ANSI Z535.6-2006 draw the reader's attention
to hazards (see "Explanation of Signal Words and the Safety Alert Symbol").
Structure of Documentation Concerning integrated safety technology, the descriptions of the IndraDrive
systems have the following structure:
● Original Instructions (this documentation)
● Application Manual (in preparation)
– is used to make oneself familiar with the subject of "Integrated Safety
Technology".
– contains information on mounting and maintenance, on proper and
safe operation and on the decommissioning of the integrated safety
technology of IndraDrive Cs.
– is addressed to persons who mount, operate and maintain IndraDrive
Cs with integrated safety technology.
● Project Planning Manual
Assists with electrical design and installation of the drive system
● Parameter Description for Rexroth IndraDrive with the firmwares MPx-1n
Apart from the safety-technology-specific parameters, all other drive pa‐
rameters are documented in the Parameter Description
● Description of Diagnostic Messages for Rexroth IndraDrive with the firm‐
wares MPx-1n
6/87 Bosch Rexroth AG DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P
Introduction
Apart from the safety-technology-specific diagnostic messages, all other

diagnostic drive messages are documented in the Description of Diag‐
nostic Messages
For an overview of reference documentations, see: "Reference

Documentations"
Your Feedback Your experience is important for our improvement processes of products and
documentations.
If you discover mistakes in this documentation or suggest changes, you can
send your feedback to the following e-mail address:
Dokusupport@boschrexroth.de
We need the following information to handle your feedback:
● The number indicated under "Internal File Reference".
● The page number.
1.2 Reference Documentations

1.2.1 Drive Systems, System Components
Drive Systems With Single-Axis Drive Controllers
Title Kind of documentation Document typecode1) Part number

Rexroth IndraDrive … DOK-INDRV*-… R911…
Cs Drive Systems With HCS01 Project Planning Manual HCS01******-PRxx-EN-P 322210

Additional Components and Accesso‐ Project Planning Manual ADDCOMP****-PRxx-EN-P 306140
ries
1) In the document typecodes, "xx" is a wild card for the current edition of
the documentation (example: PR01 is the first edition of a Project Plan‐
ning Manual)
Fig.1-3: Documentations – Drive Systems, System Components
1.2.2 Motors
Rexroth IndraDyn … DOK-MOTOR*-… R911…
A Asynchronous Motors MAD / MAF Project Planning Manual MAD/MAF****-PRxx-EN-P 295781

H Synchronous Kit Spindle Motors Project Planning Manual MBS-H******-PRxx-EN-P 297895
L Synchronous Linear Motors Project Planning Manual MLF********-PRxx-EN-P 293635
S MKE Synchronous Motors Project Planning Manual MKE*GEN2***-PRxx-EN-P 297663
S MSK Synchronous Motors Project Planning Manual MSK********-PRxx-EN-P 296289
S Synchronous Motors MSM Data Sheet MSM********-DAxx-EN-P 329338
S Synchronous Motors QSK Project Planning Manual QSK********-PRxx-EN-P 330321
T Synchronous Torque Motors Project Planning Manual MBT********-PRxx-EN-P 298798
the documentation (example: PR01 is the first edition of a Project Plan‐
ning Manual)
Fig.1-4: Documentations – Motors
Introduction
1.2.3 Cables
DOK-CONNEC-… R911…
Rexroth Connection Cables Selection Data CABLE*INDRV-CAxx-EN-P 322949

the documentation (example: CA02 is the second edition of the docu‐
mentation "Selection Data")
Fig.1-5: Documentations – Cables
1.2.4 Firmware
Rexroth IndraDrive ... DOK-INDRV*-… R911…
MPx-17 Application Manual MP*-17VRS**-APxx-EN-P 331236

Functions
MPx-17 Release Notes MP*-17VRS**-RNxx-EN-P 331588
Version Notes
MPx-16 Application Manual MP*-16VRS**-APxx-EN-P 326767
Functions
MPx-16 Release Notes MP*-16VRS**-RNxx-EN-P 329272
Version Notes
MPx-16 and MPx-17 Reference Book GEN1-PARA**-RExx-EN-P 328651
Parameters
MPx-16 and MPx-17 Reference Book GEN1-DIAG**-RExx-EN-P 326738
Diagnostic Messages
Integrated Safety Technology Original Instructions SI3-OP-MAN*-OPxx-EN-P 332837
as of MPx-1x
Rexroth IndraMotion MLD Reference Book MLD-SYSLIB2-RExx-EN-P 332627
Libraries as of MPx17
the documentation (example: RE02 is the second edition of a reference
documentation)
Fig.1-6: Documentations – Firmware
Important Directions for Use
2 Important Directions for Use

2.1 Appropriate Use
2.1.1 Introduction
Rexroth products represent state-of-the-art developments and manufacturing.
They are tested prior to delivery to ensure operating safety and reliability.
WARNING Personal injury and property damage caused

by incorrect use of the products!
The products have been designed for use in the industrial environment and may
only be used in the appropriate way. If they are not used in the appropriate way,
situations resulting in property damage and personal injury can occur.
Rexroth as manufacturer is not liable for any damages resulting

from inappropriate use. In such cases, the guarantee and the right
to payment of damages resulting from inappropriate use are forfei‐
ted. The user alone carries all responsibility of the risks.
Before using Rexroth products, make sure that all the pre-requisites for an ap‐
propriate use of the products are satisfied:
● Personnel that in any way, shape or form uses our products must first read
and understand the relevant safety instructions and be familiar with ap‐
propriate use.
● If the products take the form of hardware, then they must remain in their
original state, in other words, no structural changes are permitted. It is not
permitted to decompile software products or alter source codes.
● Do not mount damaged or faulty products or use them in operation.
● Make sure that the products have been installed in the manner described
in the relevant documentation.
2.1.2 Areas of Use and Application

Drive controllers made by Rexroth are designed to control electrical motors and
monitor their operation.
Control and monitoring of the Drive controllers may require additional sensors
and actors.
The drive controllers may only be used with the accessories and
parts specified in this documentation. If a component has not been
specifically named, then it may neither be mounted nor connected.
The same applies to cables and lines.
Operation is only permitted in the specified configurations and com‐
binations of components using the software and firmware as speci‐
fied in the relevant Functional Descriptions.
Drive controllers have to be programmed before commissioning, making it pos‐

sible for the motor to execute the specific functions of an application.
Drive controllers of the Rexroth IndraDrive line have been developed for use in
single- and multi-axis drive and control tasks.
To ensure application-specific use of Drive controllers, device types of different
drive power and different interfaces are available.
Important Directions for Use
Typical applications include, for example:

● Handling and mounting systems,
● Packaging and food machines,
● Printing and paper processing machines and
● Machine tools.
Drive controllers may only be operated under the assembly and installation
conditions described in this documentation, in the specified position of normal
use and under the ambient conditions as described (temperature, degree of
protection, humidity, EMC, etc.).
2.2 Inappropriate Use

Using the Drive controllers outside of the operating conditions described in this
documentation and outside of the indicated technical data and specifications is
defined as "inappropriate use".
Drive controllers must not be used, if ...
● they are subject to operating conditions that do not meet the specified
ambient conditions. This includes, for example, operation under water,
under extreme temperature fluctuations or extremely high maximum tem‐
peratures.
● Furthermore, Drive controllers must not be used in applications which
have not been expressly authorized by Rexroth. Please carefully follow
the specifications outlined in the general Safety Instructions!
Components of the drive system Rexroth IndraDrive are products

of category C3 (with restricted distribution) according to
IEC 61800‑3. These components are not provided for use in a public
low-voltage mains supplying residential areas. If these components
are used in such a mains, high-frequency interference is to be ex‐
pected. This can require additional measures of radio interference
suppression.
Safety Instructions for Electric Drives and Controls
3 Safety Instructions for Electric Drives and Controls

3.1 Definitions of Terms
Application Documentation Application documentation comprises the entire documentation used to inform
the user of the product about the use and safety-relevant features for config‐
uring, integrating, installing, mounting, commissioning, operating, maintaining,
repairing and decommissioning the product. The following terms are also used
for this kind of documentation: User Guide, Operation Manual, Commissioning
Manual, Instruction Manual, Project Planning Manual, Application Manual, etc.
Component A component is a combination of elements with a specified function, which are
part of a piece of equipment, device or system. Components of the electric drive
and control system are, for example, supply units, drive controllers, mains
choke, mains filter, motors, cables, etc.
Control System A control system comprises several interconnected control components placed
on the market as a single functional unit.
Device A device is a finished product with a defined function, intended for users and
placed on the market as an individual piece of merchandise.
Electrical Equipment Electrical equipment encompasses all devices used to generate, convert, trans‐
mit, distribute or apply electrical energy, such as electric motors, transformers,
switching devices, cables, lines, power-consuming devices, circuit board as‐
semblies, plug-in units, control cabinets, etc.
Electric Drive System An electric drive system comprises all components from mains supply to motor
shaft; this includes, for example, electric motor(s), motor encoder(s), supply
units and drive controllers, as well as auxiliary and additional components, such
as mains filter, mains choke and the corresponding lines and cables.
Installation An installation consists of several devices or systems interconnected for a de‐
fined purpose and on a defined site which, however, are not intended to be
placed on the market as a single functional unit.
Machine A machine is the entirety of interconnected parts or units at least one of which
is movable. Thus, a machine consists of the appropriate machine drive ele‐
ments, as well as control and power circuits, which have been assembled for
a specific application. A machine is, for example, intended for processing,
treatment, movement or packaging of a material. The term "machine" also cov‐
ers a combination of machines which are arranged and controlled in such a way
that they function as a unified whole.
Manufacturer The manufacturer is an individual or legal entity bearing responsibility for the
design and manufacture of a product which is placed on the market in the in‐
dividual's or legal entity's name. The manufacturer can use finished products,
finished parts or finished elements, or contract out work to subcontractors.
However, the manufacturer must always have overall control and possess the
required authority to take responsibility for the product.
Product Examples of a product: Device, component, part, system, software, firmware,
among other things.
Project Planning Manual A project planning manual is part of the application documentation used to
support the sizing and planning of systems, machines or installations.
Qualified Persons In terms of this application documentation, qualified persons are those persons
who are familiar with the installation, mounting, commissioning and operation
of the components of the electric drive and control system, as well as with the
hazards this implies, and who possess the qualifications their work requires. To
comply with these qualifications, it is necessary, among other things,
1) to be trained, instructed or authorized to switch electric circuits and devices

safely on and off, to ground them and to mark them
2) to be trained or instructed to maintain and use adequate safety equipment
3) to attend a course of instruction in first aid
User A user is a person installing, commissioning or using a product which has been
placed on the market.
3.2 General Information

3.2.1 Using the Safety Instructions and Passing Them on to Others
Do not attempt to install and operate the components of the electric drive and
control system without first reading all documentation provided with the product.
Read and understand these safety instructions and all user documentation prior
to working with these components. If you do not have the user documentation
for the components, contact your responsible Rexroth sales partner. Ask for
these documents to be sent immediately to the person or persons responsible
for the safe operation of the components.
If the component is resold, rented and/or passed on to others in any other form,
these safety instructions must be delivered with the component in the official
language of the user's country.
Improper use of these components, failure to follow the safety instructions in
this document or tampering with the product, including disabling of safety de‐
vices, could result in property damage, injury, electric shock or even death.
3.2.2 Requirements for Safe Use

Read the following instructions before initial commissioning of the components
of the electric drive and control system in order to eliminate the risk of injury
and/or property damage. You must follow these safety instructions.
● Rexroth is not liable for damages resulting from failure to observe the
safety instructions.
● Read the operating, maintenance and safety instructions in your language
before commissioning. If you find that you cannot completely understand
the application documentation in the available language, please ask your
supplier to clarify.
● Proper and correct transport, storage, mounting and installation, as well
as care in operation and maintenance, are prerequisites for optimal and
safe operation of the component.
● Only qualified persons may work with components of the electric drive and
control system or within its proximity.
● Only use accessories and spare parts approved by Rexroth.
● Follow the safety regulations and requirements of the country in which the
components of the electric drive and control system are operated.
● Only use the components of the electric drive and control system in the
manner that is defined as appropriate. See chapter "Appropriate Use".
● The ambient and operating conditions given in the available application
documentation must be observed.
● Applications for functional safety are only allowed if clearly and explicitly
specified in the application documentation "Integrated Safety Technolo‐
gy". If this is not the case, they are excluded. Functional safety is a safety
concept in which measures of risk reduction for personal safety depend

on electrical, electronic or programmable control systems.
● The information given in the application documentation with regard to the
use of the delivered components contains only examples of applications
and suggestions.
The machine and installation manufacturers must
– make sure that the delivered components are suited for their individ‐
ual application and check the information given in this application
documentation with regard to the use of the components,
– make sure that their individual application complies with the appli‐
cable safety regulations and standards and carry out the required
measures, modifications and complements.
● Commissioning of the delivered components is only allowed once it is sure
that the machine or installation in which the components are installed
complies with the national regulations, safety specifications and standards
of the application.
● Operation is only allowed if the national EMC regulations for the applica‐
tion are met.
● The instructions for installation in accordance with EMC requirements can
be found in the section on EMC in the respective application documenta‐
tion.
The machine or installation manufacturer is responsible for compliance
with the limit values as prescribed in the national regulations.
● The technical data, connection and installation conditions of the compo‐
nents are specified in the respective application documentations and must
be followed at all times.
National regulations which the user must take into account
● European countries: In accordance with European EN standards
● United States of America (USA):
– National Electrical Code (NEC)
– National Electrical Manufacturers Association (NEMA), as well as
local engineering regulations
– Regulations of the National Fire Protection Association (NFPA)
● Canada: Canadian Standards Association (CSA)
● Other countries:
– International Organization for Standardization (ISO)
– International Electrotechnical Commission (IEC)
3.2.3 Hazards by Improper Use

● High electrical voltage and high working current! Danger to life or serious
injury by electric shock!
● High electrical voltage by incorrect connection! Danger to life or injury by
electric shock!
● Dangerous movements! Danger to life, serious injury or property damage
by unintended motor movements!
● Health hazard for persons with heart pacemakers, metal implants and
hearing aids in proximity to electric drive systems!
● Risk of burns by hot housing surfaces!
● Risk of injury by improper handling! Injury by crushing, shearing, cutting,

hitting!
● Risk of injury by improper handling of batteries!
● Risk of injury by improper handling of pressurized lines!
3.3 Instructions with Regard to Specific Dangers

3.3.1 Protection Against Contact With Electrical Parts and Housings
This section concerns components of the electric drive and control
system with voltages of more than 50 volts.
Contact with parts conducting voltages above 50 volts can cause personal
danger and electric shock. When operating components of the electric drive
and control system, it is unavoidable that some parts of these components
conduct dangerous voltage.
High electrical voltage! Danger to life, risk of injury by electric shock or serious
injury!
● Only qualified persons are allowed to operate, maintain and/or repair the
components of the electric drive and control system.
● Follow the general installation and safety regulations when working on
power installations.
● Before switching on, the equipment grounding conductor must have been
permanently connected to all electric components in accordance with the
connection diagram.
● Even for brief measurements or tests, operation is only allowed if the
equipment grounding conductor has been permanently connected to the
points of the components provided for this purpose.
● Before accessing electrical parts with voltage potentials higher than 50 V,
you must disconnect electric components from the mains or from the pow‐
er supply unit. Secure the electric component from reconnection.
● With electric components, observe the following aspects:
Always wait 30 minutes after switching off power to allow live capacitors
to discharge before accessing an electric component. Measure the elec‐
trical voltage of live parts before beginning to work to make sure that the
equipment is safe to touch.
● Install the covers and guards provided for this purpose before switching
on.
● Never touch electrical connection points of the components while power
is turned on.
● Do not remove or plug in connectors when the component has been pow‐
ered.
● Under specific conditions, electric drive systems can be operated at mains
protected by residual-current-operated circuit-breakers sensitive to uni‐
versal current (RCDs/RCMs).
● Secure built-in devices from penetrating foreign objects and water, as well
as from direct contact, by providing an external housing, for example a
control cabinet.
High housing voltage and high leakage current! Danger to life, risk of injury by
electric shock!
● Before switching on and before commissioning, ground or connect the
components of the electric drive and control system to the equipment
grounding conductor at the grounding points.
● Connect the equipment grounding conductor of the components of the

electric drive and control system permanently to the main power supply at
all times. The leakage current is greater than 3.5 mA.
● Establish an equipment grounding connection with a minimum cross sec‐
tion according to the table below. With an outer conductor cross section
smaller than 10 mm2 (8 AWG), the alternative connection of two equip‐
ment grounding conductors is allowed, each having the same cross
section as the outer conductors.
Cross section outer con‐ Minimum cross section equipment grounding conductor
ductor Leakage current ≥ 3.5 mA
1 equipment grounding 2 equipment grounding
conductor conductors
1.5 mm2 (16 AWG) 2 × 1.5 mm2 (16 AWG)

2.5 mm2 (14 AWG) 2 × 2.5 mm2 (14 AWG)
4 mm2 (12 AWG) 10 mm2 (8 AWG) 2 × 4 mm2 (12 AWG)
6 mm2 (10 AWG) 2 × 6 mm2 (10 AWG)

10 mm2 (8 AWG) -
16 mm2 (6 AWG) -
25 mm2 (4 AWG) 16 mm2 (6 AWG) -
35 mm2 (2 AWG) -
50 mm2 (1/0 AWG) 25 mm2 (4 AWG) -
70 mm2 (2/0 AWG) 35 mm2 (2 AWG) -

... ... ...
Fig.3-1: Minimum Cross Section of the Equipment Grounding Connection
3.3.2 Protective Extra-Low Voltage as Protection Against Electric Shock

Protective extra-low voltage is used to allow connecting devices with basic in‐
sulation to extra-low voltage circuits.
On components of an electric drive and control system provided by Rexroth, all
connections and terminals with voltages between 5 and 50 volts are PELV
("Protective Extra-Low Voltage") systems. It is allowed to connect devices
equipped with basic insulation (such as programming devices, PCs, notebooks,
display units) to these connections.
Danger to life, risk of injury by electric shock! High electrical voltage by incorrect
connection!
If extra-low voltage circuits of devices containing voltages and circuits of more
than 50 volts (e.g., the mains connection) are connected to Rexroth products,
the connected extra-low voltage circuits must comply with the requirements for
PELV ("Protective Extra-Low Voltage").
3.3.3 Protection Against Dangerous Movements

Dangerous movements can be caused by faulty control of connected motors.
Some common examples are:
● Improper or wrong wiring or cable connection

● Operator errors
● Wrong input of parameters before commissioning
● Malfunction of sensors and encoders
● Defective components
● Software or firmware errors
These errors can occur immediately after equipment is switched on or even
after an unspecified time of trouble-free operation.
The monitoring functions in the components of the electric drive and control
system will normally be sufficient to avoid malfunction in the connected drives.
Regarding personal safety, especially the danger of injury and/or property dam‐
age, this alone cannot be relied upon to ensure complete safety. Until the
integrated monitoring functions become effective, it must be assumed in any
case that faulty drive movements will occur. The extent of faulty drive move‐
ments depends upon the type of control and the state of operation.
Dangerous movements! Danger to life, risk of injury, serious injury or property

damage!
A risk assessment must be prepared for the installation or machine, with its
specific conditions, in which the components of the electric drive and control
system are installed.
As a result of the risk assessment, the user must provide for monitoring func‐
tions and higher-level measures on the installation side for personal safety. The
safety regulations applicable to the installation or machine must be taken into
consideration. Unintended machine movements or other malfunctions are pos‐
sible if safety devices are disabled, bypassed or not activated.
To avoid accidents, injury and/or property damage:
● Keep free and clear of the machine’s range of motion and moving machine
parts. Prevent personnel from accidentally entering the machine’s range
of motion by using, for example:
– Safety fences
– Safety guards
– Protective coverings
– Light barriers
● Make sure the safety fences and protective coverings are strong enough
to resist maximum possible kinetic energy.
● Mount emergency stopping switches in the immediate reach of the oper‐
ator. Before commissioning, verify that the emergency stopping equip‐
ment works. Do not operate the machine if the emergency stopping switch
is not working.
● Prevent unintended start-up. Isolate the drive power connection by means
of OFF switches/OFF buttons or use a safe starting lockout.
● Make sure that the drives are brought to safe standstill before accessing
or entering the danger zone.
● Additionally secure vertical axes against falling or dropping after switching
off the motor power by, for example,
– mechanically securing the vertical axes,
– adding an external braking/arrester/clamping mechanism or
– ensuring sufficient counterbalancing of the vertical axes.
● The standard equipment motor holding brake or an external holding brake

controlled by the drive controller is not sufficient to guarantee personal
safety!
● Disconnect electrical power to the components of the electric drive and
control system using the master switch and secure them from reconnec‐
tion ("lock out") for:
– Maintenance and repair work
– Cleaning of equipment
– Long periods of discontinued equipment use
● Prevent the operation of high-frequency, remote control and radio equip‐
ment near components of the electric drive and control system and their
supply leads. If the use of these devices cannot be avoided, check the
machine or installation, at initial commissioning of the electric drive and
control system, for possible malfunctions when operating such high-fre‐
quency, remote control and radio equipment in its possible positions of
normal use. It might possibly be necessary to perform a special electro‐
magnetic compatibility (EMC) test.
3.3.4 Protection Against Magnetic and Electromagnetic Fields During Oper‐

ation and Mounting
Magnetic and electromagnetic fields generated by current-carrying conductors
or permanent magnets of electric motors represent a serious danger to persons
with heart pacemakers, metal implants and hearing aids.
Health hazard for persons with heart pacemakers, metal implants and hearing
aids in proximity to electric components!
● Persons with heart pacemakers and metal implants are not allowed to
enter the following areas:
– Areas in which components of the electric drive and control systems
are mounted, commissioned and operated.
– Areas in which parts of motors with permanent magnets are stored,
repaired or mounted.
● If it is necessary for somebody with a heart pacemaker to enter such an
area, a doctor must be consulted prior to doing so. The noise immunity of
implanted heart pacemakers differs so greatly that no general rules can
be given.
● Those with metal implants or metal pieces, as well as with hearing aids,
must consult a doctor before they enter the areas described above.
3.3.5 Protection Against Contact With Hot Parts

Hot surfaces of components of the electric drive and control system. Risk of
burns!
● Do not touch hot surfaces of, for example, braking resistors, heat sinks,
supply units and drive controllers, motors, windings and laminated cores!
● According to the operating conditions, temperatures of the surfaces can
be higher than 60 °C (140 °F) during or after operation.
● Before touching motors after having switched them off, let them cool down
for a sufficient period of time. Cooling down can require up to 140 mi‐
nutes! The time required for cooling down is approximately five times the
thermal time constant specified in the technical data.
● After switching chokes, supply units and drive controllers off, wait 15 mi‐
nutes to allow them to cool down before touching them.
● Wear safety gloves or do not work at hot surfaces.
● For certain applications, and in accordance with the respective safety reg‐
ulations, the manufacturer of the machine or installation must take meas‐
ures to avoid injuries caused by burns in the final application. These
measures can be, for example: Warnings at the machine or installation,
guards (shieldings or barriers) or safety instructions in the application
documentation.
3.3.6 Protection During Handling and Mounting

Risk of injury by improper handling! Injury by crushing, shearing, cutting, hitting!
● Observe the relevant statutory regulations of accident prevention.
● Use suitable equipment for mounting and transport.
● Avoid jamming and crushing by appropriate measures.
● Always use suitable tools. Use special tools if specified.
● Use lifting equipment and tools in the correct manner.
● Use suitable protective equipment (hard hat, safety goggles, safety shoes,
safety gloves, for example).
● Do not stand under hanging loads.
● Immediately clean up any spilled liquids from the floor due to the risk of
falling!
3.3.7 Battery Safety

Batteries consist of active chemicals in a solid housing. Therefore, improper
handling can cause injury or property damage.
Risk of injury by improper handling!
● Do not attempt to reactivate low batteries by heating or other methods (risk
of explosion and cauterization).
● Do not attempt to recharge the batteries as this may cause leakage or
explosion.
● Do not throw batteries into open flames.
● Do not dismantle batteries.
● When replacing the battery/batteries, do not damage the electrical parts
installed in the devices.
● Only use the battery types specified for the product.
Environmental protection and disposal! The batteries contained in

the product are considered dangerous goods during land, air, and
sea transport (risk of explosion) in the sense of the legal regulations.
Dispose of used batteries separately from other waste. Observe the
national regulations of your country.
3.3.8 Protection Against Pressurized Systems

According to the information given in the Project Planning Manuals, motors and
components cooled with liquids and compressed air can be partially supplied
with externally fed, pressurized media, such as compressed air, hydraulics oil,
cooling liquids and cooling lubricants. Improper handling of the connected sup‐
ply systems, supply lines or connections can cause injuries or property damage.
Risk of injury by improper handling of pressurized lines!
● Do not attempt to disconnect, open or cut pressurized lines (risk of explo‐
sion).
● Observe the respective manufacturer's operating instructions.
● Before dismounting lines, relieve pressure and empty medium.
● Use suitable protective equipment (safety goggles, safety shoes, safety
gloves, for example).
● Immediately clean up any spilled liquids from the floor due to the risk of
falling!
Environmental protection and disposal! The agents (e.g., fluids)

used to operate the product might not be environmentally friendly.
Dispose of agents harmful to the environment separately from other
waste. Observe the national regulations of your country.
3.4 Explanation of Signal Words and the Safety Alert Symbol

The Safety Instructions in the available application documentation contain spe‐
cific signal words (DANGER, WARNING, CAUTION or NOTICE) and, where
required, a safety alert symbol (in accordance with ANSI Z535.6-2006).
The signal word is meant to draw the reader's attention to the safety instruction
and identifies the hazard severity.
The safety alert symbol (a triangle with an exclamation point), which precedes
the signal words DANGER, WARNING and CAUTION, is used to alert the
reader to personal injury hazards.
DANGER
In case of non-compliance with this safety instruction, death or serious injury
will occur.
WARNING
In case of non-compliance with this safety instruction, death or serious injury
could occur.
CAUTION
In case of non-compliance with this safety instruction, minor or moderate injury
could occur.
NOTICE
In case of non-compliance with this safety instruction, property damage could
occur.
System Overview
4 System Overview
4.1 Introduction
4.1.1 Motivation and Objectives
Overview
The operational safety of machines and installations depends largely upon the
extent of dangerous movements generated by the machine.
In normal operation (also called productive operation or automatic operation),
protective equipment prevents humans from accessing danger zones and
keeps parts / materials from being thrown outward.
In special mode (also called manual mode or setting-up mode), it is often nec‐
essary for persons to access danger zones when the entire installation has not
been de-energized. In such situations machine operators must be protected by
mechanisms internal to the drive and the control unit.
The integrated Rexroth safety technology provides the user the requirements,
on the control unit and drive side, for realizing functions of personal and ma‐
chine protection with a minimum of planning and installation work required.
Compared to conventional safety technology, the integrated safety technology
considerably increases the functionality and availability of your machine. Inte‐
grated safety technology is distinguished by the following features:
● Complies with valid standards
● Simplified system structure (e.g., use of PROFIBUS for communication
and safety)
● Increased system performance
● Reduced system costs
● Easy understanding of complex subjects
● Improved diagnoses
● Simplified certification
● Easy commissioning
● Independent of control units
Comparison With Conventional Safety Technology
A drive and control system with integrated safety technology differs from sys‐
tems with conventional safety technology by the fact that the safety functions
are directly integrated in the intelligent drives in the form hardware and soft‐
ware. This increases the functionality in all operating modes with a maximum
of safety (short reaction times).
The following components of conventional safety technology are not included
in drive and control systems with integrated safety technology:
● Motor zero-speed relay for monitoring safety related standstill
● Speed monitor for monitoring safely-reduced speeds
● Power contactors between controllers and motors
● Limit switches or position cams for detection of range
The integrated safety technology is not destined to replace con‐

ventional safety technology, such as EMERGENCY STOP moni‐
toring devices and safety door monitors.
System Overview
Using the integrated safety technology increases the available personnel and
machine safety, because the total reaction time of the system in the case of an
error event, for example, is considerably reduced with regard to comparable
systems with conventional safety technology. The safety signals are transmit‐
ted with conventional wiring.
4.1.2 Conceptual Overview

An IndraDrive system consists of the components power section, control sec‐
tion (incl. firmware) and motor and possibly required additional components.
The integrated safety technology is realized by the interaction of the hardware
and firmware components.
Fig.4-1: Schematic Diagram of IndraDrive Cs With Integrated Safety Technology
The STO/SBC function does not require any measuring system.
4.1.3 Risk Analysis

Before a machine can be placed on the market, the manufacturer of the ma‐
chine must carry our a risk analysis in accordance with the Machinery Directive
2006/42/EC in order to determine the hazards associated with the use of the
machine.
The risk analysis is a multilevel, iterative process. The procedure is described
in detail in "EN ISO 14121 - Safety of machinery - Risk assessment" . This
documentation can only give you a very short overview on the subject of risk
analysis; users of integrated safety technology are obliged to intensively study
the respective standards and legal status.
The risk analysis carried out provides you the requirements for determining the
category for safety-related control units according to the valid C-standard the
safety-relevant parts of the machine control have to comply with.
System Overview
For more detailed information on the required Safety Integrity Lev‐

els (SIL) and Performance Levels (PL), see the applied component-
and machine-relevant standards in "Safety-Relevant Standards
and Regulations".
Procedure To obtain the highest possible degree of safety, the machine manufacturer
when choosing the solutions has to apply the following basic principles in the
indicated order:
1. Eliminate or minimize the hazards by construction measures.
2. Take the required protective measures against hazards that cannot be
eliminated.
3. Document the remaining risks and inform the user of these risks.
Simplification by Use of Integrated When using integrated safety technology, the machine manufacturer will benefit
Safety Technology from of the following simplifications:
● The safety-related components of the IndraDrive Cs range with the option
"Safe Torque Off" are suited for applications up to SIL3 of
IEC EN 62061. This means that functions realized with the optional safety
technology module of the IndraDrive Cs range comply with SIL1, SIL2 or
SIL3 of IEC EN 62061.
● The safety functions integrated in IndraDrive Cs were certified by
TÜV Rheinland®; this guarantees the user that the solution complies with
the state-of-the-art / the conformity of the components in accordance with
the Machinery Directive 2006/42/EC is ensured.
Safety Integrity Level (SIL), Relation Between the SILs of IEC EN 62061 and
the Performance Level (PL) of EN ISO 13849‑1
Performance Level Average probability of dangerous Safety Integrity Level

Risk
(PL) failure [1/h] (PFH) (SIL)
a ≥10-5...<10-4 -
b ≥3*10-6...<10-5 1
c ≥10-6...<3*10-6 1
d ≥10-7...<10-6 2
e ≥10-8...<10-7 3
Fig.4-2: Safety Integrity Level: Failure Limit Values for a Safety Function of a
PDS(SR)
4.2 Product Presentation

4.2.1 What is "Integrated Safety Technology"?
The control sections of the IndraDrive Cs range can be equipped with the op‐
tional module "Safe Torque Off" ("L4").
By the mentioned optional module, IndraDrive Cs is equipped with integrated
safety technology which provides the user with safe torque off, as well as with
safe control of a brake.
Definition "Safe Torque Off" means application-related safety functions which are appli‐
cable for personal protection at machines according to
EN ISO 13849-1 Category 4 PL e and IEC EN 62061 SIL 3.
Selecting the Function The safety functions can be selected via 24 V inputs at the drive controller.
System Overview
Certification The safety technology was certified by TÜV Rheinland ®; the NRTL listing by
TÜV Rheinland of North America is in preparation.
Certificates are available on the Internet/Extranet.
Requirements That Can Be Realiz‐ The integrated safety technology is independent of the type of master commu‐
ed nication, the higher-level control units and the supply modules. It is available
as a functional characteristic of the standard drive system. The requirements
below can be realized in the machine or in the installation:
● Measures according to EN ISO 12100‑2, if accessing the danger zone is
required, for example, for equipping, teaching or material withdrawal.
● Requirements for safety-related parts of control units according to
EN ISO 13849-1 Category 4 PL e and IEC EN 62061 SIL 3, as required
in EN 1010‑1 (printing and paper converting machines), EN 12415 (turning
machines) and EN 12417 (machining centres).
● Control functions in the case of error according to EN 60204‑1 (see "Using
diversity" in EN 60204‑1).
4.2.2 Integrated Safety Technology as IndraDrive Platform Solution

The type code below shows the different characteristics of IndraDrive Cs.
System Overview
Fig.4-3: Type Code HCS01

System Overview
To employ the integrated safety technology "Safe Torque Off" ac‐

cording to IEC EN 61800-5-2, you must at least use the firmware
version MP*16V14 or higher in the drive.
4.3 Safety-Relevant Standards and Regulations

4.3.1 General Information
Standard documents and sheets are subject to copyright protection
and Bosch Rexroth mustn't pass them on. If required, contact the
authorized sales agencies; in Germany directly contact Beuth Ver‐
lag GmbH (http://www.din.de/beuth).
Below the user will find a short overview of the relevant standards for the use
of safety-related control units. The overview does not claim completeness; be‐
sides, only the safety-relevant standards and regulations for functional safety
are taken into consideration.
4.3.2 Standards Relevant to Components

Product group Standard Title
Adjustable speed electrical power drive systems, Part 5‑2:

Electric drives IEC EN 61800‑5‑2
Safety requirements - Functional
IEC 61508‑1 to Functional safety of electrical/electronic/programmable elec‐
Complex controls
IEC 61508‑7 tronic safety-related systems
Fig.4-4: Standards Relevant to Components
4.3.3 Standards Relevant to Machinery

Standard Title
EN ISO 12100-1 and Safety of machinery ‑ Basic concepts, general principles for design
EN ISO 12100-2
EN ISO 14121 Safety of machinery ‑ Risk assessment
IEC EN 60204-1 Safety of machinery ‑ Electrical equipment of machines
IEC EN 62061 Safety of machinery ‑ Functional safety of safety-related electrical, electronic and
programmable electronic control systems
EN ISO 13849-1 Safety of machinery ‑ Safety-related parts of control systems
EN ISO 13849-2 Part 1: General principles for design

Part 2: Validation
EN ISO 13850 Safety of machinery ‑ Emergency stop ‑ Principles for design
DIN EN 1037 Safety of machinery ‑ Prevention of unexpected start-up
DIN EN 999 Safety of machinery ‑ The positioning of protective equipment in respect of approach speed
of parts of the human body
DIN EN 1088 Safety of machinery ‑ Interlocking devices associated with guards ‑ Principles for design and
selection
EN ISO 11161 Safety of machinery ‑ Integrated manufacturing systems ‑ Basic requirements
System Overview
Standard Title
EN ISO 10218-1 Robots for industrial environments ‑ Safety requirements
EN ISO 10218-2 Part 1: Robot

Part 2: Robot system and integration
DIN EN 1010‑1 Safety of machinery ‑ Safety requirements for the design and construction of printing and
paper converting machines, Part 1: Common requirements
DIN EN 848‑3 Safety of woodworking machines ‑ One side moulding machines with rotating tools,
Part 3:Numerically controlled (NC) boring and routing machines
DIN EN 415-1 Safety of packaging machines
to Part 1 to part 3
DIN EN 415-8 Part 4
Parts 5-7
Part 8
DIN EN 201 Plastics and runner machines - Injection moulding machines - Safety requirements
DIN EN 201/A2
DIN EN 12415 Safety of machine tools ‑ Small numerically controlled turning machines and turning centres
DIN EN 12417 Machine tools ‑ Safety ‑ Machining centres
DIN EN 13218 Machine tools ‑ Safety ‑ Stationary grinding machines
Fig.4-5: Standards Relevant to Machinery
4.3.4 EC Directives
Description Title Notes
Directive 2006/42/EC Machinery Directive Valid since

2009-12-29
Directive 2006/95/EC Low-Voltage Directive
Directive 2004/108/EC EMC Directive
Fig.4-6: EC Directives
4.4 Overview of Functions and Characteristics

4.4.1 Characteristics of Integrated Safety Technology
Introduction
Presently, the integrated safety technology is available in the characteristic
"Safe Torque Off" [pure hardware solution (optional safety technology module
"L4")].
Drive System With Optional Safety Technology Module "Safe Torque Off"
By means of the optional safety technology module "Safe Torque Off" ("L4"),
the drive can be protected against accidental restart and thereby be kept in a
safe state (Safe torque off function). In addition, an electrically releasing brake
can be switched off in a safe way (Safe brake control function).
On the optional safety technology module "Safe Torque Off", there are two 24 V
inputs available for dual-channel selection and two outputs for dynamization.
System Overview
4.4.2 Supported Safety Technology Functions

Introduction
With IndraDrive Cs and the optional safety technology module "Safe Torque
Off" ("L4"), it is exclusively the group of safety technology functions with the
following safety technology functions which is supported at present:
● Safe torque off
● Safe brake control
● Safe stop 1 (Emergency stop), only in conjunction with an external, time-
delayed safety selection device
4.4.3 Performance
Time Response and Reaction Times
The reaction times of integrated safety technology of the optional safety tech‐
nology module "Safe Torque Off" ("L4") are as follows:
● Selection of the safety functions, i.e. transition from normal operation
("bb/Ab")
– Safe torque off: Up to 18 ms
– Safe brake control: Up to 18 ms + clamping delay of the brake
● Deselection of the safety functions, i.e. transition to normal operation ("bb/
Ab")
– Safe torque off: 20 ms
– Safe brake control: 20 ms
The above-mentioned reaction times only apply to the safety func‐

tions. To determine the total reaction time of the system, take the
following additional aspects, among other things, into account:
● When selecting the safety functions
– Time until at least a single-channel selection greater than
1 ms exists
● When deselecting the safety functions
– Time until an error-free dual-channel deselection exists
– Reaction time of the drive system to the setting of drive
enable (put motor under current, release brake)
4.5 Safety Characteristics of the Safety System

4.5.1 Introduction
For using the optional safety technology module "Safe Torque Off", the drive
system "IndraDrive Cs" has been certified according to IEC 61508,
IEC EN 61800-5-2, IEC EN 62061 and ISO EN 13849-1.
The risk assessment and risk reduction of a machine require assessing the
safety functions of the individual components. The interaction of the compo‐
nents must be taken into account, too. Therefor, it is necessary to determine
the total PFH value for the machine or the machine part (e.g., a safety zone).
The total PFH value allows judging whether the required "Safety Integrity
Levels" (SIL) or "Performance Levels" (PL) have been complied with. For the
optional safety technology module "Safe Torque Off", the chapter below shows
how the PFH value can be determined for a drive system and how additional
external components must be integrated.
System Overview
4.5.2 Safe Torque Off

Drives equipped with the optional safety technology module "Safe Torque
Off" comply with the following "Safety Integrity Levels" (SIL) or "Performance
Levels" (PL):
● Up to SIL3 according to IEC EN 62061
● Up to Category 4 PL e according to EN ISO 13849-1
Depending on the "Safety Integrity Level" or "Performance Level" to be attained,
there are the following safety characteristics:
Description SIL3 / PL e
PFH1) <2*10-9 1/h (2% SIL3)

Mission Time 175,200 h (20 years)
"Proof Test" interval 175,200 h (20 years)
MTTFd/channel 1)
> 200 years
DCavg >99%
Test interval <1 h

1) The specified safety characteristics are achieved under the conditions
mentioned in the Project Planning Manual (see "Ambient and Operating
Conditions")
The safety characteristics are independent of the motor type and

encoder type used.
The specified test interval applies to the selection via an "active"
safety selection device with OSSD outputs. The test interval of the
OSSD outputs must be smaller than specified above. When you use
the dynamization outputs of the safety option "Safe Torque Off", the
safety option itself assures that the test interval is complied with.
"Mission Time" and "Proof Test" interval

● The "Mission Time" of all components used must be observed
and complied with. After the "Mission Time" of a component is
over, the component must be discarded or replaced. It is not
allowed to continue operating the component!
● After the component was discarded ("Mission Time" over), it
must be ensured that it cannot be reused (e.g., by dismantling
it).
● If a component (with valid "Mission Time") is decommissioned,
the "Mission Time" must be recorded and continued when the
component is commissioned again.
● For the IndraDrive system, there hasn't any "Proof Test" been
specified. Therefore, the "Mission Time" cannot be reset by a
"Proof Test".
Functional Principle of Integrated Safety Technology
5 Functional Principle of Integrated Safety Technology

5.1 Basic Functions
5.1.1 Overview
In the case of a standard drive, the axis / spindle / roll is moved according to
the command values of the control unit. In this case, incorrect drive motion can
be caused by operating errors, incorrect installation in the system, defects in
parts or materials, failures in the system. Incorrect drive motion – even if the
errors only occur for a short time and occasionally – can endanger persons
staying in the danger zone of the drive motion.
You therefore have to take measures that limit the effects of errors on the drive
motion to a minimum. The remaining risk of danger to persons is then consid‐
erably reduced.
During operation, the safety functions are monitored by the drive system. For
this purpose, measures for detecting static error states were realized in the
system:
● Dual-channel structure
● Comparison of the states of both channels
● Dynamization of static states
These measures guarantee that a single error cannot cause the safety func‐
tions to get lost.
The installation or machine manufacturer has to determine in how far this is
sufficient for an existing installation or machine by a risk analysis according to
annex I of Directive 2006/42/EC.
The schematic diagram below illustrates the basic functions and functional
principles explained in this section:
Fig.5-1: Schematic Diagram of IndraDrive Cs With Integrated Safety Technology

5.1.2 Dynamization
Brief Description
Dynamization is to detect static error states in the safety-relevant circuits. Dy‐
namization takes place automatically in the background without having an effect
on the safety function or the standard drive functions.
Functional Principle of Dynamization
A safety function is selected via an N/C-N/C combination, i.e. a "0" signal at
both inputs is evaluated when the safety functions are selected. Therefore, the
dynamization of the external selection channels can only take place in the de‐
selected state (normal operation). The internal dynamizations are carried out
independent of the external selection state.
Dynamization in the Case of Selec‐
tion via an Active Safety Unit An active safety unit is a safety switching device which selects the
safe function via OSSD output. The active safety unit tests its out‐
puts on its own.
The "OSSD" (Output Signal Switching Device) is that part of a safe

selection unit which has been connected to the machine control and
which goes to the OFF state, when the safe selection unit triggers
during the intended operation.
When the safety functions are selected via an active safety unit, the dynami‐
zation pulses of the OSSD outputs of the active safety unit are evaluated and
monitored; therefore, there aren't any other dynamization signals required.
The active safety unit must detect the following errors via its OSSD outputs:
● Short circuit of one or both selection signals with 24 V
● Short circuit of one or both selection signals with 0 V
● Short circuit between both selection signals
In order that all other relevant "sleeping errors" can be detected by the STO
option, the dynamization pulses of the OSSD outputs must comply with the
following limit values:
Value Explanation
tPLmax 1 ms Maximum low time of the test pulse
tPLmin 20 µs Minimum low time of the test pulse
tPmax 1h Maximum periodic time of the test pulses
tPmin 500 µs Minimum periodic time of the test pulses
Maximum delay of the selection signals for

tVmax 1s
selection or deselection
Minimum sampling ratio of the selection
tDmin = tPH / tP 90 %
signals
Maximum bounce time for a selection or
tBounce 400 ms
deselection
Phase shift of the test pulses on both
φ -
channels: No requirement
Fig.5-2: Limit Values of the Dynamization Pulses of the OSSD Outputs

Fig.5-3: Example of Dynamized Selection Signals

The figure below illustrates, in schematic form, the interconnection of an active
safety unit and several drives with the STO option:
Fig.5-4: Dynamization in the Case of Selection via an Active Safety Unit
When you select the safety unit, the maximum current consumption
of the selection inputs of all drives of a safety zone must be taken
into account.
Dynamization for Selection via Pas‐
sive Safety Units A passive safety unit is a safety switching device with which the safe
function is selected via isolated contacts.
When selection takes place via a passive safety unit which selects
the STO/SBC function, the drive checks the wiring of the safety
function.
When the selection of the safety functions takes place via a passive safety unit,
the drive generates the dynamization pulses and makes them available via the
outputs "dynamization channel A" and "dynamization channel B". Via these two
outputs, the isolated selection contacts of the passive safety unit can be sup‐
plied.
The figure below illustrates, in schematic form, the interconnection of a passive
safety unit and several drives with the STO option:
Fig.5-5: Dynamization in the Case of Selection via a Passive Safety Unit
A safety zone must not contain more than a maximum of 25

IndraDrive Cs drives with the STO option. If more than 25 drives
are to be operated at a safety unit, you must set up several safety
zones.
When you select the safety unit, the maximum current consumption
of the selection inputs of all drives of a safety zone must be addi‐
tionally taken into account.
Integrated Safety Functions
6 Integrated Safety Functions

6.1 Overview of Safety Functions
The application-related safety functions "STO"/"SBC" described below have
been realized for personal protection in accordance with
EN ISO 13849-1 Category 4 PL e and IEC EN 62061.
Before a safety function is selected, transition to the corresponding

state has to take place for the drive system by means of command
value input.
6.1.2 Classification of Safety Functions

The safety functions can be divided into the following categories:
1. Safety functions in normal operation and in special mode with the following
functions
● Not available in conjunction with the "L4 option"
2. Safety functions in special mode "safe standstill" with the functions
● Safe torque off
● Safe brake control
3. Safety functions in special mode "safe motion" with the following functions
4. Additional or auxiliary functions
6.2 Safety Functions in Special Mode "Safe Standstill"

6.2.1 Safe Torque Off (STO)
Brief Description
Using the function "Safe torque off" requires the optional safety
technology module "L4".
The energy supply to the motor is safely interrupted with the safety function
"Safe torque off". The drive cannot generate any torque/force and, as a con‐
sequence, it cannot generate any dangerous motions, either.
Before activating the safety function "Safe torque off", the drive
system must be decelerated via the command value input; there is
no drive-controlled deceleration!
WARNING Lethal injury and/or property damage caused

by unintended axis motion!
⇒ If external force influences are to be expected with the safety function "Safe
torque off", e.g. in the case of a vertical axis, this motion has to be safely pre‐
vented by additional measures, e.g. a mechanical brake or a weight compen‐
sation; for such axes, Bosch Rexroth recommends that you use the safe braking
and holding system.
WARNING High electrical voltage! Danger to life, risk of

injury by electric shock or serious injury!
During the time a safety function is active, power is not removed from the motor;
de-energize the motor's drive before working on it.
Features The safety function "Safe torque off" (STO) has the following features:
● When the safety function "Safe torque off" (STO) is selected, the "Safe
brake control" (SBC) is automatically activated
● Corresponds to stop category 0 according to EN 60204‑1
● Is suited for safety-relevant applications up to Category 4 PL e according
to EN ISO 13849-1 or SIL 3 according to IEC EN 62061.
● The energy supply to the motor is safely interrupted via two channels.
● The selection can take place via two channels, alternatively by means of
– a passive safety unit with dual-channel, isolated conventional (non-
solid-state) normally closed contacts (e.g., safety switching device
for emergency halt, safety door monitor, etc.) or
– an active safety unit with plus-plus-switching or plus-minus-switching
OSSD outputs (e.g., safety control units, laser scanners, etc.).
● The selection can take place via one channel, alternatively by means of
– a passive safety unit with an isolated conventional (non-solid-state)
normally closed contact (e.g., safety switching device for emergency
halt, safety door monitor, etc.). In addition, the elimination of errors
in the wiring (considering EN 61800-5-2: 2007, table D.1 or EN ISO
13849-2: 2008, table D.4) is required, or
– by means of an active safety unit with plus-switching OSSD output
(e.g., safety control units, laser scanners, etc.). In addition, the elim‐
ination of errors in the wiring (considering EN 61800-5-2: 2007, table
D.1 or EN ISO 13849-2: 2008, table D.4) is required.
● The dynamization of the safety function selection takes place alternatively
by means of
– the OSSD dynamization of the active safety unit or
– the dynamization outputs at the X49 terminal connector of the op‐
tional safety technology module "L4" in the case of control by passive
safety units.
● It is possible to set up a zone by connecting up to 25 drives in parallel
● Online dynamization of the outputs and interrupting circuits
● Quick reaction time (18 ms)
● The status of the safety function "Safe torque off" is displayed via the pa‐
rameter "P‑0‑0106, Operating status STO/SBC".
Pertinent Parameters The following parameters are used in conjunction with the safety function "Safe
torque off":
● P‑0‑0106, Operating status STO/SBC
Pertinent Diagnostic Messages The following diagnostic messages can be generated in conjunction with the
safety function "Safe torque off":
● A0011 STO/SBC active
● F3134 Dynamization time interval incorrect
● F8300 Dynamization pulse width incorrect
● F8301 Error when checking selection signals

● F8302 Error when checking switch-off channels STO/SBC
● F8303 System error STO/SBC
● E8027 STO/SBC while drive enabled
With the safety function "Safe torque off" activated, "STO" is shown on the dis‐
play of the IndraDrive control panel.
Safety Function
On the optional safety technology module "L4", there are two 24 V inputs avail‐
able for dual-channel selection and two dynamization outputs for operation at
passive safety units.
For pin assignments and technical data, please see the Project
Planning Manual of the device.
The safety function "Safe torque off" can be divided into the following topics
which are described in detail below:
● Dynamization
● Requirements on the Command Value Input
● Selection of the Safety Function "Safe torque off"
Dynamization Dynamization is to detect static error states in the wiring and in the safety-
relevant circuits. Dynamization takes place automatically in the background
without having an effect on the safety function or the standard drive functions.
both inputs is evaluated as the selection of the safety function. Therefore, the
independent of the selection.
For the dynamization of the safety function selection, we distinguish whether
the safety function is selected via an active or passive safety unit. The dynam‐
ization function is explained in the chapter on "Dynamization".
Dynamization pulses of a duration of 1 µs and more are recognized as valid
dynamization pulses.
The dynamization pulses are monitored for:
● the time interval
● the pulse width
● the sampling ratio
The safety option "L4" monitors whether the dynamization of the selection sig‐
nals is carried out in the deselected state. Monitoring takes place so that
dynamization is carried out at the latest after 1 hour in the deselected state
(normal operation). For this purpose, the time in the deselected state is drive-
internally added and only reset by dynamization; i.e. when selection takes place
in the meantime, this does not cause monitoring to be reset. Monitoring takes
place independently for both selection channels. When the time interval has
been exceeded, the error message "F3134 Dynamization time interval incor‐
rect" is generated.
To increase the noise immunity, the safety technology tolerates the

failure of a dynamization pulse, when the following 8 dynamization
pulses occur within the time window described above.
In addition, the safety technology checks that the dynamization pulse does not
fall below or exceed a minimum or maximum length. This means that the dy‐
namization pulse must be longer than 20 µs and shorter than 1 ms. When one
of the two monitoring limits has been exceeded, the error message "F8300
Dynamization pulse width incorrect" is generated.
The safety technology monitors the sampling ratio of the dynamization pulse,
too. When this is done, the dynamization pause must be at least 90% of a
dynamization period. When the dynamization pause is shorter, the error mes‐
sage "F8300 Dynamization pulse width incorrect" is generated.
Requirements on the Command
Value Input Before activating the safety function "Safe torque off", the drive
system must be decelerated via the command value input; there is
no drive-controlled deceleration!
The safety function "Safe torque off" corresponds to stop category 0

according to EN 60204‑1.
When drive enable has been set and the safety function "Safe torque off" is
selected at the same time, the drive generates the warning "E8027 STO/SBC
while drive enabled", because the drive first has to be shut down before it is
allowed to activate the safety function "Safe torque off".
The warning is automatically cleared, when drive enable is removed. In the
diagnostic message memory, however, the fatal warning remains entered.
DANGER Lethal injury and/or material damage caused

by coasting axes!
⇒ When the safety function "Safe torque off" is selected with drive enable having
been set, the drive torque, independent of the diagnostic message which was
set, is immediately disabled and the drive coasts to stop; the shutdown process
is relatively slow and, above all, not safe!
Selection of the Safety Function The safety function "Safe torque off" is alternatively selected via two channels
"Safe torque off" or via one channel. The selection of the safety function is detected, when a 0-
signal is detected on both selection inputs. The selection can alternatively be
made by means of active or passive safety units.
See also "Examples of Application"
When the safety function "Safe torque off" is selected, the safety
function "Safe brake control" is activated, too, if a brake is available.
It is impossible to select or deselect both safety functions separate‐
ly.
The safety technology checks the selection signals for validation. In the case
of single-channel selection, i.e. dual-channel selection is expected due to the
wiring, but only one channel is selected, the second channel must be selected
before the first channel is deselected; otherwise, the error message "F8301
Error when checking selection signals" is generated.
The tolerance time for the differing selection between the two se‐
lection channels is 1 s; the parameter setting cannot be changed.
For diagnostic purposes, the status of the safety function "Safe torque off" can
be read via the parameter "P‑0‑0106, Operating status STO".
Notes on Commissioning
For examples of interconnection, see "Examples of Application"
Notes on Project Planning
When projecting the safety function "Safe torque off", you absolutely have to
observe the following safety instructions:
DANGER Lethal injury and/or property damage caused

⇒ If external force influences are to be expected with the safety function "Safe
torque off", e.g. in the case of a vertical axis, this motion has to be safely pre‐
vented by additional measures, e.g. a mechanical brake or a weight compen‐
sation; for such axes, Bosch Rexroth recommends that you use the safe braking
and holding system.
WARNING Injury and/or property damage caused by de‐

viation from standstill position!
⇒ Even if the control of the power section has been safely locked, momentary
axis motion, depending on the number of poles of the motor, can be triggered,
when three errors are occurring simultaneously in the power section with the
voltage DC bus being active:
● Breakdown of a power semiconductor
● Breakdown of another semiconductor
● In this case, two of six semiconductors are affected in such a way that the
motor shaft is aligning
Example synchronous motor: For a 6-pole synchronous motor, the motion can
be a maximum of 30 degrees. For a directly driven ballscrew, e.g. 20 mm per
revolution, this corresponds to a one-time maximum linear motion of 1.67 mm.
When an asynchronous motor is used, the short circuits in two separate circuits
of the power section have almost no effect, because the exciter field breaks
down when the inverter is shut down and has completely died down after ap‐
prox. 1 s.
6.2.2 Safe Brake Control (SBC)

Brief Description
Using the function "Safe brake control (SBC)" requires the optional
safety technology module "L4".
With the safety function "Safe brake control (SBC)", the motor holding brake is
switched off safely (via two channels).
Before activating the safety function "Safe brake control (SBC)", the
drive system must be decelerated via the command value input;
there is no drive-controlled deceleration!
Features The safety function "Safe brake control" (SBC) has the following features:
● The safety function "Safe brake control" (SBC) is automatically activated
when the safety function "Safe torque off" (STO) is selected
● Is suited for safety-relevant applications up to Category 4 PL e according

to EN ISO 13849-1 or SIL 3 according to IEC EN 62061.
● The energy supply to the motor holding brake is safely interrupted via two
channels.
● The selection can take place via two channels, alternatively by means of
– a passive safety unit with dual-channel, isolated conventional (non-
solid-state) normally closed contacts (e.g., safety switching device
for emergency halt, safety door monitor, etc.) or
– by means of an active safety unit with plus-plus-switching or plus-
minus-switching OSSD outputs (e.g., safety control units, laser scan‐
ners, etc.).
● The selection can take place via one channel, alternatively by means of
– a passive safety unit with an isolated conventional (non-solid-state)
normally closed contact (e.g., safety switching device for emergency
halt, safety door monitor, etc.). In addition, the elimination of errors
in the wiring (considering EN 61800-5-2: 2007, table D.1 or EN ISO
13849-2: 2008, table D.4) is required, or
– an active safety unit with plus-switching OSSD output (e.g., safety
control units, laser scanners, etc.). In addition, the elimination of er‐
rors in the wiring (considering EN 61800-5-2: 2007, table D.1 or EN
ISO 13849-2: 2008, table D.4) is required.
● The dynamization of the safety function selection takes place alternatively
by means of
– the OSSD dynamization of the active safety unit or
– the dynamization outputs at the X49 terminal connector of the op‐
tional safety technology module "L4" in the case of control by passive
safety units.
● It is possible to set up a zone by connecting up to 25 drives in parallel
● Only self-holding (electrically releasing) brakes are supported
● Online dynamization of the outputs and interrupting circuits
● Quick reaction time (18 ms plus brake delay time)
● The status of the safety function "Safe brake control" is displayed via the
parameter "P‑0‑0106, Operating status STO/SBC".
Pertinent Parameters The following parameter is used in conjunction with the safety function "Safe
brake control":
● P‑0‑0106, Operating status STO/SBC
Pertinent Diagnostic Messages The following diagnostic messages can be generated in conjunction with the
safety function "Safe brake control" (SBC):
● A0011 STO/SBC active
● C0256 Safety technology configuration error
● F3134 Dynamization time interval incorrect
● F8300 Dynamization pulse width incorrect
● F8301 Error when checking selection signals
● F8302 Error when checking switch-off channels STO/SBC
● F8303 System error STO/SBC
With the safety function "Safe brake control" activated, the display of the
IndraDrive control panel shows "STO", because the safe brake control can only
be activated in conjunction with the safe torque off (STO) function.
Safety Function
On the optional safety technology module "L4", there are two 24 V inputs avail‐
able for dual-channel selection and two dynamization outputs for operation at
passive safety units.
For pin assignments and technical data, please see the Project
Planning Manual of the device.
The safety function "Safe brake control" can be divided into the following topics
which are described in detail below:
● Dynamization
● Command Value Input
● Selection of the Safety Function "Safe Brake Control"
Dynamization Dynamization is to detect static error states, so-called "sleeping errors", in the
safety-relevant circuits. Dynamization takes place automatically in the back‐
ground without having an effect on the safety function or the standard drive
functions.
both inputs is evaluated when the safety functions are selected. Therefore, the
independent of the external selection state.
For the dynamization of the safety function selection, we distinguish whether
the safety function is selected via an active or passive safety unit. The dynam‐
ization function is explained in the chapter on "Dynamization".
The dynamization pulses are monitored for:
● the time interval
● the pulse width
● the sampling ratio
The optional safety technology module "Safe Torque Off" monitors whether the
dynamization of the selection signals is carried out in the deselected state.
Monitoring takes place so that dynamization is carried out at the latest after 1
hour in the deselected state (normal operation). For this purpose, the time in
the deselected state is drive-internally added and only reset by dynamization;
i.e. when selection takes place in the meantime, this does not cause monitoring
to be reset. Monitoring takes place independently for both selection channels.
When the time interval has been exceeded, the error message "F3134 Dy‐
namization time interval incorrect" is generated.
To increase the noise immunity, the safety technology tolerates the

failure of a dynamization pulse, when the following 9 dynamization
pulses occur within the time window described above.
In addition, the safety technology checks that the dynamization pulse does not
fall below or exceed a minimum or maximum length. This means that the dy‐
namization pulse must be longer than 20 µs and shorter than 1 ms. When one
of the two monitoring limits has been exceeded, the error message "F8300
Dynamization pulse width incorrect" is generated.
The safety technology monitors the sampling ratio of the dynamization pulse,
too. When this is done, the dynamization pause must be at least 90% of a
dynamization period. When the dynamization pause is shorter, the error mes‐
sage "F8300 Dynamization pulse width incorrect" is generated.
Requirements on the Command

Value Input Before activating the safety function "Safe brake control", the drive
system should be decelerated via the command value input to pre‐
vent wear of the brake; there is no drive-controlled deceleration!
When drive enable has been set and the safety function "Safe brake control" is
selected at the same time, the drive generates the warning "E8027 STO/SBC
while drive enabled", because the "Safe brake control" is always activated to‐
gether with the "Safe torque off" function. The warning is generated, because
the drive first must be decelerated, before it is allowed to activate the safety
functions "Safe torque off" and "Safe brake control".
The warning is automatically cleared, when drive enable is removed. In the
diagnostic message memory, however, the fatal warning remains entered.
DANGER Lethal injury and/or material damage caused

by coasting axes!
⇒ When the safety function "Safe brake control", and thereby the safety function
"Safe torque off", too, is selected with drive enable having been set, the drive
torque, independent of the diagnostic message which was set, is immediately
disabled, the motor brake is applied and the drive is only decelerated by means
of the motor brake; depending on the motor brake, the shutdown process can
be relatively slow and, above all, not safe!
Selection of the Safety Function The safety function "Safe brake control" is alternatively selected via two chan‐
"Safe Brake Control" nels or via one channel. The selection of the safety function is detected, when
a 0-signal is detected on both selection inputs. The selection can alternatively
be made by means of active or passive safety units.
See also "Examples of Application"
When the safety function "Safe brake control" is selected, the safety
function "Safe torque off" is activated, too. It is impossible to select
or deselect both safety functions separately.
The safety technology checks the selection signals for validation. In the case
of single-channel selection, i.e. dual-channel selection is expected due to the
wiring, but only one channel is selected, the second channel must be selected
before the first channel is deselected; otherwise, the error message "F8301
Error when checking selection signals" is generated.
The tolerance time for the differing selection between the two se‐
lection channels is 1 s; the parameter setting cannot be changed.
For diagnostic purposes, the status of the safety function "Safe torque off" can
be read via the parameter "P‑0‑0106, Operating status of STO".
Notes on Commissioning
For examples of interconnection, see "Examples of Application"
Notes on Project Planning
WARNING High electrical voltage! Danger to life, risk of

injury by electric shock or serious injury!
During the time a safety function is active, power is not removed from the motor;
de-energize the motor's drive before working on it.
● As the safety function "Safe brake control" cannot be deactivated, it is only

allowed to operate self-holding (electrically releasing) brakes at drives with
the safety option "L4 - Safe Torque Off".
When an electrically holding brake is configured in the parameter
"P‑0‑0525, Holding brake control word", the transition command error
"C0256 Safety technology configuration error" is generated when the drive
is switched to the operating mode (OM).
● When you select the brake, you must consider that the brake outputs are
tested online during operation. For this purpose, the outputs are switched
off or a short time (≤650 µs) and the brake is controlled. If a very fast acting
brake is used, it is impossible to exclude the possibility of the brake ap‐
plying.
Examples of Application
7 Examples of Application
7.1 STO and SBC Functions When Selected by Means of Passive
Safety Units
7.1.1 Dual-Channel Wiring
Fig.7-1: STO/SBC Function With Dual-Channel Wiring and Passive Safety Unit
The assignment of the dynamization signals can be freely selected.

7.1.2 Single-Channel Wiring
Fig.7-2: STO/SBC Function With Single-Channel Wiring and Passive Safety Unit
When the wiring (as illustrated above) between the passive safety unit and the
connector X49 of the optional safety technology module "L4" is to be a single-
channel wiring, the wiring must be carried out as a "safe wiring". For this
purpose, the following eliminations of errors must be made:
● Short circuit with other potentials
● Short circuit with 24 V
● Short circuit with ground
See also EN 61800-5-2: 2007, table D.1
In the case of single-channel wiring between the passive safety unit and the
connector X49 of the optional safety technology module "L4", the internal struc‐
ture of the passive safety unit, too, must comply with the requirements of the
"safe wiring".
The application engineers are free to choose any dynamization sig‐

nal.
7.2 STO and SBC Function When Selected by Means of Active

Safety Units
7.2.1 Dual-Channel Wiring
Plus-Plus-Switching Safety Unit
When the safety function is selected by means of a plus-plus-switching safety
unit, the following errors must be detected by the OSSD outputs:
● Short circuit of the selection signals with 24 V
● Short circuit between the two selection signals
Fig.7-3: STO/SBC Function With Active Safety Unit (Plus-Plus-Switching Out‐

puts)
Plus-Minus-Switching Safety Unit
When the safety function is selected by means of a plus-minus-switching safety
unit, the following errors must be detected by the OSSD outputs:
Fig.7-4: STO/SBC Function With Active Safety Unit (Plus-Minus-Switching Out‐

puts)
7.2.2 Single-Channel Wiring

When the safety function is selected by means of a safety unit, the short circuit
with 24 V must be detected by the OSSD output.
Fig.7-5: STO/SBC Function With Single-Channel Wiring and Active Safety Unit
When the wiring between the active safety unit and the connector X49 of the
optional safety technology module "L4" is to be a single-channel wiring (as il‐
lustrated above), the wiring must be carried out as a "safe wiring". For this
purpose, the following eliminations of errors must be made:
● Short circuit with other potentials
● Short circuit with 24 V
● Short circuit with ground
See also EN 61800-5-2: 2007, table D.1
When the wiring between the active safety unit and the connector X49 of the
optional safety technology module "L4" is a single-channel wiring, the OSSD
output must have been designed with "serial redundancy" in accordance with
SIL3.
7.3 "SS1" Function With "L4" Option

Using the E-Stop function of the drive (or the NC stop of the control unit), you
can extend the STO function to obtain the SS1 function. For this purpose, the
selecting safety unit (active or passive) must first shut down the drive by means
of the E-Stop function (or the NC stop of the control unit) and select the STO
function after a fixed time that has been set is over. The selection must always
take place after the time that has been set, independent of the state of the axis.
Fig.7-6: SS1 Function (Including "SBC") With Dual-Channel Wiring and Pas‐
sive Safety Unit
7.4 Mixed Operation of the Optional Safety Technology Modules

"L2" and "L4"
7.4.1 Mixed Operation of the Optional Safety Technology Modules "L2" and
"L4" at an Active Safety Unit
When a safety zone is to be implemented, in which drives with the optional
safety technology modules "L2" and "L4" have been integrated, the axes must
be interconnected as follows.
Fig.7-7: Mixed Operation of the Safety Options "L2" / "L4" via an Active Safety
Unit (Plus-Minus-Switching)
The circuit illustrated above makes the following demands on the active safety
unit which is used:
● Detection of short circuits of the 0 V‑switching output against 0 V/GND
● Detection of short circuits of the 24 V‑switching output against a voltage
>10 V
● Test pulses in accordance with the requirement for the optional safety
technology modules "L4" must be output
● A cyclic test in accordance with the requirement for the optional safety
technology modules "L2" must be made
● The outputs of the safety unit must be designed for the number of nodes
of a safety zone
7.4.2 Mixed Operation of the Optional Safety Technology Modules "L2" and
"L4" at a Passive Safety Unit
Dual-Channel Selection of the "L4" When a safety zone is to be implemented, in which drives with the optional
Option safety technology modules "L2" and "L4" have been integrated, the axes must
be interconnected as follows; in this case, the dual-channel control of the "L4"
option must be used:
Fig.7-8: Mixed Operation of the Safety Options "L2" / "L4" via a Safety Switching
Device (Passive Safety Unit)
The circuit illustrated above makes the following demands on the passive safety
unit which is used:
● A maximum of 15 axes with the optional safety technology modules
"L2"/"L4" may be combined in a safety zone
● The two outputs of the passive safety unit, which are used to control the
"L4" options, must comply with the requirements of the SIL or Performance
Level to be achieved.
● The two outputs of the passive safety unit, which are used to control the
"L2" options, must comply with the requirements of the SIL or Performance
Level to be achieved.
● A cyclic test in accordance with the requirement for the optional safety
technology modules "L2" must be made
Single-Channel Selection of the Setting up a safety zone with control via a passive safety unit, in which drives
"L4" Option with the optional safety modules "L2" and "L4" have been integrated, and using
the single-channel wiring of the "L4" option are not allowed!
Fig.7-9: Inadmissible Mixed Operation of the Safety Options "L2" / "L4" With
Single-Channel Selection via Safety Switching Device (Passive Safety
Unit)
Commissioning the Safety Technology
8 Commissioning the Safety Technology

8.1 Safety Instruction
WARNING Dangerous movements! Danger to life, risk of
injury, serious injury or property damage!
Do not commission the installation without having it checked by a qualified per‐
son!
Before you commission an installation with integrated safety technology for the
first time, the installation must be checked and approved in documented form
by a qualified person.
Check the danger zone!
● Before commissioning the installation, make sure that nobody is staying
in the danger zone.
● Check the danger zone and secure it against access by persons (e.g. put
up warning signs, install barriers or the like).
Observe the corresponding laws and local regulations.
8.2 Prerequisites for Using Integrated Safety Technology

8.2.1 Required Drive Firmware
The drive-integrated safety technology "L4" is a functionality only scalable by
means of the hardware and does not require any additional enabling of func‐
tional firmware packages.
The integrated safety functions "Safe torque off" and "Safe brake control" (L4)
can be used as of the firmware version MPx16V14.
See also Functional Description of firmware "Firmware Types"
8.2.2 Required Controller Configuration

General Information
To use the integrated safety technology of Rexroth IndraDrive controllers, the
drive controller has to be configured/equipped with the corresponding optional
safety technology module.
Optional Safety Technology Module "Safe Torque Off" (L4)
Using the functions "Safe torque off" and "Safe brake control" requires the op‐
tional safety technology module "Safe Torque Off" (L4). The optional module
"Safe Torque Off" can be ordered for the following controllers:
● IndraDrive Cs Basic (HCS01.1E-W00**-A0*-B)
● IndraDrive Cs Economy (HCS01.1E-W00**-A0*-E)
● IndraDrive Cs Advanced (HCS01.1E-W00**-A0*-A)
For pin assignments and technical data of the optional safety tech‐
nology module "L4", please see the Appendix: "L4 - Safe Torque
Off".
8.2.3 Required Motors and Measuring Systems

Motors by Rexroth
In conjunction with the optional safety technology module "Safe Torque
Off" (L4), there aren't any specific requirements on the motor and the measuring
system.
For motors with integrated brake, observe the requirements mentioned in the
chapter " Allowed Motor Holding Brakes".
Third-Party Motors/Optional Measuring Systems
In conjunction with the optional safety technology module "Safe Torque
Off" (L4), there aren't any specific requirements on the motor and the measuring
system.
For motors with integrated brake, observe the requirements mentioned in the
chapter " Allowed Motor Holding Brakes".
8.2.4 Allowed Motor Holding Brakes

When the safety function "Safe brake control" is to be used with the optional
safety technology module "Safe Torque Off" (L4), the brake must comply with
the following requirements:
● Control: The brake must have been designed is such a way that the hold‐
ing torque of the brake takes effect in the de-energized state (e.g., elec‐
trically releasing friction surface brake).
● Electrical connection:
– The electrical connections of the brake mustn't have ground refer‐
ence.
– The voltage range of the brake must comply with the one of the sup‐
ply voltage.
– The brake current in the activated state must be between 0.1 A and
1.25 A.
● Mechanical system: Friction surface brakes are allowed as motor holding
brake. It is not allowed to operate form-locking brakes as motor holding
brake. The static holding torque of the brake must have been dimensioned
such that the maximum weight of the load of the axis can be safely held.
For more detailed information on the dimensioning of the brake, please
see the corresponding C-standard.
In addition to the static holding torque of the brake, the required

dynamic braking torque of the brake must be considered. The dy‐
namic braking torque of the brake has a direct influence on the
behavior of the axis in the case of error and must be taken into
account in the risk analysis.
● Reliability: The brake must have been authorized for ambient tempera‐
tures from 0 to 40 °C.
8.2.5 Required Commissioning Tools

Commissioning the optional safety technology module "Safe Torque Off" does
not require any commissioning tool.
8.3 Checks Before Initial Commissioning

The checks before the initial commissioning are meant to confirm the safety
requirements stipulated in the national/international regulations (EC conformi‐
ty), particularly in the Machinery Directive or the Use of Work Equipment
Directive.
Check the protective equipment at the machine for effectiveness in all operation
modes and functions which can be set at the machine.
Make sure that the operators ‑ before they start working at the machine with
integrated safety technology ‑ are instructed by qualified staff of the machine's
operating company. The operating company of the machine is responsible for
the instruction.
8.4 Commissioning the Function "Safe Torque Off" (Optional Safe‐

ty Technology Module "L4")
8.4.1 Overview
The functions "Safe torque off" and "Safe brake control" can preferably be
commissioned by means of the commissioning software IndraWorks or man‐
ually.
The following commissioning steps describe the commissioning by

means of the commissioning software IndraWorks. For commis‐
sioning with a different commissioning tool, the corresponding pa‐
rameters which have to be set are listed.
DANGER Lethal injury and/or property damage caused

⇒ If external force influences, together with danger for persons or machines,
are to be expected with the safety function "Safe torque off", e.g. due to the
weight of the load in the case of a vertical axis, this motion has to be safely
prevented by additional measures, e.g. by a mechanical brake or a weight
compensation.
⇒ In this case, all cases of operation occurring in the application must be taken
into account, including mains failure and tripped fuses.
Fig.8-1: Overview - Commissioning Steps of the Function "Safe torque off"
8.4.2 Commissioning Steps

Step 0: Condition as Supplied and The functions "Safe torque off" and "Safe brake control" are always active and
Initialization cannot be deactivated.
During the booting process, the drive system is in the operating states "STO"
and "SBC"; i.e. the output stage and the brake (if available) have been switched
off via two channels.
After the booting process, the safety functions "Safe torque off" and "Safe brake
control" are active. When the drive is switched from operating mode to param‐
eter mode, the functionality of the functions "Safe torque off" and "Safe brake
control" is maintained, i.e. according to the selection, the functions "Safe torque
off" and "Safe brake control" become active or not.
Step 1: Connecting or Wiring the The connection or wiring of the functions "Safe torque off" and "Safe brake
Functions "Safe Torque Off" and control" depends on the option used to make the selection at the drive. The
"Safe Brake Control" chapter "Examples of Application" shows the different options of selection and
wiring.
You must wire the inputs and outputs at the connector X49 of the optional safety
technology module "L4" depending on the type of safety unit (active or passive)
and on the wiring type (single-channel or dual-channel, Plus-Plus-switching or
Plus-Minus-switching):
● The dynamization outputs Dyn_Ch1 (X49/6) and Dyn_Ch2 (X49/5) in the
case of selection via a passive safety unit
● The selection inputs SI_Ch1 (X49/3) and SI_Ch2 (X49/1) always
● The 24V supply of the X49 connector (X49/4) in the case of selection via
a passive safety unit
● The 0V supply of the X49 connector (X49/2) always

Step 2: Configuring the Brake When using the function "Safe brake control", you must configure the brake
connected to X6 (call the IndraWorks dialog: Motor, Brake, Measuring
Systems ▶ Brake).
Fig.8-2: IndraWorks Dialog "Brake"

Switch the drive to the parameter mode (phase 2 or PM) before starting the
parameter setting. In the dialog section "Configuration" of the IndraWorks dialog
"Brake", you can configure the connected brake; in this dialog, configure
"Self-holding" as the holding brake type, because only electrically releasing
brakes are allowed. (P‑0‑0525, Holding brake control word).
Step 3: Activating / Deactivating the
Safety Function Before selecting the safety functions "Safe torque off" and "Safe
brake control", shut down the drive system by means of the com‐
mand value input and reset drive enable. There is no drive-control‐
led stopping process!
The safety functions "Safe torque off" and "Safe brake control" are automatically
activated after the booting process. They cannot be deactivated.
8.5 Requirements to the Control Unit

Safety Technology Option "Safe In conjunction with the safety technology option "Safe Torque Off", there are
Torque Off" the following requirements to the control unit:
● Before selecting the safety function, shut down the drive by means of the
command value input and disable the drive torque.
● When selection takes place via the control unit, the selection must at least
comply with the required safety level of the application and the control unit
must assume the test of the wiring.
● If the selection of the safety function is to be looped through the control
unit, you must make sure that the test pulses described in the chapter
"Dynamization" are not inhibited. In addition, the control unit must perform
the monitoring and error detection of the wiring between control unit and
safety option.
Notes on Troubleshooting
9 Notes on Troubleshooting
9.1 Introduction
For the purpose of diagnosis (messages of error, warning, operating status)
and service (firmware and hardware replacement), it is necessary that you
make yourself familiar, by means of the Functional Description of the firmware,
with some functions/elements:
● Control panel and
● Parameter handling
The paragraphs below above all explain the aspects relevant to integrated
safety technology in detailed form.
The paragraphs are divided into:
● Overview of diagnostic system (e.g. logbook parameters and parameters
containing information on the hardware configuration) ("Diagnostic Sys‐
tem")
● Diagnostic messages which can be read from the display of the control
panel ("Diagnostic Messages of Integrated Safety Technology")
9.2 Diagnostic System

The general diagnostic system of IndraDrive is explained in detail in the Func‐
tional Description of the firmware where you can read more about it, if required
(see also index entry "Diagnostic system").
The following parameters are used in conjunction with the diagnostic system:
● S‑0‑0095, Diagnostic message
● S‑0‑0375, List of diagnostic numbers
● S‑0‑0390, Diagnostic message number
● P‑0‑0009, Error number
● P‑0‑0478, Logbook event
● P‑0‑0479, Logbook time stamp
Axis or Device Configuration A drive controller consists of several components (power section, control sec‐
tion, firmware,...); each of them has its own identifier in the form of a parameter
(see also Functional Description of firmware "Device Configuration").
Identifiers useful for the purpose of diagnosis and service are stored in the fol‐
lowing parameters:
● S‑0‑0140, Controller type
● S‑0‑0141, Motor type
● S‑0‑0142, Application type
● P‑0‑1518, Module code of control section
● P‑0‑1519, Module code of power section
● P‑0‑1520, Control section type
● S‑0‑0030, Manufacturer version
9.2.2 Diagnostic Messages of Integrated Safety Technology

Overview
For integrated safety technology, we distinguish the operating states normal
operation and special mode; in both operating states, the triggering of a moni‐
toring function causes an error of category F3xxx or F8xxx.
Apart from the error and warning messages, the operating states of integrated
safety technology are displayed in individual parameters (status messages).
Status Information of Integrated Safety Technology
For the purpose of diagnosis, the following status information is made available
for integrated safety technology (the status information is not allowed for the
safety-relevant evaluation):
● The parameter "P‑0‑0106, Operating status STO/SBC" makes available
binary status signals for online monitoring of the safety technology states.
By means of this status word, the individual status signals can be option‐
ally programmed to existing real-time bits of the master communication or
hardware I/Os or I/O extensions.
● Via the dialog section "STO / SBC status" of the IndraWorks dialog "Safe
torque off", the following aspects can be diagnosed:
– "STO / SBC in normal operation (NO)" is active (green), when the
safety functions have not been selected or a safety technology error
was detected.
– "STO / SBC in special mode (STO / SBC)" is active (green), when
the safety functions have been selected and are active.
– "Output stage locked by STO / SBC" is active (red), when safety
technology has locked the output stage.
– "Error" is active (red), when a safety technology error was detected.
– "Shortened diagnostic message is output" is active (green), unless
the axis has been in control (AF) after the initialization. In this state,
there aren't any selection errors output to give the external compo‐
nents for selection the time to initialize.
– "Complete diagnostic message is output" is active (green), when the
axis has been in control after the initialization. Safety technology
error messages are not suppressed.
Fig.9-1: IndraWorks Dialog "Safe torque off"

Behavior in the Case of Non-Fatal Safety Technology Errors (F3xxx)
Non-fatal safety technology errors are errors which still allow carrying out a
freely definable, variable error reaction.
Via the setting in "P‑0‑0119, Best possible deceleration" and "P‑0‑0117,
Activation of NC reaction on error", the user can define the behavior of the drive
taking place when non-fatal safety technology errors occur. At the end of the
error reaction, the drive goes torque-free. (See also Functional Description of
firmware "Error Reaction").
Commissioning Steps Therefore, the drive can only be put into operation again when:
1. The error reaction has been completed, i.e. the drive has stopped (veloc‐
ity=0!).
2. The error message was cleared by the error clearing command (cf.
"S-0-0099, C0500 Reset class 1 diagnostics").
3. The cause of the error was removed.
4. The drive is in the operating mode again and power was switched on
("Ab").
5. Drive enable was switched on again (0-1 edge).
In case non-fatal safety technology errors are occurring repeatedly,

contact our service department as operating the drive then is no
longer allowed.
Behavior in the Case of Fatal Errors (F8xxx)

Generally, there are 2 types of fatal errors (F8 errors):
● Fatal errors during initialization (e.g. F8118, F8120,...)
● Fatal errors during operation (e.g. F8060, F8022,...)
Fatal Errors During Initialization (In‐ Fatal initialization errors cannot be cleared, they require that the drive be
itialization Errors) switched off completely.
Fatal errors in conjunction with safety technology do not only require

that the drive be switched of, but additionally require that the safety
technology be completely recommissioned.
Fatal Errors During Operation When a fatal error occurs during operation, control (or U/f control) of the drive
is no longer ensured; therefore, drive enable is immediately removed in the
case of these errors and the holding brake ‑ if available ‑ is switched on. De‐
pending on the setting in "P‑0‑0119, Best possible deceleration", bit 8, the D.C.
braking can be additionally activated.
With the corresponding setting in "P‑0‑0118, Power supply,

configuration", the power supply is disconnected from the mains in
the case of fatal errors.
See also Application Manual "Error Reactions"
Commissioning Steps After a fatal error has occurred, the drive can only be put into operation again
after the following steps were carried out:
1. The error message must be cleared by the error clearing command [cf.
"S‑0‑0099, C0500 Reset class 1 diagnostics"] (for this purpose, it might
possibly be necessary to switch to the parameter mode or to switch the
drive off completely).
2. The cause of the error must be recognized and removed; this possibly
means that an entire component (e.g. motor or drive controller) must be
replaced.
3. The drive must be in the operating mode again and power must be switch‐
ed on again ("Ab").
4. Drive enable must be switched on again (0‑1 edge).
In case fatal errors are occurring repeatedly, contact our service

department as operating the drive then is no longer possible.
9.3 Removing Malfunctions, Maintenance Measures, Deactivating

the Motors
When removing malfunctions, performing maintenance measures
or deactivating the motors, observe the safety instructions in the
chapter "Safety Instructions for Electric Drives and Controls"!
In the case of malfunction, maintenance measures or to deactivate the motors,

proceed as follows:
● Observe the instructions contained in the machine documentation.
● Use the machine-side control commands to bring the drive to a controlled
standstill.
● Switch off the power voltage and control voltage of the controller.
● Only for motors with blower unit: Switch off the motor circuit breaker for
the blower unit.
● Switch off the main switch of the machine.
● Secure the machine against accidental movements and against unau‐
thorized operation.
● Wait to allow the electric systems to discharge and then disconnect all
electrical connections.
● Before dismounting them, secure the motor and, if necessary, the blower
unit against falling or movements, before unfastening the mechanical con‐
nections.
9.4 Replacing Drive Components

When replacing drive components, observe the safety instructions
in the chapter "Safety Instructions for Electric Drives and
Controls"!
The following chapters only describe the replacement of drive components

which ensure safe operation. The replacement of other drive components is
described in the respective Project Planning Manuals.
9.4.2 Replacing the Motor

WARNING Lethal electric shock by live parts with more
than 50 V!
The supply unit may only be replaced by qualified personnel which have been
trained to perform the work on or with electrical devices.
The motor should be replaced by a motor of identical type. Only by

doing this is it ensured that all parameter settings can remain un‐
changed; in addition, it is not required in this case to repeat the
acceptance test within the scope of the function "Integrated safety
technology".
1. If necessary, write down last absolute value

2. Open main switch
3. Make sure main switch cannot be switched on again
4. Disconnect plug-in connectors
When replacing the motor, cover the open mating sites of power
lines with protective caps if sprinkling with cooling liquid/lubricant or
pollution may occur (allowed pollution degree according to
EN50178: 2).
5. Replace motor
To mechanically replace the AC servo motor, observe the instruc‐

tions of the machine manufacturer.
6. Connect plug-in connectors
7. WARNING! Risk of accident caused by unwanted axis motion! Servo axes
with indirect distance measuring system via the motor encoder will loose
the position data reference when the motor is replaced!
This position data reference to the machine coordinate system must there‐
fore be reestablished after replacement.
9.4.3 Replacing the Brake

WARNING Dangerous movements! Danger to persons
from falling or dropping axes!
While the brake is replaced, secure the axis by a blocking device or by moving
the axis to a safe end position.
The same type of brake has be used after replacement.
9.4.4 Replacing the Controller

Overview
A controller of the IndraDrive range consists of the components power section
and control section (incl. firmware). The control section can be configured with
additional components (encoder interface). The control section and power sec‐
tion are firmly connected; only Rexroth service engineers or especially trained
users are allowed to replace individual components. The paragraphs below
describe how to replace the complete controller as regards the parameter
backup. The mounting and dismounting of the entire drive controller is descri‐
bed in the Project Planning Manual for the power section.
A device which is intended for replacement and has already been

in operation (thus is not in the factory-new condition as supplied),
must be brought to the condition as supplied again ("load basic pa‐
rameters") before it is used.
The figure below illustrates the basically required individual steps.
Fig.9-2: General Sequence of Controller Replacement

How to Proceed When Replacing Controllers
1. Save parameter values
Before dismounting the defective device, save the drive parameter values,
if possible.
If saving the parameter values before replacing the device should

be impossible due to a total breakdown of the device, only the pa‐
rameter values backed up after initial commissioning can be loaded
when the parameter values are loaded later on (see "Load Param‐
eter Values in Case of Total Breakdown of Device")!
1. Switch drive off and on again

2. Switch to parameter mode (PM or P2)
3. Saving parameter values of defective device can take place via com‐
missioning tool "IndraWorks Ds/D/MLD" or control master:
● Commissioning tool "IndraWorks Ds/D/MLD":
By selecting the respective menu item, the parameter values ac‐
cording to the list parameters S‑0‑0192 and P‑0‑0195 are stored on
an external data carrier (hard disk, floppy disk or the like). (Depend‐
ing on the controller, the parameter values can be saved via the
Engineering Port or via the MultiEthernet interface.)
● Control master
The parameter values according to the list parameters S‑0‑0192 and
P‑0‑0195 are stored on a master-side data carrier by the control
master.
2. Replace controller
1. Open main switch
2. Make sure main switch cannot be switched on again
3. Make sure drive controller is completely de-energized
WARNING Lethal electric shock caused by live parts

with more than 50 V!
Before working on live parts: De-energize the installation and secure the
power switch against unintentional or unauthorized re-energization.
Wait at least 30 minutes after switching off the supply voltages to allow
dis‐charging. To shorten the waiting time until voltage has fallen below 50
V, you can use a discharging device (see chapter "Appendix").
Check whether voltages have fallen below 50 V before touching live parts!
4. Remove touch guard and separate connection lines from drive control‐
ler
5. Unscrew screws on top and bottom of housing
6. Take drive controller out of drive system
7. Mount new drive controller
8. Connect new drive controller as specified in machine circuit diagram
9. Mount touch guard
3. Put controller into ready-for-operation status again
Put machine into ready-for-operation status again according to machine
manufacturer's instructions.
4. Load firmware and parameter values
When firmware and drive parameters are to be transmitted to the replaced
controller, the required firmware and a parameter backup of the respective
axis must be available.
1. Supply controller with control voltage

2. Loading parameter values can take place via commissioning tool
"IndraWorks Ds/D/MLD" or control master:
● Commissioning tool "IndraWorks Ds/D/MLD"
By selecting the respective menu item, the parameter values stored
on an external data carrier (hard disk, floppy disk or the like), imme‐
diately before the device was replaced, according to list parameters
S‑0‑0192 and P‑0‑0195 are loaded to the controller.
● Control master
The axis-specific parameter values saved before having replaced the
device can also be loaded via the control master. The parameter
values saved immediately before the replacement of the device on
a master-side data carrier (according to list parameters S‑0‑0192 and
P‑0‑0195) are loaded to the controller by the control master.
5. Put machine into ready-for-operation status
1. Put machine into ready-for-operation status again according to machine
manufacturer's instructions.
2. Check functions of drive.
Possible Problems During Controller Replacement
The paragraphs below give a brief description of critical problems and their
recommended handling.
Loading Parameter Values in Case If it should have been impossible to save the parameter values according to the
of Total Breakdown of Device list parameters S‑0‑0192 and P‑0‑0195 immediately before replacing the device
(total breakdown of device), the parameter values saved after initial commis‐
sioning have to be loaded.
In the case of drives with absolute value encoder and modulo for‐
mat, the position data reference has to be established again after
having loaded the parameter values saved after initial commission‐
ing, even if the actual position values are signaled to be valid via
the parameter "S‑0‑0403, Position feedback value status"!
NOTICE The parameter values saved after initial com‐

missioning are not generally suited for rees‐
tablishing the operatability of the drive after
replacement of devices!
Check actual position values and active target position before drive enable!
Decommissioning Drive Components
10 Decommissioning Drive Components

Before the drive or a component is decommissioned, an impact and hazard
analysis must be prepared. This analysis must assess how the decommission‐
ing affects the safety of the installation.
Furthermore, the impact and hazard analysis must contain a risk analysis of the
process of decommissioning.
On the basis of this impact and hazard analysis, decommission the drive or
component (see also IEC 61508-1:1999, 7.17).
Appendix
11 Appendix
11.1 Hardware Properties
11.1.1 X6, Motor Temperature Monitoring and Motor Holding Brake
WARNING Dangerous movements! Danger to persons
from falling or dropping axes!
The standard motor holding brake provided or an external motor holding brake
controlled directly by the drive controller are not sufficient on their own to guar‐
antee personal safety!
Personal safety must be achieved using higher-level, fail-safe measures:
● Block off danger zones with safety fences or safety guards
● Additionally secure vertical axes against falling or dropping after switching
off the motor power by, for example,
– mechanically securing the vertical axes
– adding external braking/arrester/clamping mechanisms
– ensuring sufficient equilibration of the vertical axes
Function The connection point X6 contains the connections for

● monitoring the motor temperature
● controlling the motor holding brake
Via an integrated contact element (BR), the power section switches

the voltage of the external 24V supply to the output for controlling
the motor holding brake.
View Connec‐ Signal name Function

tion
1 MotTemp+ Input motor temperature eval‐
uation
2 MotTemp-
3 +24VBr Output for controlling the mo‐
tor holding brake
4 0VBr
Spring terminal (connector) Unit Min. Max.

Connection cable mm2 0,25 1,5
Stranded wire AWG 24 16
Stripped length mm 10
Current carrying capacity outputs X6 A - 1,25
Time constant of load ms - 50
Appendix
Number of switching actions at maximum time Wear-free electronic contact

constant of load
Switching frequency Hz - 0,5
Short circuit protection X6.3 against X6.4 (output for controlling the motor holding
brake)
Overload protection X6.3 against X6.4 (output for controlling the motor holding
brake)
Fig.11-1: Function, Pin Assignment

Notes on Installation
Make sure the power supply for the motor holding brake at the motor
is sufficient. You have to take into account that voltage drops on the
supply line. Use connection lines with the highest possible cross
section of the single strands.
Use an external contact element in accordance with the required
safety category, if you would like to supply motor holding brakes
with higher currents than the allowed current load at X6. Make sure
to comply with the required minimum current consumption when
using the external contact element.
Connection Diagram
Fig.11-2: Connection of Motor Temperature Monitoring and Motor Holding Brake
11.1.2 L4 - Safe Torque Off

Description
Safety Functions The optional module provides the following safety functions:
● "Safe torque off" (STO)
● "Safe brake control" (SBC)
Appendix
● "Safe stop 1" (SS1 (Emergency stop), only in conjunction with an external
time-delayed safety selection device)
X49, L4 - Safe Torque Off
Data
View Identifica‐ Function
tion
X49 "Safe Torque Off"
Spring terminal (connector) Unit Min. Max.

Connection cable mm2 1 1,5
Stranded wire AWG 16 16
Stripped length mm 8
Output current per output mA - 350
Output current 24V supply mA - 700
Voltage load V - 60
Polarity reversal protection for power supply - Available
Fig.11-3: Data
Pin Assignment, Function
Function Signal Connection Technical data
Selection channel 1 SI_Ch1 3 Digital Inputs 1)

Selection channel 2 SI_Ch2 1
Dynamization output channel 1 Dyn_Ch1 6 Digital Outputs 2)
Dynamization output channel 2 Dyn_Ch2 5
Power supply of isolated inputs and outputs +24V 4 DC 19.2…30 V
0V 2 Min. 100 mA
Max. 700 mA
1) See index entry "Digital inputs → Technical data; L4 - Safe Torque Off"
2) See index entry "Digital outputs → Technical data; L4 - Safe Torque
Off"
Fig.11-4: Pin Assignment, Function
When the dynamization outputs do not work, check the power sup‐
ply connection. The polarity might possibly have been reversed.
Appendix
11.1.3 Technical Data of the Inputs and Outputs

Digital Inputs (L4 - Safe Torque Off)
The digital inputs correspond to IEC 61131, type 2.
Fig.11-5: Symbol
Data Unit Min. Typ. Max.
Allowed input voltage V 0 30

On V 11
Off V 5
Input current
On mA 7
Off mA 2
Input resistance kΩ 1 … 3,5
Fig.11-6: Digital Inputs (L4 - Safe Torque Off)

Digital Outputs (L4 - Safe Torque Off)
The digital outputs are compatible with digital inputs of types 1, 2 and 3
(IEC 61131).
Fig.11-7: Symbol
Data Unit Min. Typ. Max.
Output voltage ON V 11 24 30
Output voltage OFF V 5
Output current OFF mA 2
Allowed output current per out‐ mA 300
put
Short circuit protection Available
Overload protection Available
Fig.11-8: Digital Outputs (L4 - Safe Torque Off)

Appendix
11.2 Transport and Storage

11.2.1 Transport of the Components
Ambient and Operating Conditions - Transport
Description Symbol Unit Value
Temperature range Ta_tran °C Supply units and drive control‐ Motors:

lers: -20 … +80
-25 … +70
Relative humidity % 5 … 95
Absolute humidity g/m3 1 … 60
Climatic category (IEC721) 2K3
Moisture condensation Not allowed
Icing Not allowed
Fig.11-9: Ambient and Operating Conditions - Transport
11.2.2 Storage of the Components

NOTICE Damage to the component caused by long
storage periods!
Some components contain electrolytic capacitors which may deteriorate during
storage.
When storing the following components for a longer period of time, operate
them once a year for at least 1 hour:
● Converters and supply units: Operation with mains voltage ULN
● Inverters and DC bus capacitor units: Operation with DC bus voltage UDC
Ambient and Operating Conditions - Storage
Temperature range Ta_store °C Supply units and drive control‐ Motors:

lers: -20 … +60
-25 … 55
Icing Not allowed
Fig.11-10: Ambient and Operating Conditions - Storage
11.3 Ambient and Operating Conditions

The drive controllers and their additional components have been designed for
control cabinet mounting.
Appendix
Check that the ambient conditions, in particular the control cabinet

temperature, are complied with by calculating the heat levels in the
control cabinet. Afterwards, make the corresponding measure‐
ments to find out that the ambient conditions have actually been
complied with.
In the technical data of the individual components, the power dis‐
sipation is indicated as an important input value for calculating the
heat levels.
Ambient and Operating Conditions
Ambient conditions for "Integrated Safety Tech‐ The devices must be protected against conductive dirt
nology" contamination (e.g., by mounting them in control cab‐
inets of the degree of protection IP54B in accordance
with IEC529)
Degree of protection (IEC529) IP20
Use in the scope of CSA / UL For use in NFPA 79 Applications only.
Temperature during storage See chapter "Storage of the Components"
Temperature during transport See chapter "Transport of the Components"
Allowed mounting position G1
Definition of mounting positions: See index entry
"Mounting positions"
Ambient temperature range Ta_work °C 0 … 40
Installation altitude hnenn m 1000
Derating vs. ambient temperature:

In the ambient temperature range Ta_work_red, the
performance data are reduced by the fac‐
tor FTa:
Example: With an ambient temperature

Ta = 50 °C and a capacity utilization factor
fTa = 2%, the rated power is reduced to
Ta_work_red °C 40 … 55
PDC_cont_red = PDC_cont × FTa =
fTa %/K Capacity utilization factor: See technical data of the
PDC_cont × (1 - [(50 - 40) × 0.02]) = PDC_cont × 0.8
respective component (Data for Cooling and Power
Operation at ambient temperatures outside of Dissipation → Derating of PDC_cont, PBD, Iout_cont at
Ta_work and Ta_work_red is not allowed! Ta_work < Ta < Ta_work_red)
Appendix

Derating vs. installation altitude:
With installation altitudes h > hnenn, the available
performance data are reduced by the factor f3)
4).
With installation altitudes in the range of

hmax_ohne to hmax, an overvoltage limiter against
transient overvoltage must be installed in the in‐
stallation.
Use above hmax is not allowed! hmax_ohne m 2000
hmax m 4000
Simultaneous derating for ambient temperature Allowed;

and installation altitude reduce with factors f and fTa
Allowed pollution degree (EN50178) 2
Allowed dust, steam EN 50178 tab. A.2
Vibration sine: Amplitude (peak-peak) at mm 0,15 ±15 %
10 … 57 Hz1)
Vibration sine: Acceleration at 57 … 150 Hz1) g 1 ±15 %
Vibration noise (random) frequency1) Hz 20 … 150
Vibration noise (random) spectral acceleration g2/Hz 0.005 ±3 dB

density, amplitude1)
Vibration noise (random) rms value of total ac‐ g 1
celeration1)
Vibration sine: Acceleration at 10 … 2000 Hz g -
2), axial
Vibration sine: Acceleration at 10 … 2000 Hz g -

2), radial
Overvoltage category III (according to IEC60664-1)

1) According to EN 60068-2-64
2) According to EN 60068-2-6
3) Reduced performance data for drive controllers: Allowed DC bus con‐
tinuous power, braking resistor continuous power, continuous current
4) Reduced performance data for motors: Performance, torque S1 and S3
Fig.11-11: Ambient and Operating Conditions
Appendix
11.4 Declaration of Conformity

The drive controller complies with the protection goals of the Low-Voltage Di‐
rective 2006/95/EC.
We declare conformity with the Machinery Directive for the optional safety
technology module "L4 ‑ Safe Torque Off".
Fig.11-12: Declaration of Conformity for the Optional Safety Technology Module

"L4 - Safe Torque Off"
Appendix
Fig.11-13: Translation of the Original Declaration of Conformity

Service and Support
12 Service and Support

Our service helpdesk at our headquarters in Lohr, Germany and our worldwide
service will assist you with all kinds of enquiries. You can reach us around the
clock - even on weekend and on holidays.
Service Hotline
Helpdesk
Worldwide
Phone +49 (0) 9352 40 50 60 Outwith Germany please con‐
tact our sales/service office in
Fax +49 (0) 9352 40 49 41
your area first.
For hotline numbers refer to
E-mail service.svc@boschrexroth.de the sales office addresses on
the Internet.
http://www.boschrexroth.com
Internet You will also find additional notes regarding service, mainte‐
nance (e.g. delivery addresses) and training.
Preparing Information For quick and efficient help please have the following information ready:
● Detailed description of the fault and the circumstances
● Information on the type plate of the affected products, especially type co‐
des and serial numbers
● Your phone, fax numbers and e-mail address so we can contact you in
case of questions.
Index
Index
A M
Ambient conditions.............................................. 77 Maintenance measures....................................... 66
Appropriate use..................................................... 9 Manual mode...................................................... 23
Applications .................................................... 9 Means of representation
Automatic operation............................................ 23 Conventions of notation ................................. 5
Notations ........................................................ 5
Notes .............................................................. 5
C Motor
Commissioning the safety technology Connection motor holding brake (X6) .......... 73
Safety instruction .......................................... 57 Connection motor temperature monitoring
Connection (X6) .............................................................. 73
Motor holding brake (X6) .............................. 73 Motor holding brake ..................................... 73
Motor temperature monitoring (X6) .............. 73 Motor temperature monitoring ...................... 73
Replace ........................................................ 67
D
Deactivating........................................................ 66 N
Derating vs. installation altitude Normal operation................................................ 23
Overvoltage limiter ....................................... 79
Digital inputs
Technical data; L4 - Safe Torque Off ........... 76 O
Digital outputs Operating conditions........................................... 77
Technical data; L4 - Safe Torque Off ........... 76 Optional module
Documentation L4 ................................................................. 74
Overview ........................................................ 6 Safe Torque Off L4 ....................................... 74
Reference documentations ............................ 6 Safety technology L4, Safe Torque Off ........ 74
Drive controller Overview of safety functions............................... 37
Replace ........................................................ 69 Overvoltage limiter
Drive system....................................................... 11 Derating vs. installation altitude ................... 79
E P
Electric drive system........................................... 11 PELV................................................................... 16
Performance
Reaction times ............................................. 30
H Time response ............................................. 30
Hazard analysis.................................................. 24 PFH value
Safe Torque Off ............................................ 31
I Productive operation........................................... 23
Inappropriate use................................................ 10 Protective extra-low voltage................................ 16
Consequences, exclusion of liability .............. 9
IndraDrive R
Conceptual overview .................................... 24 Reaction times.................................................... 30
Integrated safety technology Reference documentations................................... 6
Dynamization ............................................... 34 Removing malfunctions....................................... 66
Functional principle ...................................... 33 Replace
Drive controller ............................................. 69
L Motor ............................................................ 67
L4...................................................... 29, 37, 41, 57 Replacing devices
Commissioning ............................................. 59 Drive controller ............................................. 68
Optional module ........................................... 74 Requirements
Safe Torque Off ............................................ 75 Motors .......................................................... 58
Loading parameter values in case of total Optional measuring systems ........................ 58
breakdown of device........................................... 70 Third-party motors ........................................ 58
Risk analysis....................................................... 24
Risk assessment................................................. 24
Index
S S
Safe brake control (SBC).................................... 41 STO..................................................................... 37
Safe torque off Storage
Activating ...................................................... 61 Of the components ....................................... 77
Deactivating ................................................. 61 Support
Safe Torque Off.................................................. 29 see Service Hotline ...................................... 83
L4 ........................................................... 74, 75
X49 ............................................................... 75
Safe torque off (STO).......................................... 37
T
Safety functions Technical data
Classification ................................................ 37 Digital inputs; L4 - Safe Torque Off .............. 76
Overview ...................................................... 37 Digital outputs; L4 - Safe Torque Off ............ 76
Safe brake control ........................................ 41 Time response.................................................... 30
Safe torque off .............................................. 37 Transport
Safety functions in special mode "safe stand‐ Of the components ....................................... 77
still"...................................................................... 37
Safety instructions for electric drives and con‐ U
trols..................................................................... 11 Use
Safety-relevant standards and regulations......... 28 Appropriate use .............................................. 9
Safety technology Inappropriate use ......................................... 10
L4 (Safe Torque Off) .................................... 75
Safe Torque Off L4 ....................................... 74
SBC..................................................................... 41 X
Setting-up mode.................................................. 23 X49
Special mode...................................................... 23 Safe Torque Off ............................................ 75
Special mode "safe standstill" X6
Safe brake control ........................................ 41 Motor temperature monitoring and motor
Safe torque off .............................................. 37 holding brake ................................................ 73
State-of-the-art...................................................... 9
Notes
Bosch Rexroth AG
Electric Drives and Controls
P.O. Box 13 57
97803 Lohr, Germany
Bgm.-Dr.-Nebel-Str. 2
97816 Lohr, Germany
Tel. +49 (0)93 52-40-0
Fax +49 (0)93 52-48 85
www.boschrexroth.com/electrics
Printed in Germany
R911332837 DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P

Indradrive MPX - 1x

Uploaded by

Copyright:

Available Formats

Indradrive MPX - 1x

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Indradrive MPX - 1x

Uploaded by

Copyright:

Available Formats

Electric Drives Linear Motion and

and Controls Hydraulics Assembly Technologies Pneumatics Service

Title Rexroth IndraDrive

Type of Documentation Original Instructions

Document Typecode DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P

Internal File Reference RS-9f12d2921c8c75d10a6846a0018b318c-1-en-US-6

Record of Revision Edition Release Date Notes

Copyright © Bosch Rexroth AG 2010

2 Important Directions for Use ......................................................................................... 9

3 Safety Instructions for Electric Drives and Controls..................................................... 11

5 Functional Principle of Integrated Safety Technology.................................................. 33

6 Integrated Safety Functions......................................................................................... 37

8 Commissioning the Safety Technology........................................................................ 57

10 Decommissioning Drive Components.......................................................................... 71

12 Service and Support.................................................................................................... 83

Edition Release date Notes

DOK-INDRV*-SI3-OP-MAN*-OP01-EN-P 2010-10-18 First edition

Fig.1-1: Record of Revisions

What? How? For example...

Fig.1-2: Conventions of Notation

This symbol highlights useful tips and tricks.

Apart from the safety-technology-specific diagnostic messages, all other

For an overview of reference documentations, see: "Reference

1.2 Reference Documentations

Title Kind of documentation Document typecode1) Part number

Cs Drive Systems With HCS01 Project Planning Manual HCS01******-PRxx-EN-P 322210

A Asynchronous Motors MAD / MAF Project Planning Manual MAD/MAF****-PRxx-EN-P 295781

Rexroth Connection Cables Selection Data CABLE*INDRV-CAxx-EN-P 322949

MPx-17 Application Manual MP*-17VRS**-APxx-EN-P 331236

Important Directions for Use

2 Important Directions for Use

WARNING Personal injury and property damage caused

Rexroth as manufacturer is not liable for any damages resulting

2.1.2 Areas of Use and Application

Drive controllers have to be programmed before commissioning, making it pos‐

Important Directions for Use

Typical applications include, for example:

2.2 Inappropriate Use

Components of the drive system Rexroth IndraDrive are products

Safety Instructions for Electric Drives and Controls

3 Safety Instructions for Electric Drives and Controls

Safety Instructions for Electric Drives and Controls

1) to be trained, instructed or authorized to switch electric circuits and devices

3.2 General Information

3.2.2 Requirements for Safe Use

Safety Instructions for Electric Drives and Controls

concept in which measures of risk reduction for personal safety depend

3.2.3 Hazards by Improper Use

Safety Instructions for Electric Drives and Controls

● Risk of injury by improper handling! Injury by crushing, shearing, cutting,

Safety Instructions for Electric Drives and Controls

3.3 Instructions with Regard to Specific Dangers

Safety Instructions for Electric Drives and Controls

● Connect the equipment grounding conductor of the components of the

1.5 mm2 (16 AWG) 2 × 1.5 mm2 (16 AWG)

6 mm2 (10 AWG) 2 × 6 mm2 (10 AWG)

25 mm2 (4 AWG) 16 mm2 (6 AWG) -

50 mm2 (1/0 AWG) 25 mm2 (4 AWG) -

70 mm2 (2/0 AWG) 35 mm2 (2 AWG) -

Document Typecode DOK-INDRV-SI3-OP-MAN-OP01-EN-P

DOK-INDRV-SI3-OP-MAN-OP01-EN-P 2010-10-18 First edition