Resolving YRC1000 Alarm 4911 Safety Fieldbus Comm Not Built

Problem Overview

Alarm 4911 "Safety Fieldbus Comm Not Built" is a latching safety fault on the Yaskawa YRC1000 robot controller. It triggers when the controller's safety option board is configured to consume a CIP Safety I/O assembly from an external scanner (typically an Allen-Bradley GuardLogix chassis) but no live safety fieldbus connection can be established. The fault appears the instant the pendant is touched or the Deadman Switch (DMS) is pressed, and it inhibits motion in Teach, Playback, and Remote modes regardless of override setting.

The alarm is commonly encountered during three scenarios:

• Decommissioning or relocating a robot cell where the upstream PLC has been powered down or removed.
• Cutting or physically severing the Ethernet trunk between the robot and the safety scanner during a tear-down.
• Flashing firmware, replacing the safety option board, or swapping CPU/comm boards without re-binding the safety I/O.

Root Cause Analysis

The YRC1000 safety architecture integrates an optional safety communication board (CP1616-class PROFIsafe/EtherNet/IP module or the equivalent Yaskawa safety option board) that brokers safety I/O between the robot's safety supervisor and an external safety PLC. Two parameters control whether the controller expects a live safety fieldbus connection or treats the safety I/O as virtual:

• VIRTUAL COMM — under SYSTEM → SETUP → OPTION FUNCTION → Ethernet I/P (CPU board) → DETAIL. Values: VIRTUAL or SAFETY.
• Safety Function Board / SFBIN Allocation — under OPTION BOARD and SAFETY SIG BOARD ALLOCATION. Per-input USED / NOT USED flag.

When VIRTUAL COMM is set to SAFETY, the supervisor performs a connection handshake at boot and periodically thereafter. If the scanner is absent, the cable is disconnected, or the CIP Safety originators/consumers do not match the controller's expected assemblies, the supervisor refuses to enter a safe-operational state and latches Alarm 4911. Per ISO 13849-1 PL d/e and IEC 62061 SIL 2/3 architectures, the controller must fail to a safe-stopped state rather than assume the fieldbus has failed safe.

Prerequisites

1. YP900-series programming pendant with functional touchscreen and three-position enabling switch (Deadman Switch).
2. Mode selector keyed to MAINT (Maintenance) position.
3. Safety password for the controller (issued by the safety administrator; required to edit SAFETY-level parameters).
4. Controller in a non-production state (relocation, decommissioning, or service).
5. Verification that all hardwired E-Stop circuits (pendant, external E-Stops, safety mats, area scanners) are functional and independent of the disabled fieldbus.

YRC1000 Resolution Procedure

1. Apply controller power and allow the pendant to reach the operator interface (HOME screen).
2. Set the mode selector to MAINT.
3. From the main menu, navigate to {SYSTEM} → {SETUP} → {OPTION FUNCTION}.
4. Under the SAFETY security level, locate the entry labelled Ethernet I/P (CPU board).
5. Cursor down to VIRTUAL COMM and press SELECT.
6. Change the parameter from SAFETY to VIRTUAL.
7. When prompted, enter the Safety password to authorize the write.
8. Press ENTER/SELECT to confirm the change.
9. Cycle controller power (OFF → wait 10 s → ON) to commit the configuration to flash memory.
10. Confirm the pendant boots to the HOME screen without Alarm 4911.

Alternate Menu Branch (OPTION BOARD)

On certain YRC1000 firmware builds the Ethernet I/P configuration appears under SYSTEM → SETUP → OPTION BOARD instead of OPTION FUNCTION. The two branches expose the same VIRTUAL COMM parameter; firmware build and safety option board variant determine which path is active. If the entry is not visible under OPTION FUNCTION, search OPTION BOARD for the Ethernet I/P CPU board instance and the CP1616-class safety communication module.

Verifying CP1616 / Safety Option Board State

After navigating to OPTION BOARD, identify the safety communication module (commonly listed as CP1616 or by Yaskawa part number depending on firmware). The status field should display NOT USED once VIRTUAL COMM is moved off SAFETY. If the status continues to read USED, the safety supervisor still believes the fieldbus is required and Alarm 4911 will re-appear on the next boot.

Disabling SFBIN Inputs (Safety SIG Board Allocation)

If Alarm 4911 persists after the VIRTUAL COMM change, drill into SAFETY SIG BOARD ALLOCATION under the Safety security level. Each SFBIN input channel can be flagged individually as USED or NOT USED. Mark every channel that previously received safety I/O from the CIP Safety scanner as NOT USED, then cycle power.

DX200 Variant Procedure

The DX200 controller uses a different menu hierarchy and reports an analogous fault. The OPTION FUNCTION → Ethernet I/P path used on the YRC1000 does not exist on the DX200. To clear the equivalent alarm on a DX200 (including MH 180 heavy-payload variants):

1. Set the mode selector to MAINT.
2. Log in at the SAFETY security level with the safety password.
3. Navigate to SAFETY SIG BOARD ALLOCATION.
4. Mark every SFBIN input as NOT USED.
5. If a Profisafe option is also installed, navigate to OPTION FUNCTION and set Profisafe Virtual Comm from SAFETY to VIRTUAL.
6. Cycle controller power and verify the alarm is clear.

Verification Procedure

1. Confirm the pendant boots to HOME without Alarm 4911 in the active alarm queue.
2. Re-open SYSTEM → SETUP → OPTION FUNCTION → Ethernet I/P → DETAIL and verify VIRTUAL COMM reads VIRTUAL.
3. Switch to Teach mode, set override to 10%, engage the Deadman Switch, and jog each axis through a small motion envelope to confirm motion enable.
4. Verify the local pendant Emergency Stop button (red mushroom) trips the safety relay and drops the contactors.
5. Verify the Deadman Switch 3-position enable behaviour: position 1 (release) and position 3 (full squeeze) must stop motion; position 2 (light hold) must allow motion.
6. Verify any external hardwired E-Stop, safety mat, or light curtain still wired to the controller's safety inputs (not via the fieldbus) trips correctly.

Re-enabling the Safety Fieldbus

After relocation or service, restore CIP Safety operation with the Allen-Bradley GuardLogix scanner:

1. Navigate to SYSTEM → SETUP → OPTION FUNCTION → Ethernet I/P → DETAIL.
2. Set VIRTUAL COMM from VIRTUAL back to SAFETY.
3. Confirm the safety communication module (CP1616-class) is set to USED under OPTION BOARD.
4. Re-mark each SFBIN input as USED under SAFETY SIG BOARD ALLOCATION if it was previously disabled.
5. Cycle controller power.
6. Reconnect the Ethernet trunk to the GuardLogix scanner and verify CIP Safety originator/consumer assemblies match the controller's expected configuration.
7. From RSLogix 5000 / Studio 5000 Logix Designer, confirm the safety connection shows Running and the safety task is executing.
8. Perform a full safety validation per the robot's risk assessment before returning to production.

YRC1000 vs DX200 Configuration Comparison

Related Safety Parameters

Troubleshooting Matrix

Field Service Tips

• Always photograph or export the safety configuration screen before making changes — the safety table is not version-controlled by default.
• If the safety password is unknown, contact the system integrator or Yaskawa Motoman support with the controller serial number; passwords are not recoverable without authorization.
• When relocating a robot cell, label and cap every disconnected Ethernet trunk to prevent accidental re-connection to a different subnet (which can produce unpredictable CIP Safety originator mismatches).
• Document the VIRTUAL COMM setting change in the cell's safety logbook and update the risk assessment to reflect that external safety fieldbus is temporarily disabled.
• After restoring the safety fieldbus, run the robot in Teach mode at low override through the full safety I/O test sequence before resuming production.

Safety Considerations

Disabling the safety fieldbus eliminates the external safety stop path provided by the Allen-Bradley GuardLogix scanner. Operators must rely solely on:

• Pendant Deadman Switch (three-position enabling device)
• Pendant Emergency Stop button
• External hardwired E-Stop circuits wired to the controller's safety I/O terminals (not via the fieldbus)
• Hardwired safety mats, light curtains, and area scanners routed through the controller's safety inputs

After completing the relocation, decommissioning, or service task, restore the safety fieldbus configuration, re-establish the CIP Safety connection with the scanner, and validate the complete safety chain — including a documented functional test of every safety input and stop category — before returning the robot to production operation.

Reference Documentation

For YRC1000 EtherNet/IP integration details, including implicit and explicit messaging patterns with a CODESYS Windows Soft PLC, refer to the Yaskawa Motoman Knowledge Center article YRC1000 EtherNet/IP and CODESYS.

FAQ