SINUMERIK 840D SL Safe Position Limit MD36934/MD36935 Change

Overview

The safe position end limits for a SINUMERIK 840D sl are stored in two machine data words:

• MD36934 $MA_SAFE_POS_LIMIT_PLUS – positive (upper) safe position end limit per axis
• MD36935 $MA_SAFE_POS_LIMIT_MINUS – negative (lower) safe position end limit per axis

These MDs are part of Safety Integrated (SI) on the NCK side and are mirrored to the SINAMICS S120 drive-side Safety Integrated parameters P9634 and P9635. Both sides must contain the same value; the drive performs the actual monitoring in its safe position channel (SP) and reports a violation back to the NCK as alarm 27012 with subsequent stop reaction.

Unlike non-safety machine data, these limits are protected by an SI confirmation / acceptance procedure. Editing them directly in the start-up area, modifying the mirrored drive parameter, or skipping the user-agreement (operator confirmation) sequence will leave the axis in a non-safe state and will produce alarms in the 27001/27002/27012 range during the next NCK reset.

This procedure applies to the configuration reported in the source case:

The governing document is the Siemens Safety Integrated function manual for 840D sl / S120: SINUMERIK Safety Integrated SINUMERIK 840D sl / SINAMICS S120 (FBSI 4.7 SP2). Use that document as the binding reference for every step below; values and menu paths can shift between NCK SW releases.

Prerequisites Before You Change the Limit

1. Access level: Log in with Service authority (key switch position 3 on the MCP). The machine data and the SI confirmation dialogs are only visible at this level.
2. Axis configuration check: Verify in MD36901 $MA_SAFE_FUNCTION_ENABLE that the safe position limit function (bit pattern for SE/SN, SLP) is enabled for the affected axis. If SLP is not active, MD36934/MD36935 are inactive.
3. Modulo check: If the axis is a modulo rotary axis, confirm whether you are using MD36934/MD36935 (modulo-corrected) or MD36936/MD36937 ($MA_SAFE_POS_LIMIT_PLUS_2 / MINUS_2 for modulo). On a linear axis without modulo only 36934/36935 apply.
4. Drive firmware: SINAMICS S120 Safety Integrated firmware ≥ 4.7 must be installed; mismatched firmware between NCK and drive side is the most common reason for stop reactions (F01611 / F30611 / F08501) on the drive side after a parameter change.
5. Backup: Before changing any SI parameter, run a complete series start-up file backup (Startup → Series start-up → Create series start-up) so you can restore the previous safe configuration if an acceptance test fails.

Parameter Mapping: NCK ↔ Drive

The NCK-side machine data and the drive-side safety parameters must match exactly. The pattern below is the same for every SI limit/cam parameter: Safe_Axis_param_NCK = Safe_Axis_param_Drive.

On SINAMICS S120, the equivalent parameter numbers come from the Safety Integrated parameter set (r97xx / p96xx range). On a CU320-2 with firmware ≥ 4.7, the mapping is:

• p9634[0] – Safe position limit, upper (drive SI channel 1)
• p9635[0] – Safe position limit, lower (drive SI channel 1)

Confirm the index in your project: in a single-encoder SI configuration you use index [0]; in a dual-encoder configuration you must also update index [1].

Procedure A – Axis With Absolute Measuring System (Recommended Path)

Use this path on any axis with an absolute EnDat or DRIVE-CLiQ encoder where the SI absolute position is already valid.

1. Bring the axis into the planned safe zone. Use JOG with reduced velocity override. Verify the axis position is well inside the current safe limits; you cannot exceed the active limit without tripping 27012.
2. Withdraw the user agreement. On the SINUMERIK Operate sidebar, open Diagnostics → Safety → User agreement. The screen lists every safety axis (machine name, SI position, user agreement). Set User agreement = NO. The access key must be at position 3 for this toggle. After the toggle the axis is not safe – the drives drop SI monitoring for SLP and only the standard NC limits remain active.
3. Edit MD36934 and MD36935 for the affected axis to the new mechanical limits. Use the axis units (mm or degrees) matching MD10220 $MA_POSCTRL_GAIN / MD10240 scaling.
4. Save the NCK area (Startup → Machine data → Save). Confirm any prompt about changing safety-related data.
5. Update the drive mirror: Open the drive commissioning tool (Starter / Startdrive / SINUMERIK Operate commissioning). Enter the same numeric values into p9634[0] and p9635[0]. Copy RAM → ROM on the drive, then select Save the part of driver (i.e. save the drive-side safety parameters to the CF card).
6. PO reset (drive): Execute a Power On reset on the drive (or CU). The drive will report an SI cross-check error during boot because NCK and drive have different CRC's; this is expected.
7. PO reset (NCK): NCK reset from HMI (Startup → Reset (PO)). Several alarms will appear in the alarm bar.
8. Run the SI confirmation: Startup → Safety → Confirm SI. Click OK for each prompt. The system signs the new SI configuration and computes fresh checksums for both NCK and drive.
9. Save the drive system again. After SI confirmation, copy RAM → ROM on the drive and Save part of driver a second time so the new SI checksum is persistent across power cycles.
10. Restore the user agreement: Go back to Diagnostics → Safety → User agreement and set User agreement = YES. The axis is now safe again with the new limits.

Procedure B – Axis With Incremental Measuring System

For an axis without an absolute encoder, the safe position is invalidated every time the drive is de-energised. The flow therefore starts with a controlled power cycle.

1. Move the axis into the new safe zone in JOG using the standard NC limits, before any SI edit. Confirm with the axis on the HMI position display.
2. Switch OFF the machine (NCK ready off, drive mains contactor open).
3. Switch ON the machine. The drives initialise with SI inactive. SI position is not valid until referencing completes.
4. Reference the axis in the conventional (non-safe) way. Once referenced, the SI absolute position is established.
5. Inspect the SI position on the HMI (Diagnostics → Safety → Axis SI positions) and verify it matches the mechanical expectation. Cross-check on the second channel where fitted.
6. Edit MD36934 / MD36935 to the new envelope. Save NCK area.
7. Edit drive mirror p9634 / p9635 to the same values. Save drive part.
8. PO reset (drive + NCK) in either order, then Confirm SI as in Procedure A steps 7–9.

If the machine has OEM-specific PLC logic that interlocks user-agreement / SI confirmation to a hardware key or guard interlock, the PLC must release that interlock before the HMI button responds. Check the OEM project if Confirm SI is greyed out.

Standalone SI Parameter Change Cycle (Per Field-Proven Pattern)

For any Safety Integrated axis parameter – not just MD36934/MD36935 – the canonical cycle is:

1. Set Safe_Axis_param_NCK = Safe_Axis_param_Drive (verify bytewise equality, including sign).
2. Save the drive part (Copy RAM → ROM + Save part of driver).
3. NCK PO reset.
4. Wait for the expected alarm list (27001, 27005, 27012, 27013 in some combination – all expected on first boot after an SI edit).
5. Run Startup → Safety → Confirm SI. Acknowledge each prompt.
6. Save the drive part again to persist the SI checksum.
7. NCK PO reset once more.
8. Verify no SI alarms remain and the axis accepts JOG motion with the new envelope.

This is the cycle the field engineer referred to as Safe_Axis_param = Drive_Axis_param → Reset PO → Confirm → Reset PO. Two PO resets are required because the first reset only loads the new values; the second reset confirms the SI checksum round-trip is consistent.

Alarm Reference (Relevant Alarms on 840D sl)

In the source case, after MD36934 was edited and a PO reset issued, the user received alarm 27001 with error code 11 and the drive was reported not ready (OFF3 active). Error code 11 in this context maps to safe position limit violation / SI cross-check inconsistent; the user agreement was not withdrawn first, so the axis was still being monitored by the old SLP envelope while the new value was being downloaded, producing the STOP F → STOP A chain. The fix is to follow Procedure A steps 2–9; do not attempt to move the axis until the user agreement is withdrawn.

PLC Signal Reference for SI State

On the PLC side, the NCK exposes the safety state through interface DB31, .. DBX71.x and DB31, .. DBX72.x. The signals most useful during this procedure are:

• DB31..DBX71.1 – SI safe position limit active
• DB31..DBX72.1 – SI safe position limit plus actively violated (positive limit)
• DB31..DBX72.2 – SI safe position limit minus actively violated (negative limit)
• DB31..DBX71.5 – SI user agreement withdrawn / pending

If your PLC logic OR's any of these into an axis enable or a feed-hold, the axis will not move in JOG even after the user-agreement toggle. Verify the OEM logic before relying on HMI buttons alone.

Verification Checklist After the Change

1. Alarm bar clear of all 27001 / 27002 / 27005 / 27012 / 27013 entries. Persistent 27013 indicates SI confirmation did not complete.
2. Diagnostics → Safety → Axis SI positions shows a real, non-zero position for both channels of the affected axis.
3. Diagnostics → Safety → SI checksums displays the same CRC for both channels; the CRC must also match the value written during SI confirmation.
4. JOG motion in both positive and negative directions travels up to but not past the new limit. Use a controlled feed override (5–10 %) for this test.
5. Drive-side, on Starter / Startdrive / AOP30, verify r9710 / r9711 (SI diagnostics) and r9725 (SI motion status) return to Safe after motion completes.
6. Run the SI acceptance test protocol (machine manufacturer's documentation, typically a checklist of safe functions) and file the signed report with the machine logbook – required for CE / functional-safety audits.

Troubleshooting Matrix

Field-Proven Caveats

• Two PO resets are not optional. The first reset exposes the mismatch (alarms 27001/27005). The second reset is the post-confirmation reboot; alarms will clear only on this second reset if Confirm SI succeeded.
• Save the drive part twice. Once before PO reset (to load new values) and once after Confirm SI (to persist the SI checksum). The NCK side keeps MD36934/36935 in the active memory after Save; you do not need to re-enter them after Confirm SI.
• Never disable SLP only on one channel. If you have a dual-encoder SI configuration, both encoders must agree on the position and both drive-side parameter sets (index [0] and [1]) must be updated.
• Modulo axes use 36936/36937. On modulo rotary axes, MD36934/MD36935 are not the active SLP parameters unless you are working in non-modulo mode. Verify with MD10210 $MA_INT_INCR_PER_DEG and the axis configuration before assuming 36934/36935 are the right pair.
• Keep a paper SI acceptance trail. The acceptance test printout from Startup → Safety → SI Acceptance Test is the legal record for the change. File it with the machine logbook.

FAQ