ABB ACS880-07 User manual

—
OPTIONS FOR ABB DRIVES
Prevention of unexpected start-up (option
+Q950) for
ACS880-07/07LC/17/17LC/37/37LC drives
User's manual

Prevention of unexpected start-up
(option +Q950) for
ACS880-07/07LC/17/17LC/37/37LC
drives
User's manual Table of contents
1. Safety instructions
4. Electrical installation
7. Start-up and validation test
3AUA0000145922 Rev H
EN
EFFECTIVE: 2020-09-30

Table of contents
1 Safety instructions
7Contents of this chapter ...........................................................................
7Use of warnings and notes .......................................................................
8Instructions for functional safety circuits ........................................................
9Electrical safety precautions .....................................................................
2 Introduction to the manual
11Contents of this chapter ...........................................................................
11Applicability .........................................................................................
11Target audience ....................................................................................
12Exclusion of liability ................................................................................
12Quick reference guide for taking a safety function into use ..................................
12Related manuals ...................................................................................
14Terms and abbreviations ..........................................................................
3 Option description
15Contents of this chapter ...........................................................................
15Overview ............................................................................................
16Summary of wirings and settings ............................................................
17Operation principle .................................................................................
17Time scheme ....................................................................................
18Operation principle diagram ..................................................................
19Fault reaction function .............................................................................
19FSO module .....................................................................................
19Resetting the FSO module ................................................................
19Drive STO function .............................................................................
4 Electrical installation
21Contents of this chapter ...........................................................................
21Wiring ................................................................................................
5 Parameter settings
23Contents of this chapter ...........................................................................
23Competence ........................................................................................
23FSO module parameter settings .................................................................
24General parameters ............................................................................
25Parameters for the STO function .............................................................
25Parameters for the SSE function .............................................................
25Parameters for the POUS function ..........................................................
27Drive parameter settings ..........................................................................
6 Use of the safety function
29Contents of this chapter ...........................................................................
29Activating the safety function .....................................................................
Table of contents 5

29Resetting the safety function .....................................................................
7 Start-up and validation test
31Contents of this chapter ...........................................................................
31Validation of the safety functions ................................................................
31Competence .....................................................................................
31Validation procedure ...........................................................................
32Validation test reports ..........................................................................
32Start-up and validation test .......................................................................
8 Maintenance
35Contents of this chapter ...........................................................................
35Safety circuit maintenance .......................................................................
35Proof test interval ..................................................................................
36Competence ........................................................................................
36Residual risk ........................................................................................
36Intentional misuse ..................................................................................
36Decommissioning ..................................................................................
9 Technical data
37Contents of this chapter ...........................................................................
37Safety data ..........................................................................................
37Safety data values ..............................................................................
38Safety component types .......................................................................
38Safety block diagrams .........................................................................
38Relevant failure modes ........................................................................
39Fault exclusions ................................................................................
39Operation delays ...............................................................................
39Ambient conditions ................................................................................
39Related standards and directives ................................................................
40Compliance with the European Machinery Directive .........................................
Further information
6 Table of contents

Safety instructions
Contents of this chapter
This chapter contains the safety instructions which you must obey when you install, operate
and do maintenance on the safety functions of a drive.
Use of warnings and notes
Warnings tell you about conditions which can cause injury or death, or damage to the
equipment. They also tell you how to prevent the danger. Notes draw attention to a particular
condition or fact, or give information on a subject.
The manual uses these warning symbols:
WARNING!
Electricity warning tells about hazards from electricity which can cause injury or
death, or damage to the equipment.
WARNING!
General warning tells about conditions, other than those caused by electricity,
which can cause injury or death, or damage to the equipment.
WARNING!
Electrostatic sensitive devices warning tells you about the risk of electrostatic
discharge which can cause damage to the equipment.
1
Safety instructions 7

Instructions for functional safety circuits
This manual does not contain the complete safety instructions of the drive. It only includes
the instructions related to the scope of this manual.
Only a qualified electrical professional who has sufficient knowledge about functional,
machine, and process safety is permitted to install, start up and maintain the safety circuit.
All user-made changes are on the user's responsibility.
WARNING!
The safety function described in this manual does not isolate the main circuit or
auxiliary circuit from the power supply. Do not do work on the drive, motor cable
or motor before you have isolated the drive system from all power supplies and
measured that there are no dangerous voltages. Before you start the work, do the
steps in section Electrical safety precautions (page 9).
WARNING!
(With permanent magnet or synchronous reluctance [SynRM] motors only)
In case of a multiple IGBT power semiconductor failure, the drive system can
produce an alignment torque which maximally rotates the motor shaft by 180/p
(with permanent magnet motors) or 180/2p(with synchronous reluctance [SynRM]
motors) degrees regardless of the activation of the Safe torque off function. p
denotes the number of pole pairs.
WARNING!
Do the validation test of the safety function at the start-up and also after you make
changes to the safety circuit.
WARNING!
Make sure that the functional safety of the machine is maintained in situations
where the safety option does not provide protection, for example, during
commissioning, system maintenance, fault tracing, or decommissioning.
WARNING!
Obey the safety instructions of the drive. If you ignore them, injury or death,
or damage to the equipment can occur. If you are not a qualified electrical
professional, do not do installation or maintenance work.
8 Safety instructions
3

Electrical safety precautions
These electrical safety precautions are for all personnel who do work on the drive, motor
cable or motor.
WARNING!
Obey these instructions. If you ignore them, injury or death, or damage to the
equipment can occur.
If you are not a qualified electrical professional, do not do installation or
maintenance work.
Go through these steps before you begin any installation or maintenance work.
1. Clearly identify the work location and equipment.
2. Disconnect all possible voltage sources. Make sure that re-connection is not possible.
Lock out and tag out.
• Open the main disconnecting device of the drive.
• If you have a permanent magnet motor connected to the drive, disconnect the motor
from the drive with a safety switch or by other means.
• Disconnect all dangerous external voltages from the control circuits.
•After you disconnect power from the drive, always wait 5 minutes to let the intermediate
circuit capacitors discharge before you continue.
3. Protect any other energized parts in the work location against contact.
4. Take special precautions when close to bare conductors.
5. Measure that the installation is de-energized.
• Before and after measuring the installation, verify the operation of the voltage tester
on a known voltage source.
• Make sure that the voltage between the drive input power terminals (L1, L2, L3) and
the grounding (PE) busbar is zero.
• Make sure that the voltage between the drive output terminals (T1/U, T2/V, T3/W)
and the grounding (PE) busbar is zero.
• Make sure that the voltage between the drive DC terminals (UDC+ and UDC-) and
the grounding (PE) terminal is zero. In cabinet-built drives, measure between the drive
DC busbars (+ and -) and the grounding (PE) busbar.
6. Install temporary grounding as required by the local regulations.
7. Ask the person in control of the electrical installation work for a permit to work.
Safety instructions 9

10

Introduction to the manual
Contents of this chapter
This chapter describes the manual in short and gives some general information for the
reader. This chapter also contains a quick reference guide for implementing a safety system.
Applicability
This manual is applicable to ACS880-07/07LC/17/17LC/37/37LC drives which have the
option: Prevention of unexpected start-up with STO, with FSO (option +Q950).
Required versions with the FSO-12 module:
• ACS880 primary control program: 1.80 or later
• FSO-12 safety functions module: revision C or later
• Drive composer pro: 1.6 or later.
Required versions with the FSO-21 module:
• ACS880 primary control program: 2.2 or later
• FSO-21 safety functions module: revision D or later
• FSE-31 pulse encoder interface module: revision D or later (if used)
• Drive composer pro: 1.8 or later.
This manual shows the default design of the safety circuit ordered with option code +Q950.
The actual design can be different from the default design because of customer-defined
modifications. Always refer to the documentation delivered with the drive.
Target audience
This manual is intended for people who install, commission, use and service the safety
function. Read the manual before working on the unit. You are expected to know the
2
Introduction to the manual 11

fundamentals of electricity, wiring, electrical components, electrical schematic symbols, and
functional safety.
Exclusion of liability
ABB is not responsible for the implementation, verification and validation of the overall safety
system. It is the responsibility of the system integrator (or other party) who is responsible
for the overall system and system safety.
The system integrator (or other responsible party) must make sure that the entire
implementation complies with the instructions in this manual, all relevant standards, directives
and local electrical code, and that the system is tested, verified and validated correctly.
Quick reference guide for taking a safety function into use
Task
Connect the user-defined wiring (if any). See the wiring instructions in this manual and the circuit dia-
grams delivered with the drive.
Check and/or set the safety function related parameters (as listed in this manual).
Do the validation test to make sure that the implemented system meets the safety requirements. You
can find the instructions for the validation test in this manual and in the FSO module user's manual.
Document the validation test procedure. You can find the guidelines for the validation test report in this
manual and in the FSO module user's manual.
Related manuals
CodeManual
Drive hardware
3AUA0000143261ACS880-07 drives (560 to 2800 kW) hardware manual
3AUA0000105718ACS880-07 drives (45 to 710 kW, 50 to 700 hp) hardware manual
3AXD50000569786ACS880-07LC drives hardware manual
3AXD50000020436ACS880-17 drives (160 to 3200 kW) hardware manual
3AXD50000035158ACS880-17 drives (45 to 400 kW) hardware manual
3AXD50000250295ACS880-17LC drives hardware manual
3AXD50000020437ACS880-37 drives (160 to 3200 kW) hardware manual
3AXD50000035159ACS880-37 drives (45 to 400 kW) hardware manual
3AXD50000251407ACS880-37LC drives hardware manual
Drive firmware
3AUA0000085967ACS880 primary control program firmware manual
3AUA0000098062ACS880 primary control program quick start-up guide
3AUA0000103295ACS880 diode supply control program firmware manual
3AUA0000131562ACS880 IGBT supply control program firmware manual
PC tools
3AUA0000094606Drive composer start-up and maintenance PC tool user's manual
TT201312111015Functional safety design tool user’s manual
Safety
3AUA0000048753Functional safety; Technical guide No. 10
12 Introduction to the manual

CodeManual
www.abb.com/safetyABB Safety information and solutions
Options
3AUA0000085685ACX-AP-x assistant control panels user’s manual
3AXD50000015612FSO-12 safety functions module user’s manual
3AXD50000015614FSO-21 safety functions module user’s manual
3AXD50000016597FSE-31 pulse encoder interface module user’s manual
Other documents
Delivered with the driveCircuit diagrams
Delivered with the drivePart lists
Safety data report (if the safety circuit is different from the default design)
See www.abb.com/drives/documents for all manuals on the Internet.
ACS880-07LC manualsACS880-07 (560 to 2800 kW)
manuals
ACS880-07 (45 to 710 kW) manuals
ACS880-17LC manualsACS880-17 (160 to 3200 kW)
manuals
ACS880-17 (45 to 400 kW) manuals
ACS880-37LC manualsACS880-37 (160 to 3200 kW)
manuals
ACS880-37 (45 to 400 kW) manuals
Introduction to the manual 13

Terms and abbreviations
DescriptionTerm
Classification of the safety-related parts of a control system in respect of their resistance
to faults and their subsequent behavior in the fault condition, and which is achieved
by the structural arrangement of the parts, fault detection and/or by their reliability.
The categories are: B, 1, 2, 3 and 4. (EN ISO 13849-1)
Cat.
Common cause failure (%) (EN ISO 13849-1)CCF
Diagnostic coverage (EN ISO 13849-1)DC
Physical size of the drive or power moduleFrame, frame size
Optional pulse encoder interface module for safety encoderFSE-31
Safety functions module which supports the FSE-31 module and the use of safety
encoders
FSO-21
Safety functions module which does not support the use of encodersFSO-12
Hardware fault tolerance (IEC 61508)HFT
Insulated gate bipolar transistorIGBT
Inverter module(s) under control of one control unit, and related components. One
inverter unit typically controls one motor.
Inverter unit
Average probability of dangerous failure on demand (IEC 61508)PFDavg
Average frequency of dangerous failures per hour (IEC 61508)PFH
Performance level. Levels a...e correspond to SIL (EN ISO 13849-1)PL
Prevention of unexpected start-upPOUS
Systematic capability (IEC 61508)SC
Safety integrity level (1...3) (IEC 61508)SIL
Maximum SIL (level 1...3) that can be claimed for a safety function or subsystem
(IEC/EN 62061)
SILCL
Safe stop emergencySSE
Safe torque off (IEC/EN 61800-5-2)STO
Proof test interval. Defines the probabilistic failure rate (PFH or PFDavg) for the safety
function or subsystem. Performing a proof test at a maximum interval of T1is required
to keep the SIL capability valid. The same interval must be followed to keep the PL
capability (EN ISO 13849) valid. Note that any T1values given cannot be regarded
as a guarantee or warranty.
T1
Test pulseTP
14 Introduction to the manual

Option description
Contents of this chapter
This chapter describes the option +Q950, prevention of unexpected start-up, and its settings.
Overview
The option +Q950 uses the FSO-12 safety functions module (option +Q973) or the FSO-21
safety functions module (option +Q972) for the Prevention of unexpected start-up (POUS)
safety function. ABB installs the FSO module to the drive and sets default parameter values
for the option at the factory.
The user must install and connect an operating switch and an indication lamp (optional) on
site. These are not included in the delivery. The user can install the operating switch on, for
example, a control desk. See the machine-specific C-type standards on whether the indication
lamp is required.
When the user sets the operating switch to the open position, the POUS function activates
the Safe torque off (STO) function in the drive. The Safe torque off function disables the
control voltage of the power semiconductors of the drive output stage. This prevents the
drive from generating the torque required to rotate the motor. With the POUS function, the
user can do short-time operations (like cleaning) or maintenance work on the non-electrical
parts of the machinery without switching off and disconnecting the drive.
Note: The situations in which you can use the POUS function must always be based on a
risk assessment. Refer to IEC 60204-1:2016.
3
Option description 15

Note: Drives with the Emergency stop, stop category 1 function (options +Q978 and +Q979):
If the user activates the POUS function during the emergency stop deceleration ramp, it
overrides the emergency stop function. This activates the drive STO function and opens
the main contactor/breaker (in option +Q978). The motor coasts to a stop. For more
information on the emergency stop functions, see Emergency stop, configurable stop
category 0 or 1 (option +Q978) for ACS880-07/07LC/17/17LC/37/37LC drives user's manual
(3AUA0000145920 [English]) and Emergency stop, configurable stop category 0 or 1 (option
+Q979) for ACS880-07/07LC/17/17LC/37/37LC drives user's manual (3AUA0000145921
[English]).
Note: ACS880-07/07LC drives, frames n×DXT + n×R8i with a main contactor/breaker (option
+F250/+F255), ACS880-17/17LC/37/37LC drives, frames n×R8i + n×R8i, and ACS880-17/37
drives, frames R8 and R11: When the inverter unit STO is activated, the main
contactor/breaker is opened after a user-defined delay (defined with parameter 94.11, the
default value is 600 s). See the hardware and firmware manuals for more information.
For a detailed description of the drive STO function, see the hardware manual. For more
information on the FSO module, see FSO-12 safety functions module user’s manual
(3AXD50000015612 [English]) or FSO-21 safety functions module user’s manual
(3AXD50000015614 [English]).
The design principles of the option +Q950 comply with EN ISO 13850. The STO function
complies with IEC/EN 61800-5-2. For a complete list of related standards and European
directives, see section Related standards and directives (page 39).
￭Summary of wirings and settings
The wirings and settings of the POUS function are:
• The drive is equipped with the FSO safety functions module (option +Q973 or +Q972).
ABB installs the module at the factory.
• The user must connect a dual-channel POUS switch to the FSO module. See section
Wiring (page 21).
• The user can connect a POUS indication lamp to the FSO module (optional).
• The digital input of the FSO module to which the POUS switch is connected, is selected
as the input for the POUS request. This is an FSO module parameter that ABB sets at
the factory. The user must check the setting at the start-up.
• The digital output of the FSO module to which the POUS indication lamp is connected,
is selected as the output for the POUS completed signal. This is an FSO module
parameter that ABB sets at the factory. The user must check the setting at the start-up.
16 Option description

Operation principle
￭Time scheme
This time scheme diagram illustrates the operation of the POUS function. This safety function
uses the POUS function of the FSO module. For more information, see the FSO module
user’s manual.
1
24
POUS switch
(POUS request)
STO status
(POUS status)
A
POUS
indication lamp
3 5
Motor speed
Time
POUS indication delay (see parameter POUS.13 POUS delay for completion): An additional security
delay. The POUS completed indication (parameter POUS.22) becomes active after this delay.
A
1. The user stops the drive.
2. After the motor has stopped, the user sets the POUS switch to the open position. The
FSO module activates the drive STO function.
Note: If the user activates the POUS function when the motor is running, the FSO module
activates the drive STO function, the motor coasts to a stop and the FSO module
generates a fault.
3. After time A has elapsed, the POUS indication lamp comes on (POUS completed
indication).
Note: If the time specified by parameter POUS.13 is not sufficient, the motor can still be
coasting when the POUS completed indication comes on.
4. The user sets the POUS switch to the closed position. The FSO module deactivates the
drive STO function. The POUS indication lamp goes off. The user can start the motor
again.
Note: In this case, automatic acknowledgement of the POUS function is selected
(parameter POUS.02).
5. The user restarts the drive.
Option description 17

￭Operation principle diagram
This diagram shows the connections of an FSO module (without the safety encoder interface).
The figure shows a simplified operation principle. For a more detailed description, refer to
the circuit diagrams delivered with the drive.
-A68
4
1
2
3
8
5
6
7
10
9
4
1
2
3
8
5
6
7
10
9
4
1
2
3
8
5
6
7
10
9
4
1
2
3
8
5
6
7
10
9
DI
DO
GND
TP
X114 X11 3
-A68
4
1
2
3
8
5
6
7
10
9
4
1
2
3
8
5
6
7
10
9
DI
DO
GND
TP
X114 X11 3
X111
-A68
4
1
2
3
8
5
6
7
10
9
4
1
2
3
8
5
6
7
10
9
DI
DO
GND
TP
X114 X11 3
X111
M
3~
M
3~
~~
2)
Main ci rcu it
~
M
3~
~
2)
Main ci rcu it
~
1
0
-A41
XSTO
IN2
OUT
SGND
IN1
IN2
OUT
SGND
IN1
-T11.x
1)
-X51B
-X52B
OUT1
SGND
OUT2
SGND
OUT1
SGND
OUT2
SGND
IN1
SGND
IN2
SNGD
IN1
SGND
IN2
SNGD
XSTO
.OUT
IN1
SGND
IN2
SGND
IN1
SGND
IN2
SGND
-S
-P
The dashed line in the figure shows a user-defined installation.- - -
To parallel inverter modules (if any)1)
Drive module2)
Inverter control unitA41
Safety functions module FSO-12/-21A68
POUS switch (user-defined)S
POUS indicator lamp (user-defined)P
Terminal block in the FSO moduleX113,
X114
STO connections to inverter controlX111
Inverter module(s) under inverter unit T11 (only for R8i)T11.x
Test pulse(s) for digital inputTP
OperationStep
Initial status: The drive is in operation, but the motor is not running.
The user sets the POUS switch [S] to the open position. This de-energizes the digital inputs of the
FSO module and activates the POUS function.
1
18 Option description

OperationStep
The FSO module [A68] de-energizes the Safe torque off (STO) inputs on the inverter control unit
[A41], which activates the drive STO function. The drive shows an indication.
2
The POUS indication lamp [P] comes on.3
The user cannot start the motor while the drive STO is active.4
Normal operation resumes after the user:5
•sets the POUS switch [S] to the closed position
•resets the drive (if necessary)
•makes sure that the drive receives the start signal (depends on the configuration, see the firmware
manual).
Fault reaction function
Definition: A safety function requires a “fault reaction function” that tries to initiate a safe
state if it detects a failure in the safety system.
Examples of different failures:
• a short or open circuit or redundancy failure of the POUS switch wiring chain
• an internal failure in the FSO module or the drive STO.
This section describes the fault reaction functions in the FSO module and the drive STO.
￭FSO module
The fault reaction function of the FSO module trips the drive if it detects a failure. The FSO
module activates the STO function or the Safe stop emergency (SSE) function. This activates
the drive STO function. The drive STO function is active until the fault is repaired.
The FSO module goes into Fail-safe mode. The STATUS/FAULT LED of the FSO module
is red until the fault is repaired. To exit the Fail-safe mode, remove the cause of the fault
and reset the FSO module. See section Resetting the FSO module (page 19).
For more information, see the drive firmware manual and the FSO module user’s manual.
Resetting the FSO module
To reset the FSO module:
• switch the power off and on, or
• click the Reboot FSO button on the Safety view of the Drive composer pro PC tool, or
•use the drive parameter 96.09 FSO reboot.
￭Drive STO function
The drive STO function has internal fault diagnostics and a fault reaction function, which
causes a fault trip if it detects a redundancy fault of STO control signals or an internal failure.
See the hardware and firmware manuals of the drive.
Option description 19

20