ABB ACS880-07 User manual

—
OPTIONS FOR ABB DRIVES
Emergency stop, stop category 1 (option
+Q964) for
ACS880-07/07LC/17/17LC/37/37LC drives
User's manual

Emergency stop, stop category 1
(option +Q964) for
ACS880-07/07LC/17/17LC/37/37LC
drives
User's manual Table of contents
1. Safety instructions
4. Electrical installation
7. Start-up and validation test
3AUA0000119909 Rev J
EN
EFFECTIVE: 2020-09-30

Table of contents
1 Safety instructions
7Contents of this chapter ...........................................................................
7Use of warnings and notes .......................................................................
8Instructions for functional safety circuits ........................................................
9Electrical safety precautions .....................................................................
2 Introduction to the manual
11Contents of this chapter ...........................................................................
11Applicability .........................................................................................
11Target audience ....................................................................................
11Exclusion of liability ................................................................................
12Quick reference guide for taking a safety function into use ..................................
12Terms and abbreviations ..........................................................................
3 Option description
13Contents of this chapter ...........................................................................
13Overview ............................................................................................
14Operation principle .................................................................................
15Fault reaction function .............................................................................
16Hardware settings ..................................................................................
4 Electrical installation
17Contents of this chapter ...........................................................................
17Wiring ................................................................................................
5 Parameter settings
19Contents of this chapter ...........................................................................
19Drive parameter settings ..........................................................................
20
Additional parameter settings for ACS880-07/07LC drives, frames n×DXT + n×R8i and
ACS880-17/17LC/37/37LC drives, frames n×R8i + n×R8i ...................................
6 Use of the safety function
21Contents of this chapter ...........................................................................
21Activating the safety function .....................................................................
22Resetting the safety function .....................................................................
7 Start-up and validation test
23Contents of this chapter ...........................................................................
23Validation of the safety functions ................................................................
23Competence .....................................................................................
23Validation procedure ...........................................................................
24Validation test reports ..........................................................................
24Start-up and validation test .......................................................................
Table of contents 5

8 Fault tracing
27Contents of this chapter ...........................................................................
27Fault tracing .........................................................................................
28Reporting problems and failures related to safety functions .................................
9 Maintenance
29Contents of this chapter ...........................................................................
29Safety circuit maintenance .......................................................................
29Proof test interval ..................................................................................
30Competence ........................................................................................
30Residual risk ........................................................................................
30Intentional misuse ..................................................................................
30Decommissioning ..................................................................................
10 Technical data
31Contents of this chapter ...........................................................................
31Safety data ..........................................................................................
31Safety data values ..............................................................................
32Safety component types .......................................................................
32Safety block diagrams .........................................................................
32Relevant failure modes ........................................................................
32Fault exclusions ................................................................................
33Operation delays ...............................................................................
33Ambient conditions ................................................................................
33ACS880-07 drives, frames R6…R11 ........................................................
33Related standards and directives ................................................................
34Compliance with the European Machinery Directive .........................................
Further information
6 Table of contents

Safety instructions
Contents of this chapter
This chapter contains the safety instructions which you must obey when you install, operate
and do maintenance on the safety functions of a drive.
Use of warnings and notes
Warnings tell you about conditions which can cause injury or death, or damage to the
equipment. They also tell you how to prevent the danger. Notes draw attention to a particular
condition or fact, or give information on a subject.
The manual uses these warning symbols:
WARNING!
Electricity warning tells about hazards from electricity which can cause injury or
death, or damage to the equipment.
WARNING!
General warning tells about conditions, other than those caused by electricity,
which can cause injury or death, or damage to the equipment.
WARNING!
Electrostatic sensitive devices warning tells you about the risk of electrostatic
discharge which can cause damage to the equipment.
1
Safety instructions 7

Instructions for functional safety circuits
This manual does not contain the complete safety instructions of the drive. It only includes
the instructions related to the scope of this manual.
Only a qualified electrical professional who has sufficient knowledge about functional,
machine, and process safety is permitted to install, start up and maintain the safety circuit.
All user-made changes are on the user's responsibility.
WARNING!
The safety function described in this manual does not isolate the main circuit or
auxiliary circuit from the power supply. Do not do work on the drive, motor cable
or motor before you have isolated the drive system from all power supplies and
measured that there are no dangerous voltages. Before you start the work, do the
steps in section Electrical safety precautions (page 9).
WARNING!
(With permanent magnet or synchronous reluctance [SynRM] motors only)
In case of a multiple IGBT power semiconductor failure, the drive system can
produce an alignment torque which maximally rotates the motor shaft by 180/p
(with permanent magnet motors) or 180/2p(with synchronous reluctance [SynRM]
motors) degrees regardless of the activation of the Safe torque off function. p
denotes the number of pole pairs.
WARNING!
Do the validation test of the safety function at the start-up and also after you make
changes to the safety circuit.
WARNING!
Make sure that the functional safety of the machine is maintained in situations
where the safety option does not provide protection, for example, during
commissioning, system maintenance, fault tracing, or decommissioning.
WARNING!
Obey the safety instructions of the drive. If you ignore them, injury or death,
or damage to the equipment can occur. If you are not a qualified electrical
professional, do not do installation or maintenance work.
8 Safety instructions
3

Electrical safety precautions
These electrical safety precautions are for all personnel who do work on the drive, motor
cable or motor.
WARNING!
Obey these instructions. If you ignore them, injury or death, or damage to the
equipment can occur.
If you are not a qualified electrical professional, do not do installation or
maintenance work.
Go through these steps before you begin any installation or maintenance work.
1. Clearly identify the work location and equipment.
2. Disconnect all possible voltage sources. Make sure that re-connection is not possible.
Lock out and tag out.
• Open the main disconnecting device of the drive.
• If you have a permanent magnet motor connected to the drive, disconnect the motor
from the drive with a safety switch or by other means.
• Disconnect all dangerous external voltages from the control circuits.
•After you disconnect power from the drive, always wait 5 minutes to let the intermediate
circuit capacitors discharge before you continue.
3. Protect any other energized parts in the work location against contact.
4. Take special precautions when close to bare conductors.
5. Measure that the installation is de-energized.
• Before and after measuring the installation, verify the operation of the voltage tester
on a known voltage source.
• Make sure that the voltage between the drive input power terminals (L1, L2, L3) and
the grounding (PE) busbar is zero.
• Make sure that the voltage between the drive output terminals (T1/U, T2/V, T3/W)
and the grounding (PE) busbar is zero.
• Make sure that the voltage between the drive DC terminals (UDC+ and UDC-) and
the grounding (PE) terminal is zero. In cabinet-built drives, measure between the drive
DC busbars (+ and -) and the grounding (PE) busbar.
6. Install temporary grounding as required by the local regulations.
7. Ask the person in control of the electrical installation work for a permit to work.
Safety instructions 9

10

Introduction to the manual
Contents of this chapter
This chapter describes the manual in short and gives some general information for the
reader. This chapter also contains a quick reference guide for implementing a safety system.
Applicability
This manual is applicable to ACS880-07/07LC/17/17LC/37/37LC drives which have the
option: Emergency stop, stop category 1 with STO, with safety relays (option +Q964).
This manual shows the default design of the safety circuit ordered with option code +Q964.
The actual design can be different from the default design because of customer-defined
modifications. Always refer to the documentation delivered with the drive.
Target audience
This manual is intended for people who install, commission, use and service the safety
function. Read the manual before working on the unit. You are expected to know the
fundamentals of electricity, wiring, electrical components, electrical schematic symbols, and
functional safety.
Exclusion of liability
ABB is not responsible for the implementation, verification and validation of the overall safety
system. It is the responsibility of the system integrator (or other party) who is responsible
for the overall system and system safety.
The system integrator (or other responsible party) must make sure that the entire
implementation complies with the instructions in this manual, all relevant standards, directives
and local electrical code, and that the system is tested, verified and validated correctly.
2
Introduction to the manual 11

Quick reference guide for taking a safety function into use
Task
Connect the user-defined wiring (if any). See the wiring instructions in this manual and the circuit dia-
grams delivered with the drive.
Check and/or set the safety function related parameters (as listed in this manual).
Do the validation test to make sure that the implemented system meets the safety requirements. You
can find the instructions for the validation test in this manual.
Document the validation test procedure. You can find the guidelines for the validation test report in this
manual.
Terms and abbreviations
DescriptionTerm
Classification of the safety-related parts of a control system in respect of their resistance
to faults and their subsequent behavior in the fault condition, and which is achieved
by the structural arrangement of the parts, fault detection and/or by their reliability.
The categories are: B, 1, 2, 3 and 4. (EN ISO 13849-1)
Cat.
Common cause failure (%) (EN ISO 13849-1)CCF
Frame size designation of the diode supply moduleD8T
Diagnostic coverage (EN ISO 13849-1)DC
Digital inputDI
Digital input interlockDIIL
Emergency stopE-stop
Optional digital I/O extension moduleFIO-01
Physical size of the drive or power moduleFrame, frame size
Hardware fault tolerance (IEC 61508)HFT
Insulated gate bipolar transistorIGBT
Average probability of dangerous failure on demand (IEC 61508)PFDavg
Average frequency of dangerous failures per hour (IEC 61508)PFH
Performance level. Levels a...e correspond to SIL (EN ISO 13849-1)PL
Relay outputRO
Systematic capability (IEC 61508)SC
Safety integrity level (1...3) (IEC 61508)SIL
Maximum SIL (level 1...3) that can be claimed for a safety function or subsystem
(IEC/EN 62061)
SILCL
Safe stop 1 (IEC/EN 61800-5-2)SS1
Safe torque off (IEC/EN 61800-5-2)STO
There are three categories of stop functions defined by IEC/EN 60204-1:
•stop category 0: an uncontrolled stop where power to the machine actuators is re-
moved immediately (for example, STO)
•stop category 1: a controlled stop where the machine actuators have power for
stopping, after which the power is removed (SS1)
•stop category 2: a controlled stop where the machine actuators continue to have
power (SS2).
Stop category
Proof test interval. Defines the probabilistic failure rate (PFH or PFDavg) for the safety
function or subsystem. Performing a proof test at a maximum interval of T1is required
to keep the SIL capability valid. The same interval must be followed to keep the PL
capability (EN ISO 13849) valid. Note that any T1values given cannot be regarded
as a guarantee or warranty.
T1
12 Introduction to the manual

Option description
Contents of this chapter
This chapter describes the +Q964 emergency stop option and its settings.
Overview
Option +Q964 corresponds to a controlled stop in accordance with stop category 1
(IEC/EN 60204-1) and to the Safe Stop 1 time controlled function (SS1-t). When the user
gives the emergency stop command, the drive decelerates the motor to zero speed according
to a user-defined ramp time. Then, the Safe torque off (STO) function is activated, which
prevents the drive from generating the torque required to rotate the motor. The main
contactor/breaker of the drive is not opened.
For option +Q964, ABB installs the FIO-01 digital I/O extension module (option +L501) to
the drive control unit (Slot 1).
For a detailed description of the Safe torque off function, see the drive hardware manual.
Note: Drives with the Prevention of unexpected start-up (POUS) option (+Q957): If the user
activates the POUS function during the emergency stop deceleration ramp, it overrides the
emergency stop function. This activates the Safe torque off (STO) function of the drive
immediately and the motor coasts to a stop. For more information on the POUS safety
function, see Prevention of unexpected start-up (option +Q957) for
ACS880-07/07LC/17/17LC/37/37LC drives (3AUA0000119910 [English]).
Note: ACS880-07/07LC drives, frames n×DXT + n×R8i with a main contactor/breaker (option
+F250/+F255), ACS880-17/17LC/37/37LC drives, frames n×R8i + n×R8i, and ACS880-17/37
drives, frames R8 and R11: When the inverter unit STO is activated, the main
contactor/breaker is opened after a user-defined delay (defined with parameter 94.11, the
default value is 600 s). See the hardware and firmware manuals for more information.
The SS1 and STO functions comply with IEC/EN 61800-5-2.
The design principles of the option +Q964 comply with EN ISO 13850.
3
Option description 13

For a complete list of related standards and European directives, see section Related
standards and directives (page 33).
Operation principle
The figure shows a simplified operation principle. For a more detailed description, refer to
the circuit diagrams delivered with the drive.
1)
-A61
24 VDC+
-S61
-K63-K63
-S62 -S62
-S62-S62
-A62-A62
-K61-K61
-A41
-K61-K61
-T11.x
XSTO
XSTO
.OUT 3)
IN2
OUT
SGND
IN1
IN2
OUT
SGND
IN1
IN1
SGND
IN2
SNGD
IN1
SGND
IN2
SNGD
-X51B
-X52B
IN1
SGND
IN2
SGND
IN1
SGND
IN2
SGND
OUT1
SGND
OUT2
SGND
OUT1
SGND
OUT2
SGND
-X969-X969
-A62
-K63-K63
24 VDC+
-A412.X
RO1
DIO2
M
3~
M
3~
~~
2)
Main ci rcu it
~
M
3~
~
2)
Main ci rcu it
~
Inverter control unitA41
Emergency stop safety relay with delay contactsA61
Extension safety relayA62
Digital I/O extension moduleA412.X
Emergency stop buttonS61
Emergency stop reset button with indicator lightS62
Timer relayK61
Safety relayK63
STO terminal blockX969
Inverter module(s) under inverter unit T11 (only for R8i)T11.x
Reset circuit1)
Drive module2)
To parallel R8i modules (if any)3)
14 Option description

OperationStep
Initial status: The drive is in operation and the motor is running.
The user activates emergency stop with the emergency stop button [S61].1
The emergency stop safety relay [A61] de-energizes the digital input on the digital I/O extension
module [A412.X] of the drive. This gives the emergency stop command to the drive.
2The emergency stop safety relay [A61] de-energizes the timer relay [K61].
The break delay counter of the emergency stop safety relay [A61] starts (user-adjustable delay).
The break delay counter of the timer relay [K61] starts (non-user-adjustable delay).
The drive acknowledges the reception of the emergency stop command by energizing the relay output
(RO1) of the digital I/O extension module [A412.X].
3The relay output of the extension module [A412.X] energizes the timer relay [K61], resetting its break
delay counter. The relay keeps its delayed break contact closed.
Note: If the drive does not acknowledge the reception of the emergency stop command in 2 seconds,
the drive STO function is activated.
The drive decelerates the motor to zero speed in emergency stop deceleration time (user-defined
drive parameter).
4
The break delay counter of the emergency stop safety relay [A61] trips and the delay contact de-en-
ergizes the extension safety relay [A62].
5 The extension safety relay [A62] de-energizes XSTO inputs IN1 and IN2 of the inverter control unit
[A41], which activates the drive STO function.
The extension safety relay [A62] de-energizes safety relay [K63].
The contact of the safety relay [K63] energizes the emergency stop reset button indicator light [S62].6
Normal operation resumes after the user:
7
•releases the emergency stop button [S61] to normal (up) position
•pushes the emergency stop reset button [S62] for 0.1 … 3 seconds to reset the emergency stop
circuit
•resets the drive (if the drive tripped on a fault)
•makes sure that the drive has received the start signal (depends on the configuration, see the
firmware manual).
Fault reaction function
Definition: A safety function requires a “fault reaction function” that tries to initiate a safe
state if it detects a failure in the safety system.
The fault reaction function of the emergency stop safety relay trips the system, if it detects
a failure in the safety circuit (for example, short circuit between signals, open circuit, or
redundancy fault).
If a fault is detected, the fault reaction function:
• activates the emergency stop command
• activates the drive STO function
• keeps the safe state activated and the emergency stop reset button indicator light on
until the fault is repaired and the safety function is reset.
Note: Resetting the safety function is not possible, if the reset circuit in the emergency stop
safety relay is open.
The user must reset the safety relay. See section Fault tracing (page 27).
The STO function has its own internal fault diagnostics and fault reaction function.
Option description 15

Hardware settings
The time delay on the emergency stop safety relay [A61] is adjustable. Set the delay
according to the application requirements. Make sure that the delay is slightly longer than
the emergency stop deceleration time defined by drive parameters 23.23 Emergency stop
time, and 46.01 Speed scaling or 46.02 Frequency scaling. See chapter Parameter
settings (page 19).
Use the rotary switches on the relay to set the time delay. Refer to the table that follows:
DescriptionValueSwitch
Selects the delay mode. Must be 1.1tFkt
Selects the time range (in seconds)
for the delayed contacts.
User-definedtmax
Value range: 1 … 300 s.
Adjusts the time within the selected
range in 10% steps.
User-definedt
Value range: 0.1…1.
Example: If the required time (tv) is 30 s, set:
• tmax = 30 s and t = 1 (tv= tmax · t = 30 s · 1 = 30 s), or
• tmax = 300 s and t = 0.1 (tv= tmax · t = 300 s · 0.1 = 30 s).
16 Option description

Electrical installation
Contents of this chapter
This chapter describes the wiring of the safety option done at the factory and contains
guidelines for making user connections.
Wiring
One emergency stop button and one reset button are installed on the cabinet door and
wired to the drive at the factory. There are double contacts in the emergency stop button
and double wiring (redundant two-channel connection) between the button and the
emergency stop safety relay [A61]. The safety relay detects cross faults and faults across
one contact from the emergency stop button.
If necessary, install additional emergency stop buttons on site and connect them to the
applicable terminal block inside the drive cabinet. Refer to the circuit diagrams delivered
with the drive. Obey these general rules:
1. Use only double-contact buttons approved for emergency stop circuits.
2. Connect the emergency stop buttons with two conductors (two-channel connection).
Keep the channels separate.
Note: If you use only one channel in a two-channel implementation, or if the channels
are connected together, the cross fault detection of the emergency stop relay detects a
redundancy fault and activates the fault reaction function.
Note: The safety circuit design can be different when modified according to the customer's
safety requirements. Refer to the circuit diagrams delivered with the drive.
3. Use shielded, twisted pair cables. ABB recommends double-shielded cable and
gold-plated contacts in the emergency stop button.
4
Electrical installation 17
11

4. Make sure that the sum resistance for one channel (loop resistance) is not more than 1
kohm.
5. Obey the general control cable installation instructions given in the drive hardware manual.
You can also install additional reset buttons and indication lamps for the emergency stop
circuit on site. ABB recommends gold-plated contacts in the reset button. Connect the
buttons to the applicable terminal block inside the drive cabinet. Refer to the circuit diagrams
delivered with the drive. Obey the rules below:
1. Sum resistance of the external reset circuit must not be more than 1 kohm.
2. Obey the general control cable installation instructions given in the drive hardware manual.
18 Electrical installation

Parameter settings
Contents of this chapter
This chapter contains the parameter settings related to the safety function.
Drive parameter settings
This section shows the drive parameter settings related to the safety function in the ACS880
primary control program.
The table that follows shows the parameters that are set at the factory.
Description
Default value1)
NameNo.
Activates (and specifies the type of) I/O extension module
1.
FIO-01Module 1 type14.01
Specifies the slot (1…3) on the control unit of the drive into
which the I/O extension module is installed.
Slot 1Module 1 loca-
tion
14.02
Selects whether DIO1 of the extension module is used as a
digital input or output.
InputDIO 1 function14.09
Selects whether DIO2 of the extension module is used as a
digital input or output.
InputDIO 2 function14.14
Selects a drive signal to be connected to relay output RO1.
In this case, the RO1 is energized by the status of DIO2 of
the FIO module (inverted value).
P.14.5.1-RO1 source14.34
Selects the way the motor is stopped when an emergency
stop command is received.
Eme ramp stop (Off3)Emergency
stop mode
21.04
Selects the source of the emergency stop signal. In this case,
the source is DIO2 of the FIO module.
P.14.5.1Emergency
stop source
21.05
Selects the source of external event 1. In this case, the
source is DIO1 of the FIO module.
P.14.5.0External event
2 source
31.03
Selects the type of external event 2.Warning/FaultExternal event
2 type
31.04
5
Parameter settings 19

Description
Default value1)
NameNo.
Selects which indications are given when one or both Safe
torque off (STO) signals are switched off or lost. Warn-
ing/Warning is the recommended setting.
Warning/WarningSTO indication
run/stop
31.22
1) Value set by ABB at the factory for the default design.
The table that follows shows the parameters that you must set according to application
requirements. Make sure that the selected values agree with the time delay settings of the
emergency stop safety relay. See section Hardware settings (page 16).
DescriptionValueNameNo.
In speed control mode, this parameter defines the decelera-
tion rate for emergency stop Off3 as the time it would take
for the speed to decrease from the value of parameter 46.01
Speed scaling to zero. This also applies to torque control
because the drive switches to speed control on receiving an
emergency stop Off3 command. In frequency control mode,
this parameter specifies the time it would take for the fre-
quency to decrease from the value of 46.02 Frequency
scaling to zero.
User-definedEmergency
stop time
23.23
Selects the maximum speed value used to define the initial
speed value that defines the deceleration ramp rate. Set this
parameter if you use the speed control mode or torque control
mode.
User-definedSpeed scaling46.01
Selects the maximum frequency value used to define the
initial frequency value that defines the deceleration ramp
rate. Set this parameter if you use the frequency control
mode.
User-definedFrequency
scaling
46.02
Additional parameter settings for ACS880-07/07LC drives,
frames n×DXT + n×R8i and ACS880-17/17LC/37/37LC drives,
frames n×R8i + n×R8i
Note: ACS880 primary control program controls the inverter unit by default. There are
dedicated control units for the supply and inverter units.
The parameters are set at the factory. The supply unit parameter settings in the ACS880
supply control programs:
•parameter 121.05 Emergency stop source is set to value Inactive.
For more information, see the firmware manuals.
20 Parameter settings