Danfoss iC7 Series User manual

Operating Guide
iC7 Series Functional Safety
Frequency Converters, 1.3–106 A
drives.danfoss.com

1
1.1
1.2
1.3
1.4
2
2.1
2.2
3
3.1
3.2
3.3
3.4
3.5
3.5.1
3.5.2
3.5.3
4
4.1
4.2
5
5.1
5.2
5.2.1
5.2.2
6
6.1
6.1.1
6.1.2
6.2
7
7.1
7.2
Contents
Introduction 5
Version History 5
Purpose of this Operating Guide 5
Additional Resources 5
Abbreviations 5
Safety 7
Qualified Personnel for Working with Functional Safety 7
General Safety Considerations 7
iC7 Functional Safety 8
Safe Torque Off (STO) 8
STO Activation 8
Automatic/Manual Restart Behavior 8
System Configuration Security 8
Frequency Converters with Functional Safety Group 1 (Not Upgradable) 9
STO Properties 9
STO Failure 10
STO Feedback 10
Installation 12
STO Installation for Frequency Converters with Functional Safety Group 1 (STO - Not Upgradable) 12
Connection Examples 13
Commissioning 15
Safety Instructions for Commissioning 15
Commissioning Test 15
Commissioning Test for STO Applications in Manual Restart Mode 15
Commissioning Test for STO Applications in Automatic Restart Mode 16
Operation and Maintenance 17
Functional Tests 17
Functional Test Using the STO Feedback Signal 17
Functional Test Without Using the STO Feedback Signal 17
Diagnostic Tests 18
Specifications 20
Functional Safety Standards and Performance 20
Technical Data 21
AQ319741840653en-000201/136R0268 | 3Danfoss A/S © 2023.03
Contents
iC7 Series Functional Safety
Operating Guide

7.3
7.4
Operating Conditions 22
Cable Specifications 22
AQ319741840653en-000201/136R02684 | Danfoss A/S © 2023.03
Contents
iC7 Series Functional Safety
Operating Guide

•
•
•
•
•
•
1 Introduction
1.1 Version History
This guide is regularly reviewed and updated. All suggestions for improvement are welcome.
The original language of this guide is English.
Table 1: Version History
Version
Remarks
AQ319741840653, version 0201
Minor updates.
The information in this version is valid for iC7-Automation frequency converters up to 106 A.
AQ319741840653, version 0102
First release.
The information in this version is valid for iC7-Automation frequency converters up to 43 A.
1.2 Purpose of this Operating Guide
This operating guide provides information on the functional safety features of the iC7 drives and is targeted at users already familiar
with the Danfoss iC7 series. It is intended as a supplement to the drive-specific guides.
The guide includes instructions on how to verify that the built-in functional safety features are active, and about configuring the
safety features.
1.3 Additional Resources
Additional resources are available to help understand the features, and safely install and operate the iC7 products:
Safety guides, which provide important safety information related to installing iC7 drives.
Installation guides, which cover the mechanical and electrical installation of drives, or functional extension options.
Design guides, which provide technical information to understand the capabilities of the iC7 drives for integration into motor
control and monitoring systems.
Application guides, which provide instructions on setting up the drive for a specific end use. Application guides for application
software packages also provide an overview of the parameters and value ranges for operating the drives, configuration exam-
ples with recommended parameter settings, and troubleshooting steps.
Facts Worth Knowing about AC Drives, available for download on www.danfoss.com.
Other supplemental publications, drawings, and guides are available at www.danfoss.com.
Latest versions of Danfoss product guides are available for download at http://drives.danfoss.com/downloads/portal/.
1.4 Abbreviations
Table 2: Abbreviations Related to Functional Safety
Abbrevia-
tions
Reference
Description
B10d
–
Number of cycles until 10% of the components have a dangerous failure (for pneumatic
and electromechanical components).
Cat.
EN ISO 13849-1:2015
Category, level “B, 1–4”
CCF
–
Common cause failure
FIT
–
Failure in time: 1E-9/hour
HFT
EN IEC 61508-4:2010
Hardware fault tolerance: HFT = n means that n+1 faults could cause a loss of the safety
function.
MTTFd
EN ISO 13849-1:2015
Mean time to failure - dangerous. Unit: Years are divided into Low, Medium, and High.
AQ319741840653en-000201 / 136R0268 | 5Danfoss A/S © 2023.03
Introduction
iC7 Series Functional Safety
Operating Guide

Abbrevia-
tions
Reference
Description
PFH
EN IEC 61508-4:2010
Probability of dangerous failures per hour. Consider this value if the safety device is op-
erated in high demand or continuous mode of operation, where the frequency of de-
mands for operation made on a safety-related system is greater than 1 per year.
PFD
EN IEC 61508-4:2010
Average probability of failure on demand, value used for low demand operation.
PL
EN ISO 13849-1:2015
Discrete level used to specify the ability of safety-related parts of control systems to per-
form a safety function under foreseeable conditions. Levels divided into a to e.
PLr
–
Required performance level (the required performance level for a particular safety func-
tion).
SIL
EN IEC 61508-4:2010
Safety integrity level
STO
EN IEC 61800-5-2:2017
Safe Torque Off
SS1
EN IEC 61800-5-2:2017
Safe Stop 1
SRECS
–
Safety-related electrical control system
SRP/CS
EN ISO 13849-1:2015
Safety-related parts of control systems
PDS/SR
EN IEC 61800-5-2:2017
Power Drive System (safety-related)
AQ319741840653en-000201 / 136R02686 | Danfoss A/S © 2023.03
Introduction
iC7 Series Functional Safety
Operating Guide

•
•
•
•
•
•
•
-
-
2 Safety
2.1 Qualified Personnel for Working with Functional Safety
Only qualified personnel can install, configure, commission, maintain, and decommission functional safety features and functions.
Qualified personnel for working with functional safety features are qualified electrical engineers, or persons who have received
training from qualified electrical engineers, and are suitably experienced to operate devices, systems, plants, and machinery in ac-
cordance with the general standards and guidelines for safety technology.
Furthermore, they must:
Be familiar with the basic regulations concerning health and safety/accident prevention.
Have read and understood the safety guidelines given in this manual.
Have a good knowledge of the generic and specialist standards applicable to the specific application.
Installers and system designers of power drive systems (safety-related) (PDS(SR)) are responsible for:
Hazard and risk analysis of the application.
The overall safety of the application.
Identifying safety functions required and allocating SIL or PL to each of the functions, other subsystems, and the validity of sig-
nals and commands from them.
Designing appropriate safety-related control systems, such as hardware, software, and parameterization.
2.2 General Safety Considerations
When installing or operating the AC drive, pay attention to the safety information given in the instructions. For more information
about safety guidelines for installation, see the product-specific safety guide that is included in the drive shipment. For more infor-
mation about safety guidelines for operating the drive, see the product-specific operating guide.
NOTICE
After installing the safety functions, perform a commissioning test.
A successful commissioning test is required after the initial installation, and after each change to the installation or application
involving functional safety.
If the commissioning test fails, safe operation cannot be guaranteed.
See 5 Commissioning for more information on performing the commissioning test.
WARNING
RISK OF ELECTRIC SHOCK
The STO safety function does not provide electrical safety. The STO function itself is not sufficient to implement the Emergency-
Off function as defined by IEC 60204-1:2018. Using the STO function to implement Emergency-Off may lead to death or personal
injury.
Emergency-Off requires measures of electrical isolation, for example, by switching off mains via an extra contactor.
AQ319741840653en-000201 / 136R0268 | 7Danfoss A/S © 2023.03
Safety
iC7 Series Functional Safety
Operating Guide

•
•
1.
2.
3 iC7 Functional Safety
3.1 Safe Torque Off (STO)
NOTICE
Select and apply the components in the safety control system appropriately to achieve the required level of operational safety.
Before integrating and using STO in an installation, carry out a thorough risk analysis on the installation to determine whether the
STO functionality and safety levels are appropriate and sufficient.
The Safe Torque Off (STO) function is a component in a safety control system. STO prevents the unit from generating the power
required to rotate the motor.
The iC7 drives are available with:
Safe Torque Off (STO), as defined by EN IEC 61800-5-2:2017.
Stop category 0, as defined in EN IEC 60204-1:2018.
The STO function is available for iC7-Automation drives with functional safety option code +BEF1. Specific hardware revisions are
listed in the appendix of the functional safety certificate.
3.2 STO Activation
The STO function is activated by removing the voltages at the STO inputs of the frequency converter. By connecting the frequency
converter to external safety devices providing a safe delay, an installation for a Safe Stop 1 can be obtained. External safety devices
must fulfill the required Cat./PL or SIL when connected to STO inputs.
With default settings, the frequency converter issues a fault, trips the unit and coasts the motor to a stop, when the STO function is
activated. Manual restart is required.
Use the STO function to stop the frequency converter in situation, where a safety function is required. In normal operating mode
when STO is not required, use the standard stop function instead.
3.3 Automatic/Manual Restart Behavior
The STO default state prevents unintended restarts (Restart Prevention Behavior).
NOTICE
The prevention of unintended restart after STO deactivation does not fulfill a SIL 2 or SIL 3 requirement. If unintended restart is
critical to the installation, this has to be controlled by the use of STO, both after STO activation and at normal start-up scenarios,
for example after normal power cycle.
CAUTION
The default restart behavior is set to Manual. Before switching to Automatic, ensure that requirements of EN ISO 12100:2011
paragraph 6.3.3.2.5 are fulfilled.
Terminating STO and Resuming Normal Operation
Reapply 24 V DC supply to STO inputs.
Give a reset signal (via bus, digital I/O, or the control panel.
Set the STO function to automatic restart by setting the value of parameter 7.2.1 Safe Torque Off Response from default
value Fault (manual reset) to value Warning (automatic reset).
Automatic reset means that STO is terminated and normal operation is resumed, when the 24 V DC is applied to STO
inputs. No reset signal is required.
3.4 System Configuration Security
iC7 drives are equipped with a hardware security chip, and the application software includes both mandatory and configurable se-
curity features that prevent unauthorized access to the drive, ensure secure connectivity to the drive, and protect the drive against
unauthorized software modifications.
For more details on the security features included in the application software, refer to application software documentation.
AQ319741840653en-000201 / 136R02688 | Danfoss A/S © 2023.03
iC7 Functional Safety
iC7 Series Functional Safety
Operating Guide

•
•
•
•
•
•
•
Configurable security features can be adjusted according to application requirements. Depending on the software version of the
frequency converter, the parameters can be password-protected.
3.5 Frequency Converters with Functional Safety Group 1 (Not Upgradable)
Frequency converters with STO (+BEF1) provide the Safe Torque Off (STO) safety function with a dual-channel, galvanically isolated
input, and an STO feedback signal for diagnostic purposes.
The drive integrates the STO functionality via the functional safety I/O terminals as described in Table 3.
The iC7 drive with STO functionality is designed and approved suitable for the requirements of:
Category 3 in EN ISO 13849-1.
Performance Level "e" in EN ISO 13849-1.
SIL 3 in IEC 61508 and EN 61800-5-2.
The STO safety function is active if one or both of the STO inputs are not connected to a +24 V signal. The frequency converter is not
able to go to the RUN state. For more information, see Table 4.
Prerequisites for normal operation (STO function is not active) are:
STO A and STO B signals are energized.
No internal faults are active.
All control input and outputs are galvanically isolated from supply voltage (PELV) and other high voltage terminals, unless other-
wise specified.
Table 3: Functional Safety I/O Terminals in Frequency Converters
Terminal X31
Terminal X32
Numbering
Terminal Name
Functions
Numbering
Terminal Name
Functions
41
24 V
+ 24 V DC Output
45
GND
0 V/GND
42
S.INA+
+ STO Input Channel A
46
S.INA–
- STO Input Channel A
43
S.INB+
+ STO Input Channel B
47
S.INB–
- STO Input Channel B
44
S.FB+
+ STO Input Channel B
48
S.FB–
- STO Feedback
Table 4: Instances of the STO Function and STO Feedback Output
STO inputs
Operating conditions
STO function
STO feedback signal
Fault or warning text
Both inputs energized with
24V DC
Normal operation
Deactivated
Deactivated
No faults or warnings
Power removed from both in-
puts
STO demand
Activated
Activated
"STO activated"(1)
Only one input energized
Failure in demand or due
to internal fault
Activated
Deactivated
"STO – Fault [channel
name]"(2)
1Regular STO demand: Can be either fault or warning depending on restart settings.
2Failure in demand or due to internal fault (always a “fault”, not configurable). Indicated after discrepancy timer (500 ms) elapsed.
3.5.1 STO Properties
For flexible adaptation to the safety system, the STO inputs contain the following properties:
Galvanic isolation of terminals: The functional safety I/O terminal blocks on the control board (X31, X32) have separate, galvani-
cally isolated inputs to allow, for example, interchanging of the polarities of the STO input terminals as shown in Illustration 7
and Illustration 8.
Test pulse filtering: Several control modules test their safe outputs using Test Pulse Pattern (on/off tests), to identify faults due
to either short or cross circuiting. When connecting the STO inputs with a safe output of a control module, test pulses shall not
activate STO. For that reason, test pulses for no longer than 2 ms will be ignored on the STO input lines.
AQ319741840653en-000201 / 136R0268 | 9Danfoss A/S © 2023.03
iC7 Functional Safety
iC7 Series Functional Safety
Operating Guide

•
Time
2 ms max.
Debounce time
Time
Active
Inactive
Voltage
STO Ch. A/B Test pulse STO demanded
STO function
e30bi779.10
Illustration 1: Test Pulse Filtering
Asynchronous input tolerance: The input signals at the STO terminals are not always synchronous. If the discrepancy between
the two signals is longer than 500 ms, the drive indicates a STO fault as described in Table 4. This feature does not delay the
activation of the STO function.
e30bj145.10
STO Ch. A/B
Ch.A
Ch.B
Discrepancy time
STO function
Active
Inactive
Illustration 2: Discrepancy Time
3.5.2 STO Failure
An internal hardware failure might lead to a mode where an external STO request does not lead to the de-energizing of the motor.
The PFH/PFD and MTTF values stated in 7.1 Functional Safety Standards and Performance reflect the probability of this fault. Any
other STO-related, internal failures lead directly to an unrequested activation of the STO function, or effect only one of the 2 redun-
dant STO channels. Failures effecting a single channel are detectable when performing the diagnostic test specified in 6 Operation
and Maintenance.
3.5.3 STO Feedback
STO feedback is a single channel feedback signal which can be used for diagnostic purposes, and for providing an indication of an
active STO. It can help to achieve better safety capability on system level, for example, in retrofit cases, where a diagnostic feedback
to the safety system is required.
AQ319741840653en-000201 / 136R026810 | Danfoss A/S © 2023.03
iC7 Functional Safety
iC7 Series Functional Safety
Operating Guide