Danfoss VLT series User manual

MAKING MODERN LIVING POSSIBLE
Operating Instructions
VLT®Frequency Converters - Safe Torque Off
www.danfoss.com/drives

Contents
1 Introduction 2
1.1 Purpose of the Manual 2
1.2 Additional Resources 2
1.3 Functional Overview 2
1.4 Approvals and Certifications 3
1.5 Symbols, Abbreviations and Conventions 4
2 Safety 5
2.1 Safety Symbols 5
2.2 Qualified Personnel 5
2.3 Safety Precautions 5
3 Installation 7
3.1 Safety Instructions 7
3.2 Safe Torque Off Installation 7
3.3 Installation in Combination with Thermistor Module MCB 112 8
4 Commissioning 9
4.1 Safety Instructions 9
4.2 Activation and Termination of Safe Torque Off 9
4.3 Parameter Settings for STO in Combination with Thermistor Module MCB 112 9
4.4 Automatic/Manual Restart Behaviour 9
4.5 Safe Torque Off Commissioning Test 10
4.5.1 Restart Prevention for STO Application 10
4.5.2 Automatic Restart of Safe Torque Off Application 10
4.6 System Configuration Security 10
4.7 Service and Maintenance 10
5 Safe Torque Off Technical Data 11
Index 12
Contents VLT®Frequency Converters - Safe Torque Off Operating Instructions
MG37D102 - Rev. 2013-11-15 1

1 Introduction
1.1 Purpose of the Manual
This manual provides information for use of Danfoss VLT®
frequency converters in functional safety applications. The
manual includes information about functional safety
standards, Danfoss VLT®frequency converter Safe Torque
Off (STO) function, and the related installation and
commissioning as well as service and maintenance for STO.
1.2 Additional Resources
This manual is targeted at users already familiar with the
VLT®frequency converters and is intended as a
supplement to the manuals and instructions available for
download at www.danfoss.com/BusinessAreas/DrivesSo-
lutions/Documentations/VLT+Technical+Documentation.htm.
Read the instructions shipped with the frequency converter
and/or frequency converter option before installation of
the unit and observe the instructions for safe installation.
Disclosure, duplication and sale of this document, as well
as communication of its content, are prohibited unless
explicitly permitted. Infringement of this prohibition incurs
liability for damages. All rights reserved with regards to
patents, utility patents and registered designs. VLT®is a
registered trademark.
1.3 Functional Overview
1.3.1 Introduction
The Safe Torque Off (STO) function is a component in a
safety control system. Components in the system must be
selected and applied appropriately to achieve the desired
level of operational safety. STO disables the control voltage
of the power semiconductors of the frequency converter
output stage, which in turn prevents generating the
voltage required to rotate the motor.
The frequency converter can integrate the safety function
Safe Torque Off (STO, as defined by EN IEC 61800-5-2) and
Stop Category 0 (as defined in EN 60204-1). The frequency
converter is available with STO functionality via control
terminal 37.
Before integrating and using STO in an installation, a
thorough risk analysis on the installation must be carried
out to determine whether the STO functionality and safety
levels are appropriate and sufficient. The frequency
converter with STO functionality is designed and approved,
suitable for the requirements of:
•Category 3 in EN ISO 13849-1
•Performance Level "d" in EN ISO 13849-1
•SIL 2 in IEC 61508 and EN 61800-5-2
•SILCL 2 in EN 62061
1.3.2 Products Covered and Identification
The STO function is available for the following types of
frequency converters:
•VLT®HVAC Drive FC 102
•VLT®Refrigeration Drive FC 103
•VLT®AQUA Drive FC 202
•VLT®AutomationDrive FC 301 enclosure type A1
•VLT®AutomationDrive FC 302
Identification
•Confirm that the frequency converter is
configured with STO function by checking the
unit typecode on the nameplate (see Table 1.1).
Product Typecode
VLT®HVAC Drive
FC 102 T or U at digit 17 of the typecode
VLT®Refrigeration
Drive FC 103 T at digit 17 of the typecode
VLT®AQUA Drive
FC 202 T or U at digit 17 of the typecode
VLT®Automa-
tionDrive FC 301
enclosure type A1
T at digit 17 of the typecode
VLT®Automa-
tionDrive FC 302 X, B or R at digit 17 of the typecode
Table 1.1 Typecode Identification
Introduction VLT®Frequency Converters - Safe Torque Off Operating Instructions
2 MG37D102 - Rev. 2013-11-15
1
1

1.4 Approvals and Certifications
Table 1.2 Approvals and Certifications
More approvals and certifications are available. Contact
local Danfoss partner.
Applied standards and compliance
Use of Safe Torque Off on terminal 37 requires that the
user satisfies all provisions for safety including relevant
laws, regulations and guidelines. The integrated STO
function complies with the following standards:
•IEC 60204-1: 2005 Stop category 0 – uncontrolled
stop
•EN 60204-1: 2006 Stop category 0 – uncontrolled
stop
•IEC/EN 61508: 2010 SIL2
•IEC/EN 61800-5-2:2007
•IEC/EN 62061: 2005 SIL CL2
•ISO 13849-1: 2006 Category 3 PL d
•EN ISO 13849-1:2008 Category 3 PL d
Introduction VLT®Frequency Converters - Safe Torque Off Operating Instructions
MG37D102 - Rev. 2013-11-15 3
11

1.5 Symbols, Abbreviations and Conventions
Abbreviation Reference Description
Cat. EN ISO 13849-1 Category, level “B, 1-4”
DC Diagnostic Coverage
FIT Failure In Time: 1E-9/hour
HFT EN IEC 61508 Hardware Fault Tolerance: HFT = n means that n+1 faults could cause a loss of the
safety function
MTTFd EN ISO 13849-1 Mean Time To Failure - dangerous. Unit: years
PFH EN IEC 61508 Probability of Dangerous Failures per Hour. This value shall be considered if the safety
device is operated in high demand or continuous mode of operation, where the
frequency of demands for operation made on a safety-related system is greater than
one per year.
PFD EN IEC 61508 Average probability of failure on demand, value used for low demand operation.
PL EN ISO 13849-1 Discrete level used to specify the ability of safety related parts of control systems to
perform a safety function under foreseeable conditions. Levels a-e
SFF EN IEC 61508 Safe Failure Fraction [%]; percentage of safe failures and dangerous detected failures of
a safety function or a subsystem related to all failures.
SIL EN IEC 61508
EN IEC 62061
Safety Integrity Level
STO EN IEC 61800-5-2 Safe Torque Off
SS1 EN IEC 61800 -5-2 Safe Stop 1
SRECS EN IEC 62061 Safety Related Electrical Control System
SRP/CS EN ISO 13849-1 Safety Related Parts of Control Systems
PDS/SR EN IEC 61508 Power Drive System (Safety-related)
Table 1.3 Abbreviations Related to Functional Safety
Conventions
Numbered lists indicate procedures.
Bullet lists indicate other information and description of illustrations.
Italicised text indicates
•cross reference
•link
•parameter name
Introduction VLT®Frequency Converters - Safe Torque Off Operating Instructions
4 MG37D102 - Rev. 2013-11-15
1
1

2 Safety
2.1 Safety Symbols
The following symbols are used in this document:
WARNING
Indicates a potentially hazardous situation which could
result in death or serious injury.
CAUTION
Indicates a potentially hazardous situation which could
result in minor or moderate injury. It may also be used
to alert against unsafe practices.
NOTICE
Indicates important information, including situations that
may result in damage to equipment or property.
2.2 Qualified Personnel
The products may only be assembled, installed,
programmed, commissioned, maintained, and decommis-
sioned by persons with proven skills. Persons with proven
skills
•are qualified electrical engineers, or persons who
have received training from qualified electrical
engineers and are suitably experienced to
operate devices, systems, plant and machinery in
accordance with the general standards and
guidelines for safety technology
•are familiar with the basic regulations concerning
health and safety/accident prevention
•have read and understood the safety guidelines
given in this manual and also the instructions
given in the Operating Instructions of the
frequency converter.
•have a good knowledge of the generic and
specialist standards applicable to the specific
application
Users of PDS(SR)s are responsible for
•hazard and risk analysis of the application
•identifying safety functions required and
allocating SIL or PLr to each of the functions
•other subsystems and the validity of signals and
commands from them
•designing appropriate safety-related control
systems (hardware, software, parameterisation,
etc.)
Protective Measures
•Safety engineering systems may only be installed
and commissioned by qualified and skilled
personnel
•Install the frequency converter in an IP54 cabinet
as per IEC 60529 or in an equivalent environment.
In special applications a higher IP degree may be
necessary
•Ensure short-circuit protection of the cable
between terminal 37 and the external safety
device according to ISO 13849-2 table D.4
•When external forces influence the motor axis
(e.g. suspended loads), additional measures (e.g.,
a safety holding brake) are required to eliminate
hazards
2.3 Safety Precautions
See the Safety Chapter in the relevant Operating
Instructions for general safety precautions.
CAUTION
After installation of STO, a commissioning test as
specified in chapter 4.5 Safe Torque Off Commissioning
Test must be performed. A passed commissioning test is
mandatory after first installation and after each change
to the safety installation.
WARNING
If external forces act on the motor e.g. in case of vertical
axis (suspended loads) - and an unwanted movement,
for example caused by gravity, could cause a hazard, the
motor must be equipped with additional measures for
fall protection. For example, mechanical brakes must be
installed additionally. Risk of death and serious injury.
WARNING
Safe Torque Off (i.e. removal of 24 V DC voltage supply
to terminal 37) does not provide electrical safety. The
Safe Torque Off function itself is not sufficient to
implement the Emergency-Off function as defined by EN
60204-1. Emergency-Off requires measures of electrical
isolation, e.g. by switching off mains via an additional
contactor. Risk of death and serious injury.
Safety VLT®Frequency Converters - Safe Torque Off Operating Instructions
MG37D102 - Rev. 2013-11-15 5
22

WARNING
SAFE TORQUE OFF FUNCTION
The Safe Torque Off function does NOT isolate mains
voltage to the frequency converter or auxiliary circuits.
Perform work on electrical parts of the frequency
converter or the motor only after isolating the mains
voltage supply and waiting the length of time specified
in the Safety Chapter in the relevant Operating
Instructions. Failure to isolate the mains voltage supply
from the unit and waiting the time specified could result
in death or serious injury.
•Do not stop the frequency converter by using the
Safe Torque Off function. If a running frequency
converter is stopped by using the function, the
unit trips and stops by coasting. If this is not
acceptable, e.g. causes danger, stop the
frequency converter and machinery by using the
appropriate stopping mode before using this
function. Depending on the application, a
mechanical brake may be required.
•Safe Torque Off is suitable for performing
mechanical work on the frequency converter
system or affected area of a machine only. It does
not provide electrical safety. Safe Torque Off
should not be used as a control for starting
and/or stopping the frequency converter.
CAUTION
Automatic restart behaviour is only allowed in 1 of the 2
situations:
1. The unintended restart prevention is
implemented by other parts of the Safe Torque
Off installation.
2. A presence in the dangerous zone can be
physically excluded when Safe Torque Off is not
activated. In particular, paragraph 5.3.2.5 of ISO
12100-2 2003 must be observed.
WARNING
The Safe Torque Off function can be used for
asynchronous, synchronous and permanent magnet
motors. 2 faults can occur in the power semiconductor of
the frequency converter. When using synchronous or
permanent magnet motors, a residual rotation can result
from the faults. The rotation can be calculated to angle =
360/(number of poles). The application using
synchronous or permanent magnet motors must take
this residual rotation into consideration and ensure that
it does not pose a safety risk. This situation is not
relevant for asynchronous motors. Risk of death and
serious injury.
NOTICE
The selection of a stop category in accordance with EN
60204-1 for each stop function must be determined by a
risk assessment:
•Stop Category 0 is achieved with immediate
removal of power to the actuator, resulting in
an uncontrolled coast to stop. Safe Torque Off
(STO) according to EN 61800-5-2 accomplishes a
Stop Category 0 stop.
•Stop Category 1 is achieved with power
available to the machine actuators to achieve
the stop. Power is removed from the actuators
when the stop is achieved according to EN
61800-5-2 Safe Stop 1 (SS1).
•Stop Category 2 is a controlled stop with power
available to the machine actuators. The stop is
followed by a holding position under power.
NOTICE
When designing the machine application, timing and
distance should be considered for a coast to stop (Stop
Category 0 or Safe Torque Off). For more information
regarding stop categories, refer to EN 60204-1.
Safety VLT®Frequency Converters - Safe Torque Off Operating Instructions
6 MG37D102 - Rev. 2013-11-15
22

3 Installation
3.1 Safety Instructions
See chapter 2 Safety for general safety instructions.
3.2 Safe Torque Off Installation
For motor connection, AC mains connection, and control
wiring, follow the instructions for safe installation in the
Operating Instructions of the frequency converter.
For installation with the Ex-certified Thermistor Module
MCB 112, see chapter 3.3 Installation in Combination with
Thermistor Module MCB 112.
Enable the integrated Safe Torque Off as follows:
1. Remove the jumper wire between control
terminals 37 and 12 or 13. Cutting or breaking
the jumper is not sufficient to avoid short-
circuiting. (See jumper on Illustration 3.1)
12/13
37
130BA874.10
Illustration 3.1 Jumper between Terminal 12/13 (24 V) and 37
2. Connect an external safety monitoring relay via a
NO safety function to terminal 37 (Safe Torque
Off) and either terminal 12 or 13 (24 V DC).
Follow the installation instructions for the safety
monitoring relay, and ensure that the safety
monitoring relay comply with Category 3 /PL “d”
(ISO 13849-1) or SIL 2 (EN 62061 and IEC 61508).
12
37
3
2
FC
4
1
130BB967.10
1Safety relay (cat. 3, PL d or SIL2
2 Emergency stop button
3 Reset button
4 Short-circuit protected cable (if not inside installation IP54
cabinet). See ISO 13849-2 Table D.4 for further information.
Illustration 3.2 Installation to Achieve a Stop Category 0 (EN
60204-1) with Safety Cat. 3/PL “d” (ISO 13849-1) or SIL 2 (EN
62061 and IEC 61508).
3. Complete wiring according to the instructions
given in the Operating Instructions of the
frequency converter.
Installation VLT®Frequency Converters - Safe Torque Off Operating Instructions
MG37D102 - Rev. 2013-11-15 7
33

3.3 Installation in Combination with
Thermistor Module MCB 112
NOTICE
Combination of Thermistor Module MCB 112 and Safe
Torque Off function is only available for VLT®HVAC
Drive FC 102, VLT®AutomationDrive FC 302, and VLT®
AutomationDrive FC 301 enclosure type A1.
Thermistor Module MCB 112 uses Terminal 37 as its safety-
related switch-off channel.
•Ensure that the output X44/12 of MCB 112 is
AND-ed with the safety-related sensor (such as
emergency stop button, safetyguard switch, etc.)
that activates Safe Torque Off. This means that
the output to Safe Torque Off terminal 37 is HIGH
(24 V) only if both the signal from MCB 112
output X44/12 and the signal from the safety-
related sensor are HIGH. If at least 1 of the 2
signals is LOW, then the output to terminal 37
must be LOW, too.
•Ensure that the safety device with AND-logic
complies with the needed safety level.
•Short-circuit protect the connection from the
output of the safety device with safe AND-logic
to the Safe Torque Off terminal 37, see
Illustration 3.3.
130BA967.11
121110987654321
37203332292719181312
DI DI
SIL 2
Safe Stop
Digital Input
e.g. Par 5-15
PTC
Sensor
X44/
Par. 5-19
Terminal 37 Safe Stop
Safety Device
Safe Input
Safe Output
Safe AND Input
Manual Restart
PTC Thermistor Card
MCB112
Non-Hazardous AreaHazardous
Area
Illustration 3.3 Combination of a Safe Torque Off Application
and an MCB 112 Application
Illustration 3.3 shows a Restart input for the external safety
device. This means that in this installation 5-19 Terminal 37
Safe Stop can be set to value [7] PTC 1 & Relay W or [8] PTC
1 & Relay A/W. Refer to MCB 112 Operating Instructions for
further details.
Installation VLT®Frequency Converters - Safe Torque Off Operating Instructions
8 MG37D102 - Rev. 2013-11-15
33