Lenze L-force 9400 User manual

EDS94AYAD
.,4z
Ä.,4zä
Manual
L-force | 9400

E94AYAD - SM300
Safety module
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Please read these instructions and the documentation of the standard device before you
start working!
Observe the safety instructions given therein!
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Contents
1
1-1
EDS94AYAD EN 2.2
1 Safety engineering
Contents
1.1 Basics 1.1-1.......................................................
1.1.1 Introduction 1.1-1..........................................
1.1.2 Drive-based safety with L-force | 9400 1.1-1....................
1.1.3 Terms and abbreviations of the safety engineering 1.1-2..........
1.1.4 Important notes 1.1-3.......................................
1.1.5 Safety instructions 1.1-4.....................................
1.1.6 Application as directed 1.1-4.................................
1.1.7 Hazard and risk analysis 1.1-5................................
1.1.8 Standards 1.1-5............................................
1.1.9 Overview of sensors 1.1-5....................................
1.2 Device modules 1.2-1...............................................
1.2.1 Slot 1.2-1..................................................
1.2.2 Function mode of the safety modules 1.2-2.....................
1.2.3 Safety module SM300 1.2-3..................................
1.2.4 Connection of safety sensors 1.2-8............................
1.3 Safety functions 1.3-1...............................................
1.3.1 Integration into the application of the controller 1.3-1...........
1.3.2 Error states 1.3-3...........................................
1.3.3 Safe torque off 1.3-5........................................
1.3.4 Safe stop 1 1.3-7...........................................
1.3.5 Safe PROFIsafe connection 1.3-9..............................
1.4 Acceptance 1.4-1...................................................
1.4.1 Description 1.4-1...........................................
1.4.2 Periodic inspections 1.4-1....................................
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Basics
Introduction
1
1.1
1.1.1
1.1-1
EDS94AYAD EN 2.2
1.1 Basics
1.1.1 Introduction
With increasing automation, protection of persons against hazardous
movements is becoming more important. Functional safety describes the
measures needed by means of electrical or electronic equipment to reduce
or remove danger caused by failures.
During normal operation, safety equipment prevents people accessing
hazardous areas. In certain operating modes, e.g. set-up mode, work needs
to be carried out in hazardous areas. In these situations the machine
operator must be protected by integrated drive and control measures.
Drive-based safety provides the conditions in the controls and drives to
optimise the safety functions. Planning and installation expenditure is
reduced. In comparison to the use of standard safety engineering,
drive-based safety increases machine functionality and availability.
1.1.2 Drive-based safety with L-force | 9400
The controllers of the L-force|9400 range can be equipped with a safety
module. The functional range of the safety module types varies in order to
optimally implement different applications.
”Drive-based safety” stands for applied safety functions, which can be used
for the protection of persons working on machines.
The motion functions are continued to be executed by the controller. The
safety modules monitor the safe compliance with the limit values and
provide the safe inputs and outputs. When the limit values are exceeded the
safety modules start the control functions according to EN 60204-1 directly
in the controller.
The safety functions are suitable for applications according to IEC 61508
SIL 3 and meet, depending on the module, the requirements of EN 954,
part 1 up to control category 4.
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Basics
Terms and abbreviations of the safety engineering
1
1.1
1.1.3

1.1-2 EDS94AYAD EN 2.2
1.1.3 Terms and abbreviations of the safety engineering
Abbreviation Meaning
9400 Lenze servo controller
EC_S0 Error-Class Stop 0
EC_S1 Error-Class Stop 1
EC_S2 Error-Class Stop 2
EC_FS Error-Class Fail-Safe
Cat. Category according to EN 954-1
OSSD Output Signal Switching Device, tested signal output
PS PROFIsafe
PWM Pulse width modulation
S-DI Safe input (Safe Digital Input)
S-DO Safe output (Safe Digital Output)
SIL Safety Integrity Level according to IEC 61508
SM Safety module
Optocoupler
supply Supply of optocouplers to control the driver
OFF state Signal state of the sensors when they are activated or respond
ON state Signal state of the sensors in normal operation
Abbreviation Safety function
SDI Safe direction
SLI Safely limited increment
SLS Safely limited speed
SOS Safe operating stop
SS1 Safe stop 1
SS2 Safe stop 2
SSM Safe speed monitor
STO Safetorqueoff
Formerly: safe standstill
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Basics
Important notes
1
1.1
1.1.4
1.1-3
EDS94AYAD EN 2.2
1.1.4 Important notes
The following pictographs and signal words are used in this documentation
to indicate dangers and important information:
Structure of safety instructions:
Danger!
(characterises the type and severity of danger)
Note
(describes the danger and gives information about how to
prevent dangerous situations)
Pictograph and signal word Meaning
Danger!
Danger of personal injury through dangerous electrical
voltage.
Reference to an imminent danger that may result in death or
serious personal injury if the corresponding measures are
not taken.
Danger!
Danger of personal injury through a general source of
danger.
Reference to an imminent danger that may result in death or
serious personal injury if the corresponding measures are
not taken.
Stop!
Danger of property damage.
Reference to a possible danger that may result in property
damage if the corresponding measures are not taken.
Pictograph and signal word Meaning
Note! Important note to ensure troublefree operation
Tip! Useful tip for simple handling
Reference to another documentation
Pictograph and signal word Meaning
Warnings!
Safety or application note for the operation of a
UL-approved device in UL-approved systems.
Possibly the drive system is not operated in compliance with
UL if the corresponding measures are not taken.
Warnings!
Safety or application note for the operation of a
UR-approved device in UL-approved systems.
Possibly the drive system is not operated in compliance with
UL if the corresponding measures are not taken.
Safety instructions
Application notes
Special safety instructions
and application notes for UL
and UR
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Basics
Safety instructions
1
1.1
1.1.5

1.1-4 EDS94AYAD EN 2.2
1.1.5 Safety instructions
1.1.6 Application as directed
The safety modules SMx (E94AYAx) may only be used together with Lenze
drive controllers of the L-force | 9400 (E94A...) series.
Any other use shall be deemed inappropriate!
ƒ Only skilled personnel are permitted to install and commission the
safety functions.
ƒ All control components must comply with the demands of the hazard
and risk analysis.
ƒ Install the controllers in control cabinets with IP54 protection.
ƒ Wiring with insulated wire end ferrules or rigid cable is vital.
ƒ For modules without integrated short-circuit monitoring:
– All safety-relevant external cables (e.g. control cables for safety
functions, feedback contacts) outside the control cabinet must be
protected, e.g. by a cable duct.
– In this connection, make sure that short circuits cannot occur!
– For further measures see ISO 13849-2.
ƒ If external forces act on the drive axes, additional brakes are necessary.
The effect of the gravitational force on hanging loads must be
especially observed!
Danger!
If the request for the safety function is cancelled, the drive will
restart automatically.
You must provide external measures which ensure that the drive
only restarts after a confirmation (EN 60204).
Danger!
When the “safe torque off” (STO) function is used, an
”emergency-off” according to EN 60204 is not possible without
additional measures. There is no electrical isolation, no service
switch or repair switch between motor and controller!
“Emergency-off” requires an electrical isolation, e.g. by a central
mains contactor!
After the installation is completed, the operator must check the wiring of the
safety function.
The functional test must be repeated at regular intervals. The time intervals
to be selected depend on the application, the entire system and the
corresponding risk analysis. The inspection interval should not exceed one
year.
Installation/commissioning
During operation
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Basics
Hazard and risk analysis
1
1.1
1.1.7
1.1-5
EDS94AYAD EN 2.2
In case of a short-circuit of two power transistorsa residual movement of the
motorofupto180°/numberofpolepairsmayoccur!(Example:4-pole
motor ⇒residual movement max. 180 °/2 = 90 °)
This residual movement must be considered in the risk analysis, e.g. safe
torque off for main spindle drives.
1.1.7 Hazard and risk analysis
This documentation can only accentuate the need for a hazard analysis. The
user of drive-based safety must concentrate on dealing with the standards
and legal position.
Before putting a machine into circulation, the manufacturer of the machine
must carry out a hazard analysis according to the Machinery Directive
89/392/EEC to find out the hazards related to the application of the
machine. To achieve a level of safety as high as possible the Machinery
Directive contains three principles:
ƒ Removing or minimising the hazards by the construction itself.
ƒ Taking the protective measures required against hazards that cannot
be removed.
ƒ Documentation of the existing residual risks and training of the user
regarding these risks.
The execution of the hazard analysis is specified in EN 1050, guidelines for
risk assessment. The result of the hazard analysis determines the category
of safety-based control modes according to EN 954-1 which the
safety-oriented parts of the machine control must comply with.
1.1.8 Standards
Safety regulations are confirmed by laws and other governmental
guidelines and measures and the prevailing opinion among experts, e.g. by
technical regulations.
The regulations and rules to be applied must be observed in accordance with
the application.
1.1.9 Overview of sensors
Passive sensors are two-channel switching elements with contacts. The
connecting cables and the sensor function must be monitored.
The contacts must switch simultaneously. Nevertheless, safety functions
will be activated as soon as at least one channel is switched.
The switches must be wired according to the closed-circuit principle.
Examples of passive sensors:
ƒ Door contact switch
ƒ Emergency-off control units
Residual hazards
Passive sensors
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Basics
Overview of sensors
1
1.1
1.1.9

1.1-6 EDS94AYAD EN 2.2
Active sensors are units with two-channel semiconductor outputs (OSSD
outputs). Drive-based safety integrated in this device series allows for test
pulses < 1 ms to monitor the outputs and cables.
P/N-switching sensors switch the positive and negative cable or signal and
earth cable of a sensor signal.
Theoutputs mustswitch simultaneously.Nevertheless,safety functionswill
be activated as soon as at least one channel is switched.
Examples of active sensors:
ƒ Lightgrid
ƒ Laser scanner
ƒ Control
For sensor inputs that are not used ”no sensor” must be parameterised. It is
monitored that no sensor signal is applied.
Connected deactivated sensors can create the false impression of safety
technology being provided. For this reason, a deactivation of sensors by
parameter setting only is not permissible and not possible.
Active sensors
Sensor inputs
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Slot
1
1.2
1.2.1
1.2-1
EDS94AYAD EN 2.2
1.2 Device modules
1.2.1 Slot
The slot for the safety modules is marked in the documentation with M4. It
is the lowest slot in the controller (see overview).
1.2.1.1 Mounting
E94AYAX001
1.2.1.2 Dismounting
E94AYCXX001H
1.2.1.3 Module exchange
Every module exchange is detected by the basic device and documented in
a logbook.
When the module is replaced by the same type no restrictions arise.
When the module is replaced by a different type, the drive is inhibited by the
controller. The inhibit can only be deactivated when the parameter setting
of the required safety module complies with the plugged safety module.
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Function mode of the safety modules
1
1.2
1.2.2

1.2-2 EDS94AYAD EN 2.2
1.2.2 Function mode of the safety modules
The code C00214 must comply with the plug-in safety module type so that
thecontrollerisabletooperate.
The transmission of the pulse width modulation is safely (dis-)connected by
thesafety module.Hence thedrivers donot create arotating field.The motor
is safely switched to torqueless operation (STO).
M
SMx
PWM
µC
PC
3x
3x
Xx
SSP94SM320
Fig. 1.2-1 Disconnecting paths of the safety modules
SMx Safety module SM100/SM300
xx Input / output terminal
C Control section
μC Microcontroller
PWM Pulse width modulation
PPowersection
M Motor
When the controller is switched off by a safety module, the ”Safe torque off”
status is set (C00183 = 101).
If internal errors of the safety modules are detected, the motor is safely
switched to torque-free operation (fail-safe status).
C00214
Disconnecting paths
Safety status
Fail-safe status
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Safety module SM300
1
1.2
1.2.3
1.2-3
EDS94AYAD EN 2.2
1.2.3 Safety module SM300
1.2.3.1 Overview
ThetypedesignationofthesafetymoduleisE94AYAD.
Functions
ƒSafetorqueoff(STO)
(previously: safe standstill, protection against unexpected start-up)
ƒ Safe stop 1 (SS1)
ƒ Connection of safety sensors
ƒ PROFIsafe safety bus connection
The SM300 supports the transmission of safe information on the PROFIsafe
protocol according to the specification ”PROFIsafe - Profile for Safety
Technology”, Version 1.30, of the PROFIBUS Nutzerorganisation (PNO). The
basic device transmits the PROFIsafe information to the SM300 for safe
evaluation.
The following applies to the SM300 safety module , version VA 1.xx:
ƒ The basic device must be equipped with a communication module
E94AYCPM (PROFIBUS-DP), SW version 0.9.
ƒ The safe parameter setting is not supported. For this reason, all
parameters are permanently set.
ƒ The stopping time of the SS1 cannot be parameterised. It is
permanently set to ts=30s.
ƒ This module does not support (safe) outputs.
Danger!
If the request for the safety function is cancelled, the drive will
restart automatically.
You must provide external measures which ensure that the drive
only restarts after a confirmation (EN 60204).
1.2.3.2 Safety category
The implemented safety functions meet the requirements of the standards:
ƒ Control category 3 according to EN 954-1
In order to comply with category 3, the external wiring and cable
monitoring must also meet the requirements of category 3.
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Safety module SM300
1
1.2
1.2.3

1.2-4 EDS94AYAD EN 2.2
1.2.3.3 Elements of the module
SSP94SM317
Fig. 1.2-2 Module view
Pos. Description
PROFIsafe target address switch (on the left housing side)
X82.1
Pluggable terminal strips for input and output signals
X82.2
X82.3
X82.4
Pos. Colour State Description
MS Green
On Drive-based safety is initialised faultlessly.
Blinking
Drive-based safety is initialised faultlessly. Internal
communication to the standard device is not
possible.
Off Drive-based safety is not initialised.
Acknowledgement is not possible.
EN Yellow On Controller enabled
Off Non-safe display ”STO”
ME Red
On
System error:
zAfter a serious internal error, STO is activated.
zCan only be reset by switching the 24V supply.
Blinking
Error:
zAfteraninternalerrororanerroratthesafe
inputs, a standstill function is activated.
zThe safety class is quit.
zAcknowledgement is possible.
Flashing
Fault:
zA monitoring function has responded and
activated a standstill function.
zThe safety class is not quit.
zAcknowledgement is possible.
Off Error-free operation
PS Red
On
Error PROFIsafe:
zCommunication is not possible.
zAcknowledgement is possible.
Blinking No valid PROFIsafe configuration
Off PROFIsafe is error-free.
DE Red On
Themoduleisnotacceptedbythestandarddevice
(see notes given in the documentation for the
standard device).
Displays
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Safety module SM300
1
1.2
1.2.3
1.2-5
EDS94AYAD EN 2.2
X82.1 Labelling Description
n. c.
This terminal strip is not assigned.
n. c.
n. c.
n. c.
n. c.
n. c.
n. c.
n. c.
n. c.
X82.2 Labelling Description
-GND external supply
+24 V external supply via a safely separated power supply unit
(SELV/PELV)
n. c.
This part of the terminal strip is not assigned.
n. c.
n. c.
n. c.
AIE Error confirmation input (Acknowledge Input Error)
CLA Clock output for passive sensors, channel A (clock A)
CLB Clock output for passive sensors, channel B (clock B)
X82.3 Labelling Description
GCL GND clock output
GI2 GND IN I2A/I2B
I2B Sensor input 2, channel B (only for passive sensors)
I2A Sensor input 2, channel A (only for passive sensors)
GCL GND clock output
GI1 GND I1A/I1B
I1B Sensor input 1, channel B (only for passive sensors)
I1A Sensor input 1, channel A (only for passive sensors)
n. c. This terminal is not assigned.
X82.4 Labelling Description
GCL GND clock output
GI4 GND I4A/I4B
I4B Sensor input 4, channel B (only for active sensors)
I4A Sensor input 4, channel A (only for active sensors)
n. c.
This part of the terminal strip is not assigned.
Sensor input 3 is not available.
n. c.
n. c.
n. c.
n. c.
Terminal assignment
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Safety module SM300
1
1.2
1.2.3

1.2-6 EDS94AYAD EN 2.2
Cable cross-sections and tightening torques
Type [mm2][Nm] AWG [lb-in]
Wire end ferrule,
insulated 0.25 ... 0.5 Spring terminal 24 ... 20 Spring terminal
Rigid 0.14 ... 1.5 26 ... 16
1.2.3.4 Technical data
The inputs are isolated and designed for a low-voltage supply of 24 V DC.
Detailed features of the inputs and outputs
Signal Specification min. typ. max.
I1A, I1B
I2A, I2B
I4A, I4B
AIE
PLC input, IEC-61131-2, 24 V, type 1
LOW signal [V] -3 0 5
Input current [mA] 15
HIGH signal [V] 15 24 30
Input current [mA] 215
Input capacitance [nF] 3.3
AIE Pulse duration [ms] 300 104
CLA, CLB PLC output, IEC-61131-2, 24 V DC, 50 mA
LOW signal output voltage [V] 00.8
HIGH signal output voltage [V] 17 24 29
Output current [mA] 50
Width of the test pulse [μs] 750
Test pulse rate [s] 1.8
Cable resistance of a passive sensor [kΩ] 2
+, - Supply voltage of the module via a safely
separated power supply unit (SELV/PELV)
[V] 19,2 24 30
Input current [A]
Tab. 1.2-1 Technical data
The chapter ”Response times” must be observed as well (1.3.5.2).
1.2.3.5 Commissioning
ƒ Settings in or at the module:
– PROFIsafe target address switch
ƒ Required settings in the basic device:
– C00214, type of safety module
ƒ Integration of the SM300 into the drive application
ƒ During commissioning and after the replacement of a module it is vital
to check the safety function.
24 V
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Safety module SM300
1
1.2
1.2.3
1.2-7
EDS94AYAD EN 2.2
1.2.3.6 Test certificate
SSP94TUEV3
Fig. 1.2-3 TÜV Certificate
The type test was carried out by ’TÜV Rheinland Group’ and confirmed with
a certificate.
Contents Specifications
Test institute TÜV Industrie Service GmbH, ASI area
Test report 968/EL 302.01/05
Test fundamentals EN 954-1, EN 60204-1, EN 50178, EN 61800-3, IEC 61508 Part 1-7
Object to be examined SM300, type E94AYAD VA1.xx of the 9400 Servo Drives range
Test result The module meets the requirements according to EN 954-1,
category 3.
Special conditions The safety instructions in the corresponding user documentation
must be observed.
Place of issue Cologne
Issue date 30.06.2005
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Connection of safety sensors
1
1.2
1.2.4

1.2-8 EDS94AYAD EN 2.2
1.2.4 Connection of safety sensors
1.2.4.1 General
The following applies to the sensors of the SM300, version VA 1.xx:
ƒ Sensor type and function cannot be parameterised.
ƒ The sensor signals are converted into PROFIsafe bit information and
transmitted to the master control for processing. A local evaluation is
not carried out.
ƒ Unused sensor inputs must not be connected. The PROFIsafe bit of a
non-connected input is in the OFF state.
Note!
Make sure that an internal contact function test is carried out at
thesafeinputs:
Safe input in the ON state
ƒALOWlevelatone channel puts the input in the OFF state.
The discrepancy monitoring starts simultaneously.
ƒA LOW level must be detected at both channels within the
discrepancy time, otherwise a discrepancy error will be
reported.
ƒTo be able to confirm the discrepancy error, a LOW level must
be detected before at both channels.
Safe input in the OFF state
ƒA HIGH level at one channel starts the discrepancy monitoring.
ƒA HIGH level must be detected at both channels within the
discrepancy time, otherwise a discrepancy error will be
reported.
ƒTo be able to confirm the discrepancy error, a HIGH level must
be detected before at both channels.
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Connection of safety sensors
1
1.2
1.2.4
1.2-9
EDS94AYAD EN 2.2
Specification Sensor type
passive active
Discrepancy time 30 s
Input delay 4ms 0ms
Input filter time for test pulses 15 ms
Repetition rate of the test
pulses
is determined by the clock
outputs CLA and CLB >50ms
Error response EC_S1
Confirmation via PROFIsafe or AIE input
Tab. 1.2-2 Specification of sensor connections
Explanations
Discrepancy time
ƒ Maximum time in which both channels of a safe input may have
non-equivalent states without the safety engineering noticing an error.
Input delay
ƒ Time between the recognition of the signal change and the effective
evaluation of an input signal. As a result, multiple and short signal
changes due to contact bounce of the components are not taken into
account.
Input filter time
ƒ Time in which the interference pulses and test pulses are not detected
by e.g. active sensors that are switched on.
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]

Safety engineering
Device modules
Connection of safety sensors
1
1.2
1.2.4

1.2-10 EDS94AYAD EN 2.2
1.2.4.2 Connection of passive sensors
The safe sensor inputs I1A, I1B and I2A, I2B are only suitable for equivalent
switching passive sensors.
To monitor passive sensors according to EN 954-1, cat. 3, the clock outputs
CLA and CLB must be wired. Please observe the following:
ƒ The clock outputs are only suitable for monitoring the passive sensors.
ƒ Always connect ...
– ... CLA with the A channel of the sensor input via the sensor.
– ... CLB with the B channel of the sensor input via the sensor.
–...GCLwithGIxofthesensorinput.
ƒ The sensor inputs are tested cyclically through short LOW operation.
These errors are detected:
ƒ Short circuit to supply voltage.
ƒ Short circuit between the input signals when different clock outputs
are used.
ƒ Non-equivalent input signals after the discrepancy time.
These errors are not detected:
ƒ Short circuit between the input signals when the same clock outputs
are used.
Avoid unrecognisable errors by the installation, e.g. by separated cable
routing.
GCL
GI2
I2B
I2A
GCL
GI1
I1A
I1B
CLB
CLA
S1
S2
V
CC
û
û
SM300
E94AYAD
SSP94SM351
Fig. 1.2-4 Ways to detect errors
8Unrecognisable errors
Phone: [phone] - Fax: [phone] - Web: www.clrwtr.com - Email: [email protected]