Lenze SM100 E94AYAB User manual

EDS94AYAB
.;2G
Ä.;2Gä
Manual
9400

E94AYAB − SM100
Safety module
L−force Drives
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Please read these instructions and the documentation of the standard device before you
start working!
Observe the safety instructions given therein!
0Fig. 0Tab. 0
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Contents i
3
EDS94AYAB EN 2.1
1 Safety engineering 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1 Basics 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.1 Introduction 4. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.2 Drive−based safety with L−force | 9400 4. . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.3 Terms and abbreviations of the safety engineering 5. . . . . . . . . . . . . . . . .
1.1.4 Important notes 6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.5 Safety instructions 7. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.6 Hazard and risk analysis 9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.7 Standards 9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.1.8 Safety notes for the installation according to UL or UR 9. . . . . . . . . . . . .
1.1.9 Overview of sensors 9. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3 Device modules 11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3.1 Slot 11. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3.2 Function mode of the safety modules 12. . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3.3 Safety module SM0 13. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3.4 Safety module SM100 14. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.4 Acceptance 19. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.4.1 Description 19. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.4.2 Periodic inspections 19. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Basics
Introduction
1

4 EDS94AYAB EN 2.1
1 Safety engineering
1.1 Basics
1.1.1 Introduction
With increasing automation, protection of persons against hazardous movements is
becoming more important. Functional safety describes the measures needed by means of
electrical or electronic equipment to reduce or remove danger caused by failures.
During normal operation, safety equipment prevents people accessing hazardous areas. In
certain operating modes, e.g. set−up mode, work needs to be carried out in hazardous
areas. In these situations the machine operator must be protected by integrated drive and
control measures.
Drive−based safety provides the conditions in the controls and drives to optimise the safety
functions. Planning and installation expenditure is reduced. In comparison to the use of
standard safety engineering, drive−based safety increases machine functionality and
availability.
1.1.2 Drive−based safety with L−force | 9400
The controllers of the L−force|9400 range can be equipped with a safety module. The
functional range of the safety module types varies in order to optimally implement
different applications.
"Drive−based safety" stands for applied safety functions, which can be used for the
protection of persons working on machines.
The motion functions are continued to be executed by the controller. The safety modules
monitor the safe compliance with the limit values and provide the safe inputs and outputs.
When the limit values are exceeded the safety modules start the control functions
according to EN 60204−1 directly in the controller.
The safety functions are suitable for applications according to IEC 61508 to SIL 3 and meet,
depending on the module, the requirements of Performance Level e (PL e) and control
category 4 according to EN ISO 13849−1.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Basics
Terms and abbreviations of the safety engineering
1
5
EDS94AYAB EN 2.1
1.1.3 Terms and abbreviations of the safety engineering
Abbreviation Meaning
9400 Lenze servo controller
Cat. Category according to ISO 13849−1 (formerly EN 954−1)
OSSD Output Signal Switching Device, tested signal output
PS PROFIsafe
PWM Pulse width modulation
SD−In Safe input (Safe Digital Input)
SD−Out Safe output (Safe Digital Output)
SIL Safety Integrity Level according to IEC 61508
SM Safety Module
Opto supply Optocoupler supply for the driver control
PELV Protective extra low voltage
SELV Safety extra low voltage
OFF state Signal state of the safety sensor technology when it is released or responding
ON state Signal state of the safety sensor technology in normal operation
PM P/N switching signal paths
PP P/P switching signal paths
GSE File containing device−specific data to establish PROFIBUS communication
GSDML File containing device−specific data to establish PROFINET communication
S−Bus Safety bus
Abbreviation Safety function
SLS Safely limited speed
SOS Safe operating stop
SS1 Safe stop 1
SS2 Safe stop 2
SSM Safe speed monitor
STO Safe torque off
Formerly: safe standstill
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Basics
Important notes
1

6 EDS94AYAB EN 2.1
1.1.4 Important notes
The following pictographs and signal words are used in this documentation to indicate
dangers and important information:
Safety instructions
Structure of safety instructions:
Danger!
(characterises the type and severity of danger)
Note
(describes the danger and gives information about how to prevent dangerous
situations)
Pictograph and signal word Meaning
Danger!
Danger of personal injury through dangerous electrical voltage.
Reference to an imminent danger that may result in death or
serious personal injury if the corresponding measures are not
taken.
Danger!
Danger of personal injury through a general source of danger.
Reference to an imminent danger that may result in death or
serious personal injury if the corresponding measures are not
taken.
Stop!
Danger of property damage.
Reference to a possible danger that may result in property
damage if the corresponding measures are not taken.
Application notes
Pictograph and signal word Meaning
Note! Important note to ensure troublefree operation
Tip! Useful tip for simple handling
Reference to another documentation
Special safety instructions and application notes for UL and UR
Pictograph and signal word Meaning
Warnings!
Safety or application note for the operation of a UL−approved
device in UL−approved systems.
Possibly the drive system is not operated in compliance with UL
if the corresponding measures are not taken.
Warnings!
Safety or application note for the operation of a UR−approved
device in UL−approved systems.
Possibly the drive system is not operated in compliance with UL
if the corresponding measures are not taken.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Basics
Safety instructions
1
7
EDS94AYAB EN 2.1
1.1.5 Safety instructions
Application as directed
The safety modules SMx (E94AYAx) may only be used together with Lenze drive controllers
of the L−force | 9400 (E94A...) series.
Any other use shall be deemed inappropriate!
Installation/commissioning
Danger!
Danger to life through improper installation
Improper installation of the safety engineering systems can cause an
uncontrolled starting action of the drives.
Possible consequences:
ƒDeath or severe injuries
Protective measures:
ƒSafety engineering systems may only be installed and commissioned by
qualified and skilled personnel.
ƒAll control components (switches, relays, PLC, ...) and the control cabinet
must comply with the requirements of ISO 13849−1 and ISO 138492. This
includes i.a.:
– Switches, relays in IP54 enclosure.
– Control cabinet in IP54 enclosure.
– Please refer to ISO 13849−1 and ISO 138492 for all further requirements.
ƒIt is essential to use insulated wire end ferrules for wiring.
ƒAll safety relevant cables outside the control cabinet must be protected, e.g.
by means of a cable duct:
– Ensure that there are no short circuits.
– For further measures see ISO 138492.
ƒIf an external force acts upon the drive axes, additional brakes are required.
Please observe that hanging loads are subject to the force of gravity!
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Basics
Safety instructions
1

8 EDS94AYAB EN 2.1
Danger!
If the request for the safety function is cancelled, the drive will restart
automatically.
You must provide external measures which ensure that the drive only restarts
after a confirmation (EN 60204).
Danger!
When the "safe torque off" (STO) function is used, an "emergency
switching−off" according to EN 60204 is not possible without additional
measures. There is no electrical isolation, no service switch or repair switch
between motor and controller!
Emergency switching−off" requires an electrical isolation, e.g. by a central
mains contactor!
During operation
After the installation is completed, the operator must check the wiring of the safety
function.
The functional test must be repeated at regular intervals. The time intervals to be selected
depend on the application, the entire system and the corresponding risk analysis. The
inspection interval should not exceed one year.
Residual hazards
In case of a short−circuit of two power transistors a residual movement of the motor of up
to 180 °/number of pole pairs may occur! (Example: 4−pole motor Þresidual movement
max. 180 °/2 = 90 °)
This residual movement must be considered in the risk analysis, e.g. safe torque off for
main spindle drives.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Basics
Hazard and risk analysis
1
9
EDS94AYAB EN 2.1
1.1.6 Hazard and risk analysis
This documentation can only accentuate the need for a hazard analysis. The user of
drive−based safety must concentrate on dealing with the standards and legal position:
Before putting a machine into circulation, the manufacturer of the machinemust carry out
a hazard analysis according to the Machinery Directive2006/42/EC (until 28 December
2009: 98/37/EC) to find out the hazards related to the application of the machine. To
achieve a level of safety as high as possible the Machinery Directive contains three
principles:
ƒRemoving or minimising the hazards by the construction itself.
ƒTaking the protective measures required against hazards that cannot be removed.
ƒDocumentation of the existing residual risks and training of the user regarding
these risks.
The execution of the hazard analysis is specified in EN 1050, guidelines for risk assessment.
The result of the hazard analysis determines the categoryof safety−based control modes
according to EN ISO 13849−1 which thesafety−oriented parts of the machine control must
comply with.
1.1.7 Standards
Safety regulations are confirmed by laws and other governmental guidelines and
measures and the prevailing opinion among experts, e.g. by technical regulations.
The regulations and rules to be applied must be observed in accordance with the
application.
1.1.8 Safety notes for the installation according to ULor UR
Warnings!
ƒMaximum surrounding air temperature: 55 °C.
ƒExternal fuse for 24 Vdc supply voltage. Rated 4 A DC fuse UL248−14.
1.1.9 Overview of sensors
Passive sensors
Passive sensors are two−channel switching elements with contacts. The connecting cables
and the sensor function must be monitored.
The contacts must switch simultaneously (equivalently). Nevertheless, safety functions
will be activated as soon as at least one channel is switched.
The switches must be wired according to the closed−circuit principle.
Examples of passive sensors:
ƒDoor contact switch
ƒEmergency−off control units
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Basics
Overview of sensors
1

10 EDS94AYAB EN 2.1
Active sensors
Active sensors are units with two−channel semiconductor outputs (OSSD outputs).
Drive−based safety integrated in this device series allows for test pulses < 1 ms to monitor
the outputs and cables.
P/N−switching sensors switch the positive and negative cable or signal and earth cable of
a sensor signal.
The outputs must switch simultaneously. Nevertheless, safety functions will be activated
as soon as at least one channel is switched.
Examples of active sensors:
ƒLightgrid
ƒLaser scanner
ƒControl
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Device modules
Slot
1
11
EDS94AYAB EN 2.1
1.2 Device modules
1.2.1 Slot
The slot for the safety modules is marked in the documentation with M4. It is the lowest
slot in the controller (see overview in the documentation of the controller).
1.2.1.1 Mounting
E94AYAX001
1.2.1.2 Dismounting
E94AYCXX001H
1.2.1.3 Module exchange
Every module exchange is detected by the standard device and documented in a logbook.
When a module is replaced by the same type, no restrictions arise. Depending on the
module type it may be necessary to take further measures (e.g. address setting, safe
parameter setting, ...).
When the module is replaced by a different type, the drive is inhibited by the controller. The
inhibit can only be deactivated when the parameter setting of the required safety module
complies with the plugged safety module.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Device modules
Function mode of the safety modules
1

12 EDS94AYAB EN 2.1
1.2.2 Function mode of the safety modules
C00214
The code C00214 must comply with the plug−in safety module type so that the controller
is able to operate.
Disconnecting paths
The transmission of the pulse width modulation is safely (dis−)connected by the safety
module. Hence the drivers do not create a rotating field. The motor is safely switched to
torqueless operation (STO).
M
SMx
PWM
µC
PC
3x
3x
Xx
SSP94SM320
Fig. 1−1 Disconnecting paths of the safety modules
SMx Safety module
xx Input / output terminal
C Control section
mC Microcontroller
PWM Pulse width modulation
P Power section
M Motor
Safety status
When the controller is switched off by the safety module, the controller switches to the
"Safe torque off"device state.
ƒ"Controller in STO state" is entered into the logbook (0x00750003).
ƒ"Safe torque off active" is displayed in C00183.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Device modules
Safety module SM0
1
13
EDS94AYAB EN 2.1
1.2.3 Safety module SM0
1.2.3.1 Overview
The type designation of the module is E94AYAA.
Function
ƒThere are no safety functions available.
ƒThis module is required to operate the controller without safetyfunctions.
Note!
If safety functions are required, replace the SM0 module by a module with
safety functions (e.g. SM100, SM301).
Note!
After the module has been exchanged, the controller does not work if the
module type plugged−in does not comply with the stored type (C00214).
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Device modules
Safety module SM100
1

14 EDS94AYAB EN 2.1
1.2.4 Safety module SM100
1.2.4.1 Overview
The type designation of the safety module is E94AYAB.
Function
ƒSafe torque off
(up to now: Safe standstill, protection against unexpected start−up)
Danger!
If the request for the safety function is cancelled, the drive will restart
automatically.
You must provide external measures which ensure that the drive only restarts
after a confirmation (EN 60204).
SM 100
SIA
SIB
GI
24O
DO1
GO
PWM
µC
-~
--
SSP94S1010
Fig. 1−2 Function overview SM100
SM100 Safety module
SIA, SIB, GI Two−channel sensor signal connections, supply through safely separated power
supply unit (SELV/PELV)
(old labelling up to HW version VB: SI1, SI2, GI)
24O, DO1, GO Non−safe feedback connections, supply through safely separated power supply
unit (SELV/PELV)
mC Microcontroller
PWM Pulse width modulation
1.2.4.2 Safety category
The functions of the SM100 safety module for the Servo Drives 9400 controllers meet the
requirements of the following standards:
ƒCategory 4 and Performance Level e (PL e) according to ISO 13849−1 (formerly
EN 954−1)
– In order to comply with category 4/PL e, the external wiring and cable monitoring
must also meet the requirements of category 4/PL e.
– Ensure that short circuits cannot occur in the external wiring.
ƒSIL 3 according to IEC 61508
– The SM100 safety module does not contribute to the probability of failure on
demand (PFD) and probability of failure per hour (PFH) of IEC 61508.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Device modules
Safety module SM100
1
15
EDS94AYAB EN 2.1
1.2.4.3 Elements of the module
SSP94SM112
Fig. 1−3 Module view
Displays
Pos. Colour Condition Description
EN Yellow On Controller enabled
Off Non−safe display "Safe pulse inhibit"
DE Red On The module is not accepted by the standard device (see notes
given in the documentation for the standard device).
Tab. 1−1 LED display SM 100
1.2.4.4 Technical data
24 V
The inputs and outputs are isolated and designed for a low−voltage supply through a safely
separated power supply unit (SELV/PELV) of 24 V DC. P/N switching input signals and test
pulses £1 ms are permissible.
Output signals of active sensors are directly wired to the X80 terminal.
Passive Sensors are wired to the X80 terminal via a switching device. The switching device
must comply with the required control category of the application.
There is no monitoring for short circuits.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Device modules
Safety module SM100
1

16 EDS94AYAB EN 2.1
Signals
X80 Marking Description Electrical data
SIA Input first shutdown path SIA: Ityp = 160 mA
GI GND potential for SIA/SIB LOW: −3 ... 5 V,
HIGH: 15 ... 30 V,
SIB Input second shutdown path SIB: Ityp = 28 mA
Supply through safely
separated power supply unit
(SELV/PELV)
GO GND potential feedback 24 V, max. 0.7 A,
short−circuit−proof,
LOW−active,
Supply through safely
separated power supply unit
(SELV/PELV)
24O 24 V supply feedback
SSP9400X80
DO1 Non−safe signalling output: "Safe pulse
inhibit"
Terminal data
Conductor cross−section Tightening torque
[mm2] [AWG] [Nm] [lb−in]
Rigid 0.2 ... 2.5 24 ... 12
Spring terminal
Wire end ferrule,
insulated 0.2 ... 1.5 24 ... 16
Twin wire end
ferrule 0.5 ... 1.0 20 ... 18
Stripping length / contact length: 10 mm
Information for the exchange of modules of different hardware versions
up to HW: VB from HW: VC Comment
SI1 SIA
The exchange of the spring terminal
is required!
GI GI
SI2 SIB
GO GO
24O 24O
DO1 DO1
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Device modules
Safety module SM100
1
17
EDS94AYAB EN 2.1
Detail features of the inputs and outputs of the SM100
Terminal Specification [Unit] min. typ. max.
SIA, SIB Low signal V −3 0 5
High signal V 15 24 30
Input capacitance at switch−off nF 4
Input delay (tolerated test pulse) ms 1
Switch−off time (depending on the standard device) ms 2.5 4
Running time ms 3
SIA Input current mA 160 170
Input capacitance at switch−on, reduced mF 20
SIB Input current mA 28 35
Input capacitance at switch−on, reduced mF 5
GI Ground for SIA/SIB
24O, GO Supply voltage through safely separated power supply
unit (SELV/PELV) V 18 24 30
DO Low signal V 0 0.8
High signal V 17 24 29
24O, GO, DO Output current A 0.7
Truth table
Inputs Outputs Description Enable
SIA SIB DO1 through SM100
001"Safe torque off" is activated 0
0 1 0 0
1 0 0 0
110Drive is active 1
Tab. 1−2 Truth table SM100
1.2.4.5 Commissioning
ƒSettings in or at the module are not required.
ƒRequired settings in the basic device:
– C00214, type of safety module
ƒDuring commissioning and after the replacement of a module it is vital to check the
safety function.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Device modules
Safety module SM100
1

18 EDS94AYAB EN 2.1
1.2.4.6 Test certificate
Zertifikat_el325
Fig. 1−4 TÜV Certificate
The type test was carried out by ’TÜV Rheinland Group’ and confirmed with a certificate.
Contents Specifications
Test institute TÜV Rheinland Industrie Service GmbH, ASI business area
Test report 968/EL 325.02/07
Test fundamentals EN ISO 13849−1, EN 60204−1, EN 50178, EN 61800−3, IEC 61508 Part 1−7,
EN 62061, IEC 61800−5−2
Object to be examined SM100, type E94AYAB of the Servo Drives 9400 series
Test result The module meets the requirements according to ISO 13849−1, category 4/PL
e and of SIL 3 according to IEC 61508.
Special conditions The safety instructions in the corresponding user documentation must be
observed.
Place of issue Cologne
Issue date 01.10.2007
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]

Safety engineering
Acceptance
Description
1
19
EDS94AYAB EN 2.1
1.3 Acceptance
1.3.1 Description
The machine manufacturer must check and prove the operability of the safety functions
used.
Inspector
The machine manufacturer must authorise a person with expertise and knowledge of the
safety functions to carry out the test.
Protocol
The test result of every safety function must be documented and signed.
Note!
If parameters of the safety function are changed, the test must be repeated
and recorded in the test report.
Scope
A complete test comprises the following:
ƒDocumentation of the plant including the safety functions.
– Plant description and overview map
– Description of the safety devices
– Safety functions used
ƒFunctional test of the safety functions used
ƒPreparing the test report
– Documenting the functional test
– Controlling the parameters
– Signing
ƒPreparing the appendix with test records
– Protocols from the plant
– External recording
1.3.2 Periodic inspections
The correct sequence of the safety−oriented functions must be checked in periodic
inspections. The risk analysis or applicable regulations determine the time distances
between the tests. The inspection interval should not exceed one year.
Buy: www.ValinOnline.com | Phone [phone] | Email: [email protected]