Pilz PMCprotego S2-2 User manual

PMCprotego S2-2(-C)
Operating Manual-1002529-EN-04
}PMCprotego - Safe Motion

Preface
This document is a translation of the original document.
All rights to this documentation are reserved by Pilz GmbH & Co. KG. Copies may be made
for internal purposes. Suggestions and comments for improving this documentation will be
gratefully received.
Source code from third-party manufacturers or open source software has been used for
some components. The relevant licence information is available on the Internet on the Pilz
homepage.
Pilz®, PIT®, PMI®, PNOZ®, Primo®, PSEN®, PSS®, PVIS®, SafetyBUS p®,
SafetyEYE®, SafetyNET p®, the spirit of safety® are registered and protected trademarks
of Pilz GmbH & Co. KG in some countries.
SD means Secure Digital

Contents
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 3
Section 1 Introduction 5
1.1 Validity of the documentation 5
1.1.1 Retaining the documentation 5
1.2 Definition of symbols 5
Section 2 Overview 7
2.1 Unit structure 7
2.1.1 Unit features 7
2.2 Front view 8
Section 3 Safety 9
3.1 Intended use 9
3.1.1 Permitted motor types 10
3.1.2 Permitted motor encoder types 10
3.1.3 Use of qualified personnel 11
3.1.4 Warranty and liability 11
3.1.5 Disposal 11
3.2 Standards 12
Section 4 Function description 13
4.1 Overview 13
4.2 Inputs and outputs 14
4.2.1 Inputs 15
4.2.2 Outputs 16
4.2.2.1 Single-pole outputs 16
4.2.2.2 Output test 17
4.3 Safety functions 19
4.3.1 Safe torque off - STO 19
4.3.2 Safe stop 1 - SS1 21
4.3.3 Safe stop 2 - SS2 25
4.3.4 Safe operating stop - SOS 27
4.3.5 Safely limited speed - SLS 30
4.3.6 Safe speed range - SSR 33
4.3.7 Safe direction - SDI 36
4.3.8 Safely Limited Increment - SLI 40
4.4 Operating mode of the servo amplifier 43
4.5 Reaction times 44
4.6 Configuration 46
Section 5 Installation 47
5.1 General requirements 47
5.2 Dimensions 47
5.3 Installing the safety card 48
Section 6 Wiring 49
6.1 General wiring guidelines 49
6.2 Connector pin assignment 50

Contents
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 4
6.3 Shielding 51
6.4 Digital inputs 52
6.5 Digital outputs 52
6.5.1 Supply voltage 52
6.5.2 Single-pole outputs 54
Section 7 Commissioning 55
7.1 Safety guidelines 55
7.2 Initial commissioning 56
7.3 Recommissioning 59
7.3.1 Recommissioning at a restart 59
7.3.2 Recommissioning after error 60
7.3.2.1 Switching the inputs "SS1 Activate" or "Reset" 60
7.3.2.2 Command "CLRFAULT" 61
7.3.3 Swap safety card 62
7.3.3.1 Download configuration from Configurator to safety card 63
7.3.3.2 Download configuration to SD card 64
7.3.3.3 Download configuration from SD card to safety card 64
7.4 Safety checks 66
Section 8 Operation 67
8.1 Operating states 67
8.2 Testing the safe pulse disabler 68
8.3 Display elements 70
8.4 Messages 71
Section 9 Technical details 72
9.1 Safety characteristic data 74
9.1.1 Safe actuator with one encoder 74
9.1.1.1 MTTF >= 10 years 74
Section 10 Order reference 75
Section Glossary 76

Introduction
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 5
1 Introduction
1.1 Validity of the documentation
This documentation is valid for the products PMCprotego S2-2 and PMCprotego S2-2-C. It
is valid until new documentation is published.
This operating manual explains the function and operation, describes the installation and
provides guidelines on how to connect the product PMCprotego S2-2(-C).
Please also refer to the following documents from the motion control range:
}The configuration of the expansion card is described in the online help for the Configur-
ator PASconfig SDrive.
}The servo amplifier PMCprotegoD is described in the "PMCprotegoD operating
manual".
}Details of how to set the parameters for the servo amplifier are described in the help for
the commissioning software PASmotion.
All these manuals can be found on the supplied DVD: "Motion Control"
You will need to be conversant with the information in these documents in order to fully un-
derstand this operating manual.
1.1.1 Retaining the documentation
This documentation is intended for instruction and should be retained for future reference.
1.2 Definition of symbols
Information that is particularly important is identified as follows:
DANGER!
This warning must be heeded! It warns of a hazardous situation that poses
an immediate threat of serious injury and death and indicates preventive
measures that can be taken.
WARNING!
This warning must be heeded! It warns of a hazardous situation that could
lead to serious injury and death and indicates preventive measures that can
be taken.
CAUTION!
This refers to a hazard that can lead to a less serious or minor injury plus
material damage, and also provides information on preventive measures
that can be taken.

Introduction
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 6
NOTICE
This describes a situation in which the product or devices could be dam-
aged and also provides information on preventive measures that can be
taken. It also highlights areas within the text that are of particular import-
ance.
INFORMATION
This gives advice on applications and provides information on special fea-
tures.

Overview
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 7
2 Overview
2.1 Unit structure
The safety card PMCprotego S2-2(-C) is an expansion of the servo amplifier PMCprot-
egoD. It is used for safe motion monitoring, which is achieved in conjunction with the
standard motor encoder and servo amplifier. In the event of an error, the servo amplifier's
power element shuts down the power quickly and safely.
2.1.1 Unit features
The safety card has the following features:
2 single-pole digital inputs to activate the safety function Safe Stop1 (SS1) in accordance
with EN 61800-5-2 (fixed assignment):
}Safety function Safe Stop 1 (SS1)
}Input to reset the safety card after an error
7 single-pole digital inputs, which can be assigned the following safety functions in accord-
ance with EN61800-5-2 in the safety card's Configurator:
}Safe Stop 2 (SS2)
}Safe Operating Stop (SOS)
}Safe Speed Range (SSR)
}Safely Limited Speed (SLS)
}Safe Direction (SDI)
}Safely Limited Increment (SLI)
2 single-pole digital outputs with fixed function:
}Safe Torque Off (STO)
}Safety card ready (Ready)
4 single-pole digital outputs, which can be freely assigned the status of safety functions.
Supply voltage
}24VDC for digital outputs
LEDs for
}Supply voltage (POWER)
}System status (RUN)
}Download of configuration data (CONFIG)
}Fault or drive torque-free (STO)
C type:
}PMCprotego S2-2-C: Coated circuit board

Overview
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 8
2.2 Front view
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
RUN
POWER
STO
CONFIG
X30
8176106 12
100001
1
3
4
5
2
1
3
Key:
}1: Screw for attachment to the servo amplifier
}2: LEDs to display operating states
}3: Inputs/outputs and supply voltage
}4: Labelling strip with:
– Order number
– Serial number
– Number of device version
}5: 2D code

Safety
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 9
3 Safety
3.1 Intended use
The safety card PMCprotego S2-2(-C) is an expansion of the servo amplifier PMCprot-
egoD. It is designed for use in safety-related applications.
It meets the requirements for safety functions in accordance with EN61800-5-2, with re-
gard to safe motion monitoring.
The safety card meets the requirements of ENIEC61508 up to SIL2 and ENISO13849-1
up to PLd.
The function of the safe pulse disabler is tested
}By restarting after safety functions SS1 or STO have been triggered as a condition of
operation
or
}By restarting after safety function SS1 has been triggered by the operator
INFORMATION
To test the safe pulse disabler through deliberate operator action, see the
section entitled "Operation", under "Testing the safe pulse disabler".
The following is deemed improper use
}Any component, technical or electrical modification to the servo amplifier.
}Use of the servo amplifier outside the areas described in this manual.
}Use of the servo amplifier outside the documented technical details (see chapter en-
titled “Technical Details”)
Intended use includes making the installation and wiring EMC-compliant.
Intended use also includes compliance with the
}Operating manual for the PMCprotego D
}Online help for the configuration tool PASconfigSDrive.
INFORMATION
For the use of the safety card in a PMCprotego D, the approvals of the rel-
evant servo amplifier apply (see Technical Details in the operating manual
of the servo amplifiers).
The safety card PMCprotego S2-2(-C) from Version 1.0 may only be used in conjunction
with the following servo amplifiers:
}PMCprotego D.01 from Version1.1
}PMCprotego D.03 from Version1.1
}PMCprotego D.06 from Version1.1
}PMCprotego D.12 from Version1.1
}PMCprotego D.24 from Version1.1

Safety
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 10
}PMCprotego D.48 from Version1.1
}PMCprotego D.72 from Version1.1
3.1.1 Permitted motor types
The following motor types are approved for use with the safety card:
}Rotary synchronous motors
}Linear synchronous motors
Please note: The use of synchronous motors without motor encoder (sensorless operation)
is not permitted.
Work is in progress for use with:
}Asynchronous motors
Please note the following fault detection guidelines:
When the drive is operated with an encoder (standard motor encoder on the servo ampli-
fier), a fault on the encoder system is detected by the safety card as follows:
}Rotary synchronous motors
Detected within one mechanical revolution of the motor.
}Linear synchronous motors
Detected within the distance travelled, in accordance with the following formula:
Distance = (Number of poles /2) · Pole pair pitch
Commands in the servo amplifier:
– Number of poles: MPOLES
– Pole pair pitch: MPITCH
3.1.2 Permitted motor encoder types
The motor encoder is connected to an input on the servo amplifier. The following motor en-
coder types are approved for use with the safety card:
Encoder type
Feedback type (parameter
FBTYPE) in the servo ampli-
fier's commissioning soft-
ware
Connection to the
servo amplifier
Feedback types with one-cable connection (power and feedback in one cable)
Hiperface DSL 35 X1
SFD3 36 X1
Feedback types with two-cable connection (power and feedback in two cables)
Resolver 0 X2
Hiperface (Stegmann) 2 X1
EnDat (Heidenhain) 4 X1
SinCos 5 V with W&S 7 X1
RS422 24V 12 X3
ROD 5 V with Hall 15 X1

Safety
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 11
Encoder type
Feedback type (parameter
FBTYPE) in the servo ampli-
fier's commissioning soft-
ware
Connection to the
servo amplifier
ROD 24V with W&S 16 X3
ROD 5V with W&S 17 X1
BiSS encoder 5 V - digital 20 X1
BiSS encoder 12 V - digital 22 X1
SSI 25 X1
SSI - Linear encoder 26 X1
ROD 5V 27 X1
EnDat 2.2 with 5 V 32 X1
EnDat 2.2 with 12 V 34 X1
3.1.3 Use of qualified personnel
The products may only be assembled, installed, programmed, commissioned, operated,
maintained and decommissioned by competent persons.
A competent person is a qualified and knowledgeable person who, because of their train-
ing, experience and current professional activity, has the specialist knowledge required. To
be able to inspect, assess and operate devices, systems and machines, the person has to
be informed of the state of the art and the applicable national, European and international
laws, directives and standards.
It is the company’s responsibility only to employ personnel who
}Are familiar with the basic regulations concerning health and safety / accident preven-
tion,
}Have read and understood the information provided in this description under "Safety"
}Have a good knowledge of the generic and specialist standards applicable to the spe-
cific application.
3.1.4 Warranty and liability
All claims to warranty and liability will be rendered invalid if
}The product was used contrary to the purpose for which it is intended
}Damage can be attributed to not having followed the guidelines in the manual
}Operating personnel are not suitably qualified
}Any type of modification has been made (e.g. exchanging components on the PCB
boards, soldering work etc.).
3.1.5 Disposal
}In safety-related applications, please comply with the mission time TM in the safety-re-
lated characteristic data.
}When decommissioning, please comply with local regulations regarding the disposal of
electronic devices (e.g. Electrical and Electronic Equipment Act).

Safety
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 12
3.2 Standards
Knowledge of and compliance with the relevant standards and directives are a prerequisite
for using the safety card. The following standards are relevant:
}EN61326-3-1: Electrical equipment for measurement, control and laboratory use -
EMC requirements
}EN61800-3: Adjustable speed electrical drives
}EN61800-5-2: Adjustable speed electrical power drive systems – Part 5-2: Safety re-
quirements. Functional
}ENISO13849-1: Safety of machinery – Safety-related parts of control systems –
Part1: General principles for design, Part2: Safety validation
}EN61508: Functional safety of safety-related electrical/electronic/programmable elec-
tronic control systems, Parts 1, 3, 4
}EN61508-2: Requirements for safety-related electrical/electronic/programmable elec-
tronic systems
}EN60204-1: Safety of machinery – Electrical equipment of machines – Part 1: General
requirements
}EN62061: Safety of machinery – Functional safety of safety-related electrical, elec-
tronic and programmable electronic control systems
Please note this is not an exhaustive list of safety standards and directives.
Where standards are undated, the 2009-03 latest editions shall apply.

Function description
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 13
4 Function description
4.1 Overview
The safety card monitors safety functions in accordance with EN61800-5-2. It monitors
safe motion sequences on drives, which are safely brought to a stop and shut down in the
event of an error.
The safety card is built into a servo amplifier PMCprotegoD. This converts the servo ampli-
fier into a safe servo amplifier.
A safe drive system from Pilz consists of the following:
}Servo amplifier (PMCprotego D)
}Safety card PMCprotegoS built into the servo amplifier
}Servo motor (synchronous motor) with
– Standard encoder system (feedback)
– Brake (optional, not safety-related)
}Safety control system
Safety card
PMCprotego S
Servo amplifier
PMCprotego D
Digital outputs:
Status of safety functions
Operational readiness
Safe servo amplifier PMCprotego DS
Safety control system
PSS
PNOZmulti
...
Digital inputs:
Safety functions
Safe pulse
disabler
M3
Internal
supply voltage
Motor brake
Start-up
disabler
Motor
encoder
24 VDC
Safety devices
e.g.
E-STOP
Operating mode
Light grid
Configurator
PASconfig SDrive
Fig.: Safe drive system

Function description
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 14
The safety card
}Activates safety functions
}Monitors safe motion sequences.
}Signals the status of safety functions to the safety control system
}In the event of an error, activates the safe pulse disabler which is integrated within the
servo amplifier and shuts down the power to the motor
}Passes the brake command to the servo amplifier that is executing the travel command
The servo amplifier
}Removes the power to the motor, if the safe pulse disabler is activated, switches the
motor to torque-free and can also control an internal motor brake.
The safety control system
}Activates the safety functions via inputs on the safety card
}Evaluates signals from safety devices, such as:
– E-STOP pushbuttons
– Safety gates
– Light beam devices
– Two-hand buttons
}Processes the safety card's status outputs
}Safe interconnection between safety card and safety control system
}Fault detection (short across contacts, short circuit) on signals between the safety con-
trol system and safety card, and initiation of measures
Configurator PASconfig SDrive
}Configuration and parameterisation of the safety card
}Safe upload and download of the configuration file
}Online display of the status of the safety functions
}Display of error stack
}Ability to save the configuration to SD card
4.2 Inputs and outputs
The safety card has safe inputs and outputs which
}can be freely assigned
}can be assigned fixed functions.
Inputs I0 to I6 can be used to activate the safety functions.
Outputs O0 to O3 can be used to acknowledge the status of the safety functions.
Inputs and outputs are assigned to the safety functions in the safety card's Configurator.

Function description
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 15
SOS
SSA Safe Standstill Acknowledge
SS1
SS2
SLS
SSR
SDI
SLI
SSA Safe Standstill Acknowledge
SRA Safe Range Acknowledge
SRA Safe Range Acknowledge
SDA Safe Direction Acknowledge
SRA Safe Range Acknowledge
SSA Safe Standstill Acknowledge
Safety Functions
SS2 Activate
SOS Activate
SLS Activate
SSR Activate
SDI Pos Activate
SDI Neg Activate
SLI Activate
O3
O2
O1
O0
STO Acknowledge
Ready
SS1 Activate
Reset
I0
I4
I5
I3
I2
I1
I6
Inputs Outputs
Fig.: Inputs and outputs
4.2.1 Inputs
The safety card has safe single-pole inputs.
Inputs with fixed assignment:
}SS1 Activate: Safe Stop 1
}Reset: Additional safe input to reset the safety card after an error
The single-pole digital inputs I0 … I6 are used to activate the safety functions. Inputs are
assigned to the safety functions in the safety card's Configurator. The following signals are
available to activate the safety functions:
}SS2 Activate: Safe Stop 2
}SOS Activate: Safe Operating Stop
}SSR Activate: Safe Speed Range
}SLS Activate: Safely Limited Speed
}SDI Neg Activate: Safe Direction, negative
}SDI Pos Activate: Safe Direction, positive
}SLI Activate: Safely Limited Increment
Signals at the input
}1/0 pulse edge at the input: Safety function is triggered
}"0"-signal (0V) at the input:
– Safety function is activated
}"1"-signal (+24V) at the input:
– Safety function is not activated
NOTICE
Inputs "SS1 Activate" and "Reset" must always be connected.
In the case of all inputs, only tested outputs from a safety control system
may be connected.

Function description
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 16
4.2.2 Outputs
4.2.2.1 Single-pole outputs
Safe, single-pole outputs signal the status of the activated safety functions and the safety
card's state of readiness.
Outputs with fixed assignment:
}STO Acknowledge
– 1: Power element switched off
– Internal error on servo amplifier or safety card
– Limit values exceeded
– Activated via SS1
– 0: Drive in closed loop operation
}Ready
– 1: Safety card is ready for operation
– 0: Safety card is not ready for operation. Possible causes:
– Safety card is starting up
– No supply voltage
– Major internal error
– Error on the feedback output "STO Acknowledge"
INFORMATION
"Ready" is a second feedback channel for the safety function STO. The
"Ready" output switches off if a problem occurs at the feedback signal "STO
Acknowledge".
The single-pole digital outputs O0 … O3 signal the status of the safety functions. Outputs
are assigned to the signals in the safety card's Configurator. The following signals are avail-
able:
}SSA Safe Standstill Acknowledge
– 1: Motor is within the permitted limit values for standstill.
– 0: Standstill monitoring is inactive or motor is outside the standstill range
}SDA Safe Direction Acknowledge
– 1: Drive is moving in the permitted direction.
– 0: Drive is not moving in the permitted direction or monitoring is not activated.
}SRA Safe Range Acknowledge
– 1: Drive is moving within the permitted limit values for speed or position.
– 0: Drive is moving outside the permitted limit values for speed or position, or monit-
oring is not activated.

Function description
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 17
The table below shows which outputs signal the status of which safety function.
Output
In-
ternal
error
No safety
function
activated SS1 SS2 SOS SLS SSR SDI SLI
STO Acknow-
ledge
x x xxxxxxx
SSA Safe Stand-
still Acknowledge
- - - x x - - - x
SDA Safe Direc-
tion Acknowledge
- - - - - - - x -
SRA Safe Range
Acknowledge
- - - - - x x - x
Ready - x x x x x x x x
Signals at the output
}"0"-signal (0V) at the output:
– Output is high impedance
– No current to the load
– Safety function not activated
}"1"-signal (+24V) at the output:
– Output is low impedance
– Current is supplied to the load
– Safety function activated
Supply voltage
}24VDC connection to supply the safety card's digital outputs
4.2.2.2 Output test
The outputs are tested regularly:
}Outputs that are switched on are checked via regular off tests.
– Test pulses for outputs that are switched on: see technical details
– Outputs that are switched on are switched off for the duration of the test pulse.
– The load must not switch off because of the test.
}Outputs that are switched off are checked via regular on tests.
– Test pulses for outputs that are switched off: see technical details
– Outputs that are switched off are switched on for the duration of the test pulse.
– The load must not switch on because of the test.
Testing for shorts
}A test is regularly carried out to check for shorts between the outputs.

Function description
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 18
WARNING!
When wiring an output with capacitance it is essential to note the pulse dur-
ation, repetition period and scan time of the power-up test, otherwise the
load may switch on unintentionally.
Timing diagram
1
t1t2t1
t
t2t1
U
0
}1: "1" signal
}0: "0" signal
}t1 Pulse duration on on test (see Technical details)
}t2 Scan time of power-up test under normal circumstances (ca. 200 ms)
Characteristic: Output capacitance C dependent on load current I
1
2
3
4
5
0
0,2 0,4 0,6 0,8 1 1,2 1,4 1,6 1,8 2
C [µF]
I [A]

Function description
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 19
4.3 Safety functions
Safety functions maintain a safe condition on a plant or prevent hazardous conditions
arising on a plant.
The safety functions for electrical drives are defined in EN61800-5-2.
The safety card implements the following safety functions:
}Safe stop 1 (SS1)
}Safe stop 2 (SS2)
}Safe operating stop (SOS)
}Safe speed range (SSR)
}Safely limited speed (SLS)
}Safe direction (SDI)
}Safely Limited Increment (SLI)
Activation of safety functions
}The safety functions are activated using the single-pole safe inputs on the safety card.
}These inputs operate in accordance with the failsafe principle (on switching off). The
safety control system activates the safety functions via a 1/0 pulse edge.
Feedback from the safety functions
}Message via single-pole semiconductor outputs
– "1" signal: Inside the set limit values
– "0" signal: Outside the set limit values
Simultaneous activation of safety functions
}All safety functions can be active at the same time. However, safety function SS1 has
priority over all other safety functions.
}If SS1 is activated, the drive is stopped in accordance with its configuration.
}No other safety functions are processed or called up during this time.
Reaction to limit value violations and errors
}When set limit values are exceeded, the E-STOP braking ramp is activated.
}The safety function STO is activated if there are any internal errors on the safety card
or servo amplifier. The power element is switched off.
4.3.1 Safe torque off - STO
The safety function "Safe Torque Off" (STO) removes the power to the motor. It is imple-
mented via the servo amplifier's shutdown path and the safety card's safe outputs.
Features of the safety function:
}The motor becomes torque-free and no longer generates any hazardous movements.
}To prevent the drive running down in an uncontrolled manner, in normal operation the
safety function STO is activated via the safety function SS1.
}STO is only activated directly when
– there is an internal error on the servo amplifier or safety card

Function description
Operating Manual PMCprotego S2-2(-C)
1002529-EN-04 20
– the STO delay time is set to 0
– the inputs "SS1 Activate" and "Reset" simultaneously switch to a "0" signal
}The STO-ENABLE reset lock on the servo amplifier has no function if the servo ampli-
fier contains a safety card. The output contact is linked internally. In this case, the
safety card activates the safe pulse disabler on the servo amplifier in order to shut
down the power element.
}The safety function "Safe Torque Off" corresponds to a category0 stop (uncontrolled
stop) in accordance with EN60204-1.
Prerequisites for normal operation:
}Input "SS1 Activate" and "Reset": "1" Signal (+24 VDC)
}"Ready" output: "1" Signal (+24 VDC). The safety card is ready for operation.
}"STO Acknowledge" output: “0” Signal
Safety function is activated
}By an error after limit values have been exceeded or
}By an internal error on the safety card or servo amplifier, if the drive can no longer be
braked safely
}By executing the safety function SS1 (1/0 pulse edge). In this case the drive is braked
safely before it is switched to torque-free (see section: "Safe stop – SS1").
}The inputs "SS1 Activate" and "Reset" simultaneously switch to a "0" signal
}A second error occurs while SS1 (drive shutdown) is activated.
Reaction:
}The drive is switched to torque-free
}"STO Acknowledge" output: “1” Signal
If any external forces influence the motor axis (e.g. suspended loads), additional measures
(e.g. a safety holding brake) are required in order to eliminate hazards.