SEW-Eurodrive DRC User manual

Drive Technology \ Drive Automation \ System Integration \ Services
Manual
Electronic Motor
DRC
Functional Safety
Edition 10/2013 20186541 / EN

SEW-EURODRIVE—Driving the world

Manual – Functional Safety – DRC Electronic Motor 3
Contents
Contents
1 General information ............................................................................................ 4
1.1 How to use this documentation................................................................... 4
1.2 Underlying standards .................................................................................. 4
1.3 Structure of the safety notes ....................................................................... 4
1.4 Rights to claim under warranty ................................................................... 5
1.5 Exclusion of liability..................................................................................... 5
1.6 Content of the documentation..................................................................... 5
1.7 Other applicable documentation ................................................................. 5
1.8 Copyright..................................................................................................... 5
1.9 Product names and trademarks.................................................................. 5
2 Integrated safety technology ............................................................................. 6
2.1 Safe condition ............................................................................................. 6
2.2 Safety concept ............................................................................................ 6
2.3 Safety functions .......................................................................................... 8
2.4 Restrictions ............................................................................................... 10
3 Safety conditions .............................................................................................. 11
3.1 Approved units .......................................................................................... 11
3.2 Installation requirements........................................................................... 12
3.3 External safety controller requirements .................................................... 14
3.4 Startup requirements ................................................................................ 16
3.5 Operational requirements ......................................................................... 16
4 Technical data ................................................................................................... 17
5 Appendix............................................................................................................ 18
5.1 Unit variants with optional standard brake ................................................ 18
5.2 Connection variants .................................................................................. 20
5.3 Connection of an external safety relay for STO ........................................ 25
5.4 Connection of an external safety controller for STO ................................. 29
Index................................................................................................................... 33

4Manual – Functional Safety – DRC Electronic Motor
1How to use this documentation
General information
1 General information
1.1 How to use this documentation
The documentation is an integral part of the product and contains important information
on operation and service. The documentation is written for all employees who assemble,
install, start up, and service this product.
The documentation must be accessible and legible. Make sure that persons responsible
for the system and its operation, as well as persons who work independently on the unit,
have read through the documentation carefully and understood it. If you are unclear
about any of the information in this documentation, or if you require further information,
contact SEW-EURODRIVE.
1.2 Underlying standards
The safety assessment of the unit is based on the following standards and safety
classes:
1.3 Structure of the safety notes
1.3.1 Meaning of signal words
The following table shows the graduation and meaning of the signal words for safety
notes, warnings regarding potential risks of damage to property, and other notes.
1.3.2 Design of the section-related safety notes
Section-related safety notes do not apply to a specific action, but to several actions per-
taining to one subject. The symbols used either indicate a general hazard or a specific
hazard.
This is the formal structure of a safety note for a specific section:
Underlying standards
Safety class / underlying standard
• Performance level (PL) according to EN ISO 13849-
1:2008
• Safety Integrity Level (SIL) according to EN 61800-5-
2:2007
Signal word Meaning Consequences if disregarded
DANGER! Imminent hazard Severe or fatal injuries
WARNING! Possible dangerous situation Severe or fatal injuries
CAUTION! Possible dangerous situation Minor injuries
NOTICE Possible damage to property Damage to the drive system or its envi-
ronment
INFORMATION Useful information or tip: Simpli-
fies handling of the drive sys-
tem.
SIGNAL WORD!
Type and source of danger.
Possible consequence(s) if disregarded.
• Measure(s) to prevent the danger.

Manual – Functional Safety – DRC Electronic Motor 5
1
Rights to claim under warranty
General information
1.3.3 Design of the embedded safety notes
Embedded safety notes are directly integrated into the instructions just before the de-
scription of the dangerous action.
This is the formal structure of an embedded safety note:
•SIGNAL WORD! Type and source of hazard.
Possible consequence(s) if disregarded.
– Measure(s) to prevent the hazard.
1.4 Rights to claim under warranty
A requirement of fault-free operation and fulfillment of any rights to claim under limited
warranty is that you adhere to the information in the documentation. Therefore read the
documentation before you start working with the unit.
1.5 Exclusion of liability
You must comply with the information contained in this documentation to ensure safe
operation and to achieve the specified product characteristics and performance fea-
tures. SEW-EURODRIVE assumes no liability for injury to persons or damage to equip-
ment or property resulting from non-observance of these operating instructions. In such
cases, any liability for defects is excluded.
1.6 Content of the documentation
This document contains additional safety-related information and conditions for opera-
tion in safety-related applications.
1.7 Other applicable documentation
This document supplements the operating instructions and limits the application notes
according to the following information. Use this document only together with the operat-
ing instructions.
1.8 Copyright
© 2013 SEW-EURODRIVE. All rights reserved.
Unauthorized duplication, modification, distribution or any other use of the whole or any
part of this documentation is strictly prohibited.
1.9 Product names and trademarks
All product names in this documentation are trademarks or registered trademarks of
their respective titleholders.

6Manual – Functional Safety – DRC Electronic Motor
2Safe condition
Integrated safety technology
2 Integrated safety technology
The safety technology of the DRC drive unit described below has been developed and
tested in accordance with the following safety requirements:
• SIL 3 according to EN 61800-5-2:2007
• PL e according to EN ISO 13849-1:2008
This was certified by TÜV Nord. Copies of the TÜV certificate and the corresponding re-
port are available from SEW-EURODRIVE on request.
2.1 Safe condition
For safety-related operation of DRC drive units, safe torque off is defined as safe con-
dition (see STO safety function). The underlying safety concept is based on this defini-
tion.
2.2 Safety concept
• The DRC drive unit can be connected to an external safety controller or safety relay.
This disconnects the safety-related STO input via a 2-pole 24 V switching signal
(sourcing/sinking) when a connected control device (e.g. emergency stop button with
latching function) is activated. This activates the STO function (safe disconnection)
of the DRC drive unit.
• An internal, dual-channel structure with diagnostics prevents the generation of pulse
trains at the power output stage (IGBT). On the one hand, the internal supply voltage
for controlling the upper and lower IGBTs is disconnected, and on the other hand the
controlling pulse patterns are short-circuited. This means that the output stage can
no longer supply power to the motor for generating torque.
• Instead of galvanic separation of the drive from the supply system by means of con-
tactors or switches, the disconnection of the STO input described here safely pre-
vents the control of the power semiconductors in the output stage. The rotary-field
generation for the respective motor is deactivated even though the line voltage is still
present.

Manual – Functional Safety – DRC Electronic Motor 7
2
Safety concept
Integrated safety technology
2.2.1 Schematic representation "Safety concept for DRC"
The following figure shows a schematic representation of the safety concept for the DRC
drive unit:
2463070859
[1] Safety controller/safety relay external
[2] Connection "STO+"
[3] Connection "STO-"
[4] Motor phase
[5] Motor
24V
Safety M
UZ-
UZ+
[1]
[2]
[3]
[4]
[5]
μC
HV
SNT SNT

8Manual – Functional Safety – DRC Electronic Motor
2Safety functions
Integrated safety technology
2.3 Safety functions
The following drive-related safety functions can be used:
•STO (safe torque off according to EN 61800-5-2) by disconnecting the STO input.
If the STO function is activated, the frequency inverter no longer supplies power to
the motor for generating torque. This safety function corresponds to a non-controlled
stop according to EN 60204-1, stop category 0.
The STO input must be disabled by a suitable external safety controller / safety relay.
The following figure shows the STO function:
2463228171
v Velocity
tTime
t1Time at which STO is triggered
Disconnection range
v
t
t1

Manual – Functional Safety – DRC Electronic Motor 9
2
Safety functions
Integrated safety technology
•SS1(c) (safe stop 1, function variant c according to EN 61800-5-2) by means of suit-
able external control (e.g. safety relay with delayed disconnection)
The following sequence is mandatory:
– Decelerate the drive using an appropriate brake ramp specified via setpoints.
– Disconnect the STO input (= triggering the STO function) after a specified safety-
related time delay.
This safety function corresponds to a controlled stop according to EN 60204-1, stop
category 1.
The following figure illustrates the SS1(c) function:
2463226251
v Velocity
tTime
t1Point of time when the brake ramp is initiated
t2Point of time when STO is triggered
∆t Time between initiating the brake ramp and STO
Safe time delay range
Disconnection range
v
t
t1tt
2

10 Manual – Functional Safety – DRC Electronic Motor
2Restrictions
Integrated safety technology
2.4 Restrictions
•The standard brake that can optionally be integrated in DRC drive units is not
safety-related and therefore not part of the safety functions mentioned above.
If the brake controller and/or the motor brake fails, the drive can coast for much lon-
ger depending on the application (i.e. the friction and inertia of the system). In case
of regenerative loads (e.g. lifting axes, declining conveying lines), the drive can even
accelerate. This must be taken into account for a risk analysis of the system/ma-
chine. Additional safety measures might have to be implemented (e.g. safety brake
system).
→The DRC drive unit cannot be used without an additional brake system for appli-
cation-specific safety functions that require active deceleration (braking) of the dan-
gerous movement.
• When using the SS1(c) function as described in chapter "Safety functions", the brake
ramp of the drive is not monitored with respect to safety. In case of a fault, the drive
might not be decelerated after the delay time, or it might be accelerated in the worst
case. In this case, the STO function (see chapter "Safety functions") is only activated
after the set time delay has elapsed. The resulting danger must be taken into account
in the risk assessment of the system/machine. Additional safety measures might
have to be implemented.
WARNING
The safety concept is only suitable for performing mechanical work on the system/ma-
chine components.
If the STO signal is disconnected, the supply system voltage is still present at the DC
link of the DRC.
Severe or fatal injuries from electric shock.
• Before working on the electric part of the drive system, disconnect it from the sup-
ply system using an appropriate external disconnecting device and secure it
against unintentional reconnection to the power supply.

Manual – Functional Safety – DRC Electronic Motor 11
3
Approved units
Safety conditions
3 Safety conditions
The requirement for safe operation is that the safety functions of the DRC drive unit are
properly integrated into an application-specific higher-level safety function. A sys-
tem/machine-specific risk assessment must be carried out through the system/machine
manufacturer and taken into account for the use of the drive system with DRC drive
units.
The system/machine manufacturer and the operator are responsible for compliance of
the system/machine with applicable safety regulations.
The following requirements are mandatory when installing and operating the DRC drive
unit in safety-related applications.
The requirements are divided into:
• Approved devices
• Installation requirements
• Requirements for external safety controllers and safety relays
• Startup requirements
• Operational requirements
3.1 Approved units
Only the following unit variants of DRC drive units are permitted for safety-related appli-
cations.
Permitted application options:
• GIO12B
• GIO13B
Type code
example
DRC 2- 015- SNI- AECR /XX
Description Product
series
Size Power Installa-
tion tech-
nology
Version Extended
control
range
Options
Permitted
variants
DRC 1
2
3
4
005
015
030
040
SNI
DSC
DAC
DBC
A ECR (stan-
dard)
/IV
/BY1C
/BY2C
/BY4C
/BW1
/BW2
/BW3

12 Manual – Functional Safety – DRC Electronic Motor
3Installation requirements
Safety conditions
3.2 Installation requirements
• Power lines and STO control lines have to be routed in separate cables.
• The length of the cable from the safety controller to the DRC drive unit must not ex-
ceed 100 m.
• The wiring technology used must comply with EN 60204-1.
• The STO control lines must be routed according to EMC guidelines and as follows:
– Outside an electrical installation space: Shielded cables must be routed perma-
nently (fixed) and protected against external damage, or equivalent measures
have to be taken.
– Inside an electrical installation space: Individual conductors can be routed.
– Adhere to the relevant regulations in force for the application.
• The DRC drive unit does not detect short circuits or interference voltage in the supply
line. This is why you must make sure that
– No parasitic voltages can occur in the STO control lines, or that
– The external safety controller can detect a crossfault from an external potential to
the STO control lines.
• Observe the values specified for safety components when designing the safety cir-
cuits.
• The STO signal may not be used for feedback.
• Observe the notes in the "DRC Electronic Motor" operating instructions for EMC-
compliant installation.
It is important that the shielding of the STO control line is connected to the housing
at both ends.
• Only use grounded voltage sources with safe disconnection (PELV) according to EN
61131-2 and EN 60204-1 for all signal interfaces (SBus, binary inputs, binary output,
etc.) of the DRC drive unit and all SBus stations.
In case of a single fault, the voltage between the outputs or between any output and
grounded parts must not exceed DC 60 V.
• When planning the installation, observe the technical data of the DRC drive unit.
• Do not use the DC 24 V output of the DRC drive unit for safety-related applications
with DRC drive units.

Manual – Functional Safety – DRC Electronic Motor 13
3
Installation requirements
Safety conditions
• For safety-related applications with DRC drive units, you have to remove the jumpers
labeled "Caution, remove jumper for safety operation", se following figures (jumpers
are not installed in unit variants with STO plug connectors X5502 and X5503):
WARNING
No safe disconnection of the DRC drive unit.
Severe or fatal injuries.
• Do not use the 24 V output for safety-related applications with DRC drive units.
• You may only jumper the STO input with 24 V when the DRC drive unit is not used
to fulfill any safety functions.
DRC-DBC-B and -DAC-B (shown with DRC size 1/2 as an example)
Remove the jumpers between STO input (terminals 1/2) and 24 V output (terminals 4/5):
4745809035
DRC-DSC-B and -SNI-B (shown with DRC size 1/2 as an example)
Remove the jumpers between STO input (terminals 1/2) and 24 V output (terminals 5/15):
4747351179
CAUTION
remove jumper
for safety operation
CAUTION
remove jumper
for safety operation
CAUTION
remove jumper
for safety operation
CAUTION
remove jumper
for safety operation
1.
2.
3.
CAUTION
remove jumper
for safety operation
CAUTION
remove jumper
for safety operation
2.
CAUTION
remove jumper
for safety operation
CAUTION
remove jumper
for safety operation
3.

14 Manual – Functional Safety – DRC Electronic Motor
3External safety controller requirements
Safety conditions
3.3 External safety controller requirements
A safety relay can be used as an alternative to a safety controller. The following require-
ments apply analogously.
• The safety controller and all other safety-related subsystems must be approved and
tested for at least that safety class which is required in the overall system for the re-
spective, application-related safety function.
The following table shows an example of the required safety class of the safety con-
troller:
• The wiring of the safety controller must be suitable for the required safety class, (see
manufacturer documentation). The STO input of the DRC drive unit requires 2-pole
disconnection (sourcing/sinking).
• The values specified for the safety controller must be strictly adhered to when de-
signing the circuit.
• The switching capacity of the safety relays or the relay outputs of the safety controller
must correspond at least to the maximally permitted, limited output current of the 24
V voltage supply.
Observe the manufacturer's instructions concerning the permitted contact loads and
fusing that may be required for the safety contacts. If the manufacturer provides no
specific information, the contacts must be protected with 0.6 times the nominal value
of the maximum contact rating specified by the manufacturer.
• To ensure protection against unintended restart in accordance with EN 1037, the
safe control system must be designed and connected in such a way that resetting the
control device alone does not lead to a restart. A restart may only be carried out after
a manual reset of the safety circuit.
Application Safety controller requirements
Performance level e according to EN ISO
13849-1.
Performance level e according to EN ISO
13849-1.
SIL 3 according to EN 61508
SIL 3 according to EN 62061 Performance level e according to EN ISO
13849-1.
SIL 3 according to EN 61508

Manual – Functional Safety – DRC Electronic Motor 15
3
External safety controller requirements
Safety conditions
• Note the following for two-pole disconnection of the DRC drive unit with tested, safe
outputs:
– When disconnected, the switch-on test pulses may never occur at the plus and
minus output at the same time.
– When connected, the switch-off test pulses may not be longer than 1 ms. The next
pulse blanking cannot reoccur earlier than after 20 ms.
3.3.1 Sample circuit "safety relay"
The following figure shows the basic connection of an external safety relay (according
to the requirements listed above) to the DRC drive unit.
The information in the respective manufacturer's data sheets must be observed for con-
nection.
9007201720642187
<1 ms >20 ms
t
High: no STO
Low: STO active
2466502411
[1] Safety relay with approval [4] STO signal
[2] DC 24 V voltage supply [5] Reset button for manual reset
[3] Fuses in accordance with the manufacturer's
specifications of the safety relay
[6] Permitted emergency stop actuating device
[4]
[3] [1]
[5]
[6]
[2] U

16 Manual – Functional Safety – DRC Electronic Motor
3Startup requirements
Safety conditions
3.4 Startup requirements
• To validate the implemented safety functions, they must be documented and
checked after successful startup (validation).
Observe the limitations for safety functions in chapter "Limitations" for the validation
of the safety functions. Non-safety-relevant parts and components that affect the re-
sult of the validation test must be deactivated, if necessary.
• When you are using the DRC drive unit in safety-relevant applications, it is essential
that you perform and record startup checks for the disconnecting device and correct
wiring.
3.5 Operational requirements
• Operation is only allowed within the limits specified in the data sheets. This principle
applies to the external safety controller as well as to the DRC drive unit and approved
options.
• The built-in diagnostic function is limited in case of a permanently enabled or perma-
nently disabled STO input. Only when the STO signal is activated ("Low" to "High"),
extended diagnostic functions are performed. This means that the STO input must
be switched at least once in three months while the supply system is connected to
achieve a complete test coverage. Follow this test procedure:
• To achieve complete test coverage after a unit reset (e.g. after connecting the supply
system), the test transition (STO active →not active) must be started at least
10 seconds later. The unit must (already) be signaling "ready for operation" or "STO
– safe torque off" and may not be in error state.
• A detected hardware fault in the internal switch-off channels for STO will lead to a
locking error state of the DRC drive unit. When the error is reset (e.g. by switching
the power supply off and back on), a complete internal diagnostics test run must be
performed according to the above test procedure. If the error re-occurs, replace the
unit or contact SEW Service (for detailed information about possible error states,
refer to the respective DRC operating instructions).
2467673483
max. 3 months >500 ms >500 ms
High: no STO
Low: STO active
internal
diagnostics
internal
diagnostics
t

Manual – Functional Safety – DRC Electronic Motor 17
4
Technical data
4 Technical data
The table below shows the technical data for the DRC drive unit relating to the integrated
safety technology. The technical data and approvals in the respective DRC operating in-
structions must be observed in addition.
Technical data of the STO input Min. Typical Max. Unit
Input voltage range -3 24 30 V DC
Input impedance 1000 Ohm
Capacitance of the STO input
(capacitance between STO+ and STO–)
≤10 nF
Switch-on/switch-off threshold 11 V
Input voltage for ON status (STO) 15 V
Input voltage for OFF status (STO) 5 V
Permitted leakage current of the external
safety controller
0 2mA
Required current for STO-IN supply 24 mA
Time from disconnecting the safety voltage
until the deactivation of the rotating field
420ms
Time from connecting the safety voltage until
the deactivation of the rotating field
220 300 ms
Test interval for STO function: See test proce-
dure in chapter "Operation requirements"
3Months
Safety characteristics
Approved safety classes SIL 3 according to EN 61800-5-2
Performance level e according to EN ISO 13849-1
Probability of a dangerous failure per hour (=
PFH value)
2×10
−91/h
Service life 20 years, after which the component must be replaced
with a new one.
Safe state Safe torque off (STO)
P
i
f
kVA
Hz
n

18 Manual – Functional Safety – DRC Electronic Motor
5Unit variants with optional standard brake
Appendix
5 Appendix
5.1 Unit variants with optional standard brake
The standard brake, which is optionally integrated in DRC drive units, is not safety-re-
lated. It is not part of the safety functions described in chapter "Safety functions".
We recommend activation with SS1 (c); the standard brake is applied when the speed
is 0.
For this purpose, the factory settings of the following parameters must not be changed:
Index Parameter Factory setting
8584.0 Brake function 1 = ON: The drive decelerates along the set ramp. When the
speed is "0", the brake is applied.
9833.20 Brake application for STO 1 = YES: The brake is applied (not safety-related) when STO is
activated.
4744670987
tTime
t1Point of time when the brake ramp is initiated
t2Point of time when STO is triggered
∆t Time between initiating the brake ramp and STO
Safe time delay range
Disconnection range
Deceleration
ramp
Speed
Drive enable signal
Control signal
STO
Brake
active
inactive
t
t
1
tt
2

Manual – Functional Safety – DRC Electronic Motor 19
5
Unit variants with optional standard brake
Appendix
If STO is activated before the motor has come to a standstill, the brake behaves as set
in parameter "9833.20 – Brake application with STO":
[1] Parameter "9833.20 – Brake application with STO" = 1 (factory setting)
– The brake is applied (not safety-related) when STO is activated
[2] Parameter "9833.20 – Brake application with STO" = 0
– The motor coasts to a halt
– The brake status remains the same
– The deceleration distance is not defined
Activating the STO function during the execution of the ramp aborts the controlled ramp-
down:
Possible reasons for premature activation of STO:
– Deceleration time ∆t too short
– Extension of the deceleration ramp due to current limit, e.g. load too high
INFORMATION
Note the information about permitted "emergency braking operations" in the operating
instructions in chapter "Technical Data".
4744860555
[1] Parameter "9833.20 – Brake application with STO" = 1 (factory setting)
[2] Parameter "9833.20 – Brake application with STO" = 0
tTime
t1Point of time when the brake ramp is initiated
t2Point of time when STO is triggered
∆t Time between initiating the brake ramp and STO
Safe time delay range
Disconnection range
Decel-
eration
ramp
Speed
Drive enable signal
Control signal
STO
Brake
active
inactive
t
t
1
tt
2
[2]
[1]
[1]

20 Manual – Functional Safety – DRC Electronic Motor
5Connection variants
Appendix
5.2 Connection variants
5.2.1 Position of the terminals for safe torque off (STO)
The following figure shows an example of the terminal positions for safe torque off
(STO) of the DRC drive unit:
5.2.2 Assignment of the terminals for safe torque off (STO)
The following figure shows the terminal assignment for safe torque off (STO) of the DRC
drive unit:
Connection cable
4749325835
PE PE
Assignment
No. Name Color Function
1STO+ Yellow Input STO +
2STO−Yellow Input STO –
11 STO + Yellow Output STO + (to loop through)
12 STO −Yellow Output STO – (to loop through)
INFORMATION
For information about looping STO through, refer to chapter "Connecting an external
safety relay for STO".
INFORMATION
Use only shielded cables for this connection.