SEW-Eurodrive MOVIPRO ADC User manual

Drive Technology \ Drive Automation \ System Integration \ Services
Manual
Decentralized Drive and Application Controller
MOVIPRO
®
ADC
Functional Safety
Edition 06/2010 16896017 / EN

SEW-EURODRIVE—Driving the world

Manual – MOVIPRO® ADC – Functional Safety 3
Contents
Contents
1 General Information ............................................................................................ 4
1.1 How to use this documentation................................................................... 4
1.2 Structure of the safety notes ....................................................................... 4
1.3 Rights to claim under limited warranty ........................................................ 5
1.4 Exclusion of liability..................................................................................... 5
1.5 Content of the documentation..................................................................... 5
1.6 Other applicable documentation ................................................................. 5
1.7 Copyright..................................................................................................... 5
2 Safety Conditions................................................................................................ 6
2.1 Overview ..................................................................................................... 6
2.2 Approved units ............................................................................................ 6
2.3 Installation requirements............................................................................. 7
2.4 Requirements for external safety controllers .............................................. 8
2.5 Startup requirements .................................................................................. 9
2.6 Operation requirements ............................................................................ 10
3 Axis Module with Safe Torque Off STO .......................................................... 11
3.1 Safe condition ........................................................................................... 11
3.2 Safety concept .......................................................................................... 11
3.3 Safety functions ........................................................................................ 12
3.4 Connection variants .................................................................................. 14
3.5 Diagnostics ............................................................................................... 18
3.6 Technical data........................................................................................... 18
4 Safety-Related Brake Module........................................................................... 19
4.1 Safe condition ........................................................................................... 19
4.2 Safety concept .......................................................................................... 19
4.3 Safety functions ........................................................................................ 20
4.4 Connection variants .................................................................................. 20
4.5 Technical data........................................................................................... 20
5 PROFIsafe Option S11 ...................................................................................... 21
5.1 Safe condition ........................................................................................... 21
5.2 Safety concept .......................................................................................... 21
5.3 Safety function .......................................................................................... 23
5.4 Startup ...................................................................................................... 23
5.5 Data exchange with PROFIsafe option S11 ............................................. 27
5.6 Response times ........................................................................................ 33
5.7 Diagnostics ............................................................................................... 33
5.8 Technical data........................................................................................... 38
6 Restrictions ....................................................................................................... 39
7 Address List ...................................................................................................... 40
Index................................................................................................................... 50

4Manual – MOVIPRO® ADC – Functional Safety
1How to use this documentation
General Information
1 General Information
1.1 How to use this documentation
The documentation is an integral part of the product and contains important information
on operation and service. The documentation is written for all employees who assemble,
install, startup, and service this product.
The documentation must be accessible and legible. Make sure that persons responsible
for the system and its operation, as well as persons who work independently on the unit,
have read through the documentation carefully and understood it. If you are unclear
about any of the information in this documentation, or if you require further information,
contact SEW-EURODRIVE.
1.2 Structure of the safety notes
1.2.1 Meaning of the signal words
The following table shows the grading and meaning of the signal words for safety notes,
notes on potential risks of damage to property, and other notes.
1.2.2 Structure of the section-related safety notes
Section safety notes do not apply to a specific action, but to several actions pertaining
to one subject. The used symbols indicate either a general or a specific hazard.
This is the formal structure of a section safety note:
1.2.3 Structure of the embedded safety notes
Embedded safety notes are directly integrated in the instructions just before the descrip-
tion of the dangerous action.
This is the formal structure of an embedded safety note:
•SIGNAL WORD Nature and source of hazard.
Possible consequence(s) if disregarded.
– Measure(s) to prevent the danger.
Signal word Meaning Consequences if disregarded
DANGER Imminent danger Severe or fatal injuries
WARNING Possible dangerous situation Severe or fatal injuries
CAUTION Possible dangerous situation Minor injuries
NOTICE Possible damage to property Damage to the drive system or its envi-
ronment
INFORMATION Useful information or tip: Simpli-
fies the handling of the drive
system.
SIGNAL WORD
Type and source of danger.
Possible consequence(s) if disregarded.
• Measure(s) to prevent the danger.

Manual – MOVIPRO® ADC – Functional Safety 5
1
Rights to claim under limited warranty
General Information
1.3 Rights to claim under limited warranty
A requirement of fault-free operation and fulfillment of any rights to claim under limited
warranty is that you adhere to the information in the documentation. Read the documen-
tation before you start working with the unit!
1.4 Exclusion of liability
You must comply with the information contained in this documentation to ensure safe
operation of MOVIPRO®and to achieve the specified product characteristics and per-
formance features. SEW-EURODRIVE assumes no liability for injury to persons or dam-
age to equipment or property resulting from non-observance of these operating instruc-
tions. In such cases, any liability for defects is excluded.
1.5 Content of the documentation
This document contains additional safety-related information and conditions for the op-
eration of MOVIPRO®in safety-related applications.
1.6 Other applicable documentation
This document supplements the MOVIPRO® ADC operating instructions and limits the
application notes according to the following information. Only use this document in con-
nection with the MOVIPRO® ADC operating instructions.
1.7 Copyright
© 2010 – SEW-EURODRIVE. All rights reserved.
Unauthorized duplication, modification, distribution or any other use of the whole or any
part of this documentation is strictly prohibited.

6Manual – MOVIPRO® ADC – Functional Safety
2Overview
Safety Conditions
2 Safety Conditions
2.1 Overview
The requirement for safe operation is that the safety functions of MOVIPRO®are prop-
erly integrated into an application-specific higher-level safety function or safety system.
The system or machine manufacturer has to make a risk analysis for this purpose. The
required safety requirements and functions must be validated before startup.
The system/machine manufacturer and the operator are responsible for compliance of
the system/machine with applicable safety regulations.
The following requirements are mandatory when installing and operating MOVIPRO®
units in safety-related applications.
The requirements are divided into:
• Approved devices
• Installation requirements
• Requirements for external safety controllers and safety relays
• Startup requirements
• Operation requirements
2.2 Approved units
MOVIPRO®units are only permitted for applications with safe disconnection of the drive
if these safety properties are documented in their operating instructions.

Manual – MOVIPRO® ADC – Functional Safety 7
2
Installation requirements
Safety Conditions
2.3 Installation requirements
• You may only use SEW hybrid cables for safety-related applications with
MOVIPRO®.
• Do not shorten SEW hybrid cables. Use cables in their original lengths with prefabri-
cated plug connectors. Ensure proper connections.
• Power lines and safety-related control lines have to be installed in separate cables.
This does not apply to SEW hybrid cables.
• The length of the cable from the safety control system to MOVIPRO®must not ex-
ceed 100 m.
• Wiring must comply with EN 60204-1.
• The safety-related control lines must be routed according to EMC guidelines and as
follows:
– Outside an electrical installation space: Shielded cables must be routed perma-
nently (fixed) and protected against external damage, or other equivalent mea-
sures.
– Single conductors may be routed inside an electrical installation space.
Observe the respective regulations governing the application.
• The safety-related 24 V power supply may not be used for feedback.
• Make sure that parasitic voltages cannot be generated in the safety-related control
lines.
• When designing the safety circuits, always observe the values specified for safety
components.
• Use only grounded voltage sources with safe electrical disconnection (PELV) in ac-
cordance with VDE 0100 and EN 60204-1 for all DC 24 V supply voltages of
MOVIPRO®.
In case of a single fault, the voltage between the outputs or between any output and
grounded parts may not exceed DC 60 V.

8Manual – MOVIPRO® ADC – Functional Safety
2Requirements for external safety controllers
Safety Conditions
2.4 Requirements for external safety controllers
A safety relay can be used as an alternative to a safety controller.
The following requirements apply to safety controllers and safety relays analogously.
• The safety controller and all other safety-related subsystems must be approved for
at least that safety class which is required in the overall system for the respective,
application-related safety function.
The following table shows an example of the required safety class of the safety con-
troller:
• The wiring of the safety controller must be suitable for the required safety class, (see
manufacturer documentation).
• When designing the circuits, always observe the values specified for the safety con-
troller.
• The switching capacity of the safety relays or the relay outputs of the safety controller
must correspond at least to the maximally permitted, limited output current of the
DC 24 V voltage supply.
1593958923
[1] Safety relay with approval [4] Safety-related DC 24 V voltage supply
[2] DC 24 V voltage supply [5] Reset button for manual reset
[3] Fuses in accordance with the manufacturer's
specifications of the safety relay
[6] Permitted emergency stop actuating device
Application requirement Safety controller requirements
Performance level d according to EN ISO 13849-1 Performance level d according to EN ISO 13849-1
SIL 2 according to EN 61508
SIL 2 according to EN 62061 Performance level d according to EN ISO 13849-1
SIL 2 according to EN 61508
[4]
[3] [1]
[5]
[6]
[2] U

Manual – MOVIPRO® ADC – Functional Safety 9
2
Startup requirements
Safety Conditions
Observe the manufacturer's instructions concerning the permitted contact
loads and fusing that may be required for the safety contacts. Unless specified
otherwise, the contacts must be protected with 0.6 times the nominal value of
the maximum contact rating specified by the manufacturer.
• To ensure protection against unintended restart in accordance with EN 1037, the
safety controllers must be designed and connected in such a way that resetting the
control device alone does not lead to a restart. A restart may only be carried out after
a manual reset of the safety circuit.
• SEW-EURODRIVE recommends bipolar disconnection of the safety circuit.
• The MOVIPRO®unit input of the safety-related DC 24 V power supply has an input
capacitance, see chapter "Technical Data" of the MOVIPRO® ADC operating instruc-
tions. This must be taken into account as load when designing the switching output.
• If the safety circuit is disconnected at both poles, the test pulses may not be applied
at the same time. The pulse blanking must not exceed 1 ms. The next pulse blanking
cannot reoccur earlier than after 1 s.
2.5 Startup requirements
• Startup must be documented. Evidence for the safety functions must be provided.
Observe the limitations for safety functions in chapter "Limitations" for verification of
the safety functions. Non-safety-related parts and components that affect the result
of the verification test (e.g. motor brake) must be deactivated, if necessary.
• For operating MOVIPRO®in safety-related applications, you must perform and re-
cord startup checks for the disconnecting device and correct wiring.
• During the startup procedure/function test, the correct assignment of the respective
voltage supply must be checked with a measurement.
• The function test must be carried out in succession for all potentials, i.e. separately.
684086667
<1ms >1s
High
Low
t

10 Manual – MOVIPRO® ADC – Functional Safety
2Operation requirements
Safety Conditions
2.6 Operation requirements
• Operation is only allowed within the limits specified in the data sheets. This principle
applies to the external safety relay as well as MOVIPRO®and approved options.
• The safety functions must be checked at regular intervals to ensure the faultless
functionality. The period of time between tests must be determined in accordance
with the risk analysis.

Manual – MOVIPRO® ADC – Functional Safety 11
3
Safe condition
Axis Module with Safe Torque Off STO
3 Axis Module with Safe Torque Off STO
It was developed and tested according to the following safety requirements:
• Performance level d according to EN ISO 13849-1
• Protection against restart in accordance with EN 1037
3.1 Safe condition
For safety-related operation of MOVIPRO®, safe torque off is defined as safe condi-
tion (see STO safety function). The safety concept is based on this.
3.2 Safety concept
•MOVIPRO
®is characterized by the optional connection of a safety relay/external
safety controller. It de-energizes all active elements that generate the pulse trains to
the power output stage (IGBT) by switching off the safety-related DC 24 V supply
when a connected control device (e.g. emergency stop button with latching function)
is activated. This ensures that the frequency inverter no longer supplies power to the
motor for generating torque.
• Disconnecting the DC 24 V power supply ensures that any voltage supply required
for operating the drive is safely interrupted.
• Instead of galvanic isolation of the drive from the supply system using contactors or
switches, the disconnection of the DC 24 V supply described here safely prevents
the gating of the power semiconductors in the frequency inverter. This means the ro-
tary-field generation for the respective motor is deactivated even though the mains
voltage is still present.
The following figure shows the safety concept:
1630255243
[1] MOVIPRO®[4] CPU
[2] Frequency inverter [5] X5502: Input for safe torque off (STO)
[3] DC +24 V power supply unit [6] Power semiconductor
[2]
[3]
M
12
5
43
[4]
[6]
[1]
[5]
STO+
0V24
STO-
+24 V

12 Manual – MOVIPRO® ADC – Functional Safety
3Safety functions
Axis Module with Safe Torque Off STO
3.3 Safety functions
The following drive-related safety functions can be used:
•STO (safe torque off according to IEC 61800-5-2) by disconnecting the safety-
related DC 24 V supply.
If the STO function is activated, the frequency inverter no longer supplies power to
the motor for generating torque. This safety function corresponds to a non-controlled
stop according to EN 60204-1, stop category 0.
The safety-related DC 24 V power supply must be switched off by a suitable external
safety controller/safety relay.
The following figure shows the STO function:
INFORMATION
Observe the restrictions in the "Restrictions (page 39)" chapter.
2463228171
V Velocity
tTime
t1Time at which STO is triggered
Disconnection range
v
t
t1

Manual – MOVIPRO® ADC – Functional Safety 13
3
Safety functions
Axis Module with Safe Torque Off STO
•SS1(c) (safe stop 1, function variant c according to IEC 61800-5-2) by means of suit-
able external control (e.g. safety relay with delayed disconnection)
The following sequence is mandatory:
– Decelerate the drive using an appropriate brake ramp specified via setpoints
– Disconnect the safety-related DC 24 V power supply (= trigger the STO function)
after a specified safety-related time delay.
This safety function corresponds to a controlled stop according to EN 60204-1, stop
category 1.
The following figure illustrates the SS1(c) function:
2463226251
V Velocity
tTime
t1Point of time when brake ramp is initiated
t2Point of time when STO is triggered
∆tTime between initiating the brake ramp and STO
Normal operation
Disconnection range
v
t
t1tt
2

14 Manual – MOVIPRO® ADC – Functional Safety
3Connection variants
Axis Module with Safe Torque Off STO
3.4 Connection variants
3.4.1 X5502: STO-IN (safety relay)
This connection is marked by a yellow ring.
The following table provides information about this connection:
INFORMATION
For technical data, refer to the "MOVIPRO®ADC" operating instructions.
WARNING
No safe disconnection of MOVIPRO®if the connection is bypassed.
Severe or fatal injuries.
• Bypass this connection only if MOVIPRO®will not perform any safety functions ac-
cording to DIN EN ISO 13849-1.
Function
Input for safe torque off (STO)
Connection type
M12, 5-pole, female, A-coded
Wiring diagram
2264816267
Assignment
No. Name Function
1 +24V DC 24 V output
2 STO- 0V24 reference potential for safe torque off (STO)
3 0V24 0V24 reference potential
4 STO+ DC 24 V input for safe torque off (STO)
5 res. Reserved
1
43
2
5
INFORMATION
Use shielded cables only for this connection.

Manual – MOVIPRO® ADC – Functional Safety 15
3
Connection variants
Axis Module with Safe Torque Off STO
3.4.2 Connection of an external safety relay for STO
The following figure shows a connection example with a safety relay and disconnection
of all poles:
18014400187293195
[1] Installation space [3] MOVIPRO®
[2] Safety relay [4] X5502: Input for safe torque off (STO)
sicherheitsgerichtete
Abschaltung
[1]
[4]
[3]
[2]
42
DC +24 V
INFORMATION
When wiring the STO signals, possible faults in plug connectors and cables/lines have
to be considered (see ISO 13849-2) and the installation has to be designed according
to the required safety class. MOVIPRO®does not detect short circuits in the supply
line. SEW-EURODRIVE therefore recommends to connect only STO signals to X5502
using a two-core cable, as shown in the figure.

16 Manual – MOVIPRO® ADC – Functional Safety
3Connection variants
Axis Module with Safe Torque Off STO
3.4.3 Disconnection of group drives
The following figure shows a connection example for disconnection of group drives with
a safety relay and disconnection of all poles:
27021599799194379
[1] Installation space [3] MOVIPRO®
[2] Safety relay [4] X5502: Input for safe torque off (STO)
sicherheitsgerichtete
Abschaltung
[1]
DC +24 V [4]
[4]
2
4
[3]
2
4
[3]
[2]
INFORMATION
When wiring the STO signals, possible faults in plug connectors and cables/lines have
to be considered (see ISO 13849-2) and the installation has to be designed according
to the required safety class. MOVIPRO®does not detect short circuits in the supply
line. SEW-EURODRIVE therefore recommends to connect only STO signals to X5502
using a two-core cable, as shown in the figure.

Manual – MOVIPRO® ADC – Functional Safety 17
3
Connection variants
Axis Module with Safe Torque Off STO
Requirements For group drives, the STO signal for several MOVIPRO®drives can be provided by a
single safety relay. The following requirements must be met:
• For EMC reasons, the maximum cable length is limited to 100 m. Other instructions
published by the manufacturer on the use of safety relays (for specific applications)
must also be observed.
• The maximum output current/the maximally permitted contact load of the safety relay
must be observed.
• You must comply with the permitted signal levels at the STO input and all other tech-
nical data of MOVIPRO®. The routing of the STO control cables and the voltage drop
must be considered.
• Other requirements of the safety relay manufacturer (such as protecting the output
contacts against welding) must be strictly observed. You must also observe the basic
cable routing requirements from chapter "Installation requirements".
• A calculation based on the technical data of MOVIPRO®must be performed sepa-
rately for each case of group drive disconnection.
For technical data, refer to the "MOVIPRO® ADC" operating instructions.
3.4.4 Connecting an external safety controller for STO
The following figure shows a connection example with a safety controller and disconnec-
tion of all poles for STO:
18014400187769483
[1] F-PLC safety controller [2] MOVIPRO®
DOn_M: Ground output [3] X5502: Input for safe torque off (STO)
DOn_P: Plus output
[1]
DOn_P
DOn_M
2
4
[2]
[3]
INFORMATION
When wiring the STO signals, possible faults in plug connectors and cables/lines have
to be considered (see ISO 13849-2) and the installation has to be designed according
to the required safety class. MOVIPRO®does not detect short circuits in the supply
line. SEW-EURODRIVE therefore recommends to connect only STO signals to X5502
using a two-core cable, as shown in the figure.

18 Manual – MOVIPRO® ADC – Functional Safety
3Diagnostics
Axis Module with Safe Torque Off STO
3.5 Diagnostics
The frequency inverter reports the unit status "Safe stop – active". Unit status 17dec is
reported in the high byte of status word 1.
3.6 Technical data
For general technical data and approvals of MOVIPRO®, refer to the respective operat-
ing instructions. The electrical data of the STO input (X5502) is documented there as
well. The specific, safety-related data is listed below:
Characteristic safety values of axis module with STO
Approved safety classes Performance level d according to EN ISO 13849-1
Probability of dangerous failure per hour (PFH
value)
0 (fault exclusion)
Service life 20 years
Safe condition Safe torque off (STO)
Safety data of STO input
Switch-on/switch-off threshold Typ. DC 8 V
Input voltage for OFF status (STO) Max. DC 5 V
Time from disconnecting the safety-related DC
24 V supply until the deactivation of the rotating
field
Typ. 50 ms
Max. 100 ms

Manual – MOVIPRO® ADC – Functional Safety 19
4
Safe condition
Safety-Related Brake Module
4 Safety-Related Brake Module
The safety-related brake module adds the safe SBC brake control function to the axis
module.
4.1 Safe condition
Relating to the safety-related brake module, the de-energized condition of the con-
nected brake is defined as safe condition. The safety concept is based on this.
4.2 Safety concept
• Disconnecting the safety-related control voltage also means the connected brake is
de-energized. The power supply required for releasing the connected brake is inter-
rupted safely.
• Instead of separating the brake control galvanically from the power supply using con-
tactors or switches, the disconnection procedure described here prevents the power
semiconductors in the safety-related brake module from being activated, in this way
ensuring safe disconnection. This means that all connected brakes are de-energized
although the supply voltage is still present at the safety-related brake module.
The following figure shows the safety concept of the safety-related brake module in con-
nection with the axis module:
9007200884995723
[1] MOVIPRO®[6] Power semiconductor
[2] Frequency inverter [7] Safety-related brake module
[3] DC +24 V power supply unit [8] Control
[4] CPU [9] Unsafe operating control of the brake
[5] X5502: Input for safe torque off (STO) [10] Safety-related control of the brake
[2]
[3]
M
12
5
43
[4]
[1]
[5]
[7]
[8]
[9]
[10]
[6]
[6]
STO+
+24 V
0V24
STO-

20 Manual – MOVIPRO® ADC – Functional Safety
4Safety functions
Safety-Related Brake Module
4.3 Safety functions
The following drive-related safety function can be used:
•SBC (Safe Brake Control according to IEC 61800-5-2)
The SBC function safely de-energizes the connected brake by disconnecting the
safety-related control voltage. The control voltage must be disconnected using a suit-
able external safety relay/safety controller.
4.4 Connection variants
For connection variants, refer to "Connection variants" in section "Axis module with safe
torque off" (page 14).
4.5 Technical data
For general technical data and approvals of MOVIPRO®, refer to the respective operat-
ing instructions. The electrical data of the STO/SBC input (X5502) is documented there
as well. The specific, safety-related data is listed below:
Characteristic safety values of the brake module
Safe condition Brake de-energized
Maximum possible safety class Performance level d according to EN ISO 13849-1
Safety category 3 according to EN 954-1
Probability of dangerous failure per hour (PFH
value)
0 (fault exclusion)
Service life Max. 20 years
Safety data of SBC input
Switch-on/switch-off threshold Typ. DC 10 V
Input voltage for OFF status (brake de-ener-
gized)
Max. DC 6 V
Duration from switching off the safety-related
control voltage at the safety-related brake mod-
ule until switching off the brake voltage (plus the
brake application time of the connected brake).
Max. 6 ms