ENG_652567.XML
Legal framework
Machine manufacturers and manufacturing plants must ensure that their machines or plants cannot cause danger due to malfunctions in addition to the general risks of electric shock, heat or radiation.
In Europe, for example, compliance with the Machinery Directive 2006/42/EC is legally stipulated by the EU Directive on Safety and Health at Work. In order to ensure compliance with this directive, it is recommended that the corresponding harmonized European standards are applied. This triggers the "assumption of conformity" and gives manufacturers and operators the legal security in terms of compliance with both national regulations and EU directives. The machine manufacturer uses the CE marking to document the compliance with all relevant directives and regulations in the free movement of goods.
Safety-related standards
Functional safety is specified in various standards. For example, EN ISO 12100 specifies standards pertaining to machine safety (risk assessment and risk reduction). IEC 61508 specifies basic requirements for electronic and programmable safety-related systems. EN 62061 (only applicable for electrical and electronic control systems) and EN ISO 13849‑1, which has replaced EN 954‑1, define the functional and safety-related requirements of safety-oriented control systems.
The above-mentioned standards define different safety requirements that the machine has to satisfy in accordance with the risk, frequency of a dangerous situation, probability of occurrence and the opportunities for recognizing impending danger.
- EN ISO 13849‑1: Performance Level PL a ... e; Category B, 1 ... 4
- EN 62061: Safety Integrity Level SIL 1 ... 3
Trend toward integrated safety systems
The trend toward greater complexity and higher modularity of machines has seen a shift in safety functions away from the classical central safety functions (for example, shutdown of the complete machine using a main disconnecting means) and into the machine control system and the drives. This is often accompanied by a significant increase in productivity because the equipping times are shortened. Depending on the type of machine, it may even be possible to continue manufacturing other parts while equipping is in progress.
Integrated safety functions act much faster than those of a conventional design. The safety of a machine is increased further with Safety Integrated. Furthermore, thanks to the faster method of operation, safety measures controlled by integrated safety systems are perceived as less of a hindrance by the machine operator, therefore significantly reducing the motivation to consciously bypass safety functions.
ENG_652568.XML
The safety functions integrated in SIMATIC MICRO-DRIVE are described below.
Safety functions integrated in the SIMATIC MICRO-DRIVE drives (integrated in the failsafe variants, e.g. PDC100F)
The large number of safety functions integrated in the SIMATIC MICRO-DRIVE drive system in combination with the sensors and safety control required for the safety function contribute to the implementation of highly effective, practical personnel and machine protection.
They comply with the requirements of the following safety categories:
- PL d and Category 3 according to EN ISO 13849‑1
- SIL 2 according to IEC 61508 and IEC 61800‑5‑2
The Safety Integrated functions are generally certified by independent institutes. You can obtain the corresponding test certificates and manufacturer's declarations from your Siemens contacts.
The integrated safety functions that are currently available are described below. Their functional safety satisfies the requirements defined in the international standard IEC 61800‑5‑2 for variable-speed drive systems.
The safety functions integrated into the SIMATIC MICRO-DRIVE drive system can be roughly divided into two categories:
Functions for safely stopping a drive
- Safe Torque Off (STO)
- Safe Stop 1 (SS1)
Functions for safely monitoring the motion of a drive
- Safely-Limited Speed (SLS)
- Safely-Limited Torque (SLT 1))
- Safe Speed Monitor (SSM)
1) Only for PDC100F.
Safe Torque Off (STO)
The STO function is the most common and basic drive-integrated safety function. It ensures that no torque-generating energy can continue to affect a motor and prevents unintentional start-ups.
Effect
This function is a mechanism that prevents the drive from restarting unexpectedly, in accordance with EN 60204‑1, Section 5.4. The STO function suppresses the drive pulses (corresponds to Stop Category 0 according to EN 60204‑1). The drive is reliably torque-free. This state is monitored internally in the drive.
Application
STO has the immediate effect that the drive cannot supply any torque-generating energy. STO can be used wherever the drive will naturally reach a standstill due to load torque or friction in a sufficiently short time or when "coasting down" of the drive will not have any relevance for safety.
STO makes it possible for persons to work safely when the protective door is open (restart interlock) and is used on machines/installations with moving axes, e.g. on handling or conveyor systems.
Customer benefits
Some of the advantages of the Safety Integrated Function STO over conventional safety technology with electromechanical switchgear include the elimination of separate components as well as of the work that would be required to wire and service them, i.e. no wearing parts as a result of the electronic shutdown. Because of the fast electronic switching times, the function provides a shorter reaction time than the conventional solution comprising electromechanical components. When STO is triggered, the converter remains connected to the network and can be fully diagnosed.
G_D211_XX_00304
Safe Stop 1 (SS1)
The SS1 function causes a motor to stop rapidly and safely and switches the motor to torque-free mode after coming to a standstill by activating STO.
Effect
The SS1 function can safely stop the drive in accordance with EN 60204‑1, Stop Category 1. When the SS1 function is selected, the drive brakes autonomously along a quick stop ramp and automatically activates the Safe Torque Off functions when the set safe delay time has expired.
Application
The SS1 function is used when, in the event of a safety-relevant incident, the drive must stop as quickly as possible with a subsequent transition into the STO state (e.g. EMERGENCY STOP). It is thus used to bring large centrifugal masses to a stop as quickly as possible for the safety of the operating personnel, or to brake motors at high speeds as quickly as possible. Examples of typical applications are saws, grinding machine spindles, centrifuges, winders and storage and retrieval machines.
Customer benefits
The targeted stopping of a drive by means of SS1 reduces the risk of danger, increases the productivity of a machine, and allows the safety clearances in a machine to be reduced. The principle is to bring the drive actively to a standstill, compared with just using the STO function. Complex mechanical brakes that are susceptible to wear are not normally required to brake the motor.
G_D211_XX_00305
Safely-Limited Speed (SLS)
The SLS function monitors the drive to ensure that it does not exceed a preset speed or velocity limit.
Effect
The SLS function monitors the drive against a parameterized speed limit. Four different limit values can be selected. The speed setpoint is not influenced independently. After SLS has been selected, the higher-level control must bring the drive down below the selected speed limit within a parameterizable time. If the speed limit is exceeded, a customizable drive-integrated fault reaction occurs.
The SLS limit stage 1 can be multiplied by a factor that is transferred in 16-bit resolution via PROFIsafe. This allows an almost unlimited number of limits to be specified.
Application
The SLS function is used if people are in the danger zone of a machine and their safety can only be guaranteed by reduced speed. Typical application cases include those in which an operator must enter the danger zone of the machine for the purposes of maintenance or setting up, such as a winder in which the material is manually threaded by the operator. To prevent injury to the operator, the roller may only spin at a safely reduced speed. SLS is often also used as part of a two-stage safety concept. While a person is in a less critical zone, the SLS function is activated, and the drives are only stopped in a smaller area with higher potential risk. SLS can be used not only for operator protection, but also for machinery protection, e.g. if a maximum speed must not be exceeded.
Customer benefits
The SLS function can contribute to a significant reduction in downtime, or greatly simplify or even accelerate setup. The overall effect achieved is a higher availability of the machine. Moreover, external components such as speed monitors can be omitted.
G_D211_XX_00307
Safely-Limited Torque (SLT)
The SLT function monitors the current/torque of a motor.
Effect
The SLT function allows the torque to be reduced within a defined period of time. If the torque exceeds the SLT monitoring limit, the drive responds with a "Safe Stop". The stop responses STO or SS1 can be specified via parameters.
Application
In the simplest case, this function is used for force limiting when opening and closing a protective door on a machine.
Customer benefits
The SLT function avoids the use of external hardware for measuring and limiting the force and the associated wiring effort.
G_D211_XX_00386
Safe Speed Monitor (SSM)
The SSM function warns when a drive is working below an adjustable speed limit. As long as it remains below the threshold, the function issues a safety-related signal.
Effect
If a speed value drops below a parameterized limit, a safety-related signal is generated. This can, for example, be processed in a safety controller to respond to the event by programming, depending on the situation.
Application
With the SSM function, in the simplest case, a safety door can be unlocked if the speed drops below a non-critical level. Another typical example is that of a centrifuge that may be filled only when it is operating below a configured speed limit.
Customer benefits
Unlike SLS, there is no drive-integrated fault reaction when the speed limit is exceeded. The safe feedback can be evaluated in a safety control unit, allowing the user to respond appropriately to the situation.
G_D211_XX_00209
Activation of the Safety Integrated Functions
The STO safety function for SIMATIC MICRO-DRIVE can be activated via terminals, e.g. for use of a conventional safety circuit.
For standalone safety solutions for small to medium sized applications, it is frequently sufficient that the various sensing components are directly hardwired to the drive.
For integrated safety solutions, the safety-relevant sequences are generally processed and coordinated in the fail-safe SIMATIC controller. In this case, the system components communicate via the PROFINET fieldbus. The safety functions are controlled via the safe PROFIsafe communication protocol.
The SIMATIC MICRO-DRIVE drives can be easily integrated into the plant or system topology.
PROFIsafe (only for the failsafe variants, e.g. PDC100F)
SIMATIC MICRO-DRIVE drives support the PROFIsafe profile based on PROFINET.
PROFIsafe is an open communications standard that supports standard and safety-related communication over the same communication path (wired or wireless). A second, separate bus system is therefore not necessary. The telegrams that are sent are continually monitored to ensure safety-relevant communication.
Possible errors such as telegrams that have been lost, repeated or received in the incorrect sequence are avoided. This is done by consecutively numbering the telegrams in a safety-relevant fashion, monitoring their reception within a defined time and transferring an ID for transmitter and receiver of a telegram. A CRC (cyclic redundancy check) data security mechanism is also used.
The operating principle of Safety Integrated
Two independent switch-off signal paths
Two independent switch-off signal paths are available. All switch-off signal paths are low active. This ensures that the system is always switched to a safe state if a component fails or in the event of cable breakage. If a fault is discovered in the switch-off signal paths, the STO or SS1 function (depending on parameter settings) is activated and a system restart inhibited.
Two-channel monitoring structure
All the main hardware and software functions for Safety Integrated are implemented in two independent monitoring channels (e.g. switch-off signal paths, data management, data comparison). A cyclic crosswise comparison of the safety-relevant data in the two monitoring channels is carried out.
The monitoring functions in each monitoring channel work on the principle that a defined state must prevail before each action is carried out and a specific acknowledgement must be made after each action. If these expectations of a monitoring channel are not fulfilled, the drive coasts to a standstill (two channel) and an appropriate message is output.
Safe actual value sensing with encoder
The safe actual value sensing is based on the redundant evaluation of the differential incremental tracks A/B that supply HTL/TTL and the three Hall-effect sensors integrated in the motor.
All EC motors of the Siemens Product Partners with IQ encoder and Hall-effect sensors can be used for all of the safety functions of the SIMATIC MICRO-DRIVE drive system.
