TWO CHANNELS REDUNDANT SAFETY ARCHITECTURE SINGLE CHANNEL NON-REDUNDANT SAFETY ARCHITECTURE

Transcription

1 Table FY100-0/E Safety proportional valves with double power supply - option /U digital, direct or piloted operated, with one or two position transducers IEC Safety Integrity Level and ISO Performance Level - certified by TWO CHANNELS REDUNDANT SAFETY ARCHITECTURE Digital proportional valves with certified double power supply - option /U are intended for use in hydraulic circuits of machines which must comply with safety requirements, as hydraulic presses or other machinery with potential dangerous failures. These valves are designed to perform safety functions, in addition to the control of direction, speed, pressure/force or position of hydraulic actuators, depending to the valve type and options. SINGLE CHANNEL NON-REDUNDANT SAFETY ARCHITECTURE They are certified by TÜV in compliance to IEC up to SIL 2 / SIL 3 and ISO up to category 4, PL e - see section 3 The safety proportional valves are identified with a specific nameplate reporting the SAFETY CERTIFIED logo. 1 SAFETY NORMS The Machine directive 2006/42/EC with relevant harmonized norms IEC Safety Integrity Level (SIL) and ISO Performance Level (PL), represent the framework of the functional safety, which is key aspect in terms of general principles of prevention concerning safety of devices or system with health implications. IEC and relevant norms IEC (process control system) plus IEC (machine control systems) introduce the integrated probabilistic approach to the functional safety. They classify the failure probability into four Safety Integrity Levels: SIL1, SIL2, SIL3, SIL4, the increasing number identifies higher protection level (SIL4 is rarerly required). ISO norm considers the design and integration of safety related parts of a control system regardless of the applied technology. The requirements are classified into five Performance Levels: PL a, PL b, PL c, PL d, PL e, the increasing letter identifies higher protection level. 2 RISK ASSESSMENT The Risk Assessment has to be started at the machine design phase and it should take account of all the foreseeable tasks that will need to be performed on the machine. It is the responsibility of the machine manufacturer to ensure that all safety requirements are satisfied and to conduct a documented risk assessment to ensure that all potential machine hazards are covered. 3 TÜV CERTIFICATION Atos proportional valves with double power supply are certified by TÜV in compliance to: IEC 61508, IEC 61511, IEC max SIL 3 for direct operated valves type DHZO, DKZOR, DLHZO, DLKZOR max SIL 2 or SIL 3 for pilot operated valves type DPZO, depending on non-redundant or redundant safety architecture ISO category 1, PL c for non-reduntant and max category 4, PL e for redundant safety architecture Note: the category level classifies the system architecture: - Category 1 or 2 is assigned to non-redundant system - Category 3 or 4 is assigned to redundant system The TÜV certification guarantees the valve compliance with related safety norms and it proves that all requirements have been met for the SIL and PL levels claimed for the specific valve The certification also confirms the following data which can be used by the machine manufacturer for the certification of the whole system: the design process used by the valve manufacturer to avoid failures the design techniques and measures used to control failures the methods used to define hardware fault tolerances the methods used to measure the safe failure fractions the methods used to measure the probabilities of failure The use of non-certified products invests the machine manufacturer of the responsibility for validating that all above aspects have been carried out according to the applicable s. FY100

2 4 SAFETY RELATED PARTS OF THE CONTROL SYSTEM ACTUATOR DANGEROUS MOVEMENT PLC LASER BARRIER SPOOL POSITION MONITOR SENSORS LOGIC VALVE VALVE DIAGNOSTICS Detect dangerous situations Controls the machine operations and activates the safety procedures in case of dangerous situations Controls the actuator and avoids the dangerous movement Monitors the correct valve operation 5 DESCRIPTION OF SAFETY FUNCTION Digital proportional valves option /U are designed to receive separate power supplies for logic VL+ and solenoids SAFE_V+. The safety function is performed by removing the SAFE_V+ supply, in order to de-energizing solenoids and let spring force move the spool to the valve rest position. The driver remains powered ON thanks to VL+ supply, thus providing spool monitor signal to machine control unit through analog output or fieldbus communication. 6 SAFETY DIAGNOSTICS Digital proportional valves with double power supply provide output signals, via analog monitors or fieldbus interface, which can be processed by a superior control in order to perform continuous diagnostics and detect potential failures. Both monitors and fieldbus interface can be configured via software as different valve diagnostic signals, such as actual spool position or control deviation. Other output signals are available for indirect failure detection according to the valve execution: - pressure/force signals for valve with alternated P/Q control SP, SF, SL - hydraulic actuator position signal for valve with integral axis controller Note: indirect failure detection signals can be processed to monitor the state of the machine or the system, but they are not representative of the status of the safety proportional valve. 6.1 Control deviation The control deviation signal is the difference between the spool position demand value (spool expected position) and the actual spool position value (effective spool position). This signal can be accessed via monitor analog signal, reconfiguring via software the monitor output, or via fieldbus. This signal permits a direct monitoring of the system increasing control reaction performance in case of eventual valve s failure, since the superior control can process the control deviation without performing specific math calculations. Control deviation value: close to zero, means that the spool is correctly following the command signal (demand value) and the valve is properly working consistently different from zero for a time longer than the valve or system normal response (delay time), highlights an anomalous condition during the hydraulic regulation The admissible tolerance around the zero control deviation and the delay time have to be defined according to the application characteristics. Consults E-MAN* and Z-MAN* manuals for further details, see section Monitoring of control deviation Delay time Control deviation Tolerance Time

3 7 SAFETY ARCHITECTURE SIL and PL levels depends not only on the characteristics of the single components but also on the architecture of the hydraulic system and of the signals diagnostics. For example, redundant safety architectures and continuous automatic diagnostics increase the protection level permitting higher PL and SIL levels be achived. The following representations show the max achievable SIL and PL levels using proportional valves with double power supply, depending on the machine safety architecture. Example of single channel, non-redundant safety architecture DANGEROUS MOVEMENT SPOOL POSITION MONITOR SOLENOID POWER SUPPLY LOGIC POWER SUPPLY PLC Safety function = to prevent the dangerous cylinder movement in a certain phase of the cycle or in emergency The safety function is achieved by interrupting the power supply to the solenoids of the proportional valve so that the spool is moved by the springs to the central rest position with positive overlap. Through the continuous monitoring of the valve s spool position, the machine PLC verifies that the valve properly operates according to the command signal and in case of interruption of the solenoids power supply, the safe condition is fully accomplished - see section 5. The safety function is not performed in case of valve failure Fault tolerance HFT = 0 SIL and PL levels for single channel safety architecture: H SIL 3 for direct operated valves H SIL 2 for pilot operated valves H Performance Level category 1 PL c for direct and pilot operated valves Example of two channels, redundant safety architecture DANGEROUS MOVEMENT POPPET POSITION SWITCH SHUT OFF VALVE POWER SUPPLY PLC In this example a shut-off valve with poppet position switch has been added to grant a redundant safety architecture. The safety function is performed by interrupting the power supply to the solenoids of the proportional valve and synchronously close the shut-off valve SPOOL POSITION MONITOR SOLENOID POWER SUPPLY LOGIC POWER SUPPLY The safety function is performed even in case of failure of one valve, or Fault tolerance HFT = 1 SIL and PL levels for two-channels safety architecture: H SIL 3 for direct and pilot operated valves H Max Performance Level category 4 PL e for direct and pilot operated valves Digital proportional valve with double power supply - option /U (i.e. DHZO-TES-SN-NP-07*-L5 /U) Machine PLC supervising the safety function Monitor signals used for safety diagnostics Safety shut-off valve with poppet position switch (i.e. JO-DL /FV) FY100

4 8 HYDRAULIC CONFIGURATIONS In the below tables are shown the valve s hydraulic configuration according to the solenoid power supply status: DHZO, DKZOR-TES - direct operated, positive spool overlap - technical table FS165 51, 53 71, 72, 73 DHZO, DKZOR-TES/TEZ - direct operated, zero spool overlap - technical tables FS168, FS DPZO-TES - pilot operated, positive spool overlap - technical table FS172 51, 53 71, 73 DPZO-LES - pilot operated, positive spool overlap - technical table FS175 71, 73 DPZO-LES/LEZ - pilot operated, zero spool overlap - technical table FS178, FS DLHZO, DLKZOR-TES/TEZ - direct operated, zero spool overlap - technical tables FS180, FS with fail safe 1 or 3 60 without fail safe Note : Central safety rest position of zero spool overlap - configuration 70 In absence of solenoid power supply (SAFE_V+ = 0), the valve spool is moved by the springs force to the central safety rest position characterized by a small offset of about 1% to 6% of the total stroke in P-B / A-T configuration. This is specifically designed to avoid that in case of interruption of solenoid power supply, the actuator moves towards an undefined direction (due to the tolerances of the zero overlap spool), with potential risk of damages or personnel injury. Thanks to the central safety rest position the actuator movement is suddenly stopped and it is recovered at very low speed towards the direction corresponding to the P-B/ A-T connection. Spool position with solenoid power supply ON and reference signal = 0 (zero overlap position) Spool offset position 1% to 6% of total stroke with solenoid power supply OFF (central safety rest position)

5 9 POWER SUPPLY AND SIGNALS SPECIFICATIONS Option /U provides the following signals on the 12 pin main connector. Safe power supply (SAFE_V+ and SAFE_V0) The safe power supply must be appropriately stabilized or rectified and filtered: apply at least a mf/40 V capacitance to single phase rectifiers or a 4700 mf/40 V capacitance to three phase rectifiers. When safe power supply is removed from pins 1 and 2, the spring force moves the spool to the valve rest position due to solenoids de-energizing. A safety fuse is required in series to each power supply: 2,5 A time lag fuse. Power supply for driver s logic and communication (VL+ and VL0) The power supply for driver s logic and communication must be appropriately stabilized or rectified and filtered: apply at least a mf/40 V capacitance to single phase rectifiers or a 4700 mf/40 V capacitance to three phase rectifiers. The presence of driver s logic and communication power supply on pin 9 and 10, allow to remove safe power supply from pin 1 and 2 maintaining active the monitors signals, diagnostics and fieldbus communications. A safety fuse is required in series to each driver s logic and communication power supply: 500 ma fast fuse. Do not disconnect VL0 before VL+ when the driver is connected to PC USB port Enable Input Signal To enable the driver, supply 24 VDC on pin 3 referred to pin 10: Enable input signal allows to enable/disable the current supply to the solenoid, without removing the electrical power supply to the driver; it is used to maintain active the communication and the other driver functions when the valve has to be disabled. This condition does not comply with European Norms IEC and ISO Fault Output Signal Fault output signal indicates fault conditions of the driver (solenoid short circuits/not connected, reference signal cable broken for 4 20mA input, etc.). Fault presence corresponds to 0 VDC, normal working corresponds to 24 VDC (pin 11 referred to pin 10): Fault status is not affected by the Enable input signal. The Fault output signal must not be directly used to activate safety functions, like to switch-on/off the machine s safety components, as prescribed by norm ISO MAIN CONNECTOR SIGNALS -12 pin - /U option PIN TES LES TEZ LEZ TECHNICAL SPECIFICATIONS NOTES 1 SAFE_V+ Safe power supply 24 VDC for solenoid Input - power supply 2 SAFE_V0 Safe power supply 0 VDC for solenoid Gnd - power supply 3 ENABLE Enable (24 VDC) or disable (0 VDC) the driver, referred to VL0 Input - on/off signal Flow reference input signal: ±10 VDC / ±20 ma maximum range Q_INPUT+ Defaults are ±10 VDC for and 4 20 ma for /I option Input - analog signal 4 Position reference input signal: P_INPUT+ ±10 VDC / ±20 ma maximum range 5 INPUT- Negative reference input signal for Q_INPUT+, F_INPUT+ and P_INPUT+ Input - analog signal 6 Q_MONITOR 7 F_INPUT+ 8 F_MONITOR P_MONITOR Flow monitor output signal: ±10 VDC / ±20 ma maximum range, referred to VL0 Defaults are ±10 VDC for and 4 20 ma for /I option Position monitor output signal: ±10 VDC / ±20 ma maximum range, referred to VL0 Pressure/force reference input signal: ±10 VDC / ±20 ma maximum range Defaults are ±10 VDC for and 4 20 ma for /I option Pressure/force monitor output signal: ±10 VDC / ±20 ma maximum range, referred to VL0 Defaults are ±10 VDC for and 4 20 ma for /I option Output - analog signal Input - analog signal Output - analog signal 9 VL+ Power supply 24 VDC for driver s logic and communication Input - power supply 10 VL0 Power supply 0 VDC for driver s logic and communication Gnd - power supply 11 FAULT Fault (0 VDC) or normal working (24 VDC), referred to VL0 Output - on/off signal PE EARTH Internally connected to driver housing Note: connections NOT available for TES/LES in SN execution 11 CONNECTIONS MAIN CONNECTORS ZM-12P - 12 pin - metallic A1 A2 A1 ZH-12P - 12 pin - plastic male - 12 pin (2) A2 Notes: use of metallic connectors is strongly recommended in order to fulfill EMC requirements For fieldbus and/or transducers connections, refer to specific technical tables for each valve model. (2) pin layout always referred to driver s view FY100

6 12 RELATED DOCUMENTATION General tables: F002 Basics for digital electrohydraulics GS001 Basics for digital proportionals GS002 Basics for digital proportionals with P/Q control GS003 Settings for digital proportionals GS500 Programming tools GS510 Fieldbus K500 Electric and electronic connectors P005 Mounting surfaces for electrohydraulic valves Valves technical tables: FS165 DHZO-TES, DKZOR-TES, direct operated FS172 DPZO-TES, pilot operated FS175 DPZO-LES, pilot operated FS168 DHZO-TES, DKZOR-TES, direct operated FS180 DLHZO-TES, DLKZOR-TES, direct operated, sleeve execution FS178 DPZO-LES, pilot operated FS230 TEZ/LEZ digital proportional valves with integral axis controller Commissioning and troubleshooting tables: F003 Commissioning and troubleshooting QF300 Quickstart for TES direct operated proportional valves (supplied with the valve) QF320 Quickstart for TES/LES pilot operated proportional valves (supplied with the valve) Operating and fieldbus manuals: E-MAN-RI-LES - TES and LES drivers user manual E-MAN-RI-LES-S - TES and LES drivers with S option user manual E-MAN-S-BC - CANopen protocol programming manual E-MAN-S-BP - PROFIBUS DP protocol programming manual E-MAN-S-EH - EtherCAT protocol programming manual E-MAN-S-EW - POWERLINK protocol programming manual E-MAN-S-EI - EtherNet/IP protocol programming manual E-MAN-S-EP - PROFINET IRT protocol programming manual SIL safety manuals for operating, installation and maintenance (supplied with the valve): TT366 DHZO-TES/TEZ, DKZOR-TES/TEZ TT367 DLHZO-TES/TEZ, DLKZOR-TES/TEZ TT368 DPZO-TES/LES/LEZ TUV certificates (supplied with the valves): C-IS Safety proportional valves, direct operated C-IS Safety proportional valves, piloted operated 06/18