ServoOne CM. Specification SDC DE EN IT CN. Integrated safety control with encoder version. deutsch english italiano

Transcription

1 ServoOne CM Specification SDC deutsch english italiano 中文 DE EN IT CN Integrated safety control with encoder version

2 2 This document does not replace the Operation Manual ServoOne CM Axis Controller ID no.: B.X It supplements this manual with a description of the safety function SDC. Please always follow the information given in "Measures for your safety", "Intended use" and "Responsibility" in the operation manual mentioned above. You will find information on mounting, installation and commissioning along with the assured technical characteristics of the SystemOne CM system in the additional documents (operation manuals ServoOne CMP and MotionOne CM, device help ServoOne CM, etc.) ID no.: B.0-00 Date: Applicable as from: I/O-Expander: This documentation is to be kept! Firmware V SDC V V The German version of this document is the original version, versions in all other languages have been translated from the original text. Subject to technical change without notice: The content of our documentation was compiled with the greatest care and attention, and based on the latest information available to us. We should nevertheless point out that this document cannot always be updated simultaneously with the on-going technical development of our products. Information and specifications may be subject to change at any time. For information on the latest version please visit

3 Table of contents 1 About this document Scope Intended use Order code Hazard analysis and risk assessment Maintenance and repair Definition of terminology Function description Overview of the connections Wiring and commissioning State as delivered Safe inputs (SO CM axis controller) Electrical isolation concept Test pulses from the supply unit SO-CMP Example circuits for the inputs Safe brake output (SBC) Safe encoder evaluation Single-axis controller Double-axis controller Triple-axis controller Safety assessment: Encoder type "Drive " Requirements on a sin/cos encoder Requirements on an HTL encoder or on counting pulses Evaluation of speed and direction of rotation Requirements on an HDSL encoder FSoE address setting, slave Response times Validation Validating safety function SBC Validating monitoring using signatures Safety instructions...30 A Appendix A.1 Safety-related characteristics...31 A.2 Declaration of conformity...31 DE EN IT CN 3

4 4

5 1 About this document 1.1 Scope This document only applies to the ServoOne CM axis controller type: SOCM-1.xxxx.x2xx.x, SOCM-2.xxxx.x2xx.x, SOCM-3.xxxx.x2xx.x From SN: 1717xxxxx You will find the data on manufacture along with characteristic data and the model on the rating plate of the ServoOne CM axis controllers. For the location of the rating plate on the device refer to the operation manual. Year = Year of production 1.3 Order code The article designation provides information on the related variant of the axis controller supplied. You will find the significance of the individual characters of the order code in the column on the left. ServoOne CM Axes Supply Cooling Rated current SO CM : Single-axis controller 2: Double-axis controller 3: Triple-axis controller 0: DC (from SOCMP) 0: Wall mounting (with heat sink) 1: Cold plate (without heat sink) 01: 1.5 A 03: 3 A 06: 6 A 12: 12 A 16: 16 A 18: 18 A 24: 24 A 32: 32 A DE EN IT CN Figure 1.1 Data on manufacture, rating plate Encoder interface 1: Standard 2: Hiperface DSL (one-cable single-cable solution) + standard 3: Hiperface DSL (one-cable solution) 1.2 Intended use The axis controllers are components for installation in industrial/commercial plants and machinery. It is imperative they are installed in a switch cabinet with degree of protection IP54 or higher. Safety function Extras Model Version index * In preparation 1: SD0 (STO and SBC) standard 2: SDC (encoder version SinCos + HDSL ) 3: SDC (encoder version SinCos + EnDat2.2)* 4: SDC (encoder version Resolver + HDSL )* 5: SDC (encoder version resolver + EnDat2.2)* 0: None 1: Assemblies coated 0: LTI Motion About this document 5

6 About this document Hazard analysis and risk assessment 1.6 Definition of terminology The user of the safety functions of the device variant SDC of the ServoOne CM axis controller must follow the currently applicable version of the Machinery Directive 2006/42/EEC. The manufacturer or the manufacturer's representative has the obligation to undertake a hazard analysis (as per applicable Machinery Directive) prior to placing a machine on the market. The manufacturer must undertake an analysis of the hazards that emanate from the machine and implement appropriate measures to reduce/eliminate the hazards. With the hazard analysis the prerequisites are met to be able to define the necessary safety functions. The safety functions of the device variant SDC of the ServoOne CM axis controller have been accepted by the accredited certification body TÜV Rheinland Industrie Service GmbH. Conformance to parts of ISO , EN 62061, EN and EN is ensured. Note, qualifications! The operator of the safety-related system is trained to suit his/her level of knowledge, which is appropriate for the complexity and the safety integrity level of the safety-related system. The training includes the study of the main features of the production process and knowledge of the relationship between the safety-related system and the EUC (Equipment Under Control). 1.5 Maintenance and repair Actions to maintain or service the device are not necessary. If there is a fault, particularly if safety functions are affected, the device is to be replaced and returned to the manufacturer. Safety functions A safety function is a function that is provided by an E/E/PE (electrical/ electronic/ programmable electronic) safety-related system, a safety-related system in a different technology or external devices for risk reduction with the goal of achieving or maintaining a safe state for the EUC taking into account a special undesirable event. STO: Safe Torque OFF The supply of power to the drive is safely interrupted (no electrical isolation) with the safety function STO. The drive is not allowed to be able to produce any torque and therefore no hazardous movement. The standstill position is not monitored. The STO function complies with stop category 0 in accordance with EN SBC: Safe Brake Control The function SBC is used for the safe operation of a holding brake. SS1: Safe Stop 1 The drive is braked by the action of the drive controller and during this process the change in speed or the time is monitored. Once standstill is reached or if the time has elapsed, the STO function is activated. SS2: Safe Stop 2 The drive reduces the movement to standstill and monitors the change in speed. Once standstill is reached, the SOS function is activated. SOS: Safe Operating Stop An operating stop is the state in which the motor is maintained at standstill; the drive is in speed or position control. SLS: Safely Limited Speed The drive is monitored for compliance with a defined speed limit (vmax). SLI: Safely Limited Increment The movement of the drive is monitored for a limiting value per movement task. The safety function makes possible a safe jog mode.

7 SDI: Safe Direction Monitoring for the stipulated direction of rotation or movement of the axis. SCA: Safe Cam If the motor speed or the motor position is in a defined range, a safe signal is output. SLP: Safely Limited Position DE EN IT CN Monitoring that the drive does not exceed a defined position as a limiting dimension. OSSD: Output Signal Switching Device An OSSD is a safe output switching element. Such an output switching element is safe because the safe controller continuously emits a test pulse as short as possible on the output and in this way detects whether a downstream semiconductor on this output can still be switched. Test pulse generator The TP generator in the ServoOne CMP supply unit generates test pulses (signatures), so that the downstream peripherals can be checked for short circuits and cross circuits. If the related safe digital input is configured accordingly, the input expects a signature generated by the TP generator. If the expectation is not met, the system changes to the safe state. The functions of all safety functions supported by the device version SDC of the ServoOne CM axis controller are described in the programming manual "Safety Manager" (in preparation). About this document 7

8 8

9 2 Function description Axis controller malfunctions must be detected by the superimposed monitoring of the movement or by other measures in the application. The detection and the reaction are the responsibility of the user. The safety system provides the safety functions STO and SBC that the user can employ as a reaction to axis controller malfunctions in the application The safety control in the device version SDC of the ServoOne CM axis controller is certified according to the requirements of EN ISO PL e / cat 4 and EN / EN SIL CL 3. The safety function STO describes a protective measure as an interlocking or control function. Category 4 signifies that on the occurrence of up to two failures, the safety function is retained. The STO function is the fallback solution for all other safety functions because it ensures that the drive does not produce any torque. The other safety functions can be used up to max. SIL 3 /PL e (cat 4) depending on the sensors used. The safety-related parts are designed such that: y A single failure in any of these parts does not result in the loss of the safety function, and y The single failure is detected on or before the next demand upon the safety function. If this detection is not possible, an accumulation of failures must not result in the loss of the safety functions. Compared to the conventional solution, the integrated safety functions offer the following advantages: y No need for external motor contactors y Less wiring effort y Space-saving y Better EMC behaviour, achieved with continuous shielding of the motor cable y Shorter response times CAUTION! The safety function may be lost on the occurrence of two or more failures! Certain failures are detected by the internal diagnostic features in the inactive state or on the transition from the active state to the inactive state of the safety function. To reduce the residual risk due to undetected failures, at least once every 24 h it is necessary to request the safety functions if these are not tested automatically by a pulse pattern. The SIL achieved by the forced state change of the application must be determined by the user. The safety function STO is certified according to SIL3, PL e (cat 4), an accumulation of more than two failures can cause the loss of the safety function if the control signals are not tested automatically. It must be ensured that the user or the machine control initiates a shutdown at least once every 24 h. DE EN IT CN Function description ID no.: B.0-00 Date:

10 Function description ID no.: B.0-00 Date:

11 3 Overview of the connections The device version SDC has four safe digital inputs on X11 and, depending on the number of axes, one to three safe brake outputs with high driver power on X12 / X13 / X14. The FSoE slave address can be set with the aid of the DIL switch block (S-ADR). X5.1 / X5.2 X6 X7 X9 X8 X10 X11 X11 X11 X11 Abbreviation X7 X8 X9 X10 Designation Encoder interface Encoder interface Encoder interface Encoder interface Details See 4.4 Safe encoder evaluation X11 Safe inputs See 4.2 Safe inputs (SO CM axis controller) X12 Power connection motor 1 X13 Power connection motor 2 X14 Power connection motor 3 S-ADR Table 3.1 FSoE slave addressing Key to layout With integrated connections for motor holding brake. See 4.3 Safe brake output (SBC) DIL switch block for setting the FSoE address. See 4.5 FSoE address setting, slave DE EN IT CN S-ADR X12 X13 S-ADR X12 X14 X13 S-ADR X12 SO CM-1.xxxx.x SO CM-2.xxxx.x SO CM-3.xxxx.x Figure 3.1 Layout ID no.: B.0-00 Date: Overview of the connections 11

12 Overview of the connections ID no.: B.0-00 Date:

13 4 Wiring and commissioning 4.1 State as delivered In the state as delivered the safety function STO is activated and deactivated by the two safe digital inputs SDI00 and SDI01 for all axes on the ServoOne CM axis controller (number of axes depending on the version: single, double or triple-axis controller). The activation of the brake output via the functional section is always enabled. It is possible to change this configuration using the programming software SafetyManager. If the state as delivered is overwritten by transferring a program from SafetyManager, the state as delivered cannot be restored again using the Reset to factory setting function! To make it possible to wire the power stage and use the brake output again, a program containing the safety block STO must be transferred from SafetyManager (you will find more information on this aspect in the programming manual). The State as delivered function is used to make it possible for the user to undertake functional tests. The user is responsible for the compliance of the requirements with the safety assessment for the machine and/or system. DE EN IT CN 4.2 Safe inputs (SO CM axis controller) The device version SDC of the ServoOne CM axis controller has four safe digital inputs. They are suitable for connecting single-channel or dual-channel signals with and without pulsing, or cross circuit testing. Used individually, they satisfy the requirements of SIL 2 / PL d, a group of two inputs satisfies the requirements of SIL 3 / PL e. On wiring the safe digital inputs in closed cabinets, the following procedure must be followed: Dual-channel control: y A three-core cable that contains GND and both channels for one safe digital input y Three twisted individual wires (GND and two channels, where one channel is for each safe digital input) Figure 4.1 Wiring SDI00 and SDI01 Single-channel control: y Shielded individual wires. It is possible to commission the drive-related section without first transferring a program prepared in SafetyManager. Wiring and commissioning 13

14 Wiring and commissioning 14 Figure ServoOne CM Type X11/SDI00 Safe digital input X11/GND* Reference ground SDI00 and SDI01 SDI00 SDI02 GND GND X11/SDI01 Safe digital input SDI01 SDI03 X11/SDI02 Safe digital input X11 / Safe - DI X11/GND* Reference ground SDI02 and SDI03 Des. Specification Electrical isolation SDI00 Activate input = high level Deactivate input = low level Yes 2) SDI01 OSSD support 1) Switching level low/high: < 5 V / > 15 V DC U In max up to 30 V I In max = 15 ma (in the range -3 V V) Input characteristic type 1 in accordance with EN Yes 2) X11 / SDI03 Safe digital input * The GND connections are not connected internally Function for the safe digital inputs SDI00 to SDI03 can be programmed as required (see 4.1 State as delivered) Table 4.1 Terminal assignment X11/Safe-DI Each of the four inputs is suitable for the connection of OSSD signals, e.g., as are used by various safe outputs for an internal self-test or shutdown test. OSSD test pulses to be filtered out must comply with the following specification: y The duration of the test pulses must be 0.75 ms. y The repetition rate of the test pulses must be 30 ms. CAUTION! On failure to observe this information, the device or the machine may be damaged. If the duration of the test pulses is in the range from 0.75 ms to 2 ms, they will result in undesired shutdowns at unpredictable times. This statement applies irrespective of whether the cross circuit monitoring is used or not. The ServoOne CM axis controller detects a "high" level on the related input if the voltage connected is greater than 15 V and low level if the voltage is less than 5 V (as per EN ). SDI02 Activate input = high level Deactivate input = low level Yes 2) SDI03 OSSD support 1) Switching level low/high: < 5 V / > 15 V DC U In max up to 30 V I In max = 15 ma (in the range -3 V V) Input characteristic type 1 in accordance with EN Yes 2) The behaviour of the inputs is undefined in the range > 5 V / < 15 V. 1) OSSD = safe output signal switching device 2) See Electrical isolation concept Table 4.2 Specification X11/Safe-DI Electrical isolation concept y The digital inputs SDI00/SDI01/GND are isolated in relation to SDI02/SDI03/GND y All inputs are isolated in relation to the 24 V supply y All inputs are isolated in relation to the PE y Maximum permissible isolation voltage: SELV/PELV y Maximum permissible input voltage: - 60 V to + 60 V Short circuits, earth faults and cross circuits can result in the failure of the safety function and must be prevented as per EN13849.

15 4.2.2 Test pulses from the supply unit SO-CMP The safe digital inputs are also able to check the test pulses generated by the SO-CMP supply unit. Using these test pulses, faults on the inputs in the external wiring can be detected, as only the correspondingly configured pulse pattern is accepted. Each input can be configured separately in this way for the following signal sources: Connection of test pulses on outputs ERR Voltage TPxx H Test pulse format 30 ms < t P < 1,2 s DE EN IT CN y Input is allocated to a pulse pattern y Input is allocated to a continuous DC 24 V voltage The figure below shows the test pulses from the SO-CMP supply unit and at the same time specifies the test pulses expected. X3 XC OUT L TP00 0,35-0,75 ms t H RO01NC RO01CO RO01NO X6 / State TP00 TP01 GND L TP01 H > 10 ms t RO02CO RO02NO L t Figure 4.2 SO-CMP supply unit test pulses On the allocation of the test pulses, it is to be ensured that the inputs SDI00 and SDI01 are not operated using the same test pulse signal. The same applied for the inputs SDI02 and SDI03. Otherwise the system changes to the safe state and outputs an alarm message. For the inputs it is also possible to use an HTL encoder as the counting pulse for the encoder evaluation. Wiring and commissioning 15

16 Wiring and commissioning Example circuits for the inputs In the following circuit examples it is a prerequisite that the switching elements used have safety-related approval as per the required PL in accordance with EN ISO or SIL in accordance with EN / EN In addition the following points must be noted: y The safety regulations and EMC guidelines must be met. y In relation to the failure exclusions assumed, reference is made to the table in annex D of the standard EN ISO The examples shown in the following and their characteristic architecture define the allocation to a category in accordance with EN ISO The resulting maximum possible performance levels in accordance with EN ISO continue to be dependent on the following factors related to the external components: y Structure (single or redundant) y Detection of common cause failures (CCF) y Diagnostic coverage on demand (DCavg) y Time to the dangerous failure of a channel (MTTFd) Example 1: Single-channel sensor, without cross circuit test The examples in the following show the connection to SDI00 and SDI01 in various combinations. The specifications for the circuits and characteristics of SDI02 and SDI03 are identical to those for SDI00 and SDI01. Figure 4.3 Notes on example 1 Single-channel sensor, without cross circuit test The single-channel sensor is connected to an input on the ServoOne CM axis controller without pulsing. This design is not recommended for safety applications because the failure of the switching element would deactivate the safety function. A short circuit between the incoming and return conductor would bypass the switching element and it would not be possible to detect a short circuit. PL b can be achieved as a maximum. For higher requirements on the SIL/PL, the cross circuit test as per example 3 must be used. After the transition of the input signal from "active" to "inactive", the signal must remain in the "inactive" state for at least 10 ms before the transition to "active" takes place. To meet the test rate for category 2, the demand rate for the safety function controlled using the single-channel input is not allowed to be more frequent than once per 240 s.

17 Example 2: Dual-channel sensor, without cross circuit test Example 2b: Dual-channel sensor, without cross circuit test with high side / low side DE EN IT CN Figure 4.4 Dual-channel sensor, without cross circuit test Figure 4.5 Dual-channel sensor, without cross circuit test with high side / low side Notes on example 2 The usage of homogeneous dual-channel sensors without test pulses provides a redundant shut-off path, however a short circuit between the incoming and return conductors will bypass the switching elements. It is also not possible to detect a cross circuit. Safe operation can only be achieved by separate cable laying and the exclusion of a short circuit on the terminals. This type of connection is not to be recommended for safety applications outside the switch cabinet. Taking into account the short circuit and cross circuit fault exclusion (as per EN ISO ) and the usage of suitable switching elements with positively opening contacts, PL e can be achieved. Notes on example 2b The usage of homogeneous dual-channel sensors without test pulses provides a redundant shut-off path, however a short circuit between the incoming and return conductors will bypass the switching elements. It is still not possible to detect a cross circuit, except for a short circuit between SDIxx and GND. Safe operation can only be achieved by separate cable laying and the exclusion of a short circuit on the terminals. This type of connection is not to be recommended for safety applications outside the switch cabinet. Taking into account the short circuit and cross circuit fault exclusion (as per EN ISO ) and the usage of suitable switching elements with positively opening contacts, PL e can be achieved. Wiring and commissioning 17

18 Wiring and commissioning 18 Example 3: Single-channel sensor with cross circuit testing Example 4: Dual-channel sensor with cross circuit testing Figure 4.6 Single-channel sensor with cross circuit testing Figure 4.7 Dual-channel sensor with cross circuit testing Notes on example 3 On the usage of a single-channel sensor with pulses, short circuits in relation to 24 V DC and 0 V DC and an open circuit in the cable will be detected. However, cable short circuits between the two connections on the sensor and a short circuit between the input and pulse output are not detected. The failure of the switching element is also not detected; this situation will result in the loss of the safety function. Taking into account the short circuit and cross circuit fault exclusion (as per EN ISO ), PL d can be achieved if a suitable switching element with positively opening contacts is used and the sensor is triggered at regular intervals and the safety function demanded in this manner. After the transition of the input signal from active to inactive, the signal must remain in the "inactive" state for at least 10 ms before the transition to "active" takes place. To meet the test rate for category 2, the demand rate for the safety function controlled using the single-channel input is not allowed to be more frequent than once per 240 s. Notes on example 4 By using two independent pulse signals on the homogeneous sensor, all cross circuits can be detected. Normally closed contacts are recommended for safety functions. This is because only these contacts can be tested using the test pulses. On the usage of suitable switching elements with positively opening contacts, PL e as per EN ISO can be achieved.

19 Example 5: Safety control with single-channel high-side output Example 6: Safety control with dual-channel high-side output DE EN IT CN Figure 4.8 Safety control with single-channel high-side output Figure 4.9 Safety control with dual-channel high-side output Notes on example 5 It is possible to use single-channel safety controls that have a suitable output with the required PLr. However, a short circuit on the input SDIxx in relation to 24 V DC will not be detected. Safe operation can only be achieved by the exclusion of a short circuit on the terminals in relation to 24 V DC. This type of connection is not to be recommended for safety applications outside the switch cabinet. Taking into account the short circuit and cross circuit fault exclusion (as per EN ISO ), PL d can be achieved. Notes on example 6 The usage of dual-channel safety controls provides a redundant shut-off path, however the detection of a cross circuit on both outputs on the safety control in relation to 24 V DC is not possible. Safe operation can only be achieved by separate cable laying and the exclusion of a short circuit on the terminals in relation to 24 V DC. This type of connection is not to be recommended for safety applications outside the switch cabinet. Taking into account the short circuit and cross circuit fault exclusion (as per EN ISO ) and detection of an individual short circuit on one of the outputs on the safety control in relation to 24 V DC, PL e can be achieved. Wiring and commissioning 19

20 Wiring and commissioning Safe brake output (SBC) The axis controller support the safety function SBC (Safe Brake Control) according to the requirements of EN , EN ISO PL d category 3 and EN / EN SIL 2. You will find the safety-related characteristics in appendix A.1 Safetyrelated characteristics. Usage of a safety brake with a manufacturer's specification that excludes this failure with the necessary safety integrity. It is only allowed to connect brakes, contactors or relays with a minimum holding voltage 5 V to the brake driver outputs on the system. The switching elements used must be designed as per the required PL and category in accordance with EN ISO or SIL in accordance with EN / EN or have appropriate safety-related approval. The release of the brake can be delayed by up to 200 ms by the internal diagnostics on the brake output. CAUTION! On failure to observe this information, the device or the motor may be damaged. The two failures Short circuit output brake driver and "Short circuit between any cores in the motor supply cable" must be excluded by means of suitable wiring. Definition and validation of a second means of braking in the application. For instance this feature can be achieved by using two brakes where each brake is in itself capable of applying the necessary braking torque. In addition, the function of the brakes must be validated regularly. The user of the safety system is responsible for ensuring that short circuits on each brake output on an axis controller in relation to the brake output on the next axis controller can be excluded by means of suitable design of the wiring. If the brake does not release due to a failure, the safety function may be lost due to wear or irreparable damage to the brake. The failure "Brake does not release" must be taken into account during the design of the brake(s) and the validation. The failure Brake does not engage must be excluded by one of the following measures:

21 If a redundant brake is operated by an external control in the application, the user of the safety system must exclude a short circuit between any core in the brake supply cable from the axis controller in relation to any core in the brake supply cable from the external control by means of suitable wiring. 4.4 Safe encoder evaluation Along with the drive and control-related evaluation of various encoder signals, the device version SDC of the ServoOne CM axis controller also makes it possible to monitor the encoder signal in the context of functional safety. This internal diagnostics makes it possible to integrate the various safety monitoring functions. On additional usage of a monitoring encoder in the form of redundancy for the process encoder, it is possible to increase the Performance Level (PL) or Safety Integrity Level (SIL) for the application, provided both encoder systems act on a common axis. EMC measures such as shielding etc. are to be noted. DE EN IT CN If redundant brakes are used in the application, the user must exclude the fault "Both brakes lose the mechanical coupling to the application at the same time" (shaft fracture, slipping etc.) by means of suitable design of the coupling of the brakes or oversizing the shaft (both brakes on the same shaft). X11/X13/X14 Function Figure BRK_OUT BRK_GND Specification High side switching in relation to 24 V GND Connection for motor holding brake, contactors or relays I = 2 A max. On the usage of encoder combinations, the encoders must be free of mutual interactions. This statement applies both to the electrical part and the mechanical part. If both encoders are coupled to the system to be monitored via common mechanical parts, the connection must positive and must not include any wearing parts (chains, toothed belts etc.). If, nevertheless, this is the case, additional monitoring devices for the mechanical connection of the sensor are required (e.g. monitoring a toothed belt). For active position processing up to SIL3 EN61508 or PL e EN 13849, an absolute encoder must be used on at least one of the two encoder interfaces. It is permissible to use a SIN/COS encoder for position processing: y For safety functions up to SIL 2/ EN61508 or PL d / EN y In conjunction with unambiguous referencing y Cyclic safety-related forced checking of the referencing On the usage of two equivalent sensors, it is to be ensured that the sensor with the higher resolution is configured as sensor 1 (process sensor) and the sensor with the lower resolution is configured as sensor 2 (reference sensor). The SIL / PL actually achievable in the end is dependent on the encoders used and their safety-related characteristics. The following tables show the maximum level achievable theoretically. Figure 4.10 Connection of safe brake output (SBC) Wiring and commissioning 21

22 Wiring and commissioning 22 CAUTION! Electrical components in the encoder may be damaged if this instruction is not followed. The encoder connections are not allowed to be connected or disconnected during operation. Switch off the supply of electrical power to encoders connected and the SDC assembly module before connecting or disconnecting the encoder connections. Make sure the external power supply for externally supplied encoders is switched off. Twisted pair cables according to the RS485 standard for signal transmission are to be used for the data and clock signals and for track A and track B. On the selection of the wire cross-section, the current consumption of the encoder and the cable length in the installation in the specific case are to be taken into account. The following encoder combinations show the possible arrangements Single-axis controller Encoder A Encoder B PL / SIL Type Connection Type Connection max. 1 SSI X7 HTL X11/1 PL e / SIL 3 2 Drive 1) X7 HTL X11/1 PL e / SIL 3 3 Sin/Cos X7 Drive 1) X8 PL e / SIL 3 4 Sin/Cos X7 HTL X11/1 PL e / SIL 3 5 NC - DSL X12 PL e / SIL 3 6 Drive 1) - DSL X12 PL e / SIL 3 7 Sin/Cos X7 DSL X12 PL e / SIL 3 8 Sin/Cos X7 NC - PL e / SIL 3 1) See chapter Yellow fields = encoders that are safely evaluated. Table 4.3 Encoder combination single-axis controller encoder axis Double-axis controller Encoder A Encoder B SIL / PL Type Connection Type Connection max. 1 SSI X7 HTL X11/1 PL e / SIL 3 2 Drive 1) - HTL X11/1 PL e / SIL 3 3 Sin/Cos X7 Drive 1) - PL e / SIL 3 4 Sin/Cos X7 HTL X11/1 PL e / SIL 3 5 NC - DSL X12 PL e / SIL 3 6 Drive 1) - DSL X12 PL e / SIL 3 7 Sin/Cos X7 DSL X12 PL e / SIL 3 8 Sin/Cos X7 NC - PL e / SIL 3 1) See chapter Yellow fields = encoders that are safely evaluated. Table 4.4 Encoder combination double-axis controller encoder axis 1 Encoder A Encoder B SIL / PL Type Connection Type Connection max. 1 SSI X9 HTL X11/2 PL e / SIL 3 2 Drive 1) - HTL X11/2 PL e / SIL 3 3 Sin/Cos X9 Drive 1) - PL e / SIL 3 4 Sin/Cos X9 HTL X11/2 PL e / SIL 3 5 NC - DSL X13 PL e / SIL 3 6 Drive 1) - DSL X13 PL e / SIL 3 7 Sin/Cos X9 DSL X13 PL e / SIL 3 8 Sin/Cos X9 NC - PL e / SIL 3 1) See chapter Yellow fields = encoders that are safely evaluated. Table 4.5 Encoder combination double-axis controller encoder axis 2

23 4.4.3 Triple-axis controller The following encoder combinations show the possible arrangements: Encoder A Encoder B SIL / PL Type Connection Type Connection max. 3 Sin/Cos X7 Drive 1) - PL e / SIL 3 5 NC - DSL X12 PL e / SIL 3 6 Drive 1) - DSL X12 PL e / SIL 3 7 Sin/Cos X7 DSL X12 PL e / SIL 3 8 Sin/Cos X7 NC - PL e / SIL 3 1) See chapter Table 4.6 Encoder combination triple-axis controller encoder axis 1 Encoder A Encoder B SIL / PL Type Connection Type Connection max. 1 SSI X9 HTL X11/2 PL e / SIL 3 2 Drive 1) - HTL X11/2 PL e / SIL 3 3 Sin/Cos X9 HTL X11/2 PL e / SIL 3 5 NC - DSL X13 PL e / SIL 3 6 Drive 1) - DSL X13 PL e / SIL 3 7 Sin/Cos X9 DSL X13 PL e / SIL 3 8 Sin/Cos X9 NC - PL e / SIL 3 1) See chapter Table 4.7 Encoder combination triple-axis controller encoder axis 2 Encoder A Encoder B SIL / PL Type Connection Type Connection max. 1 SSI X10 HTL X11/1 PL e / SIL 3 2 Drive 1) - HTL X11/1 PL e / SIL 3 3 Sin/Cos X10 HTL X11/1 PL e / SIL 3 5 NC - DSL X14 PL e / SIL 3 6 Drive 1) - DSL X14 PL e / SIL 3 7 Sin/Cos X10 DSL X14 PL e / SIL 3 8 Sin/Cos X10 NC - PL e / SIL 3 1) See chapter Table 4.8 Encoder combination triple-axis controller encoder axis 3 CAUTION! Exclude dangerous short circuit! The safety-related evaluation and monitoring of the individual encoder signals in the ServoOne CM axis controllers is not adequate for every application. E.g. a complete safety assessment must be undertaken for uncertified encoder systems. In addition, the fault Fastening becomes detached at standstill or during the movement (safety standard EN , Annex D, Table D.16) is to be considered for single-channel systems, independent of the certification. DE EN IT CN Wiring and commissioning 23

24 Wiring and commissioning Safety assessment: A safety assessment for uncertified encoder systems must be undertaken based on the safety standard EN , fault assessment and FMEA based on tables from Annex D. Assessment of the internal layout of the encoder based on the manufacturer's documentation. Important points for such an assessment can be: y Are sin/cos signals processed separately? y Can the encoder disc become detached from the shaft or slip? y Can the encoder suffer interference due to external light? y Is the power of the transmit LED regulated and is there end-of-life monitoring? y Are sin/cos or TTL signals generated using signal processing and/or an interpolator? y Are the systems for the absolute position and incremental track independent? y For encoders that contain complex ASICs or similar for signal processing or interpolation, the following fault assumption applies: "Incorrect output signal due to malfunction of the ASIC" that cannot be excluded and cannot be detected by diagnostics without using a second, independent encoder. y For encoders that use a "complex" protocol that requires a processor or an ASIC to process, the fault model for communication buses applies. y On the usage of two encoders, the accuracy of the safe evaluation is always based on the encoder with the poorer resolution. Encoder cable: y It is only allowed to use encoder cables with a maximum length of 30 m for the connection of safe encoders. y The user must exclude a short circuit between the motor phases and the H-DSL encoder signals... In the motor connector (axis controller-cable) In the motor cable In the motor connector (cable-motor) In the motor.... Speed and signal frequencies: y The maximum values for speeds and signal frequencies stated in Table 4.1 and Table 4.1 are not allowed to be exceeded. Shutdown response time: y If redundancy in the form of a monitoring encoder for the process encoder is used in an application, the resolution of the monitoring encoder defines the response time for the shutdown for certain faults Encoder type "Drive " With the encoder type setting "Drive", the user can use a non-safe encoder signal as the second channel for plausibility and redundancy. On the usage of the encoder combination SinCos + drive, the pulses per revolution from each of the two encoders must differ for reasons of plausibility and fault exclusion. Which encoder signal is used can be selected using the following parameters in the axis controller: Parameter ID Parameter Description ) ) ) ENC_CH_SDCSel Setting: Encoder channel CH1(0) = Multi Encoder Interface 4) Encoder channel CH2(1) = Simple Encoder Interface 4) Encoder channel CH3(2) = Encoder via Motorcable 4) 1) Single, double and triple-axis controllers 2) Double and triple-axis controllers 3) Only triple-axis controllers 4) See next table Table 4.9 Encoder type setting "Drive" Axis 1: Encoder channel select for SafePosition SDC Axis 2: Encoder channel select for SafePosition SDC Axis 3: Encoder channel select for SafePosition SDC

25 X6 X7 X9 X8 X10 X11 Position Interface Type X7 Multi encoder interface X8 Simple encoder interface X11 X9 Multi encoder interface X11 Double-axis controller: Simple encoder interface X10 Triple-axis controller: X14 Multi encoder interface S-ADR X12 X13 S-ADR X12 X13 S-ADR X12 X12, X13, X14 Encoder via motor cable CAUTION! Fault at standstill!electrical components or the device may be damaged if this instruction is not followed. Faults can occur with SinCos encoders that are not detected at standstill. To be able to detect all faults via diagnostics, it is necessary to rotate the encoder by at least one encoder period every 24 h. Incremental encoder signals are monitored by, among other means, pointer length monitoring and involve a certain tolerance. This tolerance range is from 55% to 130% of the specific signal level. DE EN IT CN Multi encoder interface = evaluation using ASIC SSI/Hiperface/Endat/SinCos/TTL/resolver Simple encoder interface = incremental encoder systems TTL/SinCos Encoder via motor cable = Hiperface DSL Table 4.10 Allocation of type of encoder interface (encoder interface) Requirements on a sin/cos encoder Feature Value Fault threshold Signal frequency 400 khz Maximum that can be evaluated Speed (calculation method) Input frequency (max.) / resolution (pulses per revolution) Signal level Signals analogue 1 V pp Monitoring the supply voltage Fixed value 5 VDC, 10 VDC ±10% with ±2% measuring tolerance Monitoring of the amplitude Sin 2 +Cos 2 Fixed value 1V pp tolerance Max: 1.3 V pp ±2.5% measuring Min: 0.55 V pp ±2.5% measuring tolerance Monitoring of phase sin/cos Fixed value 90 ±30 with ±5 measuring tolerance Monitoring of counting ±45 Fixed value signal / signal phase quadrant Table 4.11 Features for sin/cos encoders The achievable safety integrity level is dependent on the selection of the encoder. The evaluation of the encoder signals is able, in conjunction with a suitable encoder, to achieve PL e as per EN ISO or SIL 3 as per EN 61508/EN Requirements on an HTL encoder or on counting pulses On the usage of an HTL encoder or on using counting pulses (e.g. with proximity switches), the signals are made available for evaluation via the safe inputs on the ServoOne CM axis controller. Counting pulses (HTL, proximity switches) are only allowed to be used as redundancy for other encoders. Both encoders must also be driven by the same motor. Feature Value Signal frequency (maximum that can be evaluated) 5 khz Speed (calculation method) Input frequency (max.) / resolution (pulses per revolution) Input level +24 V DC as per EN , type 1 Table 4.12 Features for HTL encoders Wiring and commissioning 25

26 Wiring and commissioning Evaluation of speed and direction of rotation Counting pulses can only be evaluated if the mechanical arrangement includes two proximity switches that provide signals for an offset of 90. Otherwise it is not possible to evaluate the speed and direction of rotation. Safety assessment The usage of HTL encoders or proximity switches requires a safety assessment on the mounting, cabling and power supply! Achievable safety The usage of counting pulses in addition to a process encoder will provide, in certain circumstances, the necessary redundancy to achieve PL e as per EN ISO or SIL 3 as per EN 61508/EN HTL encoders are treated like counting pulses! Requirements on an HDSL encoder Feature Value Resolution per revolution 18 bits 20 bits Measuring steps per revolution 262,144 1,048,576 Safe resolution per revolution Safe measuring steps per revolution* * Only the safe section (resolution/measuring steps) is used for the position or speed measurement on the HDSL encoder used. You will find this information in the data sheet for the HDSL encoder used. Table 4.13 HDSL encoder requirements 4.5 FSoE address setting, slave DIL switch S-ADR Decimal OFF OFF OFF OFF OFF OFF OFF OFF OFF OFF 0* Displaced by two bits Address ON OFF OFF OFF OFF OFF OFF OFF OFF OFF 1 4 OFF ON OFF OFF OFF OFF OFF OFF OFF OFF 2 8 ON ON OFF OFF OFF OFF OFF OFF OFF OFF 3 12 OFF OFF ON OFF OFF OFF OFF OFF OFF OFF 4 16 ON OFF ON OFF OFF OFF OFF OFF OFF OFF 5 20 x 2 x 2 OFF ON ON OFF OFF OFF OFF OFF OFF OFF 6 24 ON ON ON OFF OFF OFF OFF OFF OFF OFF 7 28 OFF OFF OFF ON OFF OFF OFF OFF OFF OFF 8 32 ON OFF OFF ON OFF OFF OFF OFF OFF OFF 9 36 OFF ON OFF ON OFF OFF OFF OFF OFF OFF ON ON OFF ON OFF OFF OFF OFF OFF OFF ON ON ON ON ON ON ON ON ON ON Allocation of the addresses * 0 is not allowed. Three further addresses are assigned internally based on the address set. Example for address set "8" (Base address): Address 8 Connection 1: Address 9 Connection 2: Address 10 Connection 3: Address 11 Table 4.14 FSoE address setting using DIL switch S-ADR 0*

27 If the user of the safety systems configures one or more FSoE connections, the field bus configuration must meet the following criteria: The FSoE data must be linked using the SyncManagers 5 and 6 provided for this purpose. The bus cycle time for the FSoE data (SyncManager 5 and 6) must be 1 ms or a multiple of 1 ms. It must also be equal to or a multiple of the bus cycle time for the non-safe data (SyncManager 2 and 3). 4.6 Response times The safety control for the device version ServoOne CM with SDC has a standard cycle time of 4 ms. In conjunction with the internal operating times, this cycle time yields the following response times. Function Safety function (speed) Activation of SBC 4) Application case A: Brakes are switched individually Application case B: Brakes are always all switched together Safety function (speed) Output via FSoE 1.4) Response in the worst case 27.5 ms 17.5 ms 15.5 ms 1) After this time the data are available in the output buffer for FSoE, in addition, among other aspects the actual FSoE cycle time, the cycle time of the control and the FSoE timeout/watchdog are to be taken into account. 2) These times apply for the device internal operating time if a valid FSoE package arrives. In addition, the FSoE timeout/watchdog set is to be taken into account for the response time. 3) These times apply for the case: "Safety function is already activated and the threshold is exceeded". Filter times for any speed filter activated as well as the encoder's hardware are to be added. 4) These times apply for the case: "The threshold is already exceeded and the safety function is activated via a digital input or FSoE". Filter times for any speed filter activated as well as the encoder's hardware are to be added. Table 4.15 Response times DE EN IT CN Function Safe digital input (SDI00-SDI03) Activation of STO Safe digital input (SDI00-SDI03) Activation of SBC Application case A: Brakes are switched individually Application case B: Brakes are always all switched together Safe digital input (SDI00-SDI03) Output via FSoE 1) FSoE Activation of STO 2) FSoE Activation of SBC 2) Application case A: Brakes are switched individually Application case B: Brakes are always all switched together Safety function (speed) Activation of STO 3) Safety function (speed) Activation of SBC 3) Application case A: Brakes are switched individually Application case B: Brakes are always all switched together Safety function (speed) Output via FSoE 1.3) Safety function (speed) Activation of STO 4) Response in the worst case 12.5 ms 23.5 ms 13.5 ms 11.5 ms 13.5 ms 24.5 ms 14.5 ms 13.5 ms 24.5 ms 14.5 ms 12 ms 16.5 ms The response times for the safe digital inputs (SDI00-SDI03) only apply for a falling edge on the safe input, because the LOW state is assumed as a safe state. A binding response time is not specified for a LOW HIGH transition. On the usage of FSoE, the response time stated here is increased by the cycle time of the control used plus 1 ms (in the best case). The response time can also increase by the time set for the timeout in the control used (in the worst case = there is a fault). Table 4.15 Response times Wiring and commissioning 27

28 Wiring and commissioning 28

29 5 Validation Always define a validation plan. The tests and analyses you have used to demonstrate the compliance of the solution (e.g. suggested circuit) with the requirements from your application are defined in the plan. In all circumstances check whether y All safety-related output signals are generated from the input signals in the correct and logical manner. y The behaviour if there is a fault corresponds to the circuit categories defined. y The control and equipment are adequately dimensioned for all operation modes and ambient conditions. On the conclusion of the analyses and tests, prepare a validation report. As a minimum this should include: y All objects to be tested y The personnel responsible for the testing y Test equipment (including details on the calibration) and simulation instruments y The tests undertaken y The problems found and their solution y The results Store the documented results in a traceable form. 5.1 Validating safety function SBC If the safety function SBC is used, the user must validate this function on a regular basis, however at least once a year. The table below shows the test steps to be undertaken. It is to be worked through from top to bottom. Due to the simultaneous engagement of all brakes, an internal test is triggered that is to be undertaken at least once a year to achieve the safety integrity (SIL2 / PLd) and at least once every 24 h to achieve the safety integrity (SIL3 / PLe). This test is always undertaken automatically on switching on the system. 5.2 Validating monitoring using signatures If monitoring of the STO inputs is undertaken by means of the usage of external signatures, for instance by means of the usage of the TP generator in the supply unit SO-CMP, this aspect is to be validated in the following cases y During commissioning y After changes to the application y After repair or device replacement The table below shows the test steps to be undertaken. It is to be worked through from top to bottom. Designation Event Expected result Output state Test step 1 Table 5.2 System is switched on Inputs for the safety functions are "active" (switched on) Axis controller has released brake(s) One of the outputs for the TP generator is shortcircuited to 24 V Test steps, monitoring by means of signatures It is necessary to restart the system to start again. Brake and torque are enabled. The safety system shuts down the brake and torque after maximum 2.4 s. DE EN IT CN Designation Test step 1 Test step 2 Event All brakes engage safely (due to demand from the safety function SBC for all axes) simultaneously for at least 100 ms. The application can then release the brakes again in any combination and order. Table 5.1 Test steps, SBC validation 29 Validation

30 Validation Safety instructions While undertaking the validation, pay attention to the following safety instructions. DANGER! DANGER! Risk of injury due to electrical power! Carelessness will result in serious injuries or death. x If the axis controller is in the state "STO", the mains cable, braking resistor and DC link voltage cable will carry dangerous voltages in relation to the PE conductor. If there is a short circuit in the power section, the motor cable will also carry dangerous voltages in relation to the PE conductor. x Without additional measures it is not possible to implement "Shutdown of the power supply in an emergency" using the function "STO". There is no electrical isolation between motor and axis controller! As such there is a risk due to electric shock and other risks of an electrical origin. x Pay attention to warning sign on the device (see front of device). Risk of injury due to rotating parts on the motor! x Carelessness may result in serious injuries or death. 1. If the action of external force is to be expected with the safety function "STO", e.g. due to a suspended load, this movement must be safely prevented by additional measures, e.g. by means of two brakes, locking device or clamping device with brake. 2. If there is a short circuit in two offset branches of the power section, a brief axis movement may be triggered electrically, depending on the number of poles in the motor. Synchronous motor example: On a 6-pole synchronous motor, the movement can be maximum 30. With a directly driven ball screw, e.g. 20 mm per revolution, this corresponds to a maximum on-off linear movement of 1.67 mm. Asynchronous motor example: The short circuits in two offset branches of the power section have almost no effect, because the exciter field collapses with the inhibition of the inverter and has decayed completely after approx. 1 s.