Application Technique. Safety Function: Safety Camera with E-stop

Transcription

1 Application Technique Safety Function: Safety Camera with E-stop Products: Guardmaster Dual-input Safety Relay, Guardmaster SC300 Safety Camera Safety Rating: PLd, Cat. 3 to EN ISO : 2008

2 2 Safety Function: Safety Camera with E-stop Important User Information Solid-state equipment has operational characteristics differing from those of electro-mechanical equipment. Safety Guidelines for the Application, Installation, and Maintenance of Solid-State Controls (publication SGI-1.1 available from your local Rockwell Automation sales office or online at describes some important differences between solid-state equipment and hard-wired electromechanical devices. Because of this difference, and also because of the wide variety of uses for solid-state equipment, all persons responsible for applying this equipment must satisfy themselves that each intended application of this equipment is acceptable. In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment. The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and diagrams. No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this manual. Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited. Throughout this manual, when necessary, we use notes to make you aware of safety considerations. WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury or death, property damage, or economic loss. ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence. SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present. BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures. IMPORTANT Identifies information that is critical for successful application and understanding of the product.

3 General Safety Information Safety Function: Safety Camera with E-stop 3 Contact Rockwell Automation to find out more about our safety risk assessment services. IMPORTANT This application example is for advanced users and assumes that you are trained and experienced in safety system requirements. ATTENTION: Perform a risk assessment to make sure all task and hazard combinations have been identified and addressed. The risk assessment can require additional circuitry to reduce the risk to a tolerable level. Safety circuits must take into consideration safety distance calculations, which are not part of the scope of this document. Table of Contents Introduction... 3 Safety Function Realization: Risk Assessment... 4 Safety Camera Safety Function... 4 Safety Function Requirements... 4 Functional Safety Description... 5 Bill of Material... 5 Setup and Wiring... 5 System Overview... 5 Installation... 6 Safety Distance Calculation... 7 Electrical Schematic... 8 Configuration... 8 Calculation of the Performance Level Verification and Validation Plan Additional Resources Introduction This safety function application technique explains how to wire and configure a Guardmaster dual-input safety relay to monitor an E-stop and Guardmaster SC300 safety camera. When an object intrudes into the safety camera s field of view, the E-stop is actuated, or a fault is detected in the monitoring circuit. The relay de-energizes the final control devices, in this case, a pair of 100S safety contactors. E-stops are required in most applications. Safety systems that require a sensing device, like a safety camera, and E-stop combination are common. The relay, with its dual inputs, makes this easy to implement in a single safety relay. The Guardmaster SC300 safety camera is a compact hand-detection, safety-sensor system, which operates based on image processing technology. The safety sensing function is performed by a single-image sensing device viewing a single

4 4 Safety Function: Safety Camera with E-stop two-dimensional image against a passive pattern as the background. The detection principle is based on an object of a specific resolution blocking the image-sensing device s view of the pattern. The SC300 safety camera hand-detection, safety-sensor system has an environmental rating of IP54. It fulfills Performance Level d, Category 3, per EN ISO Safety Function Realization: Risk Assessment The required performance level (PLr) is the result of a risk assessment and refers to the amount of the risk reduction to be carried out by the safety-related parts of the control system. Part of the risk reduction process is to determine the safety functions of the machine. In this application, the performance level required by the risk assessment is Performance Level d, Category 3 (PLd, Cat. 3), for each safety function. A safety system that achieves PLd, Cat. 3, or higher, can be considered control reliable. From: Risk Assessment (ISO 12100) 1. Identification of safety functions 2. Specification of characteristics of each function 3. Determination of required PL (PLr) for each safety function To: Realization and PL Evaluation Safety Camera Safety Function This application includes two safety functions: Emergency stop initiated by intrusion into the safety camera s field of view, point-of-operation control. Emergency stop initiated by actuation of an emergency push button. This system executes a Stop Category 0 stop. Power is removed and hazardous motion coasts to a stop. Safety Function Requirements The safety camera must be installed at a suitable distance from the hazardous motion, such that a user cannot reach the hazard before the motion has stopped. This distance is called the safety distance and is addressed later in this application technique. An object intruding into the safety camera field of view stops hazardous motion by removing power to the motor. The system cannot be reset while an object is in the field of view. Once the object has left the field of view, the Reset button is pressed and released and hazardous motion resumes. Pressing the E-stop button

5 Safety Function: Safety Camera with E-stop 5 stops hazardous motion by removing power to the motor. However, releasing the E-stop does not restart hazardous motion. Pressing the Reset button after the E-stop has been reset and all faults are cleared, results in the restoration of hazardous motion. A fault at the safety camera, wiring, or safety relay is detected before the next safety demand. The safety system described in this application technique is capable of connecting and interrupting power to motors rated up to 9 A, 600V AC. The safety functions meet the requirements for Performance Level d, Category 3, per EN ISO and control reliable operation per ANSI B Functional Safety Description When an object intrudes into the safety camera s field of view, hazardous motion is stopped and prevented from restarting. Hazardous motion does not restart until the safety camera field of view is restored and the Start button is pressed and released. Likewise, when the E-stop is pressed, the hazardous motion is stopped and prevented from restarting. It does not restart until the E-stop is released and the Start button is pressed and released. Bill of Material This application uses these products. Cat. No. Description Quantity 442L-SAFCAM1 Guardmaster SC300 safety camera 1 442L-ACAM30MMKIT 800FM-G611MX10 SC300 safety camera, reflective tape kit, 2 pieces, 1.5 m strips, 30 mm resolution with test rod 800F push button metal, guarded, blue, R, metal latch mount, 1 N.O. contact, 0 N.C. contact F-1YP3 E-stop, yellow enclosure, 1-hole, 2 N.C. contacts 1 400R-D22R2 100S-C09EJ23C Guardmaster dual-input safety relay, 2 dual-channel universal inputs IEC contactor, non-reversing 600V maximum, 9 A maximum 1 2 Setup and Wiring For detailed information on installing and wiring, refer to the publications listed in the Additional Resources on the back cover. System Overview When an object intrudes into the safety camera field of view, the safety camera switches off two PNP output signal switching devices (OSSD). The Guardmaster dual-input safety relay responds by opening two output relays, removing 24V DC power from the coils of the two safety contactors (which causes the contacts to open), and removing power to the motor. The motor coasts to a stop (Stop Category 0). The safety camera s OSSD outputs turn on once its field of view is no longer interrupted.

6 6 Safety Function: Safety Camera with E-stop The safety camera monitors its internal circuitry and OSSD outputs for faults. When a fault in the internal circuitry or an output is detected, the safety camera responds by turning off its OSSD outputs. The relay pulse-test outputs, S11 and S21, are run through the two N.C. contacts of the E-stop to inputs S12 and S22, respectively. When the E-stop is pressed, these circuits are interrupted. The relay responds by opening its safety contacts, removing power from the 100S contactor coils, and removing 24V DC from the coils of the two 100S contactors, which causes the contacts to open, thereby removing power to the motor. The motor coasts to a stop (Stop Category 0). The relay monitors the E-stop circuit for faults. Loose wires, shorts to 24V DC, shorts to GND, contacts failed closed, and cross faults are detected. When a fault is detected, the relay responds by opening its safety contacts, removing power from the 100S contactor coils, and removing 24V DC from the coils of the two 100S contactors, which causes the contacts to open, thereby removing power to the motor. The motor coasts to a stop (Stop Category 0). Two N.C. contacts, one from each of the safety contactors, are connected as part of the reset circuit. The relay can be reset only if both safety contactors are in a proper de-energized state. The relay cannot be reset while the E-stop remains actuated or while the safety camera OSSD outputs are off. Once the E-stop has been released and/or the safety camera OSSD outputs turn on, and the Reset button is pressed and released (a separate, deliberate action), hazardous motion resumes. The Reset button must be pressed between seconds. A shorter press or a longer press is ignored. The relay checks itself for internal faults, faults on its inputs and wiring, and monitors the safety contactors via the N.C. contacts in the reset circuit. No single fault results in the safety system failing to perform its safety function. A single fault is detected before the next demand on the safety system. The system cannot be reset until the fault is corrected. Installation Refer to the installation instructions and user manuals, found in the Additional Resources, for guidance on installing and maintaining the different parts of this system.

7 Safety Function: Safety Camera with E-stop 7 Safety Distance Calculation IMPORTANT A safety camera provides no physical barrier between personnel and hazardous motion. The safety camera must be installed at a sufficient distance from the hazardous motion to make sure that an operator putting a hand through the light curtain cannot reach the hazard before hazardous motion has stopped. This distance is referred to as the safety distance (D s ). The D s required varies from installation to installation and, therefore, must be calculated for each specific application. This application technique uses the OSHA and ANSI formula: Stopping or run-down time of the machine or system The stopping or run-down time is shown in the machine documentation or must be determined by taking a measurement. Response time of the entire protective device (SC300 safety camera: 20 ms) Reach or approach speed Other parameters that are stipulated by the standard, depending on the application How to Calculate The Safety Distance if OSHA and ANSI are Applicable The following shows an example calculation of the safety distance (D s ). Depending on the application and the ambient conditions, a different calculation can be necessary. Calculate D s by using the following formula: D s = H s (T s + T c + T r + T bm ) + D pf Parameter Definition D s H s T s T c T r T bm D pf Minimum distance from the hazardous point to the protective device, in inches or millimeters. A parameter derived from data on approach speeds of the body or parts of the body, in inches/second or milliseconds/second. Normally, 63 in./s (1600 mm/s) is used for H s. Stopping or run-down time of the machine tool measured at the final control element. Stopping or run-down time of the control system. Response time of the entire protective device after light path interruption (SC300 safety camera: 20 ms). Additional response time allowed for the brake monitor to compensate for wear. Any additional response times must be accounted for in this calculation. An additional distance added to the overall D s required. This value is based on intrusion toward the hazardous point prior to actuation of the electro-sensitive protective equipment (ESPE). Values range from in. ( mm) or more, depending on application. Example: For vertical protection with an opto-electronic protective device with an effective resolution finer than 2.5 in. (64 mm), D pf can be determined approximately by using the following formula: D pf (in.) = 3.4 (effective resolution 0.276), but not less than 0

8 8 Safety Function: Safety Camera with E-stop Electrical Schematic Color Pin Signal White 1 Reset Brown 2 24V DC Green 3 Teach Yellow 4 EDM Gray 5 OSSD 1 Pink 6 OSSD 2 Blue 7 0V DC Red 8 FE 889D-F8AB-X Camera Pigtail Teach Start Yellow Blue Red White Brown Stop E-stop Gray Green Pink Power In1 In2 Out Logic 24V DC LOGIC Test Out Automatic Reset

9 Configuration Safety Function: Safety Camera with E-stop 9 The 442L safety camera uses DIP switches to configure it for different applications. This application uses the default settings. No switch changes are necessary. Teach-in and Test ATTENTION: Only qualified and authorized safety personnel should perform the teach-in and test procedure. Read and follow the operating instructions for your safety camera. Follow these steps to perform the teach-in procedure: 1. Actuate for approximately 5 seconds (4 flashes 5 times) 2. Release for approximately 2 seconds (4 flashes 2 times) 3. Actuate for approximately 5 seconds (4 flashes 5 times) Test the protective device as per the instructions on the Important Information label (attached in the immediate vicinity) or in the operating instructions. Configure the Safety Relay Configure the safety relay for LOGIC 6, (L12) OR (IN 1 and IN 2 Automatic Reset), as explained in the Guardmaster Safety Relay DI Installation Instructions, publication version 00. LOGIC

10 10 Safety Function: Safety Camera with E-stop Calculation of the Performance Level Performance Level required (PLr) from the risk assessment is Performance Level d (PLd). When properly implemented, the safety camera safety function described here can achieve a PLd and the E-stop safety function can achieve a PLe, according to EN ISO : 2008, as calculated by using the SISTEMA Software PL Calculation Tool. Calculations are based on each safety function being operated once an hour, 24 hours a day, 365 days a year, for a total of 8760 operations a year. The 100S contactors are used in both safety functions; therefore, their calculations are based on 17,520 operations per year. Safety Camera Safety Function E-stop Safety Function

11 Safety Function: Safety Camera with E-stop 11 This safety system includes two safety functions: a safety camera safety function, and an E-stop safety function. The safety functions can be represented in block diagrams. INPUT LOGIC OUTPUT 100S K1 SC300 GSR DI 100S K2 Subsystem 1 Safety Camera Safety Function Subsystem 1 Subsystem 2 Subsystem 3 Safety Camera Safety Function Subsystem 2

12 12 Safety Function: Safety Camera with E-stop Safety Camera Safety Function Subsystem 3 The E-stop safety function is represented below. INPUT LOGIC OUTPUT E-stop 1 B1/E1 100S K1 GSR DI E-stop 1 B2/E2 100S K2 Subsystem 1 Subsystem 2 Subsystem 3 E-stop Safety Function Subsystem 1

13 E-stop Safety Function Subsystem 2 Safety Function: Safety Camera with E-stop 13 E-stop Safety Function Subsystem 3 Because these are electro-mechanical devices, the E-stop and safety contactors data includes the following: Mean Time to Failure, dangerous (MTTFd) Diagnostic Coverage (DCavg) Common Cause Failure (CCF) data Electro-mechanical devices functional safety evaluations include the following: How frequently they are operated Whether they are effectively monitored for faults Whether they are properly specified and installed SISTEMA calculates the MTTFd by using B10d data provided for the contactors along with the estimated frequency of use, entered during the creation of the SISTEMA project. The DCavg (99%) for the contactors is selected from the Output Device table of EN ISO Annex E, Direct Monitoring. The DCavg (99%) for the E-stop is selected from the Input Device table of EN ISO Annex E, Cross Monitoring. The CCF value is generated by using the scoring process outlined in Annex F of EN ISO The complete CCF scoring process must be performed when actually implementing an application. A minimum score of 65 points must be achieved.

14 14 Safety Function: Safety Camera with E-stop Verification and Validation Plan Verification and validation play important roles in the avoidance of faults throughout the safety system design and development process. EN ISO sets the requirements for verification and validation. The standard calls for a documented plan to confirm all of the safety functional requirements have been met. Verification is an analysis of the resulting safety control system. The Performance Level (PL) of the safety control system is calculated to confirm that the system meets the required Performance Level (PLr) specified. The SISTEMA software is typically used to perform the calculations and assist with satisfying the requirements of EN ISO Validation is a functional test of the safety control system to demonstrate that the system meets the specified requirements of the safety function. The safety control system is tested to confirm that all of the safety-related outputs respond appropriately to their corresponding safety-related inputs. The functional test includes normal operating conditions in addition to potential fault injection of failure modes. A checklist is typically used to document the validation of the safety control system. Prior to validating the Guardmaster Safety Relay (GSR) system, confirm that the Guardmaster safety relay has been wired and configured in accordance with the installation instructions.

15 Safety Function: Safety Camera with E-stop 15 Guardmaster Dual-input Safety Relay (GSR DI) SC300 Safety Function Verification and Validation Checklist General Machinery Information Machine Name/Model Number Machine Serial Number Customer Name Test Date Tester Name(s) Schematic Drawing Number Guardmaster Safety Relay Model Safety Wiring and Relay Configuration Verification Test Step Verification Pass/Fail Changes/Modifications Visually inspect the safety relay circuit to verify that it is wired as documented in the schematics. Visually inspect the safety camera to verify that it is configured as documented. Visually inspect the safety relay rotary switch settings to verify that they are correct as documented. Normal Operation Verification - The safety relay system properly responds to all normal Start, Stop, E-stop, and Reset commands. Test Step Verification Pass/Fail Changes/Modifications Initiate a Start command. Both contactors energize for a normal machine run condition. Verify proper machine-status indication and safety-relay status indication. Initiate a Stop command. Both contactors de-energize for a normal machine Stop condition. Verify proper machine-status indication and safety-relay status indication. While the system is running, open the moveable door. Both contactors de-energize and open for a normal safe condition. Verify proper machine-status indication and safety-relay status indication. Repeat for all safety cameras. While the system is stopped, interrupt the safety camera and initiate a Start command. Both contactors remain de-energized and open for a normal safe condition. Verify proper machine-status indication and safety-relay status indication. Initiate a Reset command. Both contactors remain de-energized. Verify proper machine-status indication and safety-relay status indication.

16 16 Safety Function: Safety Camera with E-stop GSR DI SC300 Safety Function Verification and Validation Checklist (continued) Abnormal Operation Validation - The safety relay system properly responds to all foreseeable faults with corresponding diagnostics. SC300 Safety Camera Input Tests Test Step Verification Pass/Fail Changes/Modifications While the system is running, remove the channel 1 wire from the safety relay. Both contactors de-energize. Verify proper machine-status indication and safety-relay status indication. Repeat for channel 2. While the system is running, short channel 1 of the safety relay to 24V DC. Both contactors de-energize. Verify proper machine-status indication and safety-relay status indication. Repeat for channel 2. While the system is running, short channel 1 of the safety relay to 0V DC. Both contactors de-energize. Verify proper machine-status indication and safety-relay status indication. Repeat for channel 2. While the system is running, short channels 1 and 2 of the safety relay. Both contactors de-energize. Verify proper machine-status indication and safety-relay status indication. GSR Logic Solver Tests Test Step Validation Pass/Fail Changes/Modifications While the system is running, remove the single wire safety connection between two adjoining safety relays in the system. All contactors de-energize. Verify proper machine-status indication and safety-relay status indication. Repeat for all safety connections. This test is not applicable for single relay circuits. While the system is running, turn the logic rotary switch on the safety relay. All contactors remain energized. Verify proper machine-status indication and safety-relay status indication. Repeat for all safety relays in the system. Safety Contactor Output Tests Test Step Validation Pass/Fail Changes/Modifications While the system is running, remove the contactor feedback from the safety relay. All contactors remain energized. Initiate a Stop command followed by a Reset command. The relay does not restart or reset. Verify proper machine-status indication and safety-relay status indication.

17 Safety Function: Safety Camera with E-stop 17 E-stop Safety Function Verification and Validation Checklist General Machinery Information Machine Name/Model Number Machine Serial Number Customer Name Test Date Tester Name(s) Schematic Drawing Number Guardmaster Safety Relay Model Safety Wiring and Relay Configuration Verification Test Step Verification Pass/Fail Changes/Modifications Visually inspect the safety relay circuit to verify it is wired as documented in the schematics. Visually inspect the safety relay rotary switch settings to verify they are correct as documented. Normal Operation Verification - The safety relay system properly responds to all normal Start, Stop, E-stop, and Reset commands. Test Step Verification Pass/Fail Changes/Modifications Initiate a Start command. Both contactors energize for a normal machine run condition. Verify proper machine-status indication and safety-relay status indication. Initiate a Stop command. Both contactors de-energize for a normal machine Stop condition. Verify proper machine-status indication and safety-relay status indication. While the system is running, press the E-stop push button. Both contactors de-energize and open for a normal safe condition. Verify proper machine-status indication and safety-relay status indication. Repeat for all E-stop push buttons. While the system is stopped, press the E-stop push button and initiate a Start command. Both contactors remain de-energized and open for a normal safe condition. Verify proper machine-status indication and safety-relay status indication. Repeat for all E-stop push buttons. Initiate a Reset command. Both contactors remain de-energized. Verify proper machine-status indication and safety-relay status indication.

18 18 Safety Function: Safety Camera with E-stop E-stop Safety Function Verification and Validation Checklist (continued) Abnormal Operation Validation - The safety relay system properly responds to all foreseeable faults with corresponding diagnostics. E-stop Input Tests Test Step Verification Pass/Fail Changes/Modifications While the system is running, remove the channel 1 wire from the safety relay. Both contactors de-energize. Verify proper machine-status indication and safety-relay status indication. Repeat for channel 2. While the system is running, short channel 1 of the safety relay to 24V DC. Both contactors de-energize. Verify proper machine-status indication and safety-relay status indication. Repeat for channel 2. While the system is running, short channel 1 of the safety relay to 0V DC. Both contactors de-energize. Verify proper machine-status indication and safety-relay status indication. Repeat for channel 2. While the system is running, short channels 1 and 2 of the safety relay. Both contactors de-energize. Verify proper machine-status indication and safety-relay status indication. E-stop Logic Solver Tests Test Step Validation Pass/Fail Changes/Modifications While the system is running, remove the single wire safety connection between two adjoining safety relays in the system. All contactors de-energize. Verify proper machine-status indication and safety-relay status indication. Repeat for all safety connections. This test is not applicable for single relay circuits. While the system is running, turn the logic rotary switch on the safety relay. All contactors remain energized. Verify proper machine-status indication and safety-relay status indication. Repeat for all safety relays in the system. Safety Contactor Output Tests Test Step Validation Pass/Fail Changes/Modifications While the system is running, remove the contactor feedback from the safety relay. All contactors remain energized. Initiate a Stop command followed by a Reset command. The relay does not restart or reset. Verify proper machine-status indication and safety-relay status indication.

19 Additional Resources Refer to these publications for more information about the related products from Rockwell Automation. Resource GuardShield 440L Light Curtain User Manual, publication 440L-UM003 Guardmaster Safety Relay DI Installation Instructions, publication , ver. 00 Guardmaster Safety Relay Application and Wiring Diagrams, publication SAFETY-WD001 Safety Products catalog, publication S117-CA001 Description Provides information on installing, operating, and maintaining 440L Safety Light Curtains. Provides information on installing, operating, and maintaining 440R-D22R2 safety relays. Provides functional descriptions, guidance, and wiring for typical safety relays. Provides data and guidance concerning safety principals, standards, component data and applications examples. You can view or download publications at To order paper copies of technical documentation, contact your local Allen-Bradley distributor or Rockwell Automation sales representative. 19

20 20 Safety Function: Safety Camera with E-stop For more information on Safety Function Capabilities, visit: discover.rockwellautomation.com/safety Rockwell Automation, Allen-Bradley, Rockwell Software, Guardmaster, GuardShield, and LISTEN.THINK.SOLVE. are trademarks of Rockwell Automation, Inc. Trademarks not belonging to Rockwell Automation are property of their respective companies. Publication SAFETY-AT090A-EN-P August 2013 Copyright 2013 Rockwell Automation, Inc. All rights reserved. Printed in U.SA.