FSO Webnair FSO Safety Functions Module February 11, 2015 Slide 1
Competence Requirements for ABB Commissioner / Service Engineer of ACS880 Drives with FSO The integrated Safety Function Module (FSO; option +Q973) of ACS880 drive family introduces the fully integrated functional safety. This document sets competence requirements for ABB s personnel and partners doing commissioning, parameterization, modification, maintenance or other service actions related to the integrated Safety Functions Module(s) FSO-xx. Special care shall be paid on the competence of people configuring the FSO module The required competence on functional safety and FSO is obtained by application engineering approval and training. February 11, 2015 Slide 2
Competence Requirements for ABB Commissioner / Service Engineer of ACS880 Drives with FSO cont. Competence requirements G385 course FSO Safety Module which consist of: `G3850e - FSO-11 safety functions module fundamentals, Internet course G111e - Functional safety in ABB drives, Internet course G3851e - FSO-11 safety functions module configuration, Internet course G3851 - ACS880 functional safety configuration with FSO-11 Hands on Course (1.5 days) February 11, 2015 Slide 3
US1370p_FSO_Standards and Definitions_Rev_B, Dec 2014 FSO safety functions modules Standards and Definitions February 11, 2015 Slide 4
Why must machinery meet these requirements? Conformity helps to prevent accidents and consequent injuries. Machine manufacturers can rest assured they have met their obligations to design and deliver safe machines that comply with national laws New and improved safety strategies are becoming a way of improving their productivity and competitiveness in the market February 11, 2015 Slide 5
Standards Descriptions EN ISO 13849-1 A standard that provides instructions to designers to make machines safe. These instructions include recommendations for the design, integration and validation of the systems. Used on various kinds of machinery, regardless of the technology and energy it uses The standard also includes special requirements for safety-related parts that have programmable electronic systems February 11, 2015 Slide 6
More Standards More Descriptions EN ISO 13849-2 Specifies the validation process and required design measures/techniques for safety functions designed according to EN ISO 13849-1 EN/IEC 62061 A standard for designing electrical safety systems. Includes recommendations for the design, integration and validation of safety-related electrical, electronic and programmable electronic control systems for machinery. Unlike EN ISO 13849-1, EN/IEC 62061 does not cover requirements for non-electrical safety-related control equipment for machinery. February 11, 2015 Slide 7
More Standards More Descriptions IEC 61508 It covers the life cycle of systems comprised of electrical and/or electronic and/or programmable electronic components that are used to preform safety functions IEC 61508 is generally used when designing certifiable safety subsystems. February 11, 2015 Slide 8
SIL SIL Safety Integrity Level (SIL) SIL is a representation of the risk reduction capability of the safety functions/ subsystems. There are four possible safety integrity levels: 1, 2, 3, and 4. SIL 4 is the highest level of safety integrity and SIL 1 the lowest. NOTE: Only levels 1-3 are used in machinery February 11, 2015 Slide 9
PL PL Performance Level (PL) PL describes how well a safety system is able to perform a safety function, under foreseeable conditions. There are five possible Performance Levels: a, b, c, d and e. Performance Level e provides the highest risk reduction capability, while PL a provides the lowest. February 11, 2015 Slide 10
Standardized Safety Functions EN/IEC 61800-5-2 Safe Torque-off (STO) This function brings the machine safely into a non-torque state and/or prevents it from starting accidentally. Note: Safe torque off does not protect against electrical hazards. February 11, 2015 Slide 11
Standardized Safety Functions EN/IEC 61800-5-2 Safe Stop 1 (SS1) This function stops the motor safely, initiating the STO function below a specified speed (close to standstill) or after a defined time limit. February 11, 2015 Slide 12
Standardized Safety Functions EN/IEC 61800-5-2 Safety Limit Speed (SLS) This function prevents the motor from exceeding the defined speed limit. February 11, 2015 Slide 13
Standardized Safety Functions EN/IEC 61800-5-2 Safe Stop Emergency (SSE) There are two types of Emergency stops Emergency stop, stop category 0 (according to EN 60204-1) means that the power to the motor is cut off immediately. Stop category 0 is equivalent to the safe torque off (STO) function, as defined by standard EN/IEC 61800-5-2. Emergency stop, stop category 1 (according to EN 60204-1) means that the machine speed is brought to a standstill through controlled deceleration and then the power to the motor is cut off. Stop category 1 is equivalent to the safe stop 1 (SS1) function, as defined by standard EN/IEC 61800-5-2. February 11, 2015 Slide 14
Standardized Safety Functions EN/IEC 61800-5-2 Prevention of Unexpected Startup (POUS) Ensuring that a machine remains stopped when persons are present in danger area is one of the most important conditions in safe machines. February 11, 2015 Slide 15
Other FSO-12 Safety Functions Safe Maximum Speed (SMS) The SMS function is used to protect the machine from too high speeds/frequencies. It can only be configured to be on or off. The minimum and maximum SMS trip limits can be configured separately. February 11, 2015 Slide 16
Other FSO-12 Safety Functions Safe Maximum Speed (SBC) The SBC function provides a safe output for controlling external (mechanical) brakes. If the SBC is used, it is always combined with the drive STO. The SBC can be configured to be activated before, at the same time with, or after the drive STO. February 11, 2015 Slide 17
Other FSO-12 Safety Functions Safe Allowable Range (SAR) The SAR function sets the target time for the reference safe stopping ramp. February 11, 2015 Slide 18
Steps to meet Machinery Directive requirements Step 1: Management of functional safety managing functional safety during the life cycle of the machine. Step 2: Risk assessment analyzing and evaluating risks. Step 3: Risk reduction eliminating or minimizing risks through design and documentation. Step 4: Establishing safety requirements defining what is needed (functionality, safety performance) to eliminate the risk or reduce it to an acceptable level. Step 5: Implementing a functional safety system designing and creating safety functions. February 11, 2015 Slide 19
Steps to meet Machinery Directive requirements Step 6: Verifying a functional safety system ensuring that the safety system meets the defined requirements. Step 7: Validating a functional safety system reviewing implemented safety system against the risk assessment and making certain that the safety system actually succeeded in reducing risks as specified. Step 8: Documenting a functional safety system documenting the design, producing user documentation. Step 9: Providing compliance proving the machine s compliance with EHSR (Essential Health and Safety Requirement) of the Machinery Directive through compliance assessment and a technical file. February 11, 2015 Slide 20
Responsibilities It is the responsibility of the machine builder / OEM / system integrator to make sure that the essential health and safety requirements specified in the Machinery Directive are met. Designers and installers must be trained to understand the requirements and principles of designing and installing safety-related systems. ABB is not responsible for machine builder / OEM / system integrators assessment or design. February 11, 2015 Slide 21
Functional Safety Reference information Technical guide No. 10 February 11, 2015 Slide 22
US1369p_FSO_Overview_Rev_B, Dec 2014 FSO Safety functions modules Overview February 11, 2015 Slide 24
FSO Safety functions modules Market drivers and trends Harmonized standards support electronic safety systems Machinery application standards (EN ISO 13849-1, EN 62061) Safety functions are being integrated into motion control EN 61800-5-2 Safety function standard for power drive systems Emergency stopping, prevention of unexpected start-up, safe speed related functions Integrated safety is modular, versatile and intelligent Connect and configure, multiple functions in one system Solutions rather than components Certified safety blocks, safety data and example solutions Products in solution format is a strong concept in the market February 11, 2015 Slide 25
All-compatible ACS880 industrial drives Integrated safety Safe torque-off (STO) as standard Safety options SS1 safe stop 1 SSE safe stop emergency SLS safely-limited speed SBC safe brake control SMS safe maximum speed POUS Prevention of unexpected start-up February 11, 2015 Slide 26
Functional safety for ACS880 series Incremental safety functions Safe torque off (STO) is a standard safety function in ACS880 Safety performance (for STO only) SIL 3, SIL CL 3 (IEC 61508, EN 62061) PL e ( EN ISO 13849-1) Additional safety functions can be commissioned using Safety functions module FSO-12 Safety performance (STO with FSO-12) SIL 3, SIL CL 3 (IEC 61508, EN 62061) PL e ( EN ISO 13849-1) February 11, 2015 Slide 27
Safety functions module FSO-12 Characteristics A safety functions module provides five additional commonly used safety functions for industrial applications: Safe stop 1 (SS1) Safe stop emergency (SSE) Safe brake control (SBC) Safely-limited speed (SLS) Safe maximum speed (SMS) Prevention of unexpected startup (POUS) Safe speed functions without an encoder Safe inputs and outputs Self-diagnostics, wire diagnostics Safety data available for system design February 11, 2015 Slide 28
Safety functions module FSO-12 Characteristics FSO-12 characteristics and benefits: Quick to install Pre-programmed functions Configuration with Drive composer pro PC tool Compatible with ACS880 single- and multidrives Alternative standard mounting positions for flexibility Robust aluminum housing vibration, heat, EMC control February 11, 2015 Slide 29
FSO Safety functions modules Integrated safety reduces overall system costs Safety functionality designed to work seamlessly with the drive Ready-made verified functionalities Small in size With ABB s integrated safety, motor contactors are not needed Safe torque-off (STO) ensures process safe state, fast restarting Drive system provides safety related speed monitoring Sensorless speed monitoring can eliminate the encoder Efficient application creation, cost savings Reduced design efforts connect and configure Certified safety building blocks with safety data Improved system cycle times, fast reaction due to STO Safe speed without external sensors in many cases Reduced wiring with integrated system (safety in drive vs externally) Drive regular inputs and outputs not used for safety Single tool for drive and safety systems configuration February 11, 2015 Slide 30
FSO-12 Safety functions module Module details STO output to drive Data connection to drive (opto-isolated) Status LEDs (5) Power supply connection 24 V DC (PELV) Mounting point (1/4) Input / output status LEDs Safe inputs (4 / 8 pcs) DI Safe outputs (3 / 6 pcs) DO Wiring test pulse supply TP Factory reset February 11, 2015 Slide 31
FSO-12 Safety functions module PCBAs: Power supply CPUs & FPGA I/O & STO - 2 x CPU - 1 x FPGA - 2 x OS - SIL 3 application FW - Redundant architecture February 11, 2015 Slide 32
FSO-12 Safety functions module Status LEDs POWER (Green) hard wired ON Power RUN (Green) ON - Running Mode FLASHING Configuration mode / module booting OFF Failsafe mode STATUS / FAULT (Green / Red) Green ON - Safety function active (except SMS) FLASHING - Safety function ended (not acknowledged) OFF - Acknowledged / drive start allowed (normal operation with no active safety functions) Red ON Fault (or configuration mode if RUN LED is blinking) STO (Green) OFF - STO circuit closed, normal operation ON - STO circuit open (safe state indicated!) Inputs / outputs ON 24 V OFF 0 V NOTE: Status LED information is not considered safe February 11, 2015 Slide 33
FSO-12 Safety functions module Connections X111 Connector STO cable X110 Connector Data connector 4 3 2 1 2 1 X112 Connector Power connection 1 2 3 4 5 6 7 8 9 10 X113 Connector X114 Connector February 11, 2015 Slide 34
FSO-12 Safety functions module Encoderless mode Speed estimator Speed estimator is used for the safe speed and ramp monitoring without the use of an encoder Concept Two separate speed estimates are compared in the safety option 1. estimate from drive motor model 2. estimate formulated from actual drive IGBT switching data Limitations Only for applications where the movement slows down when drive is shut down (no active loads) Motor control has to be working correctly (properly set-up) February 11, 2015 Slide 35
Functional safety Responsibilities Machine manufacturer is responsible for the conformance to the Machinery Directive ABB is responsible for the conformance of the safety functionality of the ABB manufactured safety component, when installed and commissioned as specified according to the Machinery Directive February 11, 2015 Slide 36
US1368p_FSO_Configuration_Rev_B, Dec 2014 FSO safety functions modules Configuring safety functions February 11, 2015 Slide 38
FSO Safety functions modules Training contents 1. Creating safety functions FSO mounting Connecting inputs & outputs Configuration Verification & validation, documentation 2. Service 3. Reference information February 11, 2015 Slide 39
FSO Safety functions modules Setting up safety functions FSO mounting 24VDC ACS880 STO STO FSO Safety option Control unit Tasks: + + + IGBT disable 1. Mount FSO - - - M 3~ February 11, 2015 Slide 40
FSO Safety functions modules Mounting on control unit ACS880-01 ACS880-01 February 11, 2015 Slide 41
FSO Safety functions modules Mounting on control unit R1-R5 1 Module mounted with 4 screws. Grounded with 1 screw 2 24 V DC power supply connection 3 Required input / output wiring is connected STO cable Data connection February 11, 2015 Slide 42
FSO Safety functions modules Mounting on control unit R6-R9 ACS880-01 frames R6 R9 also have a mounting place on the side of the control unit February 11, 2015 Slide 43
FSO Safety functions modules Safe torque-off (STO) Redundant shut-off path STO circuitry is in drive potential Cable diagnostics in STO cable Start-up & periodic diagnostics 1 ms diag. pulses, feedback from drive FSO ACS880 FSO-11 STO cable February 11, 2015 Slide 44
FSO Safety functions modules Setting up safety functions connecting inputs & outputs Indication lights 24VDC ACS880 Limit switches STO STO Light curtain FSO Safety option Control unit Safety-PLC Tasks: Emergency Stop switch + + + IGBT disable 1. Mount the FSO module 2. Make necessary connections to switches and devices. Note the maximum cable lengths. - - - Mechanical brake M 3~ February 11, 2015 Slide 45
FSO-12 Safety functions module Safe digital inputs Digital input connections Single channel (8 inputs) Redundant (4 inputs) Signal levels < 5 V DC low (activation state / request) > 15 V DC high (passive state / standby) Maximum cable loop length for input is 250 m GND level for digital inputs is safety option 0V (GND) Inputs enable the wiring diagnostics (test pulsing)* Inputs follow the safety principle, i.e. 0 V is a safe state DI *If inputs are connected to test pulse (TP) sources of the FSO February 11, 2015 Slide 46
FSO-12 Safety functions module Safe digital outputs Digital output connections Single channel 6 outputs Redundant (two channel) 3 outputs Can be used for Safe Brake Control (SBC) Other safety relay activation Safety function indication Cascade connection Output type 24 V DC 150mA high side driver Outputs include wire diagnostics (test pulsing) Output active state can be configured to be 24 V or 0 V SBC active, output = 0 V Safety function indication, output = 24 V DO February 11, 2015 Slide 47
FSO-12 Safety functions module Test pulsing (TP) Used to diagnose input switching capability Supply voltage TP is periodically turned off for a short moment Alternating pulse pattern used for redundant channels Diagnostic pulse length is 0.5 2ms, every 50ms 59s TP Diagnostics is able to detect: Short circuit to power supply or to ground Short circuit between redundant channels Diagnostics can not detect shorts across the switch contacts TP Sensor supply voltage 24 V 0 V Ch1 pulse length Ch2 interval E-stop sw 24 V sensor supply with test pulsing (TP) 24 V 0 V TP 2 TP 1 FSO-11 DI 1 DI 2 February 11, 2015 Slide 48
FSO-12 Safety functions module Single channel input connections Diagnostic pulse supply Pulse 1 Pin Description Test pulse supply (24V) Digital inputs (8 single, 4 redundant) Input 1 Input 2 Input 3 single input connections February 11, 2015 Slide 49
FSO-12 Safety functions module Redundant input connection Diagnostic pulse supply (24V supply for switches) Pulse 1 Pulse 2 Pin Description 10 Diagnostic pulse supply (24V) 1-4 Digital inputs (8 single, 4 redundant) Ch 1 Input 1 Ch 2 Redundant input connections Ch 1 Input 2 Ch 2 February 11, 2015 Slide 50
FSO-12 Safety functions module Connection example 1: passive switches Redundant connection shown Separate pulse sources used Wiring of different channels should be physically separated to achieve full redundancy Pulsing 1 TP Pulsing 2 Channel separation February 11, 2015 Slide 51
FSO-12 Safety functions module Connection example 2: two passive switches Two switches can use the same pulse sources Pulsing 1 TP Pulsing 2 Channel separation February 11, 2015 Slide 52
FSO-12 Safety functions module Connection example 3: Safe Brake Control (SBC) Basic & safe brake controls connected in series Independent controls Redundant connection Feedback from the relay / contactor or from the mechanical brake itself TP DO Drive brake control GND Pulsing M February 11, 2015 Slide 53
FSO-12 Safety functions module Connection example 4: Inputs from active devices Redundant input from a PLC, light curtain or similar active device Voltage outputs from the device are connected to inputs of the FSO Common 0 V connection Remember separation of channels TP February 11, 2015 Slide 54
FSO-12 Safety functions module Connection example 5: Outputs to active devices FSO outputs are connected to inputs of, e.g., a PLC Diagnostic pulsing can be used Common 0 V connection TP February 11, 2015 Slide 55
FSO-12 Safety functions module Connection example 6: Cascading safety options Cascade connection is used to connect multiple FSO modules to actuate a function together Outputs of the first module are connected to inputs of the next module Outputs of the last module are connected to the inputs of the first module When request button is pressed, all module activate the function together Wire diagnostics is used in all connections (pulsing) Remember the separation of channels Diagnostic pulses in all connections Cascade connections February 11, 2015 Slide 56
FSO Safety functions modules Setting up safety functions - configuration Drive Composer Pro Drive & safety configuration Indication lights 24VDC ACS880 Limit switches STO STO Light curtain FSO Safety Control unit Safety-PLC Tasks: Emergency Stop switch option + + + IGBT disable 1. Mount the FSO module 2. Make necessary connections to switches and devices. Note the maximum cable lengths. 3. Configure the safety functions - - - Mechanical brake M 3~ February 11, 2015 Slide 57
FSO-12 Safety functions module Configuration - general PC-tool (configuration) Drive & safety Configuration with Drive composer pro only Offline configuration possible STO ACS880 STO Similar to Drive configuration Makes one binary file Panel can show configuration, NOT configure Password protected FSO configuration is password protected Password can be changed Factory reset : Resets the password back to factory default Factory default is 12345678 (only numbers) Resets all the parameters back to factory defaults and invalidates them NOT operational new configuration FSO Safety module Fieldbus adapter Control unit Factory reset button February 11, 2015 Slide 58
FSO-12 Safety functions module Configuration - general PC-tool (configuration) Drive & safety Backup restore Configuration file is in the PC, FSO and drive Restore can be done from any of the above Only via Drive composer pro Restore requires normal commissioning (validation of configuration and verification of functionality) The drive s normal backup-restore can be used The FSO must be the same Works with drives with the same safety configuration (checked at the power-up phase) Configuration file has date, version and userid Safety Module Safety option STO ACS880 STO Control unit February 11, 2015 Slide 59
FSO-12 Safety functions module Configuration work flow (*) = password required Drive composer pro is used for safety module configuration; Connect your PC to the drive, execute Drive composer pro and open the safety configuration tab. 1. Get the parameters: A. Fresh start: Upload from FSO the parameters (*) B. Ready made configuration: Open the safety file (.dcsafety) February 11, 2015 Slide 60 Note: After upload, the system will inform about General fault due to being in configuration mode
FSO-12 Safety functions module Configuration work flow (*) = password required 2. Configure the safety function parameters Select the used function Input & output terminals used for the function (selectable with parameters) Time limits, speed limits and other needed settings 3. Save and download configuration to the module (*) 3.1 Save the configuration (.dcsafety file) to your PC. 3.2 Download configuration to the module (*) February 11, 2015 Slide 61
FSO-12 Safety functions module Configuration work flow (*) = password required 4. After downloading, the file and communication will be validated, and the user will be informed and asked to accept the configuration. 5. Drive composer will automatically reboot the whole drive to apply the changes. 6. Fill safety issues of Installed base Commissioning report form after verification of safety systems. 7. Change password from the factory default to protect the settings, if the customer wants an individual password. Give the changed password to the customer. (*) Note: After download, the General fault will be cleared February 11, 2015 Slide 62
FSO-12 Safety functions module Configuration parameters General parameters Motor, event system, acknowledgement. STO (+SBC) STO time limits, IO, (SBC usage & time limits, IO) Safety functions Connect IO, speed limits, time limits,.. IO Used IO, polarity of outputs, diagnostics, safety relays.. February 11, 2015 Slide 63
FSO Safety functions modules Reference information FSO user s manuals February 11, 2015 Slide 64
FSO Safety functions modules Summary FSO mounting Connecting inputs & outputs Configuration Verification & validation, documentation Service February 11, 2015 Slide 65