I DT MC Operating Manual SINAMICS S20 Verification of Performance Level e in accorance with EN ISO 3849- Document Project Status: release Organization: I DT MC Baseline:.2 Location: Erl. F80 Date: 24.09.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf Author: Name Departement Location Telphon Jürgen Bremer I DT MC PM Erl F80 +49 (0) 93-98 4488 Release: Name Departement Location Telphon Date Hahn, Ulrich I DT MC RD 2 Erlangen +49 (0)93-98 5329 24.09.09 Internal version moification: Document version Date Name Departement Status V.0 03.06.09 Bremer, Jürgen I DT MC PM SP release V. 7.09.09 Hahn, Ulrich I DT MC RD 2 incomplete changes integrate V.2 24.09.09 Hahn, Ulrich I DT MC RD 2 release Copyright Siemens AG 2009. All rights reserve V.2 - release Page 2 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf Inhaltsverzeichnis Task... 4 2 Description of the safety function... 4 2. Operating principle... 4 2.2 Variant : Power contactor in the mains supply of the converter... 4 2.3 Variant 2: Power contactor on the output en between the motor an the converter... 6 3 Determining the Performance Level...7 3. Variant... 7 3.. Calculation... 7 3... Determining the... 7 3...2 Determining the iagnostic coverage level (DC)... 9 3...3 Measures against common cause failure (CCF)... 9 3...4 Defining the Performance Level... 9 3...5 Testing the PFH value... 0 3.2 Variant 2... 0 3.2. Calculation... 0 3.2.. Determining the... 0 3.2..2 Determining the iagnostic coverage level (DC)... 2 3.2..3 Measures against common cause failure (CCF)... 3 3.2..4 Defining the Performance Level... 3 3.2..5 Testing the PFH value... 3 4 Notes for users... 3 Copyright Siemens AG 2009. All rights reserve V.2 - release Page 3 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf Task The safety functions of the SINAMICS S20 fulfill Performance Level as stanar. The architectural requirements of category 4 can be achieve by using a power contactor as an aitional switch-off signal path. It shoul hereby be verifie that Performance Level e is achievable. 2 Description of the safety function As a general rule, a safety function consists of the subfunctions sensing, evaluating an responing. Safety sensors such as emergency stop buttons, position switches or light curtains are part of the sensing subfunction. Safety relays or safety controls form the evaluation subfunction, whereas safety actuators such as contactors or rives with integrate safety functions form the response subfunction. The safety function escribe in the following sections comprises a safety control (F-CPU) with associate I/O moules, a power contactor an the SINAMICS S20 rive system with integrate safety functions. No further references will be mae here to the require sensor technology. 2. Operating principle The rive is shut own by the safety control e.g. after responing of a safety sensor (this is not illustrate in the following figures). To o so, the Safe Torque Off (STO) safety function integrate in the rive is triggere via a safe output of the fail-safe I/O on the SINAMICS S20. To achieve category 4, an aitional power contactor is provie as a secon, inepenent switch-off channel. The auxiliary contact (NC contact) of the power contactor is then rea back into the I/O moule. In this case, a safe input is not require; nevertheless a regular force ormant error etection (e.g. every 8 hours) is necessary. In oing so, the control switches the contactor an checks whether the switching state has been accurately reporte back to the input. This function is to be suitably implemente in the safety program of the control. By activating the STO on the SINAMICS S20, pulse suppression is activate in the motor-sie inverter an the current is immeiately switche off electronically. In orer for the contactor to be switche at zero current an with reuce wear, the activation of the contactor is elaye by the safety control. However, in the event of a fault it must be able to switch the loa current as a secon, inepenent switch-off signal path an is thus to be configure accoringly. When etermining the response time of the safety function, the elay time of the contactor must be taken into account. 2.2 Variant : Power contactor in the mains supply of the converter In variant, the power contactor is provie on the line sie of the SINAMICS S20 (see Fig. ). This variant features the following properties: Copyright Siemens AG 2009. All rights reserve V.2 - release Page 4 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf -A -A2 P24 Line -K F-CPU F-I/O -A3 STO SINAMICS Motor Fig. Avantage: The contactor can be imensione for ohmic loas (AC). Disavantages: In the case of a failure of the safety function integrate in the rive, a resiual movement can still be performe even after switching off the line contactor, as a result of the energy save in the DC link. This must be taken into account in the risk evaluation. The contactor must be imensione for the thermal continuous current of the rive/s. Following isconnection, the DC link capacitors are ischarge. It is for this reason that the precharge time of the converter must be achieve prior to restarting the rive. As a general rule, this variant is only suitable for single rives. In the case of a multi-motor rive with a common infee, the power supply of all connecte rives woul have to be switche off simultaneously. Copyright Siemens AG 2009. All rights reserve V.2 - release Page 5 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf 2.3 Variant 2: Power contactor on the output en between the motor an the converter Variant 2 escribes a SINAMICS S20 multi-axis group with contactors on the output en (see Fig. 2). This variant features the following properties: Line - A - A2 - A3 STO SINAMICS multi-axis system F-CPU F-I/O P24 - K2. - K2.2 - K2.3 Motor Motor Motor Fig. 2 Avantages: Suitable for single an multi-motor configurations, as each rive can be switche off on an iniviual basis. The DC link remains on the line an is thus precharge, i.e. there is no thermal stress of the associate components an no time elay when restarting the system Copyright Siemens AG 2009. All rights reserve V.2 - release Page 6 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf Disavantages: In the worst case scenario, the contactor must be able to switch a DC current with an inuctive loa (motor wining). In the case of an extremely low spee or a spee setpoint of 0, the converter injects a current with a very low frequency, which affects the contactor in the same way as a DC current. The contactor must be imensione for the thermal continuous current of the rive. 3 Determining the Performance Level Both variants meet the architectural requirements in accorance with category 4. In orer to verify that Performance Level e is also fulfille in accorance with ISO 3849-, the reliability of the circuit an the components use must also be etermine. 3. Variant In the safety-relate block iagram (see Fig. 3), the SINAMICS S20 an the contactor are regare as parallel units. To etermine the Performance Level of this configuration, the of both paths must initially be etermine an, if necessary, symmetrize in accorance with ISO 3849-. Fig. 3 Note: This block iagram an the following calculation also apply to the variant which controls the safety function on the SINAMICS S20 in an alternative manner via PROFIsafe. 3.. Calculation 3... Determining the SINAMICS S20 (-A3): As an example, a single-axis rive with the PM340 Power Moule an the CU30 Control Unit is assume. Safe Torque Off (STO), activate via terminal, is use as the safety function integrate in the rive. An encoer is not require for this function. The PFH values of the SINAMICS components are 8 x 0-9 / h (PM340) an 0 x 0-9 / h (CU30), Copyright Siemens AG 2009. All rights reserve V.2 - release Page 7 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf The total PFH is thus 28 x 0-9 / h. In accorance with information provie by the manufacturer an confirme by the Institute for Occupational Safety an Health of the German Social Accient Insurance in Sankt Augustin, the replacement for exactly this SINAMICS application configuration is etermine as follows: 80 years. PFH 50.5 8760-9 h 280 50.58760 h a (Conition for category 4 specifie in ISO 3849-: >= 30 years) [F] Line contactor (-K): Accoring to ISO 3849-, Appenix C, a B0 value of 2,000,000 can be assume for a contactor. Shoul manufacturer's specifications be available for the contactor use, these values are to be applie. A sample cycle of two actuations per hour, two-shift operation, i.e. 6 h / ay an 358 prouction ays per year results in a number of,456 actuations per year. With the known B0 value, this results in an of 2,000,000,745 years. 0.,456 (Conition for category 4 specifie in ISO 3849-: >= 30 years) For the etermination of the reliability, the is limite to a maximum of 00 years in accorance with ISO 3849-. The etermine values vary greatly. Therefore, ISO 3849- requires a symmetrization accoring to the following formula: 2 3 2 80 a 00 a - 3 90 years (A3) 80 a (K) - 00 a (A3) (K) ISO 3849- states that an value is consiere high from 30 years. Copyright Siemens AG 2009. All rights reserve V.2 - release Page 8 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf 3...2 Determining the iagnostic coverage level (DC) Accoring to manufacturer's specifications for exactly this application configuration, a replacement DC of 99% can be applie for SINAMICS S20. DC (A3) = 0.99. The line contactor has a positively-riven NC contact which is evaluate by the safety control. A DC of 99% can therefore also be applie here: DC (K) = 0.99. In accorance with ISO 3849-, the mean DC is calculate as follows: DC avg. DC (A3) DC (K) 0,99 0,99 (A3) (K) 80 00 0,99 (A3) (K) 80 00 DC avg. 99%. ISO 3849- specifies that a DC > 99% is consiere as high. 3...3 Measures against common cause failure (CCF) In accorance with ISO 3849-, a minimum of 65 points are require for SRP/CS from category 2. The sample safety function ealt with here inclues Diversity of technology (conventional contactor an electronic safety function integrate in the rive) (20 points). Both the contactor an the SINAMICS S20 are installe in a cabinet with a sufficient egree of protection. This therefore provies protection against contamination an electromagnetic interference (25 points). Both channels are separately wire in the cabinet (5 points). Both the contactor use an the SINAMICS S20 can be regare as trie an teste components (5 points). A sufficient total of 65 points is achieve. 3...4 Defining the Performance Level Using the previously etermine values Category 4 high DC high Measures against CCF fulfille results in Performance Level e being achieve in accorance with ISO 3849-, see Fig. 5. Copyright Siemens AG 2009. All rights reserve V.2 - release Page 9 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf 3...5 Testing the PFH value Accoring to ISO 3849-, Appenix K, the following value is achieve for the parallel structure: PFH of 2.74 x 0-8 / h. The values of the F-CPU an the F-I/O moule are also ae to this PFH. In this example, the following SIMATIC components are use: F-CPU: SIMATIC S7 CPU 35F 2DP.54 x 0-9 / h, PL e F-DO moule: SM326 F-DO 8.0 x 0-9 / h. F-DI moule: SM326 F-DI 24.0 x 0-9 / h. The F-CPU communicates via the backplane bus with the F-I/Os by means of PROFIsafe. One FIT (failures in time) is to be consiere for the PROFIsafe master:.0 x 0-9 / h. Total PFH = 3.94 x 0-8 / h < 0-7 / h. This enables the requirements of Performance Level e to be met. 3.2 Variant 2 In the safety-relate block iagram (see Fig. 4), the SINAMICS S20 rive system an contactors are regare as parallel units. To etermine the Performance Level of this configuration, the of both paths must initially be etermine an, if necessary, symmetrize in accorance with ISO 3849-. -K2. -K2.2 -K2.3 -A -A2 -A3 Fig. 4 Note: This block iagram an the following calculation also apply to the variant which controls the safety function on the SINAMICS S20 in an alternative manner via PROFIsafe. 3.2. Calculation 3.2.. Determining the In the example illustrate in Fig. 2, the SINAMICS S20 rive system consists of three Motor Moules which are supplie from the same Line Moule. All three Motor Moules an the Line Moule are controlle by the same CU320 Control Unit. For each rive, Safe Torque Off (STO), activate via terminal, is use as the safety function integrate in the rive. The safety function of the three rives is Copyright Siemens AG 2009. All rights reserve V.2 - release Page 0 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf controlle in parallel by the safety control via the F-DO s. A power contactor is provie at the output of each Motor Moule. The power contactors are also controlle in parallel by an F-DO of the safety control. The auxiliary contacts of the three contactors are connecte in series an wire to a igital input (logic AND operation). SINAMICS S20 (-A3): The PFH values of the SINAMICS components use are 0 x 0-9 / h (CU320), 0 x 0-9 / h (Single Motor Moule, booksize format), 4 x 0-9 / h (Single Motor Moule, chassis format), 8 x 0-9 / h (Power Moule blocksize format, linke to CU320 via CUA32). The total PFH of the rive system is thus 52 x 0-9 / h. (The Line Moule oes not influence the functional safety of the system an oes not therefore make any contribution to the PFH ). In accorance with information provie by the manufacturer an confirme by the Institute for Occupational Safety an Health of the German Social Accient Insurance in Sankt Augustin, the replacement for exactly this SINAMICS application configuration is etermine as follows: PFH 50.58760 520-9 43 years. h 50.58760 h a (Conition for category 4 specifie in ISO 3849-: >= 30 years) [F2] Output contactors (-K2. - -K2.3): Accoring to ISO 3849-, Appenix C, a B0 value of 2,000,000 can be assume for a contactor. Shoul manufacturer's specifications be available for the contactor use, these values are to be applie. A sample cycle of one actuation every 5 minutes, single-shift operation, i.e. 8 h / ay an 250 prouction ays per year results in a number of 24,000 actuations per year. With the known B0 value, this results in an for each contactor of 2,000,000 833 years. 0. 24,000 In accorance with ISO 3849-, the total is etermine as follows: 2 3 277 years. (Conition for category 4 specifie in ISO 3849-: >= 30 years) Copyright Siemens AG 2009. All rights reserve V.2 - release Page of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf For the etermination of the reliability, the is limite to a maximum of 00 years in accorance with ISO 3849-. The etermine values vary greatly. Therefore, ISO 3849- requires a symmetrization accoring to the following formula: 2 3 2 43 a 00 a - 3 75 years. (A3) 43 a (K2) - 00 a (A3) (K2) ISO 3849- states that an value is consiere high from 30 years. 3.2..2 Determining the iagnostic coverage level (DC) Accoring to manufacturer's specifications for exactly this application configuration, a replacement DC of 99% can be applie for SINAMICS S20. DC (A3) = 0.99. The power contactors each have a positively-riven NC contact, which is evaluate by the safety PLC. A DC of 99% can therefore also be applie here: DC (K2. - K2.3) = 0.99. In accorance with ISO 3849-, the mean DC is calculate as follows: DC avg. DC (A3) DC (K2) 0.99 0.99 (A3) (K2) 43 00 0.99 (A3) (K2) 43 00 DC avg. 99%. ISO 3849- specifies that a DC > 99% is consiere as high. Copyright Siemens AG 2009. All rights reserve V.2 - release Page 2 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf 3.2..3 Measures against common cause failure (CCF) In accorance with ISO 3849-, a minimum of 65 points are require for SRP/CS from category 2. The sample safety function ealt with here inclues Diversity of technology (conventional contactor an electronic safety function integrate in the rive) (20 points). Both the contactor an the SINAMICS S20 are installe in a cabinet with a sufficient egree of protection. This therefore provies protection against contamination an electromagnetic interference (25 points). Both channels are separately wire in the cabinet (5 points). Both the contactor use an the SINAMICS S20 can be regare as trie an teste components (5 points). The esigners have been traine to etect the reasons for an effects of failures occurring as a result of common causes. Furthermore, an FMEA has been performe to etect an prevent failures occurring as a result of common causes (5 points each). A sufficient total of 70 points is achieve. 3.2..4 Defining the Performance Level Using the previously etermine values Category 4 high DC high Measures against CCF fulfille results in Performance Level e being achieve in accorance with ISO 3849-, see Fig. 5. 3.2..5 Testing the PFH value Accoring to ISO 3849-, Appenix K, the following value is achieve for the parallel structure: PFH of 3.4 x 0-8 / h. The values of the F-CPU an the F-I/O moule are also ae to this PFH. In this example, the following SIMATIC components are use: F-CPU: SIMATIC S7 CPU 35F 2DP.54 x 0-9 / h, PL e F-DO moule: SM326 F-DO 8.0 x 0-9 / h. F-DI moule: SM326 F-DI 24.0 x 0-9 / h. The F-CPU communicates via the backplane bus with the F-I/Os by means of PROFIsafe. One FIT (failures in time) is to be consiere for the PROFIsafe master:.0 x 0-9 / h. Total PFH = 3.864 x 0-8 / h < 0-7 / h. This enables the requirements of Performance Level e to be fulfille. 4 Notes for users Copyright Siemens AG 2009. All rights reserve V.2 - release Page 3 of 4 08.2.2009
accorance with EN ISO 3849- File: PLe_mit_Schuetz_V.2_E.rtf This ocument escribes two exemplary configurations with SINAMICS S20 rive components an verification of the Performance Level. It can be use as a manual for etermining the Performance Level for concrete applications. The parameters of the application are to be taken into consieration here e.g. the respective PFH values of the SINAMICS S20 an SIMATIC components use, B0 value of the contactors use an the number of switching cycles, the measures taken against common cause failure. Copyright Siemens AG 2009. All rights reserve V.2 - release Page 4 of 4 08.2.2009