Drive and motor safety

CMAFH Drive For Technology 2010
Drive and Motor Safety

CMAFH
Drive For Technology 2010

Gary Thrall
Senior Product Support Engineer
Bosch Rexroth Corporation

Safety on Board –
Safety on Board –
Integrated, certified and consistent
Electric Drives and Controls 2009-02-26; BRC/SPD G. Kobs 1
© Alle Rechte bei Bosch Rexroth AG, auch für den Fall von Schutzrechtsanmeldungen. Jede Verfügungsbefugnis, wie Kopier- und Weitergaberecht, bei uns.


New European Standards

IndraDrive safety functions according new standards
IndraDrive C/ M

Coming soon – IndraDrive Cs L4 option
STO and SBC

Safety on Board –
Safety on Board –


Passport into European Community market (EEA)

European Machinery Directive

Machine Builder

Fulfilling harmonized
standards the manufacturer
can assume that the safety
aspects of the machine
EC directive are met

EN 13849-1 (EN 954-1)
EN 62061
EN 61800-5-2

Change of Safety Standards

Today

European Machinery Directive
98/37/EG 2006/42/EG

January 2010
Machine Builder

EN 954-1
Valid Standard Period 3 years Extended 2 more years

EN ISO 13849-1 Transition Transition
Valid Standard
November 2006 December 2009
EN 62061
Valid Standard
January 2006

EN 61800-5-2
Components

Valid Standard
November 2007
IEC 61508
Valid Standard


Performance Level of EN ISO 13849-1:2006

The Performance Level is defined by
Category (architecture), identical to EN 954-1 and C-Standards
MTTFd (Meantime to dangerous failure in one channel)

Denotation of MTTFd Range of MTTFd
Low 3 years <= MTTFd < 10 years
Medium 10 years <= MTTFd < 30 years
High 30 years <= MTTFd < 100 years

DC (Diagnostic Coverage): Share of detected failures

Denotation of DC Range of DC
None DC < 60%
Low 60% <= DC < 90%
Medium 90% <= DC < 99%
High 99% <= DC

CCF (Common Cause Failures affecting both channels)
Measures against systematic failures

CMAFH Drive For Technology 2010 Performance Level of EN
ISO 13849-1:2006

A Performance Level d could be achieved by:

Cat. 3 Cat. 2
DCavg = medium or DCavg . = medium
MTTFd = medium MTTFd = high

EN 62061 and EN 13849-1

Safety Integrity Level Probability of dangerous Performance Level
SIL failure per hour (1/h) PL
IEC 61508 PFHd ISO 13849
- >= 10-5 to 10-4 a

ISO 13849
IEC 62061

1 >= 3 x 10-6 to 10-5 b
1 >= 10-6 to 3 x 10-6 c
2 >= 10-7 to 10-6 d
3 >= 10-8 to 10-7 e
4 < 10-8 -

electrical, electronic and All Technologies
programmable
Simplified Estimation (worst case)
calculation formula regarding to:
for subsystem architectures
HW Structure (Category like EN 954)
Diagnostic Coverage (DC)
Reliability MTTFd
Failure of Common Cause (CC)

PFHd – Probability of a dangerous Failure per Hour


Performance Level in total

Performance Level of the combination of SRP/CS

SRP/CS1 SRP/CS2 SRP/CS3 SRP/CS4
PL1 PL2 PL3 PL4
SRP/CS5
PL5
SRP/CS6
Cat 3 Cat 3 Cat 3 PL6
SRP/CS7
PL7
SRP/CS8
PL8
SRP/CS9
PL9
PFHtotal = PFHSensor + PFHIO + PFHSafetyPLC + n x PFHDrive Cat 3

PFHtotal = 2,29 10-7 + 4,29 10-8 + 2,47 10-8 + 6 x 4,29 10-8

PFHtotal = 5,54 10-7 < 10-6 -> PL d

EN ISO 13849-1:2006 Category 3 PL d

SafeMotion - More than just Switching Off!

The evolution of safety technology
Safety reaction Safety condition

Switching off SafeMotion

Electric Drives and Controls 2008-11-07; BRC/SPM; J. Ost 9

Conventional versus Integrated

controller
enable additional
E E Channel 1

two-channel switching-off
feedback

M G M

external
monitoring
unit E Channel 2

(standstill,
speed, ...) Drive Drive

Drive-integrated
Conventional safety solution
safety technology


Safety On Board with IndraDrive

Note:
- only Safe Torque Off
in BASIC

Encoders with only TTL
interface or only serial interface
are not allowed for integrated
safety technology functions.
All encoders with 1 Vpp signals
3 principles are realized to detect latent failures
(e. g. EnDat, HIPERFACE,...)
Dual channel data operation with diversity
and all resolvers supported by
Cross data comparison of safety related functions the encoder interface can be
Dynamization of static modes used for integrated safety
Due to this method one single failure may not deactivate the safety technology. It is always the
function feedback at X4 connector that is
--> Category 3 (recommended Safety level in most guidelines) evaluated.
A risk analysis by the machine builder and end user is required in
accordance to Annex I of the European Community Directive for machines
98/37/EG

Selection of safety functions

SafeMotion – Functional Safety in Automation Technology

Communication Safe Communication
Control Safe (Profisafe, SERCOS III Safety)
Control

Auto Set-up Auto Set-up

E Channel 1 Channel 1

T w o .-c h a n n e l in te rru p t

T w o -c h a n n e l in te rru p t
M E M

E Channel 2 Channel 2

Drive
Drive

Option S2 Option S2
24V / 24V Safe communication

Safety on Board - Functional Safety

Safe Torque Off Safe Motion

STO using 24V / 24V or 24V / 0V SLS using 24 V/ 24V

X41 channel 1 X31/X32 channel 1
common
power section
parts
transducer
X41 channel 2 X41 channel 2

One L2 PFH value independent from control
(opener / closer, opener / opener)
SLS using SERCOS / 24V

SERCOS channel 1
Preliminary information common
transducer
parts
X41 channel 2
Safe Torque Off:
PFH = 2 * 10 -9 1/h
One S2 PFH value independent from the control
and the safety technology feature.
Safe Motion:
Separate PFH value for the feedback
PFH drive and feedback = 5 * 10 -8 1/h


Functional Safety According to ISO 13849-1

Verification with SISTEMA
Library for certified and standard components IEC 61508
IEC 61508 IEC 61508 IEC 61800-5-2
SRP/CS1 SRP/CS2 SRP/CS3 SRP/CS4
SRP/CS5
PL1 PL2 PL3 SRP/CS6
PL4
SRP/CS7
PL5
SRP/CS8
SRP/CS9
PL6
PL7
PL8
PL9

safety switches safety I/O safety PLC safety drives

Certified components ISO 13849

S input DP DP PPC SII IndraDrive

S K1
safety switches I/O PLC Drive
Standard components ISO 13849


Certification according to new Standards

Safe Motion
IndraDrive
EN 954-1

Since 2004 more than 100,000
installed drives
Category 3

Development project “New Standards”

Hardware Modification of Control Units
IEC 61508

CSH….-L1-…. -> CSH….-L2-….
CSH….-S1-…. -> CSH….-S2-….
CSB….-L1-…. -> CSB….-L2-…. Deliverable since July 2009
CDB….-L1-…. -> CDB….-L2-….
CDB….-S1-…. -> CDB….-S2-….

New Firmware Version MPX07VRS


SafeMotion – Preliminary Data

Safe Torque Off (L2):

EN ISO 13849-1:2006 Category 3 PL = e

IEC 61508
EN 62061:2005
EN 61800-5-2:2007 SIL3

PFHd = 2 * 10 -9 1/h

MTTFd = 100 years (limitation by standard)

Mission Time = 20 years

The PFH values are based on a 100% duty cycle (24h/ 365 days)


Safe Motion (S2):

EN ISO 13849-1:2006 Category 3 PL = d

IEC 61508
EN 62061:2005
EN 61800-5-2:2007 SIL2

PFHd Drive = 3 * 10 -8 1/h
PFHd Feedback = 2 * 10 -8 1/h (Stegmann/ Heidenhain motor feedback)

MTTFd = 100 years (limitation by standard)

Mission Time = 20 years
To calculate the MTTFd value for a drive and feedback combination: Add the PFH values and convert
then into a MTTFd value. Do not add the MTTFd values since they are limited to 100 years.

The PFH values are based on a 100% duty cycle (24h/ 365 days)


Safety Integrity Level Probability of dangerous Performance Level
SIL failure per hour (1/h) PL
IEC 61508 PFHd ISO 13849
- >= 10-5 to 10-4 a

ISO 13849
IEC 62061

1 >= 3 x 10-6 to 10-5 b
1 >= 10-6 to 3 x 10-6 c
2 >= 10-7 to 10-6 d
3 >= 10-8 to 10-7 e
4 < 10-8 -

Preliminary Data for IndraDrive, Safety on Board

Safe Torque Off: PFHd = 2 * 10 -9 1/h = 2 % of max. SIL3 value

Safe Motion: PFHd Drive and feedback = 5 * 10 -8 1/h = 5 % of max. SIL2 value


IEC 61800-5-2 – New Terminology (not all available)
Safe Torque Off STO
Safe Stop 1 SS1
Safe Stop 2 SS2
Safe Operating Stop SOS
EN 61800-5-2: 2007
Safely-monitored Deceleration SMD 1)
Functional safety for speed variable drives
Safely-limited Acceleration SLA
Safe Acceleration Range SAR
Safely-limited Speed SLS
Safe Speed Range SSR
Safe Speed Monitor SSM
Safe Maximum Speed SMS 1)
Safely-limited Increment SLI

1) Not defined in IEC 61800-5-2
Safe Direction SDI
Safely-limited Position SLP
Safely-monitored Position SMP 1)
Safe Brake Control SBC
Safe Braking and Holding
System SBS 1)
Safely-limited Torque SLT
Safe Torque Range STR
Safe Motor Temperature SMT

Electric Drives and Controls 2008-11-07; BRC/SPM; J. Ost Safe Cam SCA 19

Terms of EN 61800-5-2 – New Terminology (available)

EN 61800-5-2: 2007
Functional safety for speed variable drives (C-standard)
New terms and definitions

Safety
EN 954-1 Rexroth Safety functions option IEC 61800-5-2 Terms Abk.
Safety related starting lookout L2 Safe Torque off STO
Safety related standstill S2 Safe Stop 1 SS1
Safety related operational stop S2 Safe Stop 2 SS2
Safety related operational stop S2 Safe Operating Stop SOS
Safety related drive interlock S2 Safe Stop 1 (Emergency Stop) SS1 ES
Safety related monitored stopping process S2 Safely-Monitored Deceleration * 1 SMD
Safety related reduced speed S2 Safely-Limited Speed SLS
Safety related limited increment S2 Safely-Limited Increment SLI
Safety related direction of motion S2 Safe Direction SDI
Safety related absolute position S2 Safely-Monitored Position SMP
Safety related absolute end position S2 Safely-Limited Position SLP
Safety related control of a door locking device S2 Safe Door Locking * 1 SDL
Communication via PROFIsafe S2 Safe Communication * 1 SCO
Safety related in-/outputs via PROFIsafe S2 Safe I/O *1 SIO
1
Safety related braking and holding system S2 Safe Braking and Holding System SBS

*1 Not defined in EN 61800-5-2

Drive-Integrated Safety Features

Safe Torque Off (STO)
Safe Stop 1 (SS1)
Safe Stop 1 - Emergency Stop (SS1-ES)
Safe Stop 2 (SS2, SOS)
Safely Monitored Deceleration (SMD)
Safely Limited Speed (SLS)
Safe Maximum Speed (SMS)
Safely Limited Increment (SLI)
Safe Direction (SDI)
Safely Monitored Position (SMP)
Safely Limited Position (SLP)
Safe Door Locking (SDL)
Safe I/O interface for Safety-PLC (SIO)
new Safe Braking and Holding System (SBS)


Drive Based Safety Functions

Safe Torque Off (STO)

Safe Torque off (Stop Category 0*)
v

Drive is torque-less
t0 t Power is cut safely (pulse inhibit)

* according to EN 60204-1


Safe Stop 1 (SS1) / Safe Stop 2 (SS2)

Controlled Stopping according to stop
v category 1* (SS1)
monitored stopping, control or drive
controlled with safe deceleration
t
Torque-less standstill of the drives
t0 t1
Power is cut safely (STO)

Controlled Stopping according to stop
category 2* (SS2)
monitored stopping, control or drive
controlled
v, s
t controlled standstill after stopping, no
t0 t1
power off (SOS)
* according to EN 60204-1


Safely Limited Speed (SLS) / Safely Limited Increment (SLI)

v Within the Safe Mode a safely limited
speed and / or a safely limited
increment can be enabled (enabling
device)

t0 t1 t

30
In case the speed/increment monitoring
v, s
v, s window will be triggered the drive will
be safely stopped automatically in
t accordance with the stop category 1.



Safe Direction (SDI)

In addition a safe direction (right, left)
v
can be defined.

0 t

In case the direction changes the drive
will be safely stopped automatically in
accordance with the stop category 1.



Safe Maximum Speed (SMS1)

The monitoring of a safely limited maximum
speed is active always, regardless the
operation mode of the drive
vMax
(Automatic/Manual Mode)

120
t
In case the parameterized maximum speed
will be exceeded the drive will be safely
stopped automatically in accordance with
the stop category 1.

Electric Drives and Controls 2009-02-26; BRC/SPD G. Kobs 1) Not defined in IEC 61800-5-2 26


Safely Monitored Position (SMP1)

In the safe operation mode
Working Area a working area (absolute
position) can be defined

In case the parameterized
working area will be left, the
drive will be safely stopped
Position 1 Position 2 automatically in accordance
with the stop category 1.

1) Not defined in IEC 61800-5-2



Safely Limited Position (SLP)
active in normal and safe operation mode
- The drive is not able to cross the limited switches
- The drive is stopped automatically when the available
deceleration torque would not be sufficient to stop the load
before the parameterized position area will be left
Offers cost saving by replacing hardware position limit switch

v v max

Max. Max.
deceleration deceleration
s
Positive Negative
Limit Switch Limit Switch



Safely Monitored Deceleration – safety in the stopping process

NC-controlled stopping process with safely
monitored deceleration (SMD)
n SMD
Braking of coupled drives: It may occur that
individual axes must still accelerate, in order to
stop the total movement

Safe stop in a defined time due to predictive
behavior of the drive

The drive checks each cycle whether it is
possible to stop within the time t1. If this is not
possible such as by wrong set point of the
control, the drive takes over the braking.

t1


Safety on Board - Safe Braking and Holding System

Safe braking and holding system – a new milestone

Safe Braking and Holding System (SBS)

Fall protection for axes with gravity loads

Operator protection in special operating mode

World’s only on board solution which complies with
EN ISO 13849-1, Cat. 3 PL d and EN 62061 SIL 2

Two independent brakes separately controlled and
monitored by redundant, diverse channels in the drive

Escalation strategy to protect the mechanical
subsystems

Active as well after energy cutting by emergency stop



During automatic operation the
machines and equipment are
running at full speed without
operators

During special operation mode
persons may be present in the
machine when following special
safety precautions
- Configuration
- Measuring
- Troubleshooting

Vertical or inclined axes can even
present a danger when they are
switched off and inadvertently coming
down



Fall protection of
gravity-loaded axes
Personal protection of
operators during special
operation mode

• Safe
• Braking and
• Holding system

Effective even after energy
cut-off through emergency stop


The safe braking and holding system is based on two independent brakes
which are separately controlled and monitored by the redundant diversified
channels in the drive.

Safe energy cutting Universal integration of
different brake types, e.g.

two-channel selection two-channel
of the safety feature control of the
e.g. safely-monitored brakes
deceleration

IndraDrive HAT

Electric Drives and Controls Safe feedback
2009-02-26; BRC/SPD G. Kobs 33

SafeMotion – functional safety in automation technology

IndraDrive with safety functions – a convincing technology

Safety Technology made by the experts having more than 10 years
field experience

Scalable Safety Functions minimize the potential of tampering and
therefore reduce the hazard for injury caused by passing the safety
measures

Increased productivity by reducing downtime

Online Testing (Failure Detection) during runtime

Cost savings by reduction of external components and wiring

Minimal Movement in case of emergency by detecting failures within
2 ms

High reliability due to an encapsulated, certified solution

Stand-alone – whether wired, or with or without a safety PLC


Coming Soon – Safe Torque Off for IndraDrive Cs

Safe Torque Off (L4): (A new type code to distinguish different features)
IndraDrive Cs with L4 option is currently expected to go from EW to PT
(available for sale) by end of May 2010
Certification by TÜV Rheinland is expected to be done by then
• L4 option will include STO (Safe Torque Off) and SBC (Safe Brake
Control)
• SBC is 2-channel control of the standard holding brake so that if there is a
short in either wire or a failure in one channel, the brake will still be applied.
• L4 STO circuit is completely redesigned from L1/L2
• has safe mode within a test period. The test pulse is < 1ms.
• with on-line dynamization, no need for an acknowledgement contact to meet
Cat. 4, PL e, SIL 3 -- the lifetime issue of the relay contact in the L1/L2 is gone.
• L4 connector for is no longer a D-sub
• 6-pin cage clamp connector with separate clamp for incoming and outgoing
wire at each pin
• daisy-chain up to 25 axes. Just daisy chain 4 terminals with discrete wires
from one drive to the next. This eliminates the cable management issues of
the ribbon cable in previous design. Easier and less expensive.


Coming Soon – Safe Torque Off for IndraDrive Cs

SS1 functionality [single axis wired] with Single channel STO application over a
anSS1-Fun ktion einer Achse in Verbindung mit einem Sicherh eitsschaltg erät
external safety device: Einkanalige STO-Anwahl switch device
single pole über ein einpoliges Schaltgerät
+ 2 4V

24 V Dy nam is ierte A us gän ge 24 V Dynamisierte Ausgänge
R es et
24 V m it < 1 ms Tes tim puls 24 V mit < 1 ms Testimpuls

Z
e
i
Einpoliges Schaltgerät der
E x ternes t Kategorie 3, PL d, SIL 2
S ic he rh eit s- v IndraDrive Cs IndraDrive Cs
No t e mit Zwangsöffner
s c haltgerät r STO-Option
Ha lt z gemäß EN 60947-5-1 STO-Option
K ate gorie 4, ö
Kategorie 4, PL e
P L e , SI L 3 g
Kategorie 4, PL e
e SIL3
r
t
SIL3

R üc km eldung 24 V STO -Anw ahl Ch1
24 V STO -Anwahl Ch1
24 V S TO -A nwa hl Ch2
E.Stopp 0 V G roun d fü r Ch1 u nd C h2 24 V STO -Anwahl Ch2
oder 0 V G round für Ch1 und Ch2
NC-S top p A nwahl üb er 2 Ö ffn erk onta kte
Anwahl über 1 Öffnerkontakt
SS1 function multiaxis with an external SBC-Funktion
SBC Function
safety deviceAchsen mit external wiring Verdrahtung
SS1-Funktion mehrerer and Sicherheitsschaltgerät und externer

24 V 24 V 24 V 24 V
24 V 24V 24 V

SBC-Anwahl Ch 1
Bremse 24 V
Nicht sichere
STO-Option STO-Option Ansteuerung der ODER
Bremse aus der
1. Antrieb 2. Antrieb Standard-FW

Bremse 0 V
Anwahl Ch1 Anwahl Ch1
SBC-Anwahl Ch 2
Anwahl Ch2 Anwahl Ch2

0V 0V 0V


Safety on Board and Safe Motion - Additional Resources

www.BoschRexroth.com/safety

http://www.dguv.de/ifa/en/pra/softwa/sistema/index.jsp or just Google
“IFA SISTEMA” for BGIA software to calculate PFHd and Performance
Level to IEC 13849

www.BoschRexroth.com/MediaDirectory for downloadable manuals
including Safety on Board Application Manual

Bosch Rexroth Safety on Board hands-on workshop – next scheduled
for April 21st and 22nd in Hoffman Estates (more to follow)


Functional Safety with Safety on Board

Unexpected Safety on Board
movements

Risk for human Always on the
and machine. safe side


Drive and motor safety

Weitere ähnliche Inhalte

Andere mochten auch

Ähnlich wie Drive and motor safety

Mehr von CMA/Flodyne/Hydradyne

Drive and motor safety