Allen-Bradley PowerFlex 525 Guida utente

Application Technique

Safety Function: Actuator Subsystems – Stop Category 1 via

the PowerFlex 525 and PowerFlex 527 Drives with Safe

Torque-off

Products: Guardmaster Dual-input Safety Relay, Guardmaster Multifunction-delay Expansion Module, PowerFlex 525 Drive,

PowerFlex 527 Drive

Safety Rating: CAT. 3, PLd to ISO 13849-1: 2008

Topic Page

Important User Information 2

General Safety Information 3

Introduction 3

Safety Function Realization: Risk Assessment 3

Stop Safety Functions 4

Safety Function Requirements 4

Functional Safety Description 5

Bill of Material 6

Setup and Wiring 6

Configuration 11

Calculation of the Performance Level 13

Verification and Validation Plan 17

Additional Resources 22

2Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

Important User Information

Read this document and the documents listed in the additional resources section about installation, configuration, and

operation of this equipment before you install, configure, operate, or maintain this product. Users are required to

familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws,

and standards.

Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required

to be carried out by suitably trained personnel in accordance with applicable code of practice.

If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be

impaired.

In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the

use or application of this equipment.

The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and

requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or

liability for actual use based on the examples and diagrams.

No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or

software described in this manual.

Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation,

Inc., is prohibited.

Throughout this manual, when necessary, we use notes to make you aware of safety considerations.

Labels may also be on or inside the equipment to provide specific precautions.

WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment,

which may lead to personal injury or death, property damage, or economic loss.

ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property

damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.

IMPORTANT

Identifies information that is critical for successful application and understanding of the product.

SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous

voltage may be present.

BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may

reach dangerous temperatures.

ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to

potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL

Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015 3

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

General Safety Information

Contact Rockwell Automation to find out more about our safety risk assessment services.

Introduction

This safety function application technique is concerned primarily with the Logic and Output subsystems of a safety system.

The document illustrates how to combine a Guardmaster® dual-input safety relay (GSR DI) and Guardmaster

multifunction-delay expansion module (GSR EMD) with a PowerFlex® 525 drive or a PowerFlex 527 drive to provide a

category 1 stop. The category 1 stop provides a brief delay between the stop request to the programmable automation

controller (PAC) and the de-energizing of the STO inputs to allow the system time to execute an orderly stop before the

STO inputs are de-energized. The intent is to provide a less disruptive, but safe, response to a sudden emergency stop

demand.

In an actual application, any typical safety input device could be used as the Input subsystem if properly applied. A

SensaGuard™ switch, as in Safety Function: Door Monitoring Products: SensaGuard/GSR DI, publication SAFETY-

AT069, is used as a convenient example of an Input subsystem in this application technique.

Safety Function Realization: Risk Assessment

The required performance level is the result of a risk assessment and refers to the amount of the risk reduction to be carried

out by the safety-related parts of the control system. Part of the risk reduction process is to determine the safety functions of

the machine. In this application, the performance level required (PLr) by the risk assessment is Category 3, Performance

Level d (CAT. 3, PLd), for each safety function. A safety system that achieves CAT. 3, PLd, or higher, can be considered

IMPORTANT

This application example is for advanced users and assumes that you are trained and experienced in safety system requirements.

ATTENTION: Perform a risk assessment to make sure all task and hazard combinationshave been identified and addressed. The risk

assessment can require additional circuitry to reduce the risk to a tolerable level. Safety circuits must take into consideration safety

distance calculations, which are not part of the scope of this document.

Input Logic Output

Subsystem 1 Subsystem 2 Subsystem 3 Subsystem 4

SensaGuard

Switch

Guardmaster

Dual-input

Safety Relay

Guardmaster

Expansion

Module

PowerFlex

527 Drive

4Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

control reliable. Each safety product has its own rating and can be combined to create a safety function that meets or

exceeds the PLr.

Stop Safety Functions

This application technique includes two safety functions:

1. Safety-related stop function initiated by a safeguard.

2. Prevention of an unexpected startup.

Safety Function Requirements

Safety-related Stop Function Initiated by a Safeguard

When a partial-access guard door is opened, the Input subsystem initiates and maintains a stop command for the safety

system to stop hazardous motion before a person can reach the hazardous area. The stop command cannot be reset until the

guard door is closed.

Prevention of an Unexpected Startup

The safety system cannot be reset, and hazardous motion cannot be restarted while the guard door is open. Once the guard

door is closed and the stop command is reset, a second action (pressing a Start button) is required before the hazardous

motion can resume. This document presumes that the Start/Stop button is connected to and controlled by the

programmable automation controller (PAC).

From: Risk Assessment (ISO 12100)

1. Identification of safety functions

2. Specification of characteristics of each function

3. Determination of required PL (PLr) for each safety function

To: Realization and PL Evaluation

Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015 5

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

The safety functions in this application technique each meet or exceed the requirements for Category 3, Performance

Level d (CAT. 3, PLd), per ISO 13849-1 and control reliable operation per ANSI B11.19.

Functional Safety Description

The Guardmaster dual-input safety relay, Guardmaster multifunction-delay expansion module, and PowerFlex drives with

integrated safe torque-off (STO) use 1oo2 architecture to achieve the PFH value that is used in the PL calculation

verification section of this document.

The Guardmaster dual-input safety relay monitors its safety inputs for valid status and faults. It monitors its internal

circuitry for proper operation and faults. The safety relay monitors its single wire safety (SWS) input/output (I/O) for

valid status and faults. It monitors its safety output contacts for proper, valid status and faults. When it receives a safety

demand on its inputs, or an invalid status or a fault is detected, the safety relay deactivates its safety outputs and sends a

safety stop command to the Guardmaster multifunction-delay expansion module via its L11 SWS.

The Guardmaster multifunction-delay expansion module monitors its SWS input for safety stop commands, valid status,

and faults. It monitors its internal circuitry for proper operation and faults. It monitors its safety output contacts for proper,

valid status and faults. When it receives a non-fault safety demand via its L12 SWS input, it deactivates its safety outputs in

the manner for which it is configured. In this document, the Guardmaster multifunction-delay expansion module is

configured to provide a 100 ms delay. In the event of an internal fault, or a fault signaled via the SWS, the Guardmaster

multifunction-delay expansion module immediately de-energizes its safety outputs.

The PowerFlex drive monitor its STO inputs for valid status and faults. The drive monitors its internal safety circuits for

valid status and faults. The drive monitors its outputs for valid status and faults. When the Guardmaster dual-input safety

relay de-energizes the drive STO inputs via the Guardmaster multifunction-delay expansion module, the drive's STO

feature forces the drive output power transistors to a disabled state. The hazardous motion controlled by the drive coasts to

a stop. This feature does not provide electrical power isolation.

The system cannot be restarted until the gate is closed and the Guardmaster dual-input safety relay is reset. Once the safety

relay is reset, the PAC-controlled Start button can be pressed to start the hazardous motion.

Hardwired STO Safe Torque Off Considerations for a Category 1 Stop

In the event of a malfunction, it is possible that stop category 0 may occur. When designing the machine application, timing

and distance must be considered for a coast to stop, as well as the possibility of the loss of control of a vertical load. The

nature of a malfunction causing this condition could be if a hardwired STO input to the drive were to go low (i.e. a wire

falls off ) before the drive has a chance to completely stop the motor. Use additional protective measures if this occurrence

might introduce unacceptable risks to personnel.

IMPORTANT

The vendor must provide probability of failure per hour (PFH) and all relevant functional safety data for all the subsystems of this

safety system necessary to prove that the overall safety functions meet the requirements for Performance Level d (PLd), per ISO

13849-1.

6Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

Bill of Material

This Logic and Output subsystems in this document use these products.

Setup and Wiring

For detailed information on installing and wiring, refer to the publications listed in the Additional Resources on page 22.

System Overview

Safety-related Stop Function Initiated by a Safeguard

The Guardmaster dual-input safety relay monitors the status of a safety input device, for example a SensaGuard switch.

When the input device is tripped (guard door opened), the safety relay de-energizes its two safety outputs and sends a

safety stop command downstream to the Guardmaster multifunction-delay expansion module via its SWS. After the

100 ms configured delay time, the Guardmaster multifunction-delay expansion module deactivates its safety outputs,

which remove power from the drive's (PowerFlex 525 or PowerFlex 527 drive) STO inputs. The drive disables its output

power transistors, leaving the hazardous motion to coast to a stop. When the input device is returned to its safe state (guard

door closed), and the reset button is pressed and released properly, the Guardmaster dual-input safety relay’s safety outputs

energize, the Guardmaster multifunction delay expansion module energizes its safety outputs, and the drive's STO inputs

are powered. The hazardous motion can then be restarted by pressing a PAC-controlled Start button.

Prevention of an Unexpected Start-up

The Guardmaster dual-input safety relay cannot be reset while its input device is in a tripped (guard door open) state. The

Guardmaster multifunction-delay expansion module cannot reset until the Guardmaster dual-input safety relay is reset, the

drive's STO inputs remain off, and the hazardous motion cannot be restarted. When the input device is returned to its safe

state (guard door closed), and the reset button is pressed and released properly, the Guardmaster dual-input safety relay’s

safety outputs energize, the Guardmaster multifunction-delay expansion module energizes its safety outputs, and the drive's

STO inputs are powered. The hazardous motion can then be restarted by pressing a PAC-controlled Start button.

Cat. No. Description Quantity

440R-D22R2 Guardmaster dual-input safety relay (DI) 1

440R-EM4R2D Guardmaster multifunction-delay expansion module, 4 N.O. safety contacts 1

800FP-R611PQ10V 800F reset, round plastic 1

1606-XLP72E 1606-XLP72E compact power supply, 24…28V DC, class 2 1

25C-V2P5N104 PowerFlex 527 AC drive, with embedded EtherNet/IP™ and safe torque-off 1

25B-B5PON104 PowerFlex 525 AC drive, with embedded EtherNet/IP and safe torque-off 1

Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015 7

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

Safety Distance Calculations

Detailed calculation of a proper safety distance is beyond the scope of this document, but some considerations follow.

Safeguarding systems must make certain that a person cannot reach a hazardous motion before the safeguarding system has

brought that hazardous motion to a halt. This is addressed in safety standards relevant to this application:

•IS0 14119 (Safety of machinery - Interlocking devices associated with guards - Principles for design and selection)

•ISO 18355 (Safety of machinery - Positioning of safeguards with respect to the approach speeds of parts of the

human body)

•ANSI B11.19 (Performance Criteria for Safeguarding)

Safety Distance and Access Time

Safety distance is the distance between the guarded access point and the hazardous motion necessary to make certain that a

person cannot access a hazardous motion before it is stopped, that is, the hazard has ceased.

This document uses, as an example, an interlocking device (SensaGuard switch) monitoring a partial-body access gate.

Imagine that this access gate allows a person time to reach their arm 762 mm (30 inches) into the potentially hazardous area

to perform an occasional, necessary task.

ISO 14119 3.22 defines access time as the time taken by a person to reach the hazard zone after initiation of the stop

command by the interlocking device (the SensaGuard actuator moving beyond sensing range), as calculated on the basis of

an approach speed of the body or part of the body, in our case, a hand.

ISO 13855 defines the approach speed of a hand as 1600 mm per sec. Using this value, we calculate the access time:

762 mm/1600 mm per sec or 476 ms

ANSI B11:19 defines the approach speed of a hand as 63 in. per sec. Using this value, we calculate the access time:

30 in./63 in. per sec or 476 ms

Overall System Stopping Performance

ISO 14119 6.2.1 stipulates that the overall system stopping time for a hazardous machine safeguarded by an interlock must

be less than the access time. If the overall system stopping performance is equal to or greater than the access time, an

interlock with guard-locking must be used, the distance from the safeguard to the hazard must be increased, or a different,

more suitable method must be used to safeguard the hazard. In this document, the overall system stopping performance of

our application, using an interlock must, therefore, be less than 476 ms.

The overall stopping performance of these applications is the sum of the response time of the input device (SensaGuard

switch), the response time of Guardmaster dual-input safety relay, the response time of the Guardmaster multifunction-

delay expansion module, the delay configured in the Guardmaster multifunction-delay expansion module, the safety

reaction time of the drive used (PowerFlex 525 or PowerFlex 527 drive), and the coast-to-stop time of the hazardous

motion. The response and reaction times can be taken from the product support literature.

IMPORTANT

The overall system stopping performance of a safeguarding system must be determined by actual system testing and

measurement. The worst-case, overall system stopping performance from these tests and measurements must be used to

evaluate the safety distance requirements.

8Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

The sum response/reaction time of the Guardmaster dual-input safety relay, Guardmaster multifunction-delay expansion

module, Guardmaster multifunction-delay expansion module delay, and PowerFlex drive, and worst-case, coast-to-stop

portion of the overall system-stopping performance is the same regardless of the input device used.

It may be useful to estimate how fast the hazardous motion must coast to a stop before the safeguarded system is available

for testing.

The maximum safe coast-to-stop time for a system using the PowerFlex 525 drive can be calculated as follows:

SensaGuard switch (SG) + Guardmaster dual-input safety relay (GSR DI) + Guardmaster multifunction-delay

expansion module (GSR EMD) + Guardmaster multifunction-delay expansion module delay (EMDd) + PowerFlex

525 drive (drive) = overall system stopping performance less maximum safe coast-to-stop time

54 ms (SG) + 35 ms (GSR DI) + 35 ms (EMD) + 100 ms (EMDd) + 100 ms (drive) = 324 ms = overall system

stopping performance time less the estimated maximum safe coast-to-stop time

476 ms - 324 ms = 152 ms = estimated maximum safe coast-to-stop time

The maximum safe coast-to-stop time for a system using the PowerFlex 527 drive can be calculated as f ollows:

SensaGuard switch (SG) + Guardmaster dual-input safety relay (GSR DI) + Guardmaster multifunction-delay

expansion module (GSR EMD) + Guardmaster multifunction-delay expansion module delay (GSR EMDd) +

PowerFlex 527 drive (drive) = overall system stopping performance less maximum safe coast-to-stop time.

54 ms (SG) + 35 ms (GSR DI) + 35 ms (GSR EMD) + 100 ms (EMDd) + 12 ms (drive) = 236 ms = overall system

stopping performance time less the estimated maximum safe coast-to-stop time

476 ms - 236 ms = 240 ms = estimated maximum safe coast-to-stop time.

Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015 9

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

Electrical Schematic

In this application example, a local Start/Stop button is directly wired to the PowerFlex 525 drive. This button is used for

normal, non-safety stops and starts of the system. It is also used to start/restart the drive after safety-related stops once the

safety circuit is reset.

Figure 1 - PowerFlex 525 Circuit

24V DC 0V DC - COM

Typical Safety Input Device

24V DC

0V DC

Start

Stop

Gate control

power supply

Gate control

circuit

Initiate Configured ‘Normal’

Production Stop.

Digital Common

Actuator

Logic

Range

Time **100 ms OFF Delay

PowerFlex

525

10 Rockwell Automation Publication SAFETY-AT140A-EN-P - May 2015

Safety Function: Actuator Subsystems – Stop Category 1 via the PowerFlex 525 and PowerFlex 527 Drives with Safe Torque-off

This document presumes that a Stop/Start button is connected to the system PAC. It is referred to in Figure 2, but is not

part of this circuit. This button is used for normal, non-safety stops and starts of the system. It is also used to start/restart

the drive after safety-related stops once the safety circuit is reset.

Figure 2 - PowerFlex 527 Circuit

24V DC 0V DC - COM

Typical Safety Input Device

24V DC

0V DC

To PAC

Digital Common

Gate control

power supply

Gate control

circuit

Initiate Configured ‘Normal’

Production Stop.

Start/Stop requests provided to

the drive by PAC via Ethernet.

Actuator

Logic

Range

Time **100 ms OFF Delay

PowerFlex

527

Altri manuali per PowerFlex 525

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Allen-Bradley Azionamento CC

Allen-Bradley

Allen-Bradley 1395 Manuale utente

Allen-Bradley

Allen-Bradley 1397 Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 23P Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 700H Manuale del proprietario

Allen-Bradley

Allen-Bradley PowerFlex 6000 Manuale utente

Allen-Bradley

Allen-Bradley 1336 IMPACT Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 40P Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 700H Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 4 Manuale di istruzioni

Allen-Bradley

Allen-Bradley Ultra1500 2092-DA1 Manuale utente

Allen-Bradley

Allen-Bradley Rockwell Automation PowerFlex 700 Series Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 6000 Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 6000T Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 700S Manuale utente

Allen-Bradley

Allen-Bradley CX300 Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 20P Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 520 Series Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 70 Enhanced Control Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 4M Manuale utente

Allen-Bradley

Allen-Bradley Series B Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 4M Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 6000T Manuale utente

Allen-Bradley

Allen-Bradley PowerFlex 755 Manuale utente

Manuali Azionamento CC popolari di altre marche

Vincent Associates

Vincent Associates UNIBLITZ ED12DSS Manuale utente

EKSMA OPTICS

EKSMA OPTICS DQ-100-4 Manuale elenco delle parti

Chamberlain Garog

Chamberlain Garog D Series Manuale utente

Parker

Parker PDS Series Manuale utente

Festo

Festo DGC G Series Guida all'installazione

Binks

Binks QS-5012-1-CE Manuale utente

Danfoss

Danfoss VLT 2800 Series Scheda tecnica

ABB

ABB ACQ580-01 Series Manuale di installazione

YASKAWA

YASKAWA CANopen SI-S3 Manuale utente

GE D20A6 Manuale utente

Unex

Unex MC-D-250-1000-050W-TW Manuale utente

Geckodrive

Geckodrive G213V Manuale utente

ABB

ABB RSYC-01 Manuale utente

Rockwell Automation

Rockwell Automation PowerFlex 700S Manuale del proprietario

WEG

WEG DeviceNet CFW500 Manuale utente

Siemens

Siemens SINAMICS G Scheda tecnica

Siemens

Siemens SINAMICS SM150 6SL3815-7NP41-0AA1 Istruzioni operative

SOMFY

SOMFY JR RU 30 Manuale utente