Emerson Unidrive M702 User Manual Download Page 87

Page: 87 / 284

Unidrive M702 User Guide

Issue Number: 3

The function can be used in safety-related machines or systems which
have been designed according to IEC 62061 or IEC 61508, or other
standards which are compatible with IEC 61508, since the analysis and
the integrity metrics used in EN 61800-5-2 are the same.

Note on response time of SAFE TORQUE OFF, and use with safety
controllers with self-testing outputs.

SAFE TORQUE OFF has been designed to have a response time of
greater than 1 ms, so that it is compatible with safety controllers whose
outputs are subject to a dynamic test with a pulse width not exceeding 1
ms.

Note on the use of servo motors, other permanent-magnet motors,
reluctance motors and salient-pole induction motors.

When the drive is disabled through SAFE TORQUE OFF, a possible
(although highly unlikely) failure mode is for two power devices in the
inverter circuit to conduct incorrectly.
This fault cannot produce a steady rotating torque in any AC motor. It
produces no torque in a conventional induction motor with a cage rotor. If
the rotor has permanent magnets and/or saliency, then a transient
alignment torque may occur. The motor may briefly try to rotate by up to
180° electrical, for a permanent magnet motor, or 90° electrical, for a
salient pole induction motor or reluctance motor. This possible failure
mode must be allowed for in the machine design.

Two-channel SAFE TORQUE OFF

Two fully independent input channels are provided for the SAFE
TORQUE OFF function.
Each input separately meets the requirements of the standards as
defined above, regardless of the state of the other input. If either or both
inputs are set at a logic low state, there are no single faults in the drive
which can permit the motor to be driven.
It is not necessary to use both channels in order for the drive to meet the
requirements of the standards. The purpose of the two channels is to
allow connection to machine safety systems where two channels are
required, and to facilitate protection against wiring faults. For example, if
each channel is connected to a safety-related digital output of a safety-
related controller, computer or PLC, then on detection of a fault in one
output the drive can still be disabled safely through the other output.
Then there are no single wiring faults which can cause a loss of the
safety function, i.e. inadvertent enabling of the drive.
In the event that the two-channel operation is not required, the two
inputs can be connected together to form a single SAFE TORQUE OFF
input. In this case it is important to note that a single short-circuit from
the SAFE TORQUE OFF input to a DC supply of approxi24 V
would cause the drive to be enabled. This might occur through a fault in
the wiring. This can be excluded according to EN ISO 13849-2 by the
use of protected wiring. The wiring can be protected by either of the
following methods:
•

By placing the wiring in a segregated cable duct or other enclosure.

•

By providing the wiring with a grounded shield in a positive-logic

grounded control circuit. The shield is provided to avoid a hazard
from an electrical fault. It may be grounded by any convenient method;
no special EMC precautions are required.

SAFE TORQUE OFF over-ride

The drive does not provide any facility to over-ride the SAFE TORQUE
OFF function, for example for maintenance purposes. Because of the
risk of human error, the installation must not provide any facility to over-
ride the function.

With SAFE TORQUE OFF there are no single faults in the drive which
can permit the motor to be driven. Therefore it is not necessary to have a
second channel to interrupt the power connection, nor a fault detection
circuit.

For more information regarding the SAFE TORQUE OFF input, please
see the

Control Techniques Safe Torque Off Engineering Guide

available for download from www.controltechniques.com.

The design of safety-related control systems must only be
done by personnel with the required training and experience.
The SAFE TORQUE OFF function will only ensure the safety
of a machine if it is correctly incorporated into a complete
safety system. The system must be subject to a risk
assessment to confirm that the residual risk of an unsafe
event is at an acceptable level for the application.

SAFE TORQUE OFF inhibits the operation of the drive, this
includes inhibiting braking. If the drive is required to provide
both braking and SAFE TORQUE OFF in the same operation
(e.g. for emergency stop) then a safety timer relay or similar
device must be used to ensure that the drive is disabled a
suitable time after braking. The braking function in the drive
is provided by an electronic circuit which is not fail-safe. If
braking is a safety requirement, it must be supplemented by
an independent fail-safe braking mechanism.

SAFE TORQUE OFF does not provide electrical isolation.
The supply to the drive must be disconnected by an approved
isolation device before gaining access to power connections.

It is essential to observe the maximum permitted voltage of
5 V for a safe low (disabled) state of SAFE TORQUE OFF.
The connections to the drive must be arranged so that
voltage drops in the 0 V wiring cannot exceed this value
under any loading condition. It is strongly recommended that
the SAFE TORQUE OFF circuits be provided with a
dedicated 0 V conductors which should be connected to
terminals 10 and 12 at the drive.

WARNING