Fagor QC-PDS, Hardware Manual

Page: 313 / 420

  
Functional safety
FUN
C
TI
ON
AL SAFET
Y
Residual Risks
9.
QC-PDS
HARDWARE
Ref.2003
· 313 ·
9.6 Residual Risks
Machine risk assessment and reduction
The machine manufacturer should conduct an assessment of the machine
risks and take measures to reduce them to a safe level. Finally, a residual
risk in the machine will remain. See EN ISO 13849-1, section 4.2 Strategy
to reduce risk.
The risk analysis must consider the possible failures of the conventional
part of the drive and the
RESIDUAL RISKS OF THE DRIVE SAFETY FUNCTIONS
.
Residual risks of the drive safety functions
Simultaneous failure of two IGBT’s
When STO is active, simultaneous failure of two IGBT’s (one on the top and
the other on the bottom of the output stage) can cause the axis to move for
an instant (< 180 electrical degrees). If accessing the machine while it is
stopped is risky (according to risk analysis), take the necessary measures.
Uncompensated forces on a vertical axis
Even if the motor is stopped, there may be external forces onto the motor
(e.g. uncompensated forces on a vertical axis) that could cause a risk when
STO is applied. In this case, additional protection measures are required
against axis drop (e.g. a holding brake). See
SAFE BRAKE CONTROL (SBC)
.
FAGOR’S FKM motors contain the integrated holding brake option). A risk
analysis of the machine will determine whether this measure is needed or
not.
Safe Brake Control (SBC)
This drive hasn't the Safe Brake Control (SBC) safety function.
STO while the motor is moving
Demanding STO while the motor is moving causes the motor to stop only by
friction. A risk analysis of the machine will determine whether an external
stopping brake is needed to stop the motor.
SS1-t
The braking of the SS1-t stop in
EXAMPLE 2
is not monitored and if it fails,
the STO would not be activated until after the time configured in the safety
controller. An analysis of the machine risks will determine whether SS1-t is
appropriate for the application.
Holding brake control
The examples in section
9.4 DESIGN REQUIREMENTS
do not consider the
case in which a holding brake is required. If required, its control must
reach the PL required by the risk analysis in aspects such as architecture,
diagnostics, fault exclusion, residual risks, ...
Failures in the holding brake
The drive does not integrate the S afe B rake T est (SBT) function, which
monitors the existence of faults in the brake itself, such as:
 Winding short-circuit
 Wear
If the risk analysis requires it, subject the brake to regular tests to detect
these failures.
PFH. Probability of failure per hour
As a result of possible random hardware failures in any electronic system,
an additional residual risk whose probability is PFH appears.
Electrical risk of the drive
See
SAFETY CONDITIONS
at the beginning of this manual.
DANGER.
The holding brake integrated into the motor should not be used to stop the
machine because using it repeatedly could damage the brake.
NOTE.
Usually the holding brake is not redundant. Therefore, that part of
the system is not 1oo2 - Cat. 3.