Emergency Stop Function
In
v
e
rt
er Moun
ting
and Install
a
tion
2–40
NOTE:
The system manufacturer is responsible for selecting the level of risk factors in
accordance with EN954-1. (Stop categories are defined by EN60204-1.)
Wiring Examples
The examples of wiring shown below are based on the three stop categories compliant with
European Machinery Directive EN60204-1.
• Category 0: (Uncontrolled) stopping by immediate removal of power to machine actuators
• Category 1: Stopping by removal of power after controlled stopping with power to machine
actuators retained
• Category 2: Controlled stopping with power to machine actuators retained
NOTE:
The Safe Stop function must be activated at least once a year for preventive
maintenance purposes.
NOTE:
Before preventive maintenance, the machine must be turned off. If the power supply to
the motor is not turned off during testing, the Safe Stop function will not operate. In such case,
the inverter must be replaced.
The examples of wiring below are intended to implement the Safe Stop function through safety
input of the EMR signal by the method complying with EN954-1 Category 3.
• The emergency stop circuit is monitored via an external safety relay (safety switching
device).
• One safety relay (safety switching device) can be used for multiple inverters.
3
The requirements of category B and proven
safety principle specifications must be applied.
Safety-related parts must be designed to meet
the following requirements:
•
The safety function always operates when a
single defect (fault) occurs.
•
Each single defect (fault) is eventually
detected to prevent the loss of the safety
function.
•
The safety function always
operates when a single defect
(fault) occurs.
•
Almost all defects (faults) are
detected.
•
Accumulation of undetected
defects (faults) may cause a
loss of the safety function.
Characterized mainly
by the structure
4
The requirements of category B and proven
safety principle specifications must be applied.
Safety-related parts must be designed to meet
the following requirements:
•
Any single defect (fault) in a part must not
cause any loss of the safety function.
•
If a single defect (fault) occurs, it must
be detected when or before the next
operation request is made to the safety
function. If single defects (faults) cannot
be detected, the accumulation of defects
(faults) must not cause any loss of the
safety function.
•
The safety function always
operates when a single defect
(fault) occurs.
•
Each single defect (fault) is
eventually detected to prevent
the loss of the safety function.
Category
Safety requirement
System behavior
Principle for
achieving
safety
