Rockwell Automation iTRAK, User Manual

Page: 112 / 124

112 Rockwell Automation Publication 2198T-UM002C-EN-P - March 2019
Chapter 7 Functional Safety
Stop Category Definition Stop Category 0 as defined in IEC 60204 is achieved with immediate removal
of power that produces actuator motion.
Stop Category 1 as defined in IEC 60204 is achieved with the delayed removal
of power that produces actuator motion, to facilitate the controlled stoppage of
elements that move.
Performance Level and
Safety Integrity Level (SIL) For safety-related control systems, Performance Level (PL), according to
EN ISO 13849-1, and SIL levels, according to IEC 61508 and IEC 62061.
Include a rating of the ability of the system to perform its safety functions. All
safety-related components of the control system must be included in both a
risk assessment and the determination of the achieved levels.
See the EN ISO 13849-1, IEC 61508, and IEC 62061 standards for complete
information on requirements for PL and SIL determination.
Safety Distance Calculations Detailed calculation of a proper safety distance is beyond the scope of this
document, but here are some considerations to follow.
System safeguards must be in place such that a person cannot reach a hazardous
motion before the safeguarding system has brought that hazardous motion to a
halt. These issues are addressed in safety standards relevant to this application
that are listed here.
• IS0 14119 Safety of machinery - Interlocking devices that are associated
with guards - Principles for design and selection.
• ISO 13855 Safety of machinery - Positioning of safeguards regarding the
approach speeds of parts of the human body.
• ANSI B11.19 Performance Criteria for Safeguarding.
Functional Safety
Description The safety logic device, such as a configurable safety relay or programmable
safety automation controller, monitors the safety input device, such as a door
switch or emergency stop button, for commands, proper operation, and safety
demands. The safety logic device must monitor itself for any internal faults.
When actuated, the safety logic device sends a safety stop command to the
motion control device and start the configurable timer. During this time, the
iTRAK system must decelerate to zero speed.
When the timer expires, power is removed from the safety output contactors
that remove power that produces motion from the iTRAK system. If the track
is in motion, it coasts to a stop.
The safety logic device must monitor the contactors for welded contacts via
feedback from two normally closed contacts in a series, one from each
contactor, in the reset circuit. If a contact is welded, the normally closed