Safe Torque Off (STO) with PSD1
76 (109)
192-011006N8 2019-07
09.10.19 09:27
generate any more torque. Please take into consideration that the motor will not
brake and a coasting down of the motor (trundling) may result in hazards.
Additionally the motor fixing brake can be damaged at braking. If this is the case,
the STO function in stop category 0 is not permitted.
6.6.1.3
Functional description
•
Shut-down of the motor is initiated by:
♦
Activating emergency-stop or
♦
Opening the safety door
•
The safety control UE410-MU requires a stop from PLC via output Q3.
•
Via fieldbus the PLC sends a braking ramp/ stop command to the PSD1-M for all
3 motors.
•
After a delay time set in the safety control UE410-MU, STO (channel 1 & 2) is
released via output Q4.
•
Thus all 3 motors are placed in a moment-free condition (STO). Please take care
that object STO_Setup=0 (standard settings) in order to prevent that STO is
recognized as fault.
•
In the Fieldbus, Status Word Bit 15 STO status is displayed as slowly flashing
LED.
•
The delay time in the safety control must increased in such a way that, as soon
as STO is released, the motors stand still by the braking ramp configured in the
drive.
•
The acknowledgement (start button) via the safety control UE410-MU is only
necessary, if after the disabling of the STO function, a danger to any person or to
the machine could arise due to automatic start-up.
6.6.1.4
Design Features
•
The contacts of the emergency stop buttons and the safety door need to be
designed mechanically in accordance with EN 60947-5-1 appendix K.
•
Concerning the delayed STO procedure, the risk must be considered by the
machine designer.
•
Drive and safety control must be wired in the same control cabinet. Wiring must
be in accordance with EN 60204-1.
•
The operating instructions of the UE410-MU3T5 safety control must be observed.
•
We recommend to use a filter > 3 ms for the signal Q3 in the PLC (stop input) as
the safety control UET410-MU regularly modulates test signals on the outputs Q3
and Q4.
•
Other safety controls may be used if they fulfill all requirements for category 3
PL=e and dispose of a high-quality error detection with dynamic test pulse. The
max. test pulse must be <1 ms / actively low.
6.6.1.5
Calculation of the total failure probability
The failure probability of each of the two STO circuits of the servo drive is 1.0E-09
per hour. Thus the probability of a failure of the entire 3-axis servo drive is 2.0E-09
per hour.
The safety control UE410.MU is a certified component. Its failure probability is
6.0E-09 per hour.
At this calculation only the probability of a failure of the emergency stop is
considered, not the contact of the safety door. With a B10d value of 100.000 cycles
at 240 working days, 16 working hours and at a cycle time of 1 hour, the result for
n
op
is 3840 cycles per year and 260 years for MTTFd. As the safety control
disposes of a high-quality error detection with dynamic test pulse for the input
signal, a high diagnostic coverage DC for the switches can be set.
According to Sistema the total failure probability is 3.27E-8 per hour (PL=e).
6.6.2.
STO function without external safety control
In this chapter you can read about:
•
Circuit Diagram ......................................................................................................................... 77
