BOSCH Drive and Motor Safety

CMAFH Drive For Technology 2010 Drive and Motor Safety
CMAFH Drive For Technology 2010
Drive and Motor Safety

Gary Thrall Senior Product Support Engineer Bosch Rexroth Corporation
Safety Safetyon onBoard Board Integrated, Integrated,certified certifiedand andconsistent consistent

Electric Drives and Controls 2009-02-26; BRC/SPD G. Kobs
Alle Rechte bei Bosch Rexroth AG, auch fr den Fall von Schutzrechtsanmeldungen. Jede Verfgungsbefugnis, wie Kopier- und Weitergaberecht, bei uns.
CMAFH Drive For Technology 2010 Drive and Motor Safety
New European Standards IndraDrive safety functions according new standards

IndraDrive C/ M
Coming soon IndraDrive Cs L4 option

STO and SBC
Safety Safetyon onBoard Board Integrated, Integrated,certified certifiedand andconsistent consistent

CMAFH Drive For Technology 2010 Passport into European Community market (EEA)
European Machinery Directive Machine Builder
EC
Fulfilling harmonized standards the manufacturer can assume that the safety aspects of the machine directive are met
EN 13849-1 (EN 954-1) EN 62061 EN 61800-5-2

CMAFH Drive For Technology 2010 Change of Safety Standards

Today
European Machinery Directive 98/37/EG 2006/42/EG January 2010 Period 3 years Transition Extended 2 more years Transition Valid Standard November 2006 EN 62061 Valid Standard January 2006 Components EN 61800-5-2 Valid Standard IEC 61508 November 2007 Valid Standard December 2009
Machine Builder
EN 954-1 Valid Standard EN ISO 13849-1
Electric Drives and Controls
2009-02-26; BRC/SPD G. Kobs
CMAFH Drive For Technology 2010
Performance Level of EN ISO 13849-1:2006

The Performance Level is defined by Category (architecture), identical to EN 954-1 and C-Standards MTTFd (Meantime to dangerous failure in one channel)
Denotation of MTTFd Low Medium High Range of MTTFd 3 years <= MTTFd < 10 years 10 years <= MTTFd < 30 years 30 years <= MTTFd < 100 years
DC (Diagnostic Coverage): Share of detected failures

Denotation of DC None Low Medium High Range of DC DC < 60% 60% <= DC < 90% 90% <= DC < 99% 99% <= DC
CCF (Common Cause Failures affecting both channels) Measures against systematic failures
CMAFH Drive For Technology 2010 Performance Level of EN
ISO 13849-1:2006
A Performance Level d could be achieved by: Cat. 3 DCavg = medium MTTFd = medium
or
Cat. 2 DCavg . = medium MTTFd = high

6
CMAFH Drive For Technology 2010 EN 62061 and EN 13849-1

Safety Integrity Level SIL IEC 61508 Probability of dangerous failure per hour (1/h) PFHd >= 10-5 to 10-4 >= 3 x 10-6 to 10-5 >= 10-6 to 3 x 10-6 >= 10-7 to 10-6 >= 10-8 to 10-7 < 10-8 Performance Level PL ISO 13849
IEC 62061
1 1 2 3 4
b c d e -
electrical, electronic and programmable calculation formula for subsystem architectures
All Technologies Simplified Estimation (worst case) regarding to: HW Structure (Category like EN 954) Diagnostic Coverage (DC) Reliability MTTFd Failure of Common Cause (CC)
PFHd Probability of a dangerous Failure per Hour

ISO 13849
CMAFH Drive For Technology 2010 Performance Level in total
Performance Level of the combination of SRP/CS
SRP/CS1 PL1
SRP/CS2 PL2
SRP/CS3 PL3
Cat 3
Cat 3
Cat 3
SRP/CS4 PL4 SRP/CS 5 PL5 SRP/CS 6 PL SRP/CS 6 7 PL7 SRP/CS 8 PL8 SRP/CS 9 PL9
PFHtotal = PFHSensor + PFHIO + PFHSafetyPLC + n x PFHDrive PFHtotal = 2,29 10-7 + 4,29 10-8 + 2,47 10-8 + 6 x 4,29 10-8 PFHtotal = 5,54 10-7 < 10-6 -> PL d EN ISO 13849-1:2006 Category 3 PL d
Cat 3
CMAFH Drive For Technology 2010 SafeMotion - More than just Switching Off!
The evolution of safety technology

Safety reaction Switching off Safety condition SafeMotion
2008-11-07; BRC/SPM; J. Ost
CMAFH Drive For Technology 2010 Conventional versus Integrated
controller enable E
M external monitoring unit (standstill, speed, ...)
two-channel switching-off
additional feedback
Channel 1
Channel 2
Drive
Drive Drive-integrated safety technology
Conventional safety solution
2008-11-07; BRC/SPM; J. Ost
10
CMAFH Drive For Technology 2010 Safety On Board with IndraDrive
Note: - only Safe Torque Off in BASIC
Encoders with only TTL interface or only serial interface are not allowed for integrated safety technology functions.
3 principles are realized to detect latent failures

Dual channel data operation with diversity Cross data comparison of safety related functions Dynamization of static modes
Due to this method one single failure may not deactivate the safety function --> Category 3 (recommended Safety level in most guidelines) A risk analysis by the machine builder and end user is required in accordance to Annex I of the European Community Directive for machines 98/37/EG
All encoders with 1 Vpp signals (e. g. EnDat, HIPERFACE,...) and all resolvers supported by the encoder interface can be used for integrated safety technology. It is always the feedback at X4 connector that is evaluated.
11
CMAFH Drive For Technology 2010 Selection of safety functions SafeMotion Functional Safety in Automation Technology
Communication Control Safe Control Safe Communication (Profisafe, SERCOS III Safety)
Auto Set-up
Auto Set-up
T w o .-c h a n n e l in te rru p t
T w o -c h a n n e l in te rru p t
Channel 1
Channel 1
Channel 2
Channel 2
Drive
Option S2 24V / 24V
Drive
Option S2 Safe communication
12
CMAFH Drive For Technology 2010 Safety on Board - Functional Safety Safe Torque Off Safe Motion
STO using 24V / 24V or 24V / 0V

X41 channel 1
power section
SLS using 24 V/ 24V

X31/X32 channel 1
common parts
transducer
X41
channel 2
X41
channel 2
One L2 PFH value independent from control (opener / closer, opener / opener)
SLS using SERCOS / 24V

SERCOS channel 1
common parts
Preliminary information Safe Torque Off: PFH Safe Motion: PFH drive and feedback
transducer
X41
channel 2
= 2 * 10 -9 1/h
One S2 PFH value independent from the control and the safety technology feature. Separate PFH value for the feedback
= 5 * 10 -8 1/h
2008-11-07; BRC/SPM; J. Ost
13
CMAFH Drive For Technology 2010 Functional Safety According to ISO 13849-1
Verification with SISTEMA

Library for certified and standard components
IEC 61508 SRP/CS1 PL1 SRP/CS2 PL2 IEC 61508 SRP/CS3 PL3 IEC 61508 IEC 61800-5-2 SRP/CS 4 SRP/CS 5 SRP/CS 6 PL SRP/CS 4 7 PL SRP/CS 5 8 SRP/CS PL 9 6 PL 7 PL 8 PL 9
safety switches
safety I/O
safety PLC
safety drives
ISO 13849
Certified components
input DP
DP PPC SII
IndraDrive
S safety switches I/O Standard components

Electric Drives and Controls 2008-11-07; BRC/SPM; J. Ost
K1 PLC Drive
ISO 13849
14
CMAFH Drive For Technology 2010 Certification according to new Standards

Safe Motion EN 954-1 IndraDrive Since 2004 more than 100,000 installed drives Category 3
Development project New Standards Hardware Modification of Control Units CSH.-L1-. -> CSH.-L2-. CSH.-S1-. -> CSH.-S2-. CSB.-L1-. -> CSB.-L2-. CDB.-L1-. -> CDB.-L2-. CDB.-S1-. -> CDB.-S2-. New Firmware Version MPX07VRS
IEC 61508
Deliverable since July 2009
15
CMAFH Drive For Technology 2010 SafeMotion Preliminary Data

Safe Torque Off (L2):
EN ISO 13849-1:2006 Category 3 PL = e IEC 61508

EN 62061:2005 EN 61800-5-2:2007 SIL3 2 * 10 -9 1/h 100 years (limitation by standard) 20 years
PFHd = MTTFd = Mission Time =
The PFH values are based on a 100% duty cycle (24h/ 365 days)
16

Safe Motion (S2):
EN ISO 13849-1:2006 Category 3 PL = d IEC 61508

EN 62061:2005 EN 61800-5-2:2007 SIL2 3 * 10 -8 1/h 2 * 10 -8 1/h
PFHd Drive =
PFHd Feedback =
(Stegmann/ Heidenhain motor feedback)
MTTFd = Mission Time =
100 years (limitation by standard) 20 years
To calculate the MTTFd value for a drive and feedback combination: Add the PFH values and convert then into a MTTFd value. Do not add the MTTFd values since they are limited to 100 years. The PFH values are based on a 100% duty cycle (24h/ 365 days)
17
Safety Integrity Level SIL IEC 61508 -
Probability of dangerous failure per hour (1/h) PFHd >= 10-5 to 10-4 >= 3 x 10-6 to 10-5 >= 10-6 to 3 x 10-6 >= 10-7 to 10-6 >= 10-8 to 10-7 < 10-8
Performance Level PL ISO 13849
IEC 62061
1 1 2 3 4
b c d e -
Preliminary Data for IndraDrive, Safety on Board Safe Torque Off: PFHd Safe Motion: = 2 * 10 -9 1/h = 2 % of max. SIL3 value
PFHd Drive and feedback = 5 * 10 -8 1/h = 5 % of max. SIL2 value
ISO 13849
18
CMAFH Drive For Technology 2010 IEC 61800-5-2 New Terminology (not all available)
Safe Torque Off Safe Stop 1 Safe Stop 2 Safe Operating Stop STO SS1 SS2 SOS SMD 1) SLA SAR SLS SSR SSM SMS 1)
EN 61800-5-2: 2007 Functional safety for speed variable drives
Safely-monitored Deceleration Safely-limited Acceleration Safe Acceleration Range Safely-limited Speed Safe Speed Range Safe Speed Monitor Safe Maximum Speed Safely-limited Increment Safe Direction Safely-limited Position Safely-monitored Position Safe Brake Control Safe Braking and Holding System Safely-limited Torque Safe Torque Range Safe Motor Temperature
SDI SLP SMP 1) SBC SBS 1) SLT STR SMT SCA
2008-11-07; BRC/SPM; J. Ost
Safe Cam
1) Not defined in IEC 61800-5-2
SLI
19
CMAFH Drive For Technology 2010 Terms of EN 61800-5-2 New Terminology (available)
EN 61800-5-2: 2007
Functional safety for speed variable drives (C-standard) New terms and definitions
Safety option L2 S2 S2 S2 S2 S2 S2 S2 S2 S2 S2 S2 S2 S2 S2 IEC 61800-5-2 Terms Safe Torque off Safe Stop 1 Safe Stop 2 Safe Operating Stop Safe Stop 1 (Emergency Stop) Safely-Monitored Deceleration * 1 Safely-Limited Speed Safely-Limited Increment Safe Direction Safely-Monitored Position Safely-Limited Position Safe Door Locking * 1 Safe Communication * 1 Safe I/O *1 Safe Braking and Holding System
*1 Electric Drives and Controls 2009-02-26; BRC/SPD G. Kobs
EN 954-1 Rexroth Safety functions Safety related starting lookout Safety related standstill Safety related operational stop Safety related operational stop Safety related drive interlock Safety related monitored stopping process Safety related reduced speed Safety related limited increment Safety related direction of motion Safety related absolute position Safety related absolute end position Safety related control of a door locking device Communication via PROFIsafe Safety related in-/outputs via PROFIsafe Safety related braking and holding system
Abk. STO SS1 SS2 SOS SS1 ES SMD SLS SLI SDI SMP SLP SDL SCO SIO SBS
Not defined in EN 61800-5-2 20
CMAFH Drive For Technology 2010 Drive-Integrated Safety Features
new
Safe Torque Off (STO) Safe Stop 1 (SS1) Safe Stop 1 - Emergency Stop (SS1-ES) Safe Stop 2 (SS2, SOS) Safely Monitored Deceleration (SMD) Safely Limited Speed (SLS) Safe Maximum Speed (SMS) Safely Limited Increment (SLI) Safe Direction (SDI) Safely Monitored Position (SMP) Safely Limited Position (SLP) Safe Door Locking (SDL) Safe I/O interface for Safety-PLC (SIO) Safe Braking and Holding System (SBS)
2008-11-07; BRC/SPM; J. Ost
21
CMAFH Drive For Technology 2010 Drive Based Safety Functions
Safe Torque Off (STO)
Safe Torque off (Stop Category 0*)

v
t0
Drive is torque-less Power is cut safely (pulse inhibit)
* according to EN 60204-1
22
Safe Stop 1 (SS1) / Safe Stop 2 (SS2) Controlled Stopping according to stop
v
t0
t1
category 1* (SS1) monitored stopping, control or drive controlled with safe deceleration Torque-less standstill of the drives Power is cut safely (STO)
Controlled Stopping according to stop

category 2* (SS2) monitored stopping, control or drive controlled controlled standstill after stopping, no power off (SOS) * according to EN 60204-1
23
v, s t0 t1
Safely Limited Speed (SLS) / Safely Limited Increment (SLI)

v
Within the Safe Mode a safely limited

speed and / or a safely limited increment can be enabled (enabling device)
t0 t1 t
30
In case the speed/increment monitoring
window will be triggered the drive will be safely stopped automatically in accordance with the stop category 1.
v, s
v, s
24
Safe Direction (SDI) In addition a safe direction (right, left)

can be defined.
In case the direction changes the drive

will be safely stopped automatically in accordance with the stop category 1.
25
Safe Maximum Speed (SMS1) The monitoring of a safely limited maximum

vMax
speed is active always, regardless the operation mode of the drive (Automatic/Manual Mode)
120
t
In case the parameterized maximum speed

will be exceeded the drive will be safely stopped automatically in accordance with the stop category 1.
26
Safely Monitored Position (SMP1)
In the safe operation mode

Working Area a working area (absolute position) can be defined
In case the parameterized

Position 1 Position 2 working area will be left, the drive will be safely stopped automatically in accordance with the stop category 1.

27
Safely Limited Position (SLP)

active in normal and safe operation mode - The drive is not able to cross the limited switches - The drive is stopped automatically when the available deceleration torque would not be sufficient to stop the load before the parameterized position area will be left Offers cost saving by replacing hardware position limit switch
v
Max. deceleration Positive Limit Switch
v max Max. deceleration Negative Limit Switch
28
Safely Monitored Deceleration safety in the stopping process

NC-controlled stopping process with safely monitored deceleration (SMD)
SMD
Braking of coupled drives: It may occur that

individual axes must still accelerate, in order to stop the total movement
Safe stop in a defined time due to predictive

behavior of the drive
The drive checks each cycle whether it is

possible to stop within the time t1. If this is not possible such as by wrong set point of the control, the drive takes over the braking.
t1
29
CMAFH Drive For Technology 2010 Safety on Board - Safe Braking and Holding System
Safe braking and holding system a new milestone

Safe Braking and Holding System (SBS)
Fall protection for axes with gravity loads Operator protection in special operating mode Worlds only on board solution which complies with
EN ISO 13849-1, Cat. 3 PL d and EN 62061 SIL 2
Two independent brakes separately controlled and

monitored by redundant, diverse channels in the drive
Escalation strategy to protect the mechanical

subsystems
Active as well after energy cutting by emergency stop
30
During automatic operation the

machines and equipment are running at full speed without operators
During special operation mode

persons may be present in the machine when following special safety precautions - Configuration - Measuring - Troubleshooting
Vertical or inclined axes can even

present a danger when they are switched off and inadvertently coming down
31
Fall protection of gravity-loaded axes Personal protection of operators during special operation mode
Safe Braking and Holding system
Effective even after energy

cut-off through emergency stop
32
CMAFH Drive For Technology 2010 Safety on Board - Safe Braking and Holding System The safe braking and holding system is based on two independent brakes which are separately controlled and monitored by the redundant diversified channels in the drive. Safe energy cutting Universal integration of different brake types, e.g.
two-channel selection of the safety feature e.g. safely-monitored deceleration
two-channel control of the brakes
IndraDrive
HAT
Safe feedback
33
CMAFH Drive For Technology 2010 SafeMotion functional safety in automation technology
IndraDrive with safety functions a convincing technology

Safety Technology made by the experts having more than 10 years
field experience
Scalable Safety Functions minimize the potential of tampering and

therefore reduce the hazard for injury caused by passing the safety measures
Increased productivity by reducing downtime Online Testing (Failure Detection) during runtime Cost savings by reduction of external components and wiring Minimal Movement in case of emergency by detecting failures within
2 ms
High reliability due to an encapsulated, certified solution Stand-alone whether wired, or with or without a safety PLC
34
CMAFH Drive For Technology 2010 Coming Soon Safe Torque Off for IndraDrive Cs
Safe Torque Off (L4): (A new type code to distinguish different features) IndraDrive Cs with L4 option is currently expected to go from EW to PT (available for sale) by end of May 2010
Certification by TV Rheinland is expected to be done by then
L4 option will include STO (Safe Torque Off) and SBC (Safe Brake
Control) SBC is 2-channel control of the standard holding brake so that if there is a
short in either wire or a failure in one channel, the brake will still be applied.
L4 STO circuit is completely redesigned from L1/L2

has safe mode within a test period. The test pulse is < 1ms. with on-line dynamization, no need for an acknowledgement contact to meet Cat. 4, PL e, SIL 3 -- the lifetime issue of the relay contact in the L1/L2 is gone.
L4 connector for is no longer a D-sub

6-pin cage clamp connector with separate clamp for incoming and outgoing wire at each pin daisy-chain up to 25 axes. Just daisy chain 4 terminals with discrete wires from one drive to the next. This eliminates the cable management issues of the ribbon cable in previous design. Easier and less expensive.
35
CMAFH Drive For Technology 2010 Coming Soon Safe Torque Off for IndraDrive Cs SS1 functionality [single axis wired] with ktion einer Achse in Verbindung mit einem Sicherh eitsschaltg ert anSS1-Fun external safety device:
+ 2 4V R es et 24 V Dy nam is ierte A us gn ge 24 V m it < 1 ms Tes tim puls
Single channel STO application over a Einkanalige STO-Anwahl ber ein einpoliges Schaltgert single pole switch device
24 V Dynamisierte Ausgnge 24 V mit < 1 ms Testimpuls
No t Ha lt
E x ternes S ic he rh eit ss c haltgert K ate gorie 4, P L e , SI L 3
Z e i t v e r z g e r t
IndraDrive Cs STO-Option Kategorie 4, PL e SIL3
Einpoliges Schaltgert der Kategorie 3, PL d, SIL 2 mit Zwangsffner gem EN 60947-5-1
IndraDrive Cs STO-Option Kategorie 4, PL e SIL3
R c km eldung
24 V STO -Anw ahl Ch1 24 V S TO -A nwa hl Ch2
24 V STO -Anwahl Ch1 24 V STO -Anwahl Ch2 0 V G round fr Ch1 und Ch2
E.Stopp oder NC-S top p
0 V G roun d f r Ch1 u nd C h2 A nwahl b er 2 ffn erk onta kte
SS1 function multiaxis with an external safety device and wiring SS1-Funktion mehrerer Achsen mit external Sicherheitsschaltgert und externer Verdrahtung
24 V 24 V 24 V 24V 24 V 24 V
Anwahl ber 1 ffnerkontakt
SBC-Funktion
SBC Function
24 V
SBC-Anwahl Ch 1 Nicht sichere Ansteuerung der Bremse aus der Standard-FW Bremse 24 V
ODER
STO-Option 1. Antrieb
STO-Option 2. Antrieb
Bremse 0 V
Anwahl Ch1 Anwahl Ch2 0V Anwahl Ch1
SBC-Anwahl Ch 2
Anwahl Ch2 0V
0V
36
CMAFH Drive For Technology 2010 Safety on Board and Safe Motion - Additional Resources
www.BoschRexroth.com/safety http://www.dguv.de/ifa/en/pra/softwa/sistema/index.jsp or just Google IFA SISTEMA for BGIA software to calculate PFHd and Performance Level to IEC 13849 www.BoschRexroth.com/MediaDirectory for downloadable manuals including Safety on Board Application Manual Bosch Rexroth Safety on Board hands-on workshop next scheduled for April 21st and 22nd in Hoffman Estates (more to follow)
37
CMAFH Drive For Technology 2010 Functional Safety with Safety on Board
Unexpected movements
Risk for human and machine.
Safety on Board
Always on the safe side
38

BOSCH Drive and Motor Safety

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BOSCH Drive and Motor Safety

Uploaded by

Copyright:

Available Formats

CMAFH Drive For Technology 2010 Drive and Motor Safety

CMAFH Drive For Technology 2010

Drive and Motor Safety

Safety Safetyon onBoard Board Integrated, Integrated,certified certifiedand andconsistent consistent

CMAFH Drive For Technology 2010 Drive and Motor Safety

New European Standards IndraDrive safety functions according new standards

Coming soon IndraDrive Cs L4 option

Safety Safetyon onBoard Board Integrated, Integrated,certified certifiedand andconsistent consistent

European Machinery Directive Machine Builder

EN 13849-1 (EN 954-1) EN 62061 EN 61800-5-2

CMAFH Drive For Technology 2010 Change of Safety Standards

EN 954-1 Valid Standard EN ISO 13849-1

Electric Drives and Controls

2009-02-26; BRC/SPD G. Kobs

CMAFH Drive For Technology 2010

Performance Level of EN ISO 13849-1:2006

DC (Diagnostic Coverage): Share of detected failures

CMAFH Drive For Technology 2010 Performance Level of EN

Cat. 2 DCavg . = medium MTTFd = high

CMAFH Drive For Technology 2010 EN 62061 and EN 13849-1

electrical, electronic and programmable calculation formula for subsystem architectures

PFHd Probability of a dangerous Failure per Hour

CMAFH Drive For Technology 2010 Performance Level in total

Performance Level of the combination of SRP/CS

The evolution of safety technology

Electric Drives and Controls

2008-11-07; BRC/SPM; J. Ost

CMAFH Drive For Technology 2010 Conventional versus Integrated

M external monitoring unit (standstill, speed, ...)

Drive Drive-integrated safety technology

Conventional safety solution

Electric Drives and Controls

2008-11-07; BRC/SPM; J. Ost

CMAFH Drive For Technology 2010 Safety On Board with IndraDrive

Note: - only Safe Torque Off in BASIC

STO using 24V / 24V or 24V / 0V

SLS using 24 V/ 24V

SLS using SERCOS / 24V

2008-11-07; BRC/SPM; J. Ost

Verification with SISTEMA

S safety switches I/O Standard components

CMAFH Drive For Technology 2010 Certification according to new Standards

Deliverable since July 2009

CMAFH Drive For Technology 2010 SafeMotion Preliminary Data

EN ISO 13849-1:2006 Category 3 PL = e IEC 61508

PFHd = MTTFd = Mission Time =

CMAFH Drive For Technology 2010 SafeMotion Preliminary Data

EN ISO 13849-1:2006 Category 3 PL = d IEC 61508

(Stegmann/ Heidenhain motor feedback)

MTTFd = Mission Time =

100 years (limitation by standard) 20 years

CMAFH Drive For Technology 2010 SafeMotion Preliminary Data

Safety Integrity Level SIL IEC 61508 -

Performance Level PL ISO 13849

PFHd Drive and feedback = 5 * 10 -8 1/h = 5 % of max. SIL2 value

Electric Drives and Controls

2009-02-26; BRC/SPD G. Kobs

EN 61800-5-2: 2007 Functional safety for speed variable drives

SDI SLP SMP 1) SBC SBS 1) SLT STR SMT SCA

Electric Drives and Controls

2008-11-07; BRC/SPM; J. Ost

1) Not defined in IEC 61800-5-2

Not defined in EN 61800-5-2 20

CMAFH Drive For Technology 2010 Drive-Integrated Safety Features