Home

MSD Servo Drive Specification - Functional Safety

1. Figure 7 13 Brake driver circuitry example 2 Based on the internal architecture and the two channel configuration of a suitable brake PL e as per EN ISO 13849 1 is achieved MSD Servo Drive Specification Functional Safety 36 Example 3 Two channel connection of two brakes acting on a common axis Pin 4 GND ext H Pin3 0SSDO5 H Pin 2 OSSD04 H Pin 1 24 V ext E 24 V DC GND Figure 7 14 Brake driver circuitry example 3 In this example the brake driver provides two channels each executed as single channel with internal diagnostics The redundancy and two channel configuration of the overall system is achieved by using two brakes on one axis Depending on whether the brakes have safety approval in accordance with the targeted Performance Level PL e as per EN ISO 13849 1 can be achieved with this connection Example 4 Two channel connection of two actuators contactor deadlock etc acting on a safety function X13 size 1 4 Pin 4 GND ext f e Pin 3 0SSDO6 m Pin 2 OSSDO5 Mii Pin 1 24V ext i L1 L2 13 24VDC GND Figure 7 15 Brake driver circuitry example 4 In this circuitry example two series connected mains contactors are each switched by one driver output in order to switch the mains supply of a servo drive The descriptions under example 3 apply here too MOOG ID no CB38398 00
2. ssssssssss 27 Specification of the safe MSD Servo Drive outputs 27 Status and error display in MDA5 isssssssssssssssesneeeeeeeeeneeenenenenen nennen 22 Stat s display Om device i e andes o E REPE Eee QR d nO NEUTER EET 21 Supplements to the MSD Servo Drive Operation Manual ssssseee 7 T Technical data of ready made SCC cable sss 18 U YS AOC ec 5 MSD Servo Drive Specification Functional Safety 42 MOOG bro c838398 001 Date 12 2013 MSD Servo Drive Specification Functional Safety M OOC ID no CB38398 001 Date 12 2013 TAKE A CLOSER LOOK Moog solutions are only a click away Visit our worldwide Web site for more informati on and the Moog facility nearest you MOOG Moog GmbH Hanns Klemm StraBe 28 D 71034 B blingen Phone 49 7031 622 0 Telefax 49 7031 622 100 www moog com industrial drives support moog com Moog is a registered trademark of Moog Inc and its subsidiaries All quoted trademarks are property of Moog Inc and its subsidiaries All rights reserved 2013 Moog Inc MSD Servo Drive Specification Functional Safety TECHNICAL ALTERATIONS RESERVED The contents of our documentation have been compiled with greatest care and in compliance with our present status of information Nevertheless we would like to point that this document cannot always be updated parallel to the technical further development of our products Infor
3. MOOC MSD Servo Drive Specification Functional Safety M OOG ID no CB38398 001 Date 12 2013 MSD Servo Drive Specification Functional Safety ID no CB38398 001 Date 12 2013 Applicable as from firmware version Development Phase Revision 3 The German version is the original of this Operation Manual MSD Servo Drive Specification Functional Safety 2 NOTE This document does not replace the MSD Servo Drive single axis system operation manual ID no CA65642 001 it merely supplements it Please be sure to observe the information contained in the For your safety Intended use and Responsibility sections of the aforementioned operation manuals For information on installation setup and commissioning and details of the warranted technical characteristics of the MSD Servo Drive series refer to the additional documentation Operation Manual User Manual etc Subject to technical change without notice The content of our documentation was compiled with the greatest care and attention and based on the latest information available to us We should nevertheless point out that this document cannot always be updated in line with ongoing technical developments in our products Information and specifications may be subject to change at any time For information on the latest version please visit drives support moog com Contents BEBE RZEZ uui RE EE
4. 5 Mb nt oe Lat Se se ette RUEHENI as MEI UIT 5 T2 RESPOMSIDINEY ZEE 5 1 3 Maintenance iu eorr vases OP RE A ELA dT rd KL EE O Ea 5 Supplements to the MSD Servo Drive Operation Manual 7 21 Orden Code fos AS 8 Electrical installation ano EM een 9 3 1 Overview of connections Size 1 to Size A eee aaa aaa 9 3 2 MSD Servo Drive voltage supply 11 3 3 Electricalisolatiokirmiethgd aces cuo cce iet eta een 11 3 4 Connection of brake driver supply voltage 24 V DC enne 12 3 5 KOntrolie nnections zi eee Ust ee i AANE 12 3 5 1 Specification of control connections enennennnen 12 3 5 2 Brake AVE sos cato ve eee e s do ae d 13 Sr oMMEO eM 14 3 2 SODUO 2 zara kai M 14 3 8 JEncoder Connection aan AAAA HE A NEE 14 3 8 1 Safe encoder evaluation cie einen 14 3 9 Ready mada SCC cable imren aa OPPA IRE SIE pres 18 3 10 Braking resistor RB iin AE Oto 18 3 10 1 Protection in case of brake chopper fault eenee 18 COMMISSIONING PZN 19 MOOG ID no CB38398 001 Date 12 2013 DAI OSTCS as nenne 21 51 Status display On devices ana na AE AAAA W 21 5 2 Status and error display in MDAS5 eee eee eee eee nennen nennen nenne 22 Functional Safel anne 23 6 1 Danger analysis and risk assessment nnnnnenneneneneneennennn 23 62 DETIMUOM OW LenS Kde A LI M
5. EN 61508 CIT EE 3 PFD T 20a 1 16 x 10 BA HY 1 34 x 10 1 h MOOG ID no CB38398 001 Date 12 2013 Appendix Declaration of conformity As per Machinery Directive 2006 42 EC MOOG Moog GmbH Unternehmensbereich Hanns Klemm Str 28 Industrie 71034 B blingen Konformit tserkl rung Declaration of Conformity im Sinne der EG Maschinenrichtlinie 2006 42 EG und der EMV Richtlinie 2004 108 EG as defined by EC Machinery Directive 2006 42 EC and EMC Directive 2004 108 EC Hiermit erkl ren wir dass die Bauart von Herewith we declare that the supplied model Moog MSD Servo Drive mit integrierter Sicherheitssteuerung Moog MSD Servo Drive with integrated Safety Control G392 00xAxx1xxxx 1AC 230 V 4 6 A BG1 G392 0xx xx1xxxx 3AC 400 V 4 32 A BG1 4 G395 0xx xx1xxxx 3AC 400 V 16 32 A BG3 4 den Bestimmungen der EG Maschinen und EMV Richtlinie entsprechen is in conformity with the EC Machinery and EMC Directive Folgende harmonisierte Normen wurden angewendet Following harmonized standards have been applied EN 61800 5 2 2007 EN 61800 5 1 2007 EN 61800 3 2004 EN 62061 2005 AC 2010 A1 2013 EN ISO 13849 1 2008 AC 2009 EN 61131 2 2007 EN 60664 1 2007 EN 60204 1 2006 A1 2009 AC 2010 in extracts Folgende weitere Norm wurde angewendet Following additional standards has been applied IEC 61508 1 7 2010 Jahr der CE Kennzeichnung 2013 Year of CE marking EG Baumust
6. Low Voltage PELV Protective Extra Low Voltage MOOG 3 Electrical installation ID no CB38398 001 Date 12 2013 USB1 1 RC Jv di Ethernet x2 a x3 GNDLP aE P X4 3 us ISD00 pa Dp Ya EF PE GNDLP cda ISDO1 o ISDO2 o ISDO3 FAR Vue ON Encoder SS ISDO4 GNDLP u ISD05 DG X4 8 V yP EM ISDO5 NEN KKI GNDLP b TRE X40 GNDHP N zy LI Motor PTC x4114 3 X40 ISSD00 p ys d XA x15 L mH iSAO0 AID X4 12 5a ISA00 MTT X4 17 ISSDO3 NEN m Ws Kh GNDHP_ X4 9 exon X18 m n A D X4 10 IL sao XAMA po DGND CM xw c o b GNDyP H Uy XAJ2 mo H u T y xor mm w T X4 13 F3 It GNERE i i o H control DGND X4 1 F4 tt uP s e M supply um T
7. Size 4 and the regenerated power is converted into heat by way of a braking resistor 3 10 1 Protection in case of brake chopper fault ATTENTION Overloaded brake chopper transistor If the internal brake chopper transistor is permanently switched on because it is alloyed through by overload 0 QO there is a protective function to protect the device against overheating This function is activated via Moog DRVEADMINISTRATOR 5 by assigning any digital output subject area Inputs outputs gt Digital outputs gt OSSDOO to OSSD04 with BC_FAIL 56 In the event of a fault the selected output then switches from 24 V to O V This signal ensures that the servo drive is safely disconnected from the mains supply Detailed information on parameterisation can be found in the MSD Servo Drive User Manual 4 Commissioning As opposed to standard MSD Servo Drive units MSD Servo Drive units with integrated safety control no longer feature the two inputs ENPO and ISDSH to enable the power stage and configure the STO safety function To be able to configure the power stage a program must be written and transferred using the operator control software Safety PLC Functions for more details refer to the programming manual By default the MSD Servo Drive with integrated safety control incorporates a program by which the power stage can be configured by activating the safe digital inputs ISSDOO and ISSDOT This means commissioning of
8. evaluation and monitoring of the individual encoder signals inside the controller is not always adequate Non certified encoder systems must be subjected to a complete safety analysis In addition the failure Loosening of encoder fixation so that encoder no longer reports movement correctly safety standard EN 61800 5 2 annex D table D 16 must be covered by excluding a shaft fracture in the case of single channel systems regardless of certification NOTES Safety analysis A safety analysis of non certified encoder systems includes the following points Failure analysis and FMEA based on tables from annex D of safety standard EN 61800 5 2 Analysis of the internal design of the encoder based on manufacturers documentation Key points of such an analysis may be Are sin and cos signals processed separately Can the encoder disk become detached from the shaft or slip Can the encoder be impaired by extraneous light MOOC ID no CB38398 001 Date 12 2013 3 Electrical installation Is the power of the sender LED controlled and is end of life monitoring implemented Are Sin Cos or TTL signals generated by signal processing and or interpolator Are the systems for absolute position and incremental track independent For encoders containing complex ASICS or the like for signal conditioning or interpolation the failure presumption is Wrong output signal due to ASIC malfunction which cannot be exclude
9. of an output to 24 V or cross connection can be made by suitable external diagnostic measures as well as fault detection by the process and using positive opening contacts it is possible to achieve PL e as per EN ISO 13849 1 NOTE gt The same applies to a configuration on OSSDOO and OSSDO2 Example 5 ISSD03 ISSD02 ISSD01 ISSD00 OSSD03 OSSD02 OSSD01 OSSDOO MSD Servo Drive Specification Functional Safety 34 Dynamic two channel output OSSD of one group with plausibility check zje With pulse pattern With pulse pattern alternatively also 24 V possible Figure 7 10 Output circuitry example 5 This configuration represents an example of connection of the STO in the MSD Servo Drive and MSD Servo Drive Compact model series with the outputs of the MSD Servo Drive Safety variant With this configuration all assumed faults are detected by the diagnostic process As the internal architecture of the MSD Servo Drive safety outputs is based on category 2 however the maximum possible achievable level is PL d as per EN ISO 13849 1 Example 6 Dynamic two channel output OSSD of a different group with plausibility check X4 issDo3 Je IsSD02 me ISSDO1 i IssD00 We OSSDO3 B Ossbo me OSSDO1 HT OSSDOO ET 24VDC GND With pulse pattern Figure 7 11 Output circuitry exam
10. putting the device to its intended use is only permitted in compliance with the EMC Directive 2004 108 EC C The MSD Servo Drive conforms to the Machinery Directive 2006 42 EC The servo drives conform to the requirements of the harmonised product standard EN 61800 5 1 If the servo drive is used for special applications e g in areas subject to explosion hazard the required standards and regulations e g EN 50014 General provisions and EN 50018 Flameproof housing must always be observed Repairs may only be carried out by authorised repair workshops Unauthorised opening and incorrect intervention could lead to death physical injury or material damage The warranty provided by Moog would thereby be rendered void P NOTE 2 Deployment of the servo drives in non stationary equipment is classed as non standard ambient conditions and is permissible only by special agreement NOTE 5 Cabinet mounting with IP54 protection is mandatory for use of the certified safety functions MOOG ID no CB38398 001 Date 12 2013 1 Safety 1 2 Responsibility Electronic devices are fundamentally not fail safe The company setting up and or operating the machine or system is itself responsible for ensuring that the drive is rendered safe if the device fails EN 60204 1 DIN VDE 0113 Safety of machines in the section on Electrical equipment of machines stipulates safety requirements for electrical controls They are intended
11. se keinen 9 Electricalsolation metliedi o ett ertet En oda petia 11 Encoder connection een DU 14 MOOG ID no CB38398 001 Date 12 2013 Index F Fault exclusion Functional safety Function description IDA NERONA 2 input circuitry examples ua a A e age 30 Wine CSG WSE ose dac R scum Ene M men Re E 5 Key to connection diagram Size 1 to Size 4 10 Layout Size 1 to Size 4 here Size aa pa ad vite ia t t aes radars 9 IVE ATO nah Cere n ROSE 5 MSD Servo Drive voltage supply 11 OPON e een 14 eoe E E M 14 Order code 8 Overview of connections Size 1 to Size 4 9 Protection in case of brake chopper fault 18 MSD Servo Drive Specification Functional Safety 41 MOOG ID no CB38398 001 Date 12 2013 R Rating Plate wawa W EE aaa an 8 Readyamade SCC cable anna en nn 18 Requirements for use of a resolver 16 RESPONSE im E 37 Response time to error in MS eee eee aaa aaa aaa aaa 37 coronel A ago 5 5 Safe encoder evaluation krasse nm 14 Sale in puts OUt DULS a een ea ee 27 SGN ee E 5 Salely analysis un een BIER 15 Safety instructions rennen 26 Safety monitoring PUNCU ON S aa nee ee AOR 14 Specification of control connections aaa i e a EERE 12 Specification of the safe brake driver output 28 Specification of the safe MSD Servo Drive inputs
12. 1 Date 12 2013 T Senex VO 7 5 Response times The MSD Servo Drive with integrated safety control features two different response times The standard cycle in which the Safety PLC executable program is run and a fast channel for rapid execution of key single safety functions Fast channel Standard cycle Function 2 6 axes Input M gt STOM Input M gt STO S 6 14 i Input 5 gt STOM 6 14 c E Input M STO S 68 6 14 Input M gt Output M 20 28 6 14 6 14 S input M gt Output S 52 6 14 Input S Output S 44 6 14 Input S gt Output M 68 6 14 Response time speed o safety function shutdown 24 40 4 4 output M 5 Response time speed S p safety function shutdown 64 4 os output S o g Response time speed E amp safety function shutdown 24 40 4 4 9 STOM S Response time speed ER safety function shutdown 64 4 SOS v with signature pulse on input Table 7 2 _ Response time to error in ms MSD Servo Drive Specification Functional Safety 37 MOOC bno c838398 001 Date 12 2013 MSD Servo Drive Specification Functional Safety 38 NOTE The fast channel can only be used for safe shutdown not to activate a safety function Appendix A 1 Safety acceptance tests STO shutdown acceptance test Safety characteristics to EN ISO 13849 SES tenet etd e Category udis 4 MITE OF sea 416 DE E 92 96 Safety characteristics to EN 62061
13. 2 Pushbuttons Service functions see p 21 sl t fOr MME Enables firmware download without PC for X1 removable storage see p 9 devi example evice X2 USB 1 1 port Service interface Plug amp Play connection to PC Sealed X3 Ethernet port Service interface fast TCP IP port RJ45 see p 9 xA control terminals 6 digital inputs 2 analog inputs 4 safe digital see p 12 inputs 4 safe digital outputs Gwi g i Ieremiae Factory installed module for fieldbusses e g sed p SERCOS PROFIBUS DP EtherCAT or CANopen P Depending on device type and size X11 R A iar power One or three phase AC mains supply or DC see p 10 pply supply PE PRA conductor Connection diagram Figure 3 3 see p 10 connection X9 X10 Connection of control 24V supply voltage for control electronics of see p 11 supply Uy servo drive X8 Te Additional encoder interface see X7 or safety EN Option 2 gy evaluation of an external axis P High resolution Sin Cos encoder EnDat 2 1 encoder HIPERFACEG X7 E see p 14 encoder interface encoder Table 3 1 Key to connection diagram Size 1 to Size 4 MSD Servo Drive Specification Functional Safety 10 bo Deinen rum TN Motor temperature monitoring can be routed x6 Resolver connection through the resolver lead X6 5 and 9 seep M Connection of safe Enables axle grouping of multiple JUR cross communication MSD Servo Drive units in Safety variant EA X40 Connection of motor PTC based on DIN 44082 Linear tempe
14. 3 xag Scan cycle 1 ms Yes osspot BB isao ISD0A xa 7 Switching level Low High lt 4 8 V gt 18 V osspoo BIB isao next Seeds ISD05 X4 8 Ina at 24V 2 3 mA typ 2av so B B soos GND so SI isDo4 Safe digital inputs Figure 3 5 Connection of supply for brake driver Size 1 to Size 4 issbo3 MB BU ispos Default input ssoo2 MEN ispo Brake driver supply I5SDO0 X4 14 e Frequency range lt 500 Hz GND sit MA ispo ISSDO1 X4 15 le EJ Me ISSDO2 XAM7 Scan cycle 1 ms Yes ISSDOI 5D00 Terminal Pin Specification ISSD03 xag Switching level Low High lt 5V gt 15V ISSD00 hal2 24V GND SIO DGND va 7 Uy 24 V DC 20 stabilised and smoothed aa CU mE Safe digital outputs Table 3 2 Specification of brake driver supply S da Rated operating voltage 24 V 19 2 28 8 V 055 Max Total current 400 mA ATTENTION SKO gt i i 0SSDO3 X4 24 Max Current per output 100 mA Line protection m Auxiliary voltage Suitable measures must generally be applied to provide adequate line protection The power supply to the safe brake driver output requires 24 V DC SELV PELV Table 3 3 Specification of control connections X4 Auxiliary supply to feed the digital control inputs e U U AU AU typically approx 1 2 V no E XAI2 destruction in case of short circuit 4 24 V gt GND x4 14 but device may briefly shut down e lanay 80 mA per pin with self resetting circuit breake
15. 3849 1 and SIL 3 as per EN 61508 EN 62061 for evaluation of the resolver taking into consideration all the specified points Areas of application The safety evaluation of resolvers is not dependent on specific motor types Both synchronous and asynchronous motors can be used Nor is it essential that the resolver should be integrated into the control circuit and or the commutation of the servo drive And no specific resolver type or manufacturer is specified The resolver used must however match the electrical specifications of the safety systems The user is responsible for ensuring that the resolver used is suitable to attain the safety level required in the application and that all necessary measures are implemented to that end Requirements when using a high resolution encoder system Maximum evaluatable signal frequency 400 kHz 400 kHz Speed calculation method Max input frequency Resolution pulses per revolution Signal level Digital signals EIA422 Analog signals 1 V Table 3 8 Technical data of encoder inputs ATTENTION Errors at standstill Errors may occur in incremental encoders which are not detected at standstill To be able to diagnose all errors it is necessary to rotate the encoder at least one period in 24 hours NOTES Observe tolerances Incremental encoder signals are monitored among others means by monitoring of the pointer length and is assigned a certain tolerance This tolerance range ext
16. 398 001 Date 12 2013 3 6 Option 1 Depending on the MSD Servo Drive variant option 1 is factory configured with various options Fieldbus options such as EtherCAT or SERCOS are available You will find all available options in the MSD Servo Drive Ordering Catalog The user manuals for the respective options provide detailed information on commissioning 3 7 Option 2 Option 2 can be factory configured with various technology options Additional or special encoders can be evaluated with it for example It is also possible to evaluate encoder signals of an external axis in relation to safety You will find all available options in the MSD Servo Drive Ordering Catalog The user manuals for the respective options provide detailed information on commissioning MSD Servo Drive Specification Functional Safety 14 3 8 Encoder connection 3 8 1 Safe encoder evaluation Alongside drive and control evaluation of various encoder signals the MSD Servo Drive also offers the facility to monitor the encoder signals with regard to functional safety This internal diagnosis makes it possible to integrate the different safety monitoring functions see chapter 6 When additionally using a monitoring encoder in the form of a redundancy it is possible to increase the Performance Level PL and Safety Integrity Level SIL of the application provided both encoder systems are acting on a common axis The following matrix shows the possible encoder comb
17. M ees ree as 23 6 3 FUMEHON GESGH PL OM a otii mi a erred ak 25 6 4 ValidaliODi c oii PET EA ine Dh se une a ec Hitt Can ds Ee t ele 26 6 5 Safety INSHCUCHONS w inia ecco Bau 26 Sale MAUS OU OWNS e 27 71 Specification of the safe MSD Servo Drive inputs sssssssssss 27 7 2 Specification of the safe MSD Servo Drive outputs 27 7 3 Specification of the safe brake driver output sssssssssssssee 28 74 Circuitry examples reet eterne Fh eben eines ng 30 7 4 1 Input circuitry examples 30 7 4 2 Output circuitry examples 32 7 4 3 Circuitry examples for brake driver output 35 JB JR SDO SOSUITI S s nios ira Ute ne ti Ee nee enlarge ker Dd 37 Dos TH 39 83 Safety acceptance tests se cese hi prete doa aan nal 39 8 2 D claration Ol conformity soto cei erre AAA OP e RR UENIRE E TAAA 39 MSD Servo Drive Specification Functional Safety 3 RAC padnie MSD Servo Drive Specification Functional Safety 4 1 Safety 1 1 Intended use MSD Servo Drives are built in units intended for installation in stationary electrical industrial and commercial plant or machinery When installed in machines the commissioning of the servo drive i e start up of intended operation is prohibited unless it has been ascertained that the machine fully complies with the Machinery Directive 2006 42 EC compliance with EN 60204 is mandatory Commissioning i e
18. No need for external motor contactors Less wiring Space saving MOOG ID no CB38398 001 Date 12 2013 6 Functional safety Better EMC performance due to the all over shielding of the motor cable Shorter reaction times By default the safety function STO is enabled by the two safe digital inputs ISSDOO and ISSDO1 It is possible to modify this configuration using the programming software for the integrated Safety PLC ATTENTION Some errors are detected by the internal diagnostics in the inactive state or on the transition from the active to the inactive state of the safety function To reduce the residual risk due to undetected errors it is necessary to request the safety functions not automatically tested by a pulse pattern once within 24 hours Otherwise the safety function may fail due to an accumulation of two or more undetected errors The SIL achieved by the forced change of state of the application must be defined by the user ATTENTION The STO safety function is certified to SIL3 PLE Cat 4 Accumulations of more than two errors may lead to failure of the safety function if no automatic testing of the actuation signals is implemented It must be ensured that a shutdown is carried out by the user or the machine control at least once in 24 hours MSD Servo Drive Specification Functional Safety P5 6 Functional safety MOOG ID no CB38398 001 Date 12 2013 6 4 Validation Always draw up a validatio
19. Re I 2 X10 i b J T pum DGND GNDLP ar a BE C ge rn BE xaT ry KE zi OSSDOO I AN xin tz W STH X13 2 GT mm DGND BE X13 3 z Bt mm X4 8 a LL X13 4 OSDO NEN 4 Aa m mm DGND YA X4 9 OSSD03 mm F3 M bL Gl Eee a PE GNDuP DGND Complex in RC Polyswitch DGND part non linear element imedance Figure 3 4 Electrical isolation method for Size 1 to Size 4 MSD Servo Drive Specification Functional Safety 11 3 Electrical installation MOOG ID no CB38398 001 Date 12 2013 MSD Servo Drive Specification Functional Safety 12 3 4 Connection of brake driver supply 3 5 Control connections voltage 24 V DC 3 5 1 Specification of control connections The brake driver for all sizes must be powered via an external voltage source The maximum current capacity with the output active differs according to model size for Des Term Specification Isolation details refer to chapter 6 ME e Uy 10VDC Size 1 Size 4 LAKE ISA0 X4 9 Resolution 12 bit Ry approx 101 ko Bottom ISAO X4 10 Terminal le in IP mode 125 therwi No satz xar erminal scan cycle in IP mode us otherwise X13 eav ISAI x412 ms S ossDos Tolerance U 1 96 of measuring range end value OSSD06 X4 El ano Digital inputs ISD00 X4 3 Default input osspos BRI sai nn o e Frequency range lt 500 Hz osspo BS isA1 1500
20. The power supply to the safe outputs requires a SELV PELV of 24 V DC Output groups The grouping of two outputs to meet the requirements of SIL 3 PL e is either OSSDOO and OSSDO2 or OSSDO1 and OSSDO3 73 Specification of the safe brake driver output In addition to the four safe digital outputs the MSD Servo Drive has an additional safe digital output with high driver power output the brake driver output This output is two channel with High and Low side drivers so that in addition to holding brakes contactors deadlocks etc can also be directly connected via two channels If two brakes or two actuators are connected they must act on the same safety function and act on a common axis in the application To use the brake driver outputs they must first be programmed on the Safety PLC Function in accordance with the programming manual ATTENTION Minimum fallback voltage The fallback voltage of the brake s or actuator s used must not be less than 8 V r NOTES Observe maximum output current dependent on module MSD Servo Drive size Maximum output current Size 1 2x1 4A Maximum holding current Connected brakes or actuators must not have a holding current less than Size 2 2x2 1A 15 mA as with a two channel load circuit a reverse leakage current flows in Size 3 2x2 45A the off state T Size 4 2x245A Exclusion of short circuits l If the system is operated in an axis group with multiple MSD Servo Drive unit
21. With pulse pattern alternatively also 24 V Figure 7 7 Output circuitry example 2 As opposed to example 1 figure 7 2 occurring faults are detected by internal diagnostics and plausibility checks of the switching element It is not possible however to disable the switched function without positive opening after sticking of one or more external contacts This measure enables PL d as per EN ISO 13849 1 to be achieved MOOG ID no CB38398 001 Date 12 2013 T Senex VO Example 3 Static two channel output of one group x ISSD03 ISSD02 ISSD01 ISSD00 OSSD03 OSSD02 OSSD01 OSSD00 EXESEXESESESESES 24VDC GND Figure 7 8 Output circuitry example 3 AS in example 1 figure 7 2 in this case too fault detection and thus shutdown in the event of a fault is not possible without diagnosis Suitable external measures as well as fault detection by the process can achieve PL d as per EN ISO 13849 1 provided positive opening contacts are used MSD Servo Drive Specification Functional Safety 33 7 MOOG Example 4 X4 IssD03 Elo ISSDO2 Me IsSD01 me IssD00 me OSSDO3 ai 05502 e OsSDO ai osspoo me 24V DC GND Safe I Os ID no CB38398 001 Date 12 2013 Static two channel output of a different group Figure 7 9 Output circuitry example 4 If in this example the fault exclusion short circuit
22. a contact element the contact separation is achieved as a direct result of a certain movement of the actuating element caused by non elastic links no springs Safety circuit A safety circuit is designed with two channels and has been approved by accredited testing bodies on the basis of the standards There is a large number of manufacturers offering a vast variety of safety circuits for various applications 6 3 Function description The safety control in the MSD Servo Drive is certified according to the requirements of EN ISO 13849 1 PL e Cat 4 and EN 61508 EN 62061 SIL CL 3 The safety function STO describes a safety measure in form of an interlocking and control function Category 4 means that this safety function will remain in place in case of up to two faults The STO function is the fallback solution for all other safety functions as it ensures that no torque is outputted by the drive Depending on the sensors used the other safety functions can be used up to max SIL 3 PL e Cat 3 The safety related parts must be designed in such a way that a single fault in any of the said parts does not result in loss of the safety function and the single fault is detected on or before the next request to the safety function If this is not possible a series of faults does not then lead to loss of the safety function The integrated safety functions offer the following advantages over the conventional solution
23. are data and range check SENDCON FIG STARTUP BUS E Normal system operation All outputs are switched according to the current Initialisation of the bus system RUN logic status Stop mode to transfer the parameter and program data STOP Table 5 1 Status and error display MOOG ID no CB38398 001 Date 12 2013 5 Diagnostics Display D1 D2 Alarm state Can be reset via digital input or reset mechanism within ALARM Moog DRIVEADMINISTRATOR Table 5 1 Error state Can only be reset by MSD Servo Drive 24 V reset Status and error display In the event of an alarm or error following the letter A or F a 4 digit code sequence is displayed A description of the error can be found by reference to the code in the error list contained in the programming manual NOTE If the code is 5 digit read from the master the first digit relates to the slave in the axis group A slave itself only outputs 4 digit codes MSD Servo Drive Specification Functional Safety PI MOOG ID no CB38398 001 Date 12 2013 5 2 Status and error display in MDA5 When an alarm or error has occurred a pop up immediately appears with an indication in the Cause field as to whether it is an alarm or an error from the safety section The More information field additionally shows a brief description and the code Error 49 1 Master_1xSlave gt TCP IP gt 192 168 39 6 gt Master Alarm on safety contr
24. ation Functional Safety 30 7 4 1 Input circuitry examples ATTENTION When using the safe digital outputs a short circuit between two outputs of different axes must be excluded When using two inputs for one function a discrepancy time of 3 seconds must be allowed Example 1 Single channel sensor without cross connection test ISSD03 ISSD02 ISSD01 ISSD00 OSSD03 OSSD02 OSSD01 OSSDOO 24VDC GND With pulse pattern 1 With pulse pattern 2 Figure 7 2 Input circuitry example 1 The single channel sensor is connected to an input of the MSD Servo Drive with no clocking This is not advisable for safety applications as the failure of the switching element would disable the safety function a short circuit between the supply and return conductors bridges the switching element and detection of a cross connection is not possible A maximum of PL b can be achieved Example 2 Two channel sensor without cross connection test X4 issbo3 HM ISSbo2 MM ISSD01 ie IsSD00 Iie ossDo3 io osspo ie OSSDO1 e OSSDOO HJ 24 V DC GND With pulse pattern 1 With pulse pattern 2 Figure 7 3 Input circuitry example 2 Use of two channel homogeneous sensors without test pulses incorporates a redundant shut off path though a short circuit between the supply and return conductors bridges the switching elements Also detection of a cross connectio
25. d and cannot be diagnosed without using a second independent encoder For encoders which use a complex protocol requiring a processor or an ASIC for processing in the encoder the failure model for communications buses applies Encoder cable For connecting safe encoders only approved encoder cable of maximum 30 m length may be used Speed and signal frequencies The maximum values for speeds and signal frequencies specified in the tables must not be exceeded Shutdown response time If a redundancy in the form of a monitoring encoder for the process encoder is used in an application the resolution of the monitoring encoder determines the shutdown response time in the event of certain errors NOTE When using two encoders the accuracy of the safe evaluation always relates to the encoder with the lower resolution w MSD Servo Drive Specification Functional Safety 15 3 Electrical installation MOOG ID no CB38398 001 Date 12 2013 Requirements for use of a resolver Te Maximum evaluatable signal frequency 600 Hz 36000 rpm Max signal frequency Number of pole pairs p 60 Maximum recordable speed Speed calculation method Max encoder cable length 30m Transmission ratio 2 1 Max phase shift incl cable 30 to 4 30 Exciter amplitude 8V 2 8 V Exciter frequency 8 kHz Max excitation current 100 mA 35 MA ms Permissible number of pole pairs 1to5 Table 3 7 Require
26. e used by various safe outputs for internal self testing and shutdown testing for example The MSD Servo Drive detects a High level on the respective input if the connected voltage is higher than 15 V and a Low level if the voltage is less than 5 V as per EN 61131 2 An internal diagnostic function inside the unit cyclically checks the correct functioning of the inputs The maximum transition time the time during which the input voltage of an input is between the defined switching thresholds may be 16ms If one channel reads in a different input state than the other channel for longer than 16ms an error message is generated and at the same time all outputs are disabled NOTES Outputs If no delay times are parameterised all outputs and output functions OSSDOx and STO are switched off Parameterisation of the delay times can be implemented as a de escalation strategy for OSSD04 OSSDO5 and STO _ NOTE gt Short circuits ground faults and cross connections may lead to failure of the safety function and must be prevented according to EN13849 MOOG ID no CB38398 001 Date 12 2013 T Sae VO The safe digital inputs are also capable of testing the test pulses generated by the MSD Servo Drive on the safe digital outputs see section 7 2 Specification of the safe MSD Servo Drive inputs With these test pulses errors in the external wiring can be detected on the inputs as only the associated parameterised pulse pat
27. ends from 55 96 to 130 96 of the specified signal level Achievable safety The achievable safety integrity level depends on the encoder selection In conjunction with a suitable encoder encoder signal evaluation is capable of achieving PL e as per EN ISO 13849 1 and SIL 3 as per EN 61508 EN 62061 Requirements for use of an HTL encoder or count pulses When using an HTL encoder or count pulses e g with proximity switches the signals are provided to the MSD Servo Drive for evaluation via the safe digital inputs see also chapter 6 Owing to the low resolution of count pulses HTL initiators among others they may only be used as additional redundancy for high resolution encoders and resolvers This must comply with the following specifications Maximum evaluatable input frequency 200 kHz Max input frequency Resolution pulses per revolution Input level 24 V DC as per EN 61131 2 type 1 Speed calculation method Table 3 9 Requirements for use of a resolver MOOC ID no CB38398 001 Date 12 2013 3 Electrical installation ATTENTION Evaluation of speed and direction of rotation Count pulses can only be evaluated if the mechanical design includes two proximity switches which supply the signals with a 90 offset Otherwise no evaluation of speed and direction of rotation is possible NOTES Safety analysis The use of HTL encoders or proximity switches requires a safety analysis of the installati
28. erpr fung EC type examination Benannte Stelle T V Rheinland Industrie Service GmbH Notified body Am Grauen Stein D 51105 K ln Kennnummer 0035 Identification No EG Baumusterpr fung Bescheinigung Nr 01 205 5349 13 EC type examination Certificate No Moog GmbH Postfach 1670 71006 B blingen Tel 07031 622 0 Fax 07031 622 100 A Gunter K Richard Kohse Gesch ftsf hrer General Manager Leiter Qualit tswesen Quality Manager B blingen 27 09 2013 QAF153D Konfornit tserkl rung MSD mit integrierter Sicherheitssteuerung doc Rev a 27 09 2013 MSD Servo Drive Specification Functional Safety 39 MOOG ID no CB38398 001 Date 12 2013 MSD Servo Drive Specification Functional Safety Eon Index A eee ee ae Hana name 39 B serum Braking resistor C Circuitry examples x5 dedit ocaeca edet duda etae ecce fed uda 30 COMMISSIONING uoa Seite ora sls tcs E a M x e tee EE M eite 19 Connection of power supply dt ee eee ap eie topo odd 10 Connection of supply voltage 2 tete edet ah Connection overview Size 1 to Size 4 Control coniectiOris c daceneto crei ee n berg better de ene ee D Danger analysis and risk assessment u eau aaa aaa ach 23 D claration ot contOrmlily nes anne Lean 39 Belinitionsohtermsen ae nr eidg 23 IB Te e o ife 21 E Electrical instalation
29. he motor and the servo drive This means there is a risk of electric shock or other electrical hazard DANGER FROM ROTATING PARTS If an exertion of external force is to be expected in the STO safety function such as by a suspended load this motion must be safely prevented by additional measures such as by two brakes safety bolts or a clamping device with brake Short circuits in two remote branches of the power section may activate a short time axis movement depending on the number of poles of the motor EXAMPLE Synchronous motor With a 6 pole synchronous motor the movement may be a maximum of 30 For a directly driven ball screw e g 20 mm per revolution this corresponds to a one time maximum linear movement of 1 67 mm EXAMPLE Asynchronous motor The short circuits in two offset branches of the power section have almost no effect as the exciting field collapses when the inverter is disabled and has fully decayed after approximately 1 second 7 Sate inputs outputs 71 Specification of the safe MSD Servo Drive Inputs The MSD Servo Drive has four safe digital inputs They are suitable for connection of one or two channel signals with and without clocking and cross connection testing Used individually they meet the requirements of SIL 2 PL d a group of two inputs meets the requirements of SIL 3 PL e Each of the four inputs is suitable for the connection of OSSD signals output signal switching device such as ar
30. inations Process R External axis Monitoring encoder SE Max SIL encoder monitoring 1 3 SinCos 2 SinCos xn 3 29 3 SinCos SinCos 3 4 SinCos TrL 2 3 5 SinCos HTL count pulses 3 6 IE TiL D 7 TTL HTL count pulses 2 8 SSI SinCos 3 9 SSI SinCos x 3 23 10 SSI SinCos 2 3 11 SSI TIL 3 12 SSI SSI 3 13 SSI HTL count pulses 3 14 Resolver 3 1 Option 2 requires Safety Tech option for external axis monitoring SinCos1 2 Option 2 requires Safety Tech option second safe axis monitor SinCos 3 Option 2 requires Safety Tech option second safe axis monitor SSI 4 Option 2 not required both encoder signals in the same connector 5 Relates to the maximum SIL of the external axis monitor Table3 6 Combinations of different safety monitoring functions Process En External axis Monitoring encoder ES Max SIL encoder monitoring 15 Resolver x 3 25 16 Resolver TTL S 17 Resolver TIL x 3 25 18 Resolver HTL count pulses 3 1 Option 2 requires Safety Tech option for external axis monitoring SinCos1 2 Option 2 requires Safety Tech option second safe axis monitor SinCos 3 Option 2 requires Safety Tech option second safe axis monitor SSI 4 Option 2 not required both encoder signals in the same connector 5 Relates to the maximum SIL of the external axis monitor Table3 6 Combinations of different safety monitoring functions ATTENTION Complete safety analysis Safety
31. mation and specifications may be changed at any time For information on the latest version please refer to drives support moog com ID no CB38398 001 Rev 1 0 12 2013 Applicable from firmware version Development Phase Revision 3 The German version is the original of this Operation Manual
32. ments for use of a resolver ATTENTION Undetected errors in case of axis standstill In the event of axis standstill undetected errors may occur To detect those errors the resolver must be automatically rotated by the application by an angle of at least 360 electrically at a regularly recurring interval of a maximum of 24 h NOTES Observe tolerances The monitoring of the resolver signal is assigned a certain tolerance Using non conforming cable types or lengthy encoder cables or the use of different resolver types with differing specifications may lead to unwanted error messages as monitoring tolerances may be infringed as a result So only the cable types and lengths approved by Moog may be used Positive locking friction locked connections When using a resolver the rotor must be positive locked with the motor shaft in order to exclude the error as mentioned at the beginning The stator must likewise be positive locked or friction locked with the MSD Servo Drive Specification Functional Safety 16 appropriate overdimensioning In addition shaft fracture errors must be excluded by appropriate overdimensioning of the motor shaft Fault exclusion The fault exclusion Magnetic influence at the fitting location as per the safety standard EN 61800 5 2 annex D table D 16 must be taken into account in relation to third party systems Achievable safety The system is capable of attaining PL e as per EN ISO 1
33. n is not possible Safe operation can only be attained by means of isolated cable laying and exclusion of shorting on the terminals This connection method is not advisable for use in safety applications outside of the cabinet Taking into account the short circuit and cross connection fault exclusion as per EN ISO 13849 1 PL e can be achieved MOOG ID no CB38398 001 Date 12 2013 T Senex VO Example 3 Single channel sensor with cross connection test ISSD03 ISSD02 ISSD01 ISSD00 OSSD03 OSSD02 OSSD01 OSSDOO P1 P2 24 V DC GND With pulse pattern 1 With pulse pattern 2 Figure 7 4 Input circuitry example 3 When using a single channel sensor with clocking short circuits against 24 V DC and O V DC as well as cable breaks are detected Cable shorts between the two connections of the sensor and the short circuit between the input and clock output are not detected however Failure of the switching element resulting in loss of the safety function is likewise not detected Taking into account the short circuit and cross connection fault exclusion as per EN ISO 13849 2 table D 8 PL d can be achieved provided a suitable switching element with positive opening contacts is used and the sensor is activated and the safety function thereby requested at regular intervals MSD Servo Drive Specification Functional Safety 31 Z Sale LOS MOOG ID no CB38398 001 Date 12 2013 Example 4 T
34. n plan The plan stipulates the tests and analyses with which you determined the conformance of the solution e g circuit suggestion to the requirements from your application case You should in any case check whether e all safety related output signals are correctly and logically generated by the input signals the response in case of fault corresponds to the specified circuit categories e control and operating means are sufficiently dimensioned for all modes of operation and ambient conditions After completion of analyses and tests create a validation report This report should at least contain all objects to be tested the personnel assigned to carry out testing test equipment including details of calibration and simulation instruments tests performed problems found and solutions to them results Document the results in a traceable manner SAFETY INSTRUCTIONS When carrying out the validation observe the safety instructions contained in section 6 5 6 5 IA FA MSD Servo Drive Specification Functional Safety 26 Safety instructions DANGER FROM ELECTRICAL TENSION When the servo drive is in the STO state all motor and mains cables braking resistors and DC link voltage cables are carrying dangerous voltages against protective conductors With the STO function no shutdown of voltage in case of emergency is possible without additional measures There is no electrical isolation between t
35. oller SR1 of master or local device detected Figure 5 1 Status and error display in MDA5 MSD Servo Drive Specification Functional Safety 22 6 Functional safety 6 1 Danger analysis and risk assessment Users of the MSD Servo Drive integrated safety functions must comply with the latest applicable version of the Machinery Directive 2006 42 EC The manufacturer or its representative is obliged to undertake a danger analysis in accordance with the Machinery Directive 2006 42 EC before the market launch of a machine An analysis of hazards posed by the machine must be conducted and appropriate measures instigated to reduce eliminate such hazards With the danger analysis all prerequisites for establishing the required safety functions are fulfilled The safety functions of the MSD Servo Drive with integrated safety control have been tested by the accredited certification body T V Rheinland see appendix The resultant acceptance is applicable to the servo drive types identified according to the order code chapter 2 1 ATTENTION The operator of the safety system must be trained such that his her knowledge is appropriate to the complexity and safety integrity level of the safety system This training includes the study of essential features of the production process and knowledge of the relationship between the safety system and the equipment under control EUC MOOG ID no CB38398 001 Date 12 2013 6 Func
36. on wiring and power supply Achievable safety The additional use of count pulses to a process encoder might create the necessary redundancy to achieve PL e as per EN ISO 13849 1 and SIL 3 as per EN 61508 EN 62061 HTL encoders are treated like count pulses MSD Servo Drive Specification Functional Safety 17 3 Electrical installation MOOG ID no CB38398 001 Date 12 2013 3 9 Ready made SCC cable Safe axis cross communication SCC is used to construct a group of up to six axes MSD Servo Drive Safety In such an axis group all members are provided with all the data relevant for execution of the safety and monitoring functions within defined cycle times Temperature range 10 80 C Cable diameter approx 6 mm Maximum cable length per segment between servo di 40 cm rives Maximum total cable length incl connector 2 8m Maximum number of cable segments 5 Material of outer sheath PVC Table 3 10 Technical data of ready made SCC cable NOTE SCC bus addresses are automatically configured only after power on Figure 3 6 SCC cable MSD Servo Drive Specification Functional Safety 18 3 10 Braking resistor RB In regenerative operation e g when braking the drive the motor feeds energy back to the servo drive This increases the voltage in the DC link If the voltage exceeds a threshold value the internal brake chopper transistor is activated only available up to and including
37. ple 6 With pulse pattern alternatively also 24 V possible By splitting the two outputs into different groups category 4 is internally achieved As a result this configuration achieves PL e as per EN ISO 13849 1 provided the connected elements likewise meet the requirements of the safety category MOOG ID no CB38398 001 Date 12 2013 T Senex VO 7 4 3 Circuitry examples for brake driver output ATTENTION Using the brake outputs for two actuators or brakes not acting on the same safety function is not permissible for safety purposes The High side driving output can be used functionally as an unsafe digital output For unsafe use of the brake drivers they must be programmed in accordance with the programming manual Example 1 Two channel connection of one brake X13 size 1 4 Pin 4 GND ext M Pin 3 OSSDO5 m Pin 2 OSSD04 Brake Pin 1 24 V ext I O Brake Figure 7 12 Brake driver circuitry example 1 Based on the internal architecture and the two channel configuration of a suitable brake PL e as per EN ISO 13849 1 is achieved MSD Servo Drive Specification Functional Safety ED Z Sale LOS MOOG ID no CB38398 001 Date 12 2013 Example 2 Two channel connection of one actuator contactor deadlock etc X13 size 1 4 Pin 4 GND ext i Pin 3 OSSDO5 Pin 2 OSSD04 Pin 1 24 V ext M
38. r polyswitch Digital ground DGND X4 1 Reference earth for 24 V Ina 80 mA per pin with Yes X4 13 self resetting circuit breaker polyswitch Table 3 3 Specification of control connections X4 NOTE Avoid ring currents With high currents flowing through the earth terminals a high resistance isolation from the device earth is required This may under certain circumstances result in malfunction of the drive To prevent this avoid ring currents in the wiring MOOG ID no CB38398 001 Date 12 2013 3 Electrical installation 3 5 2 Brake driver For models Size 1 to Size 4 connector X13 is provided for connection of one or two motor holding brakes acting on a common axis 24 V xin Max current to be 055D04 X13 2 driven dependent on zen OSSDO5 X13 3 dulel 24v i GND X13 4 module BR For more details see Bj chapter 6 3 osspos I GND 4 24 V to spec Table 3 4 Specification of the terminal connection for a brake SM Max current to be X13 Size 1 4 riven ndent on OSSDO5 X13 3 d i s aante 24 GND X13 4 moakie ossoo B For more details see chapter 6 3 ossDos BI GND l 24 V to spec Table 3 5 Specification of the terminal connection for two brakes precondition acting on a common axis MSD Servo Drive Specification Functional Safety 13 3 Electrical installation MOOG ID no CB38
39. rature mW temperature monitor encoder KTY84 130 Klixon automatic cut out R Power output with open circuit overload AE Conniectionioblor detection to the relay Attention Pay attention to see p 12 Size 1 4 brake 5 US freewheeling suppressor circuit X12 Power connection Motor braking resistor and connection of DC link see p 18 HW Hardware rating plate RI serial number and electrical performance see p 8 SW Software rating plate Contains serial number software version MAC see p 9 address Table 3 1 Key to connection diagram Size 1 to Size 4 3 2 The MSD Servo Drive must be supplied with 24 V 20 SELV PELV via terminals X9 and X10 MSD Servo Drive voltage supply 3 3 Electrical isolation method The control electronics with its logic uP the encoder terminals and the inputs and outputs are electrically isolated from the power section power supply DC link All control terminals are designed as safety extra low voltage protective extra low voltage SELV PELV circuits and must only be operated with such SELV PELV voltages as per the relevant specification This provides reliable protection against electric shock on the control side You therefore need a separate control supply compliant with the requirements of a SELV PELV The opposite overview shows the potential supplies for the individual terminals in detail This concept also delivers higher operational safety and reliability of the servo drive SELV Safety Extra
40. s Table 7 1 Maximum output currents dependent on module an exclusion for short circuits between the brake driver outputs of the various axes must be implemented Capacitive loads As a general rule no capacitive loads such as electronic contactors are permitted on the brake driver outputs Status not to master The status of the brake outputs is not transferred to the master MOOG ID no CB38398 001 Date 12 2013 MSD Servo Drive Specification Functional Safety 29 7 sale Vos 7 Sale LOS MOOG ID no CB38398 001 Date 12 2013 74 Circuitry examples In the following circuitry examples it is assumed that the switching elements used are executed with safety approval in accordance with the intended PL as per EN ISO 13849 1 or SIL as per EN 61508 EN 62061 The following points must additionally be noted e The safety regulations and EMC standards must be observed e With regard to the fault exclusions refer to the table in annex D to EN 13849 2 The examples presented in the following and their characteristic architecture are key to categorisation as per EN ISO 13849 1 The resulting maximum possible Performance Levels as per EN ISO 13849 are also dependent on the following factors with regard to the external components Structure single or redundant Detection of common cause failures CCFs Diagnostic coverage as required DCavg Mean time to dangerous failure of a channel MTTFd MSD Servo Drive Specific
41. se they act as switching 24 V DC outputs MSD Servo Drive Specification Functional Safety 2 7 Sale Vos MOOG ID no CB38398 001 Date 12 2013 P1 i i 2ms 4ms 6ms 8ms 10ms 12 ms Figure 7 1 Signatures For more details on use and programming of the signature outputs refer to the programming manual The following circuit diagram describes the properties of the individual signatures over time ATTENTION If the system is operated in an axis group with multiple MSD Servo Drive units an exclusion for short circuits between the safe digital outputs of the various axes must be implemented P NOTES 53 Only monitoring function The signature outputs are specified only for monitoring of the digital inputs and cannot be used for any other function in the application In addition the various signatures are specified exclusively for mechanical switching elements Other switching elements may lead to signal corruption and so result in errors being generated MSD Servo Drive Specification Functional Safety 28 Observe maximum output current The High side driving outputs are implemented for a current of 100 mA per output For higher current demand the drivers of the brake output High and Low side or external relays can be used digital outputs as per EN 61131 2 Relay fallback voltage If relays are connected to the outputs their fallback voltage must not be less than 5 V Supply
42. tern is accepted Each input can thus be configured individually for the following signal sources Input assigned to pulse 1 Input assigned to pulse 2 Input assigned to pulse 3 Input assigned to pulse 4 Input assigned to DC 24 V continuous voltage It is also possible for inputs ISSDO2 and ISSDO3 to use two pulse encoders e g proximity switches or the like or an HTL encoder as count pulses for encoder evaluation 7 2 Specification of the safe MSD Servo Drive outputs In addition to the safe signal inputs the MSD Servo Drive has four safe outputs Used individually these outputs meet the requirements of SIL 2 PL d in groups of two outputs they meet the requirements of SIL 3 PL e see section 7 4 2 Output circuitry examples The outputs can be used as safety outputs with internal cyclic shut off tests of the output driver switching the outputs to O V DC potential for a maximum test duration of 500 us OSSD If the outputs are used as non safety outputs this internal test is not carried out and no test pulses are outputted on the signals If safe outputs are to be used by the servo drive as standard outputs this must be programmed accordingly in the Safety PLC Function see programming manual In conjunction with the digital inputs the outputs can also be used as signature outputs test pulse for error detection in the external wiring see section 7 1 Specification of the safe MSD Servo Drive outputs In this ca
43. the drive section can be carried out as stipulated in accordance with the MSD Servo Drive Operation Manual independent of use of the operator control software Safety PLC Functions ATTENTION If the above default program is overwritten by transferring a program from Safety PLC Functions it cannot be restored by the Reset to default function To enable configuration of the power stage again a program must be transferred with the included safety module STO for more details refer to the programming manual MOOG ID no CB38398 001 Date 12 2013 4 Commissioning MSD Servo Drive Specification Functional Safety 19 MOOG ID no CB38398 001 Date 12 2013 MSD Servo Drive Specification Functional Safety EZ 5 Diagnostics 5 1 Status display on device In addition to the automatically displayed device states see MSD Servo Drive Operation Manual the MSD Servo Drive with integrated safety control features status information of the safety section Press and hold down button T1 for about 1s to open the selection menu When you press T1 repeatedly or hold it down the display shows FS When you then press button T2 following the letter sequence S A F and E the status of the safety section is indicated This may include the following information DIREN D1 D2 Synchronisation between the two processor systems and checking of the STARTUP configuration firmware data Distribution of the configuration firmw
44. tional safety 6 2 Definition of terms Safety functions A safety function is a function executed by an E E PE Electrical Electronic Programmable Electronic safety system a safety system implementing a different technology or external risk reduction systems with the aim of attaining or maintaining a safe state for the EUC taking into account a specific unwanted event STO Safety Torque Off The power supply to the motor is safely isolated by cutting the power to the drive The axis then coasts to a stop Attention STO is the fallback solution for all safety functions SS1 Safe Stop 1 The drive is braked by the action of the drive control and in the process monitors the velocity characteristic or the time When standstill has been reached or the time has elapsed the STO function is activated SS2 Safe Stop 2 The drive reduces the movement down to a stop monitoring the velocity characteristic in the process When standstill has been reached the SOS function is activated SOS Safe Operating Stop Safe Operating Stop is the state in which the motor is held at standstill whereby the drive in speed or position control mode SLS Safely Limited Speed The drive is monitored for compliance with a defined velocity limit vmax SLI Safely Limited Increment The travel of the drive is monitored to a limit value for each driving job This safety function enables a safe jog mode SDI Safe Direction Moni
45. to protect personnel and machinery and to maintain the function capability of the machine or system concerned and must be observed The function of an emergency stop system does not necessarily have to cut the power supply to the drive To exclude the possibility of danger it may be useful to set individual drives to a safe state using the safety functions programmable in the safety control Execution of the safety functions is assessed by means of a risk analysis of the machine or plant including the electrical equipment to EN ISO 14121 and is determined with selection of the circuit level category in accordance with EN ISO 13849 1 Safety of machines Safety related parts of controls In addition the user is obligated to validate all safety functions of the machine on completion of installation and programming 1 3 Maintenance The MSD Servo Drives are maintenance free Opening the housing is not permitted and doing so would result in voiding of any warranty In the event of a defect or error the servo drive must be returned to the manufacturer s Service department MSD Servo Drive Specification Functional Safety 5 MOOG ID no CB38398 001 Date 12 2013 MSD Servo Drive Specification Functional Safety EE 2 Supplements to the MSD Servo Drive Operation Manual As the function described in this specification integrated safety control is an option for the MSD Servo Drive system it is supplementary to the operation man
46. toring of the specified direction of rotation and movement of the axis MSD Servo Drive Specification Functional Safety 23 6 Functional safety MOOG ID no CB38398 001 Date 12 2013 SCA Safe Cam If the motor speed or position is within a defined range a safe signal is outputted SEL Safe Emergency Limit Monitoring of the permissible velocity referred to the relative distance from the maximum limit of the travel or positioning range This safety function can replace the normal safety limit switches SLP Safely Limited Position Monitoring that the drive does not exceed a defined limit position SBT Safe Brake Test Safety function to check holding brakes subject to wear Emergency stop In accordance with the national and European preface to EN 60204 1 electrical equipment may also be used for emergency stop devices provided they comply with relevant standards such as EN 954 1 and or IEC 61508 STO can thus be used for emergency stop functions NOTE gt The term emergency stop device has been replaced by the new term action in case of emergency The term emergency stop has been replaced by shutdown in case of emergency emergency stop see paragraph 9 2 5 4 2 in EN 60204 1 EN ISO 13849 1 2008 Safety of machines safety related parts of controls The EN ISO 13849 standard emerged from EN 954 1 supplemented by the aspects of quality management and reliability MSD Servo Dri
47. ual MSD Servo Drive Single Axis System ID no CA65642 001 MSD Servo Drive Single Axis System Operation Manual Specification Section Subject A Replaced 1 Safety 2 Mechanical installation 2l 3 Electrical installation 3 4 3 9 3 8 341 35 4 Commissioning 4 5 Diagnostics 5 1 6 Safe Torque Off STO 6 ff nu A 6 Table 2 1 MSD Servo Drive single axis system supplements and replacements MOOG mno 838398001 Date 12 2013 MSD Servo Drive Specification Functional Safety 7 M OOG ID no CB38398 001 Date 12 2013 2 1 Order code The MSD Servo Drive variant with integrated safety control is coded as follows in the article designation MOOG Model G392 006 001 001 D 71034 B blingen S N D116605 Rev A www moog com industrial In 230 V AC 3ph 50 60 Hz Made in Germany 40A Year of production Out 0 23P V AC 3ph 0 400 Hz C WL Week of production MSD Servo Drive Specification Functional Safety 8 Figure 2 1 MSD Servo Drive rating plate On rating plates of the MSD Servo Drive you will find the serial number from which you can identify the date of manufacture based on the following key You will find details of the rating plates locations on the MSD Servo Drive in the MSD Servo Drive Operation Manual 3 Electrical installation 3 1 Overview of connections Size 1 to Size 4 The following shows the layout with the corresponding positions of pl
48. ugs and terminals To aid orientation the connectors and terminals are labelled by abbreviations li X11 X9 X10 D1 D2 SW Size 3 4 HW Option 1 sw o x D1 D2 T1 T2 A x9 8 Service interface Service interface w 24 V against Analog setpoint 1 Analog setpoint 2 GND NaN Supply for power electronics designationand termination technique vary according to size and device type for detail see figures 3 3 to 5 5 and refer to the operation manual for teh device concerned 24 V for control electronics Uv H Output Safe cross communication Input HUHHH e Communication fieldbuses Bottom Motor brake gt actuation DC link Braking gt resistor p L 9 Brake Brake 4 Figure 3 1 Layout Size 1 to Size 4 here Size 1 MOOG ID no CB38398 001 Date 12 2013 3 Electrical installation Figure 3 2 Connection overview Size 1 to Size 4 MSD Servo Drive Specification Functional Safety 3 MOOG Electrical installation ID no CB38398 001 Date 12 2013 Figure 3 3 Connection of power supply for MSD Servo Drive single axis system 3 phase Size 1 4 bo pesat padam D1 D2 7 segment display Device status display see p 21 T1 T
49. ve Specification Functional Safety 24 IEC 62061 2005 Safety sector standard for machinery originating from IEC 61508 IEC 61508 1998 2010 International basic safety standard specifying the status of safety technology in all its aspects EN 61800 5 1 2007 Electrical drives with variable speed Part 5 1 Requirements concerning electrical thermal and function safety EUC Equipment under control EUC system A system that responds to the input signals from the process and or a user and generates output signals which enable the EUC to work as desired EUC system Equipment machine apparatus or plant used for the manufacture production and processing transportation medical or other activities EUC risk Risk resulting from the EUC or its interaction with the EUC operating equipment PFH Probability of dangerous Failure per Hour Probability of Failure per Hour in respect of a hazardous random hardware failure Validation Affirmation that the special requirements for a certain purpose of use are fulfilled by investigation and the submission of objective proof Validation describes the activity to prove that the safety related system under investigation meets the specified safety requirements of the safety related system in every respect before or after installation Positive opening operation of a contact element Symbol for positive opening operation to EN 60947 5 1 annex K e In a positive opening operation of
50. wo channel sensor with cross connection test x T ISSD03 ISSD02 ISSD01 ISSD00 OSSD03 OSSD02 OSSD01 OSSDOO BEBEEBBBE P1 P2 424 V DC GND With pulse pattern 1 With pulse pattern 2 Figure 7 5 Input circuitry example 4 By using two independent clock signals on the homogeneous sensor all cross connections and short circuits can be detected For safety application NC contacts are recommended as only they are continuously tested with the test pulses When using suitable switching elements with positive opening contacts PL e as per EN ISO 13849 1 is achieved MSD Servo Drive Specification Functional Safety 32 7 4 2 Output circuitry examples Example 1 Static single channel output X4 ISSD03 ISSD02 ISSD01 ISSD00 OSSD03 OSSD02 OSSD01 OSSD00 EESEEEE EE 24V DC GND Figure 7 6 Output circuitry example 1 With single channel switching outputs without external or internal testing the MSD Servo Drive does not detect sticking of a connected contact Shutdown is likewise not possible This circuitry variant is not suitable for safety applications Example 2 Dynamic single channel output OSSD with plausibility check ISSD03 ISSD02 ISSD01 sii dT Li IssDoo IM dl M dr M OSSD03 OSSD02 OSSD01 OSSD00 24V DC GND

MSD Servo Drive Specification - Functional Safety

Contents

Download Pdf Manuals

Related Search

Related Contents