This operating guide provides information for safe installation and commissioning of the safety option. It is intended for use by
qualified personnel. Read and follow the instructions to use the option safely and professionally. Pay particular attention to the safety
instructions and general warnings. Always keep this operating guide available with the option.
1.2 Available Resources
Throughout this guide there are references to other manuals that are helpful when installing the VLT® Safety Option MCB 151/152.
1 Installation phase: Use this installation guide and refer to VLT
AutomationDrive FC 301/FC 302 Operating Guide.
2 Parameterization phase: Refer to VLT® Motion Control Tool
MCT 10 Set-up Software Operating Guide.
3 Test phase: Use the commissioning report generated via the
MCT 10 Safe Plug-in.
Illustration 1: System Overview
Also refer to www.danfoss.com/en/search/?filter=type%3Adocumentation%2Csegment%3Adds for more information.
1.3 Document Version
This manual is regularly reviewed and updated. All suggestions for improvement are welcome. See document version and changes
applied in table 1.
MG34W4xxEditorial changes. Installation of VLT® Sensorless Safety MCB 159 added.
1.4 Type Approvals and Certifications
The following list is a selection of possible type approvals and certifications for Danfoss drives:
NOTI CE
Drives of enclosure size T7 (525–690 V) are not UL listed.
Introduction
NO TI CE
The specific approvals and certification for the drive are on the nameplate of the drive. For more information, contact the local
Danfoss office or partner.
For more information on UL 508C thermal memory retention requirements, refer to the section Motor Thermal Protection in the
product-specific design guide.
For more information on compliance with the European Agreement concerning International Carriage of Dangerous Goods by Inland
Waterways (ADN), refer to section AND-compliant Installation in the product-specific design guide.
According to the Machinery Directive regulation, it is hereby stated that the original language of this operating guide is English UK.
2.2 Warranty and Liability
All claims to warranty and liability are rendered invalid if:
•The product was used contrary to the purpose for which it was intended.
•Damage can be attributed to not having followed the guidelines in the manual.
•Operating personnel are not suitably qualified.
•Any type of modification has been made (for example, exchanging components on the PCB boards, soldering work, and more).
2.3 Safety Symbols
The following symbols are used in this manual:
DA NG ER
Indicates a hazardous situation which, if not avoided, will result in death or serious injury.
WA RN IN G
Indicates a hazardous situation which, if not avoided, could result in death or serious injury.
CA UT IO N
Indicates a hazardous situation which, if not avoided, could result in minor or moderate injury.
NO TI CE
Indicates a property damage message.
2.4 Qualified Personnel
The products must only be assembled, installed, programmed, commissioned, maintained, and decommissioned by persons with
proven skills. Persons with proven skills:
•Are qualified electrical engineers, or persons who have received training from qualified electrical engineers and are suitably
experienced to operatre devices, systems, plant, and machinery in accordance with the general standards and guidelines for safety
technology.
•Are familiar with the basic regulations concerning health and safety/accident prevention.
•Have read and understood the safety guidelines given in this manual and also the instructions given in the operating guide of the
drive.
•Have good knowledge of the generic and specialist standards applicable to the specific application.
Legal Information an Safety
2.5 Responsibilities of Users of PDS(SR)
Context:
In EN ISO 12100, risk assessment is defined as an overall process comprising a risk analysis and a risk evaluation.
Procedure
1. Carry out a hazard and risk analysis of the application according to EN ISO 12100.
2. Ensure that the qualified personnel has experience with working in ATEX areas according to Directive 99/92/EC (also known as the
ATEX Workplace Directive).
3. Identify safety functions required, and allocate SIL to each of the functions.
4. Identify other subsystems and validate the signals and commands from those subsystems.
5. Design appropriate safety-related control systems (hardware, software, parameterization, and more).
2.6 Safety Precautions
WA RN IN G
HIGH VOLTAGE
AC drives contain high voltage when connected to AC mains input , DC supply , or load sharing. Failure to perform installation ,
start-up, and maintenance by qualified personnel can result in death or serious injury.
Only qualified personnel must perform installation, start-up, and maintenance.
-
WA RN IN G
UNINTENDED START
When the drive is connected to the AC mains, DC supply, or load sharing, the motor may start at any time, causing risk of death,
serious injury, and equipment, or property damage. The motor may start by activation of an external switch, a fieldbus
command, an input reference signal from the LCP or LOP, via remote operation using MCT 10 Set-up software, or after a cleared
fault condition.
Press [Off] on the LCP before programming parameters.
-
Disconnect the drive from the mains whenever personal safety considerations make it necessary to avoid unintended
-
motor start.
Check that the drive, motor, and any driven equipment is in operational readiness.
The drive contains DC-link capacitors, which can remain charged even when the drive is not powered. High voltage can be
present even when the warning indicator lights are off.
Failure to wait the specified time after power has been removed before performing service or repair work could result in death
or serious injury.
Stop the motor.
-
Disconnect AC mains, permanent magnet type motors, and remote DC-link supplies, including battery back-ups, UPS, and
-
DC-link connections to other drives.
Wait for the capacitors to discharge fully. The minimum waiting time is specified in table Discharge time and is also visible
-
on the nameplate on top of the drive.
Before performing any service or repair work, use an appropriate voltage measuring device to make sure that the capacitors
This option is suitable for performing mechanical work on the drive system or affected area of a machine only. It doesn NOT
provide electrical safety. Using the option for starting or stopping the drive can cause personal injury.
No NOT use the option as a control for starting or stopping the drive.
-
Refer to ISO 12100 for more information about the application requirements.
-
WA RN IN G
LEAKAGE CURRENT HAZARD
Leakage currents exceed 3.5 mA. Failure to ground the drive properly can result in death or serious injury.
Ensure the correct grounding of the equipment by a certified electrical installer.
-
NO TI CE
The drive has more voltage sources than L1, L2, and L3 when load sharing (linking of DC link) or external 24 V DC are installed.
The safety option is intended to be part of the safety-related control system of a machine. Before installation, perform a risk
assessment to determine whether the specifications of this safety option are suitable for all foreseeable operational and
environmental characteristics for the system in which it will be installed.
The system user is responsible for:
•Set-up, safety rating, and validation of any actuators connected to the system.
•Completing a system-level risk assessment and reassessing the system any time a change is made.
•Providing supposition (as needed for the application) that the system fulfills the requested safety rating.
•Project management and proof testing.
•Programming the application software and the safety option configurations in accordance with the information in this manual.
•Access to the control system.
•Analyzing all configuration settings and selecting the proper setting to achieve the required safety rating.
Illustration 2: Drive with Safety Option and Fieldbus Option
The safety option performs safety functions in accordance with EN IEC 61800-5-2. It monitors safe motion sequences on drives, which
are safely brought to a stop and shutdown if an error occurs.
The safety option:
•Activates safety functions.
•Monitors safe motion sequences.
•Signals the status of the safety functions to the safety control system via possible connected PROFIBUS fieldbus.
•Activates the selected failure reaction Safe Torque Off or Safe Stop 1 if an error occurs.
There are 2 variants of the safety option:
•With HTL encoder interface (MCB 151).
•With TTL encoder interface (MCB 150).
The safety option is constructed as a standard option for the VLT AutomationDrive FC 302 and is automatically detected after
mounting.
The safety option can be used to monitor the stopping, starting, or speed of a rotating or laterally moving device. As speed monitor,
the option is often used with hard guarding, access doors, and safety gates with solenoid-lock or -unlock safety switches. When the
speed of the monitored device drops below the set switch point (where its speed is no longer considered dangerous), the safety option
sets S37 output low. This allows the operator to open the safety gate. In speed monitor applications, the safety output S37 is high for
operation (when the motor speed of the monitored device is below the set switch point). When the speed exceeds the set value,
indicating a too high (dangerous) speed, the safety output is low.
•Switches the motor to torque-free if Safe Torque Off is activated.
The safe control system:
•Activates the safety functions via inputs on the safety option.
•Evaluates signals from safety devices, such as:
-E-STOP push buttons.
-Non-contact magnetic switch.
-Interlocking switch.
-Light curtain devices.
•Processes the safety option status function.
•Provides safe connection between safety option and safety control system.
•Provides fault detection at activation of safety functions (shorts across contact, short circuit) on signal between the safety control
system and the safety option.
Functions and Systems Overview
3.1.1 Behavior of Holding Brake
NO TI CE
RISK OF HAZARD
External forces acting on the motor (vertical axis) and unwanted movements, for example caused by gravity, can cause hazards
leading to death or serious injury.
Add measures for fall protection before operating the motor.
-
Triggering the Safe Torque Off safety function means that the delay time for motors with holding brake is not effective. The motor
cannot generate holding torque to bridge the time to application of the holding brake. Check whether more measures have to be
taken, for example, this may cause the load of vertical axes to lower.
3.1.2 Safety Certification
The safety option is certified for use in safety applications up to and including SIL 2 according to EN IEC 61508 and EN IEC 62061,
Performance Level PL d, and Category 3 according to EN ISO 13849-1. Safety requirements are based on the standards valid at the time
of certification. The IFA (Institute for Occupational Safety & Health) has approved the safety option for use in safety-related applications
where the de-energized state is considered to be the safe state. All examples related to I/O included in this manual are based on
achieving de-energization as the safe state.
3.1.3 Implementation in Control Systems
Often, design measures are not sufficient and protective devices are required to minimize the risk. In this context, safety functions
executed by SRP/CS (safety-related part of control systems) are defined. SRP/CS includes the entire safety chain with sensor (detect),
logic (process), and actuator (switch).
Safety functions are defined based on the application and the hazard. They are often specified in a Type C standard (a product
standard), which provides precise specifications for special machines. If a C standard is not available, the machine designer defines the
safety functions. Typical safety functions are described in more detail in EN ISO 13849-1, section 5, Specification of Safety Functions.
The safety functions for drive systems are described in IEC 61800-5-2.
The standards require a specification of functional requirements. The specification must contain details about each safety function that
should be executed. Also define the:
•Necessary interfaces with other control functions.
•Required error responses.
•Performance level required PLr or achievable SIL level.
3.2.1.1 Performance Level (PL) and Safety Integrity Level (SIL)
For safety-related control systems, Performance Level (PL), according to EN ISO 13849-1, and SIL levels, according to EN IEC 61508 and
EN IEC 62061, include a rating of the system's ability to perform its safety functions.
All the safety-related components of the control system must be included in both a risk assessment and the determination of the
achieved levels. Refer to EN ISO 13849-1, EN IEC 61508, or EN IEC 62061 standards for complete information on requirements for PL and
SIL determination.
3.2.2 Validation of Performance Level
Check whether the required Performance Level “PLr”, determined in the risk assessment, is achieved by the selected system for each
safety function used. Check the calculation using the SISTEMA SW Tool of IFA (Institute for Occupational Safety & Health). Danfoss
provides a component library which can be used for the calculation. Danfoss offers corresponding services to support the system
check by calculation. Library can be downloaded from www.dguv.de/ifa/en/pra/softwa/sistema.
If using another validation method for the performance level, use the characteristic safety values specified.
3.2.3 Activation of Safety Functions
•The safety functions are activated using the dual-pole safe inputs on the safety option.
•These inputs operate in accordance with the fail-safe principle (on switching off). The safety control system activates the safety
functions via a 1/0 transition.
•Deactivate the safety functions before applying any changes to them.
All safety functions can be active at the same time. However, Safe Torque Off has priority over all other safety functions. Functions
already started (for example Safe Stop 1 or safely limited speed) are canceled and the drive coasts.
•Safe Torque Off has the highest priority. If the Safe Torque Off function is triggered, a Safe Torque Off is managed no matter what
other functions are active.
•Safe Stop 1 has medium priority to the other safe functions.
•Safely Limited Speed has the lowest priority.
If 2 Safe Stop 1 functions are active at the same time, the function with the steepest ramp has higher priority than the function with the
less steep ramp.
If 2 safely limited speed functions are active at the same time, the function with the lowest speed limit has higher priority than the
function with higher speed limit.
If 2 equal safety functions have to be configured, they must be parameterized as SS1-a and SS1-b, or as SLS-a and SLS.b.
Illustration 4: Safe Stop 1 Safety Functions Active
See illustration 4 for an example of first activating a Safe Stop 1 function with a given ramp and afterwards activating a 2nd Safe Stop 1
function with a steeper ramp. The lower graph shows the actual ramp function.
3.2.5 Functional Proof Tests
The functional safety standards require that functional proof tests are performed on the equipment used in the system. Proof tests are
performed at user-defined intervals and depend on PFD and PFH values.
Safety-related systems can be classified as operating in either a low-demand mode or in a high-demand/continuous mode.
Low-demand mode
The frequency of demands for operation made on a safety-related system is maximum once per year.
High-demand/continuous mode
The SIL value for a low-demand safety-related system is directly related to order-of-magnitude ranges on its average probability of
failure on demand (PFD). The SIL value for a high-demand/continuous mode safety-related system is directly related to the probability
of a dangerous failure per hour (PFH).
3.2.7 Intended Use of the Safety Option
WA RN IN G
RISK OF PERSONAL INJURY AND EQUIPMENT DAMAGE
Using the safety option for other purposes than what is intended, may cause personal injury and equipment damage. The
following is considered improper use:
Any component, technical, or electrical modification to the drive.
Use of the drive outside the allowed electrical and environmental conditions specified in the technical specifications and in the
VLT® AutomationDrive FC 301/FC302 Operating Guide.
Only use the safety option for its intended purpose.
-
The safety option is designed for use in safety-related applications. It meets the requirements for safety functions in accordance with
IEC 61800-5-2 regarding safe motion monitoring.
3.2.8 MCT 10 Set-up Software with Safe Plug-in
Use the MCT 10 Set-up Software to configure the safety functions supported in the safety option.
•Configuration of the safety functions is required for safe motion sequences. If an error or fault occurs, these functions shut down
the power element of the drive in a safe and controlled way.
•Setting of limit values, braking ramps for the safety functions, monitoring of motion sequences.
The software:
•Runs in full with a license key. All functions are available from MCT 10 Set-up Software version 3.18.
•Supports the configuration of applications with up to maximum 256 safety options per project.
•Has a simple language setting for the user interface.
A PDF file and a commissioning report can be generated for documentation of the project and all its settings.
International standard EN/ISO 13850 specifies the functional requirements and design principles of emergency stop devices.
It applies to all machines, whatever type of energy is used to control this function.
The standard allows 2 types of stop:
•Category 0 stop: Stopping by immediately cutting-off power or mechanical disconnection between the dangerous components.
•Category 1 stop: Controlled stopping with power maintained to the actuator to achieve stopping (braking for example), then cutoff of power when 0 speed is reached.
During a category 0 stop, the motor coasts down in an uncontrolled way. If access to the machine coasting down involves a hazard
(results of the hazard and risk analysis), take protective measures to avoid the hazard.
Refer to EN IEC 61800-5-2:2007 (4.2.2.2) for a definition of Safe Torque Off (STO).
A Category 1 stop triggers a controlled stop. The safety option monitors the controlled stop. If a power outage or an error occurs, a
controlled stop is impossible. Trigger the safety function Safe Torque Off after the stop to shut off the motor torque.
Refer to EN IEC 61800-5-2:2007 (4.2.2.3) for a definition of Safe Stop 1 (SS1).
An evaluation of the machine-related risks determines which of the 2 stopping methods to use.
NO TI CE
When designing the machine application, consider timing and distance for a coast to stop (Stop Category 0 or Safe Torque Off).
For more information regarding stop categories, refer to EN IEC 60204-1.
3.5.1 Operation and Requirements
The safety option is redundant and self-checking. It requires digital input signals from an input sensor (for example PNP proximity
switch) or higher resolution TTL or HTL encoders to monitor for either safe stop or speed conditions.
3.5.2 Safety Functions
Safety functions maintain a safe condition or prevent hazardous conditions from arising. The safety functions for drives are defined in
EN IEC 61800-5-2.
The safety option implements the following safety functions:
•Safe Torque Off (STO)
-No power is being fed to the motor which can generate a rotation. Stop category 0 to EN IEC 60204-1.
•Safe Stop 1 (SS1)
-Motor decelerates. Monitoring of deceleration ramp and Safe Torque Off following 0 speed, or Safe Torque Off at the end of a
deceleration time. Stop category 1 to EN IEC 60204-1.
•Safely limited speed (SLS)
-Prevents exceeding a defined speed value.
The safety option implements the following safety functions
The safety function Safe Torque Off disconnects power to the motor. It is implemented via the shutdown path of the drive and the safe
outputs of the safety option.
Features of the safety function
•The motor becomes torque-free and no longer generates any hazardous movements.
•To prevent the drive from running down in an uncontrolled manner. In normal operation, activate the safety function Safe Torque
Off via the safety function Safe Stop 1.
•Safe Torque Off is only activated directly when:
-There is an internal error on the safety option.
-The Safe Stop 1 delay time is set to 0.
-One of the inputs, DI1 or DI2, has been selected as Safe Torque Off function.
•The safety function Safe Torque Off corresponds to a category 0 stop (uncontrolled stop) in accordance with EN IEC 60204-1.
Prerequisites for normal operation
•Input DI1 or DI2: "1" Signal (+24 V DC).
•S37 output: "1" Signal (+24 V DC).
Safety function is activated
•By an error after limit values have been exceeded for Safe Stop 1 and Safely Limited Speed.
•By an internal error on the safety option or drive, if the drive can no longer be controlled.
•By executing the safety function Safe Stop 1 (1/0 transition). In this case, the drive is monitored before it is switched to torque-free.
•By download of parameterization via MCT 10 Safe Plug-in if the current drive is running.
•By executing the safety function Safe Torque Off (1/0 transition). This function ensures that no torque-generating energy can
continue to affect a motor and prevents unintentional start-ups.
NO TI CE
RISK OF HAZARD
External forces acting on the motor (vertical axis) and unwanted movements, for example caused by gravity, can cause hazards
leading to death or serious injury.
Add measures for fall protection before operating the motor.
-
The STO may be used where power removal is required to prevent an unintended start. The function disables the control voltage of the
drive output stage. Thus, it prevents the drive from generating the voltage required to rotate the motor, see illustration 7. The function
allows performing maintenance work on non-electrical parts of the machinery without switching off the power supply to the drive.
The safety function Safe Stop 1 monitors the deceleration to 0 speed in a controlled manner and activates Safe Torque Off after
detection of stop. The Safe Stop 1 can either be configured as SS1 Delay or SS1 Ramp.
Features of the safety function
•The safety function Safe Stop 1 corresponds to a category 1 stop (controlled braking) in accordance with EN IEC 60204-1.
•Monitoring the speed deceleration after which the energy supply to the motor is safely interrupted.
•The motor becomes torque-free and removes hazardous movements.
3.5.4.1 SS1 Delay
Select the SS1 Delay to activate the Safe Stop 1 function while a parameterized safety delay timer expires. STO is activated immediately
when the configured stop delay has expired, regardless of speed, see 6.3 Parameter List for parameter settings.
By using SS1 Delay, the drive attempts to follow the selected ramp. After a specified delay time, STO is activated and the motor is made
torque free.
NO TI CE
Using SS1 Delay may result in the motor still spinning when the Safe Torque Off is activated. The risk analysis for the machine
must indicate that this behavior can be tolerated. An interlock may be required.
Default value in parameter 42-40 Type is [0] Delay. If this value is selected, the Safe Stop 1 function activates a braking ramp defined
from a selected time delay in parameter 42-42 Delay Time. This means that the braking ramp is linear. Select the value of parameter42-43 Delta T (the % of the delay time), which is a reasonable tolerance after the SS1 Delay Time has expired.
NO TI CE
The SS1 Delay function does not monitor the stopping of the drive. The safety relevant time, Delta T, allows the drive to come
to a stop before Safe Torque Off is activated. Thus ensuring that the system is also stopped before Safe Torque Off is activated.
If a fault occurs, the drive does not come to a stop. It coasts after the time delay no matter of the speed of the drive.
A Actual frequency
2 Activation of STO
1 Activation of the SS1 Delay Timer
3 Parameter 42-42 Delay Time
4 Parameter 42-43 Delta T
Illustration 8: SS1 Delay
When Safe Stop 1 function is active, the drive brings the motor to 0 speed. The Safe Torque Off function is triggered after a specified
safety-relevant time. This safety function corresponds to a controlled stop of the drive according to EN IEC 60204-1, stop category 1.
3.5.4.1.1 Selecting the SS1 Settings
Procedure
1. Enter parameter 42-41 Ramp Profile.
Select:
[0] Linear, if the ramp must follow a linear curve.
[2] S-ramp Const Time, if the ramp should follow an S-ramp.
An S-ramp gives non-linear deceleration, compensating for jerks in the application.
Procedure
1. Define a speed profile by a delay (a worst-case delay from actual frequency to 0 speed) and a delay tolerance.
The safety relevant time, Delta T, allows the drive to come to a stop before STO is activated. Thus ensuring that the system is also
stopped before STO is activated. If a fault occurs, the drive does not come to a stop. It coasts after the time delay regardless of the
drive speed.
2. Define an S-ramp configuration, which achieves 0 speed within the delay.
3. Configure the S-Ramp ratio at deceleration start in parameter 42-48 S-ramp Ratio at Decel. Start and set parameter 42-49 S-ramp Ratio
at Decel. End for S-Ramp ratio at deceleration end.
Example:
Table 3: Parameters for SS1 Delay with S-ramp Stop Profile
ParameterUnitRangeDefault
Parameter 42-42 Delay Times0.1–3600.0 s1.0 s
Parameter 42-43 Delta T%0–50%5%
Parameter 42-48 S-ramp Ratio at Decel. Start%1–9950
Illustration 9: SS1 Delay with S-ramp Stop Profile
Functions and Systems Overview
3.5.4.3 SS1 Ramp
NO TI CE
The SS1 Ramp function can only be used when an encoder is connected to the safety option.
This Safe Stop type allows access to the hazard area immediately after motion is detected as stopped rather than waiting until a
specific time has elapsed.
The safety option monitors the following functions
•Braking ramp:
-In the MCT 10 Set-up Software Safe Plug-in, the braking ramp is specified and monitoring is activated. The braking period
depends on the speed of the motor when braking is started. The braking ramp can be monitored via a maximum speed error
specified in the MCT 10 Set-up Software tolerable in parameter 42-45 Delta V.
•Braking ramp in normal operation:
-The drive starts with the configured braking ramp when safety function Safe Stop 1 has been activated. Once the speed is at 0
speed limit, STO is activated.
•Safety function STO is activated when the configured limit value for the position error is exceeded.
A standstill threshold 0 speed (parameter 42-46 Zero Speed) for activating the safety function STO can be specified in MCT 10 Set-up
Software.
Safety function STO is activated when 0 speed is achieved.
3.5.4.4 SS1 Ramp Slope
For the stopping process, the safety option initiates a stop signal to the drive and monitors the controlled braking by monitoring the
braking ramp. The admissible deceleration ramp is specified in parameter 42-44 Deceleration Rate. If the safety option requests a Safe
Stop 1, the drive must decelerate at least with the steepness of this deceleration ramp, even under heavy load. If the drive does not
fulfill the admissible deceleration ramp during a Safe Stop 1 requested by the safety option, an STO is triggered immediately. The
motor then performs an uncontrolled stop. This action prevents the drive from continuing to run or even accelerating if an error
occurs.
When the Safe Stop 1 function is active, the drive brings the motor to 0 speed. The deceleration is monitored. If the monitored
deceleration is slower than expected or at 0 speed, STO is triggered.
This safety function corresponds to a controlled stop of the drive according to EN IEC 60204-1, stop category.
3.5.4.5 SS1 Ramp Time
Define a speed monitoring profile by a deceleration time and a tolerable speed (Delta V).
The Safely Limited Speed function can only be used when an encoder is connected to the safety option.
This function is used to limit a machine speed. The main goal is to monitor the motor speed and to adjust the speed to a setpoint.
There are 2 types of Safely Limited Speed:
•SLS without ramp: Monitors the motor speed and, depending on the setting of parameter 42-52 Fail Safe Reaction, trips in Safe
Torque Off or Safe Stop 1 if an overspeed occurs.
•SLS with ramp: Limits the motor speed to a setpoint and, depending on the setting of parameter 42-52 Fail Safe Reaction, trips in
STO or Safe Stop 1, if an overspeed occurs.
The Safe Limited Speed is given as speed limit in parameter 42-51 Speed Limit. The value for the cut-off speed partly depends on the
motor that is being used. A suggested value from the MCT 10 Set-up Software calculates a value for which Danfoss guarantees
functionality. This value is called delta speed limit and is added to the selected speed limit and suggested as value in parameter 42-50Cut Off Speed.
The safety function Safely Limited Speed monitors whether a specified velocity value is exceeded since it was activated via DI1 or DI2.
The function is active until the selected input has been put to high again.
If 2 safe-speed limits must be monitored, set 1 of the 2 Safe Digital Inputs DI1 or DI2 in parameter 42-20 Safe Function to SLSa or SLS-b.
Then select the input type in parameter 42-21 Type.
The cut-off speed represents the maximum allowed frequency of the actual motor frequency. If the motor frequency accelerates above
that value, the safety option enters external fault selected (STO or SS1 Ramp), and the error is given. The frequency value at which a
shutdown is realized should be parameterized in parameter 42-50 Cut Off Speed.
Table 6: Parameters for SLS without Ramp
ParameterUnitRangeDefault
Parameter 42-50 Cut Off SpeedRPM120–10000 RPM270 RPM
Parameter 42-51 Speed LimitRPM1–9999150 RPM
Parameter 42-52 Fail Safe Reactionn/aSTO/SS1STO
1 SLS is activated
3 Parameter 42-50 Cut Off Speed
5 Activation of failure function set in parameter 42-52 Fail Safe
A Actual frequency
B SLS limit
2 Parameter 42-51 Speed Limit
4 Delta speed limit
6 Fixed value of 120 RPM in parameter 42-19 Zero Speed Limit
If speed exceeds the limit, parameter 42-52 Fail Safe Reaction is activated. The safety function can either be STO or SS1 Ramp Time. SS1
can only be triggered as error response if a Safe Stop 1 function has been set as Safe Stop 1 with ramp time function, set in parameter42-40 Type.
Safe jog withSLS
A Actual frequency
1 SLS is activated
3 Parameter 42-50 Cut Off Speed
5 Activation of failure function set in parameter 42-52 Fail Safe
B SLS limit
2 Parameter 42-51 Speed Limit
4 Delta speed limit
6 Fixed value of 120 RPM in parameter 42-19 Zero Speed Limit
Reaction
Illustration 13: Safe Jog
Access under specific conditions of reduced risk
Under specific conditions of reduced risk, safe jog allows access to areas for fault-finding, commissioning, and more. On machines
where safe jog (jogging or inching) is required, this is also possible from 0 speed setpoint. By activating SLS, the motor can be moved at
safe jog resulting in several cycles and with safely monitored movements. The motor can be started and stopped continuously also
from 0 speed.
3.5.5.2 SLS with Ramp
If this safety function is needed, configure the safety option for Safely Limited Speed (SLS). When the inputs DI1 or DI2 are selected as
SLS, input is OFF, feedback velocity is monitored and compared against a configurable safe speed limit.
Select parameter 42-53 Start Ramp to configure an SLS Monitoring Ramp. The ramping begins when SLS monitoring is requested by the
selected input for SLS transition from ON to OFF. The safety option starts monitoring for safe limited speed when the ramp-down times
out. If the system speed exceeds or is equal to the configured safe speed limit during Safely Limited Speed monitoring, a Safely Limited
Speed fault occurs. The safety option then initiates the configured Safe Stop type selected in parameter -52 Fail Safe Reaction.
The ramping begins at the absolute value of the actual speed. If the actual speed is already below the Safely Limited Speed limit, the
limit comes into effect immediately without ramping. When the Safely Limited Speed function is deactivated, the speed limits are
ramped up back to the values defined in parameter group 3-1* References. The actual speed then returns to the reference value if it was
limited by this function.
1. If a safe speed limit must be monitored, set 1 of the 2 safe digital inputs, DI1 or DI2, to [1] SLS-a or [2] SLS-b in parameter 42-20 Safe
Function.
2. Select input type in parameter 42-21 Type.
3. Select parameter 42-53 Start Ramp to run Safely Limited Speed with monitored braking ramp. The default value is [0] No for
applications without SLS Ramp control.
4. Set the time allowed to reach Safe Limited Speed in parameter 42-54 Ramp Down Time.
When the safety option actively monitors Safely Limited Speed, and the motor speed is at or below the configured safe speed
limit, the function monitors the speed until the function is deactivated.
5. Set the value in parameter 42-50 Cut Off Speed.
Example:
A Actual frequency
1 SLS is activated with SS1 Ramp
3 Ramp-down time
5 0 speed limit, fixed value of 120 RPM
7 Activation of failure function set in parameter 42-52 Fail Safe
Reaction
Illustration 14: SLS with Ramp
Table 7: Parameters for SLS with Ramp
ParameterUnitRangeDefault
B SLS limit
2 SLS speed limit reached
4 Delta speed limit
6 Cut-off speed
Parameter 42-50 Cut Off SpeedRPM120–10000 RPM270 RPM
If the speed exceeds the limit, parameter 42-52 Fail Safe Reaction is activated. The safety function can either be STO or SS1 Ramp Time.
SS1 can only be triggered as error response if 1 digital input is selected as SS1 with ramp time function, set in parameter 42-40 Type.
Functions and Systems Overview
3.6 Inputs and Output
An internal diagnostic function in the safety option cyclically tests the correct function of the output. A detected fault sets the safety
option into an alarm status. At the same time, the option output S37 goes low.
Shorts between the 2 lines of a dual channel input are not detected. Therefore the cables of the channels must be routed separately to
exclude short circuits.
NO TI CE
Shield all proximity switch sensor/encoder cables. Connect the shielding to the chassis at both ends.
3.6.1 Inputs
The Dual-pole digital inputs are used to activate the safety functions. DI 1 can be:
•STO: Safe Torque Off.
•SS1: Safe Stop 1.
•SLS: Safely limited speed.
Signals at DI1:
•1/0 transition at the input: Activates the safety function.
•0 signal (0 V) at the input: Activates the safety function.
•1 signal (+24 V) at the input: Does not activate the safety function.
DI2 can be:
•STO: Safe Torque Off.
•SS1: Safe Stop 1.
•SLS: Safely Limited Speed.
•Reset: Extra safe input to reset the safety option after an error, or after deactivating a safety function on input DI1.
Signals at DI2:
•1/0 transition at the input: Activates the safety function.
•0 signal (0 V) at the input: Activates the safety function.
•1 signal (+24 V) at the input: Does not activate the safety function.
•0/1 transition at the DI2 input if configured to reset: Resets the safety option.
The reset input is for resetting the safety circuit selected on DI1. Configure the reset input for automatic or manual reset types. If
manual reset is configured, wire the DI2A reset input terminal to a 24 V DC via an NO switch.
3.6.3 Output
Safe, single-pole output
S37 is the output that goes to the STO input of the drive.
•STO Acknowledge
-Internal fault on drive or safety option.
-Limit values exceeded.
-Activated via SS1.
-PUST (Power-up Self-Test).
-External failure.
3.6.4 Allowed Sensor Types on Digital Inputs
The following sensor types are applicable:
•Sensors with 2 NC switches.
•Antivalent switches (1 NO switch and 1 NC switch).
•Sensor output of type 2xPNP.
Sensors with 2 NO switches are not applicable.
The safe digital inputs are configured for both directly connecting safety sensors, for example emergency stop control devices or light
curtains, and for connecting preprocessing safety relays, for example, safe controls. See examples of connecting the safe digital input,
in accordance with EN ISO 13849-1 and EN IEC 62061 in 4.3.1 Connecting Safe Digital Inputs.
3.6.5 Reset
NO TI CE
Both safety inputs must be off after an input fault or PUST has occurred, before a reset is accepted to branch into safe
monitoring again. This reset must only be possible at the location where the safety command has been initiated.
To operate the safety option, the application must send a reset signal either via the LCP, via a dedicated digital input or via a control
word. When a safety function has been activated, or an external failure has caused a failure state, a reset is necessary to enable the
safety option again. When the connected sensor on DI1 or DI2, or both, is enabled via a reset, the safety option can be switched on
again. This deactivates active safety functions or errors.
NO TI CE
First, trip alarms shown on the drive must be acknowledged after which a pending safety function can be acknowledged. A
single reset for the alarm mode and a 2nd reset for acknowledgment of the active safety function. Alarms caused by the drive
must be reset before an alarm can be reset on the safety option.
If a sensor with 2NC or 1NC/NO is selected, the safety option checks the signals of the safe digital input for consistency. Consistent
signals at both inputs always assume the same signal state (high or low). If 1NC/1NO is selected, it checks the right state of each input.
With electromechanical sensors (for example, emergency stop buttons or door switches), the 2 sensor switches never switch at the
same time (discrepancy). A long-term discrepancy points towards a fault in the wiring of a safe input, for example, a wire break. An
adjustable filter in the safety option prevents faults caused by temporary or short-term discrepancy. Within the filter tolerance time
(parameter 42-22 Discrepancy Time), the safety option suppresses the discrepancy monitoring of the safe inputs.
Illustration 15: Discrepancy Time
Parameterize the discrepancy time of the switching elements connected to the digital inputs. The default value is 10 ms.
NO TI CE
The discrepancy time does not extend the safety option response time. The safety option activates its safety function when 1 of
the 2 DI signals changes from high to low.
3.6.7 Stable Signal Time from Safe Outputs
The safety option normally responds immediately to signal changes at its safe input DI1 or DI2. This response is not required in the
following cases:
•When interconnecting the safe input of the option with an electromechanical sensor, contact bounce may result in signal changes
occurring, to which the option could respond.
•Several control modules test their safe outputs using test pulse pattern (on/off tests), to identify faults due to either short or cross
circuiting. When interconnecting the safe input of the option with a safe output of a control module, the option could respond to
these test signals.
A signal change during a test pulse pattern usually lasts 1 ms.
Under stable signal time, short pulses, which could lead to safety functions being incorrectly activated, can be filtered.
NO TI CE
The stable signal time extends the safety option response time. The safety option only activates the safety function after the
response time has expired.
If the signal to the input on safety option is not stable, the option responds with a fault.
Definition of a Stable Signal
Following a change to the DI input signals, the option triggers an internal monitoring time. Use parameter 42-23 Stable Signal Time to
select an appropriate stable signal time. A constant signal level is a high or a low state, at least for the time specified in parameter 42-23Stable Signal Time.
Illustration 16: Filter for Suppressing Temporary Signal Changes
3.6.8 Zero Speed Timer Error Detection
Zero Speed Timer monitors if the drive operates below 120 RPM during Safely Limited Speed.
Parameter 42-18 Zero Speed Timer contains the remaining time until the monitoring responds. The safety option signals Alarm Ext Fail
Prec Thresh Timer Elapsed after the monitoring time expires. Define the monitoring time while commissioning the system depending on
the particular application.
3.6.9 Yearly Test
According to EN ISO 13849-1, EN IEC 62061, and EN IEC 61508, the safety option must regularly test its safety-relevant circuits to ensure
correct functioning. This test must be performed at least once every year. After the power supply has been connected, the safety
option checks its circuits to switch off the torque each time the STO function is selected. The safety option monitors the regular test
interval of its safety-relevant circuits using a time module.
After 1 year in operation, the drive shows a message that a yearly test must be performed. Power cycle the drive by disconnecting and
then reconnecting the supply voltage. Activate the used inputs on the safety option and check that they function correctly.
Functions and Systems Overview
3.6.10 Safety Parameter Settings
Factory setting for both digital inputs is Safe Torque Off, meaning that the Safe Output S37 is in low state.
At the first power-up, the option shows Blank Initial State.
Properties of safety parameters
•They are kept separate for each monitoring channel.
•During start-up, a checksum (cyclic redundancy check, CRC) over the safety parameters is generated and checked. The parameters
are stored on the non-volatile memory on the option.
A reset of the safety parameters to the factory setting can be executed via the MCT 10 Set-up Software.
NO TI CE
If the safety option is reinstalled in another drive, all safety parameters can be selected either from the safety option or from the
drive in which the option is now installed. Always perform a commissioning test to ensure the correct functionality.
3.6.11 Encoder Interface
NO TI CE
Some of the diagnostics performed on the encoder signals require motion to detect faults. Make sure that motion occurs at
least once every 12 months.
To detect the standstill or the motor speed, the speed (frequency) is measured using a TTL encoder (MCB 150), an HTL encoder (MCB
151), or a PNP proximity switch (MCB 151). The HTL encoder uses 2 signal tracks, A and B. TTL encoders use 4 signal tracks A, B, and
their inverted tracks nA, nB.
Use twisted-pair, individually shielded cable to connect encoders to the safety option.
3.7 Limitations
3.7.1 Exceeded Limit Value and Internal Errors
•Exceeding set limit values activate the stop braking ramp.
•Any internal error on the safety option or drive activates the safety function STO. The drive coasts the motor.
Internal errors always result in a fault, requiring a power cycle of the drive to reset the failure. Alternatively, use parameter 42-90 RestartSafe Option to restart the safety option after internal failure without power cycling the drive.
3.7.2 Compatibility between Safety and Drive Function
The safety option is compatible with all VLT AutomationDrive FC 302 drives.
MCB 150/151 can be combined with the following A options:
•VLT® PROFIBUS DP-V1 MCA101
•VLT® DeviceNet MCA 104
•VLT® CanOpenMCA 105
•VLT® PROFINET MCA 120
•VLT® EtherNet/IP MCA 121
•VLT® Modbus TCP MCA 122
•VLT® POWERLINK MCA 123
•VLT® EtherCAT MCA 124
The MCB 151 can be combined with the following C options:
•VLT® Sensorless Safety MCB 159
The safety option is compatible with asynchronous and synchronous (PM) motors. Both motor types can be used in U/f and VVC+ in
closed and open loop as well as in FLUX open-loop control. Compliance to further motor types and control modes is to come. Contact
the local supplier for latest information.
The following software versions are required as a minimum for using MCB 150/151:
•LCP software version 7.0.
•VLT AutomationDrive FC 302 firmware version 6.64.
Functions and Systems Overview
All drives, options, and control mode combinations not listed above are not allowed.
The AC drive contains high voltage when connected to AC mains supply, DC supply, or load sharing. Failure to follow the
instructions in this warning may result in death or serious injury.
Before installation, disconnect the power supply voltage to the drive.
-
Switch off all dangerous voltages connected from external control circuits to the inputs and outputs of the drive.
-
Never install an option card into the drive during operation.
-
In addition to conventional installation tools, have the VLT AutomationDrive FC 302 Operating Guide and the VLT® Motion
-
Control Tools MCT 10 Operating Guide available as they contain important information that is not included in this manual.
Installation
WA RN IN G
ELECTRICAL HAZARD
Activation of STO does not provide electrical safety. The safety device connected to the dual-pole input of the safety option
must fulfill the required safety level for the application for interrupting the voltage/current to the safety option. This is also valid
for the connections between the safety option's safe output S37 and terminal 37 on the drive.
To connect the safety device correctly to the safety option, read and follow the instructions in this manual.
-
NO TI CE
The safety option is exclusively intended for use in option slot B.
4.1.2 Requirements for Safe Use
CA UT IO N
EMC-COMPLIANT INSTALLATION
An installation that is not EMC-compliant can cause personal injury and equipment damage.
Ensure that the installation and the wiring are EMC-compliant.
-
Refer to the guidelines in this manual. Also ensure compliance with:
•VLT AutomationDrive FC 302/FC 302 Operating Guide.
•Tool-Tip help for the configuration tool MCT 10 Safe Plug-in.
Only use the safety option with the following drives:
•VLT AutomationDrive FC 302 from software version 6.64.
If short circuits and cross circuits can be expected with safety-related signals, and if they are not detected by upstream devices,
protected cable installation is required as per EN ISO 13849-2.
4.1.4 Installing the Option
Context:
NO TI CE
Place the VLT AutomationDrive FC 302 with safety option (including connection between S37 (Y30/12 or Y31/12) on VLT®
Safety Option MCB 150/151 and X44/12 on the control card) in an IP54 enclosure as per IEC 60529.
9. Fit the LCP or blind cover in the extended LCP frame.
Connect power to the drive.
Set up the input/output functions in the corresponding parameters as mentioned in the chapter Safe Plug-in the VLT® Motion
Control Tool MCT 10 Operating Guide.
The commissioning test report is automatically generated via the Safe Plug-in in MCT 10 after downloading the parameters to the
safety option.
WA RN IN G
PROPER GROUNDING
Qualified personnel, in this case the operator or electrical installer, is responsible for proper grounding and compliance
with all applicable national and local safety regulations. Failure to have qualified personnel doing the wiring could result in
death or serious injury.
Only allow qualified personnel to do the wiring of the equipment.
-
4.1.5 General Wiring Guidelines
Inputs
Use appropriate wiring to exclude short circuits between the inputs or to a supply line.
Use separate multicore cable for supply voltages to avoid short circuits between the cable from the output (S37) to the 24 V DC supply
line.
Installation
NO TI CE
As a result of short circuits, it is no longer possible to switch off the drive terminal 37.
NO TI CE
Control cables must be shielded/armored.
See the chapter Grounding of Shielded Control Cables in the VLT AutomationDrive FC 302 Design Guide for detailed specifications.
Only shielded cables are suitable for connecting encoders.
NO TI CE
All signals to the safety option must be PELV supplied and comply with EN IEC 60204.
•Route sensitive control cables - such as encoder and active safety component cables - without any interruption and with optimum
shield support at both ends.
•Connect shields at both ends to the grounded enclosures through a good electrical connection and through a large surface area.
•Connect cable shields a close as possible to the cabinet cable entry.
•If possible, intermediate terminals should not interrupt cable shields.
•Retain cable shields for both power cables and for signal and data cables using the appropriate EMC clamps. The shield clamps
must connect the shield to the EMC shield bar of the shield support element for control cables through a low inductive connection
through a large surface area.
The allowed cable length depends on the selected encoder. The longest cable can be achieved when using bipolar TTL encoders.
Unipolar HTL encoders only allow a shorter length. In this case, the encoder power supply voltage plays a decisive role. The maximum
cable length for HTL encoders used as unipolar encoder (in this case only 1 signal is evaluated) is 100 m (328 ft).
The maximum cable length for TTL encoders used as bipolar encoder (in this case both signals A/nA or B/nB) is 150 m (492 ft).
The minimum cross-section of the power supply conductor is 0.75 mm2 (18 AWG).
Shield all proximity switch sensor/encoder cables. Connect the shield to the chassis at both ends. Always connect the chassis
on the rotary encoder to the chassis of the drive.
NO TI CE
EQUIPMENT DAMAGE
Plugging in or pulling off sensor connections during operation can damage the electrical components of the encoder.
Always de-energize connected encoders and the safety option before plugging in or pulling off encoder connections.
-
For data signals or track A and track B, use lines twisted in pairs for signal transmission according to RS485.
-
Select the wire cross-section in each individual case in compliance with the current consumption of the encoder and the
-
cable length required for the installation.
Diagnostics are performed on the encoder input signals. If the encoder diagnostic tests fail, error 99 (Safe State Fault) occurs.
4.2.2 Encoder Wiring Examples
See examples of how to connect encoder power and encoder signals in illustration 25 and illustration 26.
Illustration 25: Y31/Connecting Power and Encoder Signals to HTL Encoder (VLT® Safety Option MCB 151)
Illustration 26: Y30/Connecting Power and Differential Encoder Signals to TTL Encoder (VLT® Safety Option MCB 150)
Installation
The TTL encoder in
illustration 26 is shown with 24 V supply and TTL output. If an encoder for 5 V supply must be connected, use a 5 V
external supply.
4.2.3 Proximity Switch
An inductive proximity switch, detecting already present mechanical parts, for example a gear wheel, is a frequently used alternative to
standard encoders. The required minimum number of pulses per revolution (PPR) is 2 on the motor shaft while considering the gear
ratio.
The operating distance S set to half the nominal operating distance Sn, corresponds approximately to the optimum conditions
regarding resolution and switching frequency.
NO TI CE
When using PNP proximity switch as encoder feedback, set parameter 42-14 Feedback Type to [1] Without direction info.
4.2.4 VLT® Sensorless Safety MCB 159
The VLT® Sensorless Safety MCB 159 option provides safe speed monitoring functions (SLS, SMS) to a VLT® Safety Option MCB 151
without the need of an external speed signal. It can easily replace a speed sensor in applications where typically proximity switches are
used as a speed feedback. Only 1 wire connects the MCB 159 option to the MCB 151.
This section contains examples of connecting the fail-safe digital input according to EN ISO 13849-1 and EN IEC 62061. The examples
apply in cases where all components are installed in a control cabinet.
A 2-channel emergency stop switchB Drive
Illustration 31: Connecting a Sensor, for Example 2-channel Emergency Stop Mushroom Push Button or Limit Switch
A Drive
Illustration 32: Connecting an Electronic Sensor, for Example Safety Light Curtain
A Actuator
B Switch
C Drive
Illustration 33: Connecting 1 NO/1 NC Sensor, for Example Magnetic Switch
Illustration 34: Connecting a Digital Output Module, for Example Safety PLC
Illustration 35: Connecting a Sensor, for Example 1-channel Emergency Stop Mushroom Pushbutton or Limit Switch
B Safety output
D Drive
NO TI CE
All equipment used must be suitable for the selected category/PL or SIL.
NO TI CE
Use of a 1-channel E-stop switch provides no input redundancy, and no ability for the safety option to monitor for input short
circuits. One-channel E-stop switches used with a safety option are suitable only for Category 2 applications, per EN ISO
13849-1 PL c or SIL1.
When a 1-channel E-stop is used, guard against failure modes that can result in an unsafe condition. An example of an unsafe condition
could be the failure of the contact to a short circuit condition. A switch with positive opening operation should be used to reduce the
possibility of a failure of the switch to open. A short-circuit failure results in loss of switching function. This failure can occur from a
short across the switch contacts, a short across the wires connected to the switch between the switch and the safety option, or a short
to a secondary source of power. To reduce these risks, physically separate the wires from each other and from other sources of power
(for example, in separate wire ways or conduit). According to the definition of European standard EN ISO 13849-1, a 1-channel E-stop
could be used in applications where PL c or less (b or a) has been determined via a risk-assessment procedure.
•Secure the site in accordance with regulations (barrier, warnings, signs, and more). Only qualified personnel is allowed to
commission/recommission the system.
•Refer to the guidelines, information, and specifications stated in the operating guide of the relevant programmable control system.
•Make sure that no personal injury and/or material damage can occur, even if the plant/machine moves unintentionally.
CA UT IO N
ELECTROSTATIC DISCHARGE
Electrostatic discharge can damage components.
Ensure discharge before touching the safety option, for example by touching a grounded, conductive surface or by wearing
-
a grounded armband.
WA RN IN G
RISK OF ELECTROCUTION
Wiring the electrical connections on the drive while voltage is applied can lead to death or serious injury.
Switch off power.
-
Make sure that the control cabinet is provided with an access lock or warning signs.
-
DO NOT switch on voltage until the system is commissioned.
-
Refer to the VLT® AutomationDrive FC 301/FC 302 Operating Guide for further information on the drive. Refer to the VLT® Motion
Control Tool MCT 10 Operating Guide for further information on the Safe Plug-in.
5.1.2 Commissioning Requirements
Context:
Observe the following:
•When setting up the option for the 1st time, ensure to have a commissioning report at hand, see further information in the VLT®
Motion Control Tool MCT 10 Operating Guide.
NO TI CE
Only LCP SW version 7.0 or newer is supported.
Prerequisites:
The following components are required to perform the necessary steps for commissioning the safety option:
•Installation of MCT 10 Set-up Software version 3.18 or later.
•Successful connection to VLT AutomationDrive FC 302 with integrated safety option.
•USB or fieldbus connection or RS485 Interface adapter for connecting the control card of the drive with the PC.
Commissioning
NO TI CE
If RS485 is used, set the protocol for serial communication to [0] FC-MC in parameter 8-30 Protocol (only accessible through the
LCP).
Procedure
1. Configure the safety option in the MCT 10 with Safe Plug-in. Ensure only to configure safety functions that are wired up to the
safety option inputs.
2. Ensure that the device number (serial number and ordering number) of the safety option on the drive matches the device number
of the safety option in the MCT 10 Safe Plug-in.
Ensure that the drive is ready for commissioning (see VLT AutomationDrive FC 302 Operating Guide).
5.2 Initial Commissioning
5.2.1 Power-up/Self-test
Once the power supply has been applied to the drive, the safety option performs a self-test. During the self-test phase, all LEDs light up
(lamp test) and the message Safe Opt. initialized - SO RESET requested or SO in Self-test appears. After power-up, the LEDs light up
according to the device status.
NO TI CE
If the supply voltage of the safety option exceeds the allowed range, the safety function STO is triggered. The safety-related
output S37 on the option is switched off.
5.2.2 Initial Commissioning
1. Connect the configuration PC to the drive or motion control system.
A Make the interface in the MCT 10 Safe Plug-in (refer to the chapter Functional Safety Configuration Plug-in in the VLT® Motion
Control Tool MCT 10 Operating Guide and the Tool-Tip for help.
2. Switch on the supply voltages.
A Switch on all the supply voltages for the drive and the safety option.
The display elements on the drive and on the safety option show when they are ready for operation. The
display elements on the safety option are described in 5.3 Operation.
3. Download the configuration file.
A Select Write to drive in the MCT 10 Safe Plug-in to establish communication between the PC and the drive.
B Make sure that no other system is accessing the interface.
C Apply password, unequal to default password.
D On multi-axis systems, the safety option can be selected individually for the download. The configuration is distributed to the
safety options via the MCT 10 Set-up Software.
When the configuration file is downloaded, the LCP reads SO Custom. completed. During download, the following is checked in the
configuration:
If the selected encoder resolution is below 150 PPR for HTL/TTL encoder, set a feedback filter value in parameter 42-15 Feedback
Filter. The system then calculates an allowed value. This is also the case when using a proximity switch feedback where the
encoder resolution is below 600 PPR.
NO TI CE
Depending on the system, a movement can imply different directions for the motor encoder.
NO TI CE
Depending on the application, the motor encoder may be connected via a gearbox.
Procedure
1. Select the type of feedback device, either [1] Safe Option or [0] None in parameter 42-10 Measured Speed Source. For SS1 time delay
functionality, no feedback source is necessary.
2. Set the feedback parameters for the safety option.
In closed-loop applications, or if VLT® Sensorless Safety MCB 159 option is used, set parameter 7-00 Speed PID Feedback Source to
[11] MCB 150/151.
3. Set mounting type to Motor shaft mounted or Application mounted.
Select a gear ratio within 0.0001–32.0000 (default 1) in parameter 42-13 Gear Ratio. If the MCB 159 option is used, set the gear ratio
to 1.
4. Set the correct encoder value (1–4096 PPR) in parameter 42-11 Encoder Resolution.
If the MCB 159 option is used, set the correct encoder value to half of the amount of motor pole pairs.
5. Set parameter 42-12 Encoder Direction to [0] Clockwise (default) or [1] Counter clockwise.
If the MCB 159 option is used, select Clockwise.
6. Set parameter 42-14 Feedback Type to [0] With direction info or [1] Without direction info.
Select [1] Without direction info if a VLT® Sensorless Safety MCB 159 option or a proximity switch sensor is used for speed
detection.
5.2.5 Commissioning Test
The MCT 10 Safe Plug-in creates a commissioning report based on the commissioning test result. It generates the drive safety
signature. This function provides a final report when the safety option has been configured. This report is considered as a help tool for
safety commissioning and validates that all the safety functions are operational. The commissioning report can either be printed or
converted into a PDF file.
The test objective is to verify proper implementation (forced dormant error detection measures) and to examine the response of
specific monitoring functions to the explicit input of values outside tolerance limits.
Modifying or changing hardware and/or software components can lead to unexpected behavior of the drive. This behavior
could result in death or serious injury.
Ensure that all protective equipment is closed before system start-up and activation of the drive.
-
Keep personnel out of the danger zone.
-
Carry out a partial or complete commissioning test (mandatory).
-
Test the steady control response by briefly moving the drive in forward and reverse direction before allowing anybody to
-
reenter the danger zone.
EN IEC 61508, EN IEC 62061 and EN ISO 13849 require that the final assembler of the machine validates the operation of the safety
function with a commissioning test. The commissioning tests for the standard safety functions Safe Stop of the drive are described in
the drive manuals. The tests for the optional safety functions are described in the commissioning report generated by the MCT 10 Safe
Plug-in. The commissioning test must be performed:
•At initial start-up of the safety function.
•After any changes related to the safety function (wiring, components, settings, and more).
•After any maintenance work related to the safety function.
5.3 Operation
WA RN IN G
UNINTENDED BEHAVIOR
Numerous stored data or settings control the behavior of the drive system. Unsuitable settings or data may trigger unexpected
movements or responses to signals and disable monitoring functions. Follow the instructions below to avoid risk of death,
serious injury, or equipment damage.
Do NOT operate the drive system with unknown settings or data.
-
Verify that the stored data and settings are correct.
-
When commissioning, carefully run tests for all operating states and potential error situations.
-
Verify the functions after replacing the product and also after changing the settings or data.
-
Only start the system if there are no persons or obstructions in the hazardous area.
-
Prerequisites for normal operation are:
•Commissioning is complete.
•The safety option contains the configuration data.
•The safety functions have been tested.
•LED1, LED2, and LED4 are lit.
During operation:
•Any pulse edge change at the safety option safe input is monitored.
•The safety functions are performed in accordance with the configuration.
See 6.3 Parameter List to configure an operation of the safety option. The set-up is done via the MCT 10 Safe Plug-in.
Speed monitoring by the safety option
If an external encoder is connected to the safety option and selected in parameter 42-10 Measured Speed Source, speed monitoring is
active all the time whether a safety function is requested or not. However, if an STO is triggered (either directly, or as a consequence of
a Safe Stop 1) it interrupts the speed monitoring.
Encoder configuration
To define the type of feedback used by the safety option, select [1] Safe option in parameter 42-10 Measured Speed Source.
6.1.2 Configuration of Safety Functions
The safety functions to be carried out by the safety option are defined in the MCT 10 Safe Plug-in:
•Configurations of the safety functions.
•Setting of limit values, braking ramps for the safety functions, monitoring of motion sequences.
NO TI CE
Always perform the required commissioning test. The commissioning test report is automatically generated via the Safe Plug-in
in MCT 10 after downloading the parameters to the safety option.
Downloading the configuration to the safety option:
•On single-drive systems, via the RS486/USB interface on the drive.
•On networked systems, via RD485 or fieldbus interface on the MCT 10 Safe Plug-in. The control system passes the configuration to
the respective safety option.
•The feasibility of the configuration is checked when it is downloaded.
Further information on configuration and setting parameters for the safety functions is available in the online help for the MCT 10 Safe
Plug-in and in the VLT® Motion Control Tool MCT 10 Operating Guide.
The safety option is configured with the commissioning software MCT 10 Set-up Software via a Safe Plug-in. The Safe Plug-in in the
commissioning software is available as default from version 3.18.
The commissioning software provides the following menu items for the safety option:
The menu items are described in detail in the VLT® Motion Control Tool MCT 10 Operating Guide.
The menu item Status shows the following:
•Current signal states of inputs and outputs.
•Option operating mode
•Active safety function.
The states of the inputs and output cannot be changed via the commissioning software.
6.1.3 Password Protection
General Parameter Set-up
Use a password to protect the system configuration. A password must be entered only when changing safety option parameters
(writing to option).
Default password is 12345678.
It is advised to change the safety option default password before downloading the parameter values of a safety option with factory
settings. Only persons knowing the password can change the safety option parameter values.
NO TI CE
Any misuse of password may lead to severe safety problems.
NO TI CE
No password is required to access the commissioning parameters of the safety option. The password is required when the
parameters must be downloaded to the option via Write to Drive.
The password must be of 8 characters and is case-sensitive. Alphanumeric characters and symbols are valid for password.
The safety option checks the parameter password entered. Use the menu item Change Password to change the safety option
parameter password. Change the safety option password if there is any indication of manipulation.
6.1.3.1 Resetting the Password
Context:
NO TI CE
Resetting the password resets all option parameters to factory default.
2. Checkmark Yes, I want to reset Safe Option configuration in the drive.
3. Enter the default password (12345678).
4. Click Reset.
5. On the prompt that appears, click Yes.
6. Change the safety option password.
General Parameter Set-up
6.2 Reset and Status over Fieldbus
6.2.1 Reset of Safety Option and Pending Safe Function
There are 2 different methods of resetting the safety option and pending safe function. The configuration of parameter 42-31 ResetSource is decisive for which method to use.
If parameter 42-31 Reset Source is set to [0] Drive Reset, a reset according to the selected control word profile is required.
NO TI CE
The drive-specific alarms are also reset.
If parameter 42-31 Reset Source is set to [1] Drive Safe Reset, configure [3] Safe Option Reset in parameter 8-14 Configurable Control WordCTW.
NO TI CE
The drive-specific alarms are not reset and the control word profile is overwritten.
6.2.2 Retrieving Safety Option Status
A subset of the safety option status can be retrieved as part of the status word. Its behavior changes based on the selected control
word profile.
Configure [91] Safe Opt. Reset. req and [90] Safe Function active in parameter 8-13 Configurable Status Word STW to:
•Indicate that a reset of the safety option is required.
•Indicate that a safe function is active.
Parameter 42-80 Safe Option Status indicates the actual status (active safe function, any requests, and error number) of the safety option
and is accessible as read-only parameter from any interface or configurable as read process data for a specific fieldbus.
NO TI CE
Only active safe function is set in Safety Option Status.
20Suspension of speed monitoring0No change in state.
1Suspension of speed monitoring - see error code.
21Power Up Self-Test warning0No change in state.
1Power Up Self-Test warning is issued.
22Digital input 1 offline test warning0No change in state.
1Digital input 1 offline test warning.
23Digital input 2 offline test warning0No change in state.
1Digital input 2 offline test warning.
24–31Causes for possible internal or external errors. See error code.
General Parameter Set-up
NO TI CE
Parameter 42-81 Safe Option Status 2 indicates which digital input of the safety option is either activated, in pending state, or in
blank initial state.
Table 12: Explanation of the Status Bits for Safety Option Status 2
of the encoder connected to the MCB
150 TTL and MCB 151 HTL.
Allows for changing the detected en-
wise
[0] With direction info
coder rotation direction without
changing the wiring to the encoder.
coder speed. Remark: Only used when
gear mounted.
The feedback can be with or without
direction information. For TTL/HTL encoder, direction info is available. For
proximity switch, select [1] Without Di-rection Info.
0.01–200.00 Hz200 HzFrequency of the feedback filter. Default value is 200 Hz (off) if the encoder
resolution is higher than 150 PPR. A filter value of 200 Hz is selected, meaning that the filter is off. The use of filters depends on the given encoder resolution, gear ratio, and feedback type.
0–10000 h8760 hTime period where the option is al-
lowed to be below 120 RPM when SLS
is active before STO is activated.
42-21 Type[0] NCNC[0] NCNCNCNC, antivalent (NC/NO) or 1NC.–u_int8
42-22 Discrepancy
Time
42-23 Stable Signal
Time
42-24 Restart Behavior
[0] STO[0] STOThis can be 1 of the safety functions or
[1] SS1-a
[2] SS1-b
[3] SLS-a
[4] SLS-b
[5] disable
[1] Antivalent
[2] NC
0–5000 ms10 msAn adjustable filter time prevents
0–5000 ms10 msAn adjustable signal filter in the safety
[0] Manual[0] ManualIn case of an activated safety function,
[1] Automatic
DefaultDescriptionCon-
version
index
–u_int8
disabled. Remark: Both Safe Inputs can
NOT be disabled at the same time.
-3u_int16
faults caused by temporary discrepancy.
-3u_int16
option suppresses temporary signal
changes using test pulse pattern.
–u_int8
the safety option can either restart automatically or wait for a RESET signal
from the user.
Data
type
42-3*General42-30 Ex-
ternal Failure Reaction
42-31 Reset Source
42-33 Parameter
Set Name
[0] STO[0] STOSafety function that is executed if there
[1] SS1-a
[2] SS1-b
[0] Drive Reset[0] Drive Re-
[1] Drive Safe
Reset
[2] Safe Option
DI1_A
Visible String,
length: 8
set
SafeSet1Name of the safe parameter Set (must
is an external failure.
Source for the RESET of the safety option. Can either be executed on the option input DI2, via fieldbus or digital input on the drive or via the LCP. By selecting Drive Safe Reset, only the safety
option is reset.
be 8 characters to avoid a bad customization data error).
42-4*SS142-40 Type[0] Delay[0] DelayThe type of the SS1 Safety Function.–u_int8
ParameterValue range/
available options
[1] Ramp
(slope)
[2] Ramp (time)
42-41
Ramp Profile
42-42 Delay Time
42-43 DeltaT0–99%2%Δ T subtracts from the time in parame-
42-44 Deceleration
Rate
42-45 DeltaV1–10000 RPM120 RPMTolerance between calculated and ac-
[0] Linear[0] Safe Op-
[2] S-ramp
Const Time
0.1–3600.0 s1.0 sTime until STO is activated-1u_int16
1–30000 RPM/s1500 RPM/sDeceleration rate for the SS1 slope-
DefaultDescriptionCon-
The ramp profile for an SS1 Delay can
tion Linear
be either specified as linear or S-ramp.
ter 42-42 Delay Time to get motor to
stop before the timer expires.
based ramp type.
tual speed that the safety option allows.
Data
version
index
–u_int8
0u_int8
0u_int16
67u_int16
type
42-46 Zero
Speed
42-47
Ramp Time
42-48 Sramp Ratio
at Decel.
Start
42-49 Sramp Ratio
at Decel.
End
1–600 RPM10 RPMWhen this speed is reached, the safety
option activates the STO.
0.1–3600.0 s1.0 sTime to ramp down to 0 RPM-1u_int16
1 to (100 42-49 S-ramp
Ratio at Decel.
End)%
1 to (100 42-48)%
50%The proportion of the total ramp-down
time (parameter 42-42 Delay Time)
where the deceleration torque increases. The larger the percentage value,
the greater the jerk compensation achieved, and thus the lower the torque
jerks in the application.
50%The proportion of the total ramp-down
time (parameter 42-42 Delay Time)
where the deceleration torque decreases. The larger the percentage value,
the greater the jerk compensation achieved, and thus the lower the torque
jerks in the application.
Unauthorized modifications made to the firmware can lead to injury and equipment damage and voids the warranty.
Furthermore, Danfoss cannot be held liable for any consequences third-party changes may have on the functional safety.
Only have Danfoss change the firmware.
-
CA UT IO N
MODIFICATIONS TO THE UNIT
Unauthorized modifications made to the unit can lead to injury and equipment damage and voids the warranty. Furthermore,
Danfoss cannot be held liable for any consequences third-party changes may have on the functional safety.
Only have Danfoss make hardware modifications of the safety option.
-
WA RN IN G
YEARLY TEST
The safety option functions must be tested on a yearly basis to avoid the risk of death or injury.
Test the safety function.
-
Switch off the options used in the safety chain.
-
7.2 Repair
WA RN IN G
SHOCK HAZARD
Attaching or removing the safety option while the soft starter is connected to mains voltage may cause personal injury.
Before attaching or removing the safety option, isolate the drive from mains voltage.
-
Only Danfoss is authorized to repair the safety option. A defect option must be returned to Danfoss.
1. Save all parameters of the safety option, see VLT® Motion Control Tool MCT 10 Operating Guide.
2. Duplicate the existing device setting.
7.3.2 Removing the Safety Option
Context:
NO TI CE
The drive generates an error message after removing the safety option.
NO TI CE
Service and Repair
If the removed safety option is installed in another drive, the drive issues a warning for safety option parameter selection. Select
the safety configuration from either the drive or from the safety option.
Procedure
1. Disconnect all power (power stage supply voltage and controller supply) before plugging in or removing the option.
2. Verify that no voltage is present.
3. Remove the safety option according to the instructions in the chapter Installation in the VLT AutomationDrive FC 302 Operating
Guide.
7.3.3 Replacing the Safety Option
Context:
WA RN IN G
SHOCK HAZARD
Attaching or removing the safety option while the soft starter is connected to mains voltage may cause personal injury.
Before attaching or removing the safety option, isolate the drive from mains voltage.
-
NO TI CE
Alarm 67, Option Change informs that a change of the drive hardware configuration has occurred after a power-up. This
situation can occur after installing/removing an option, or if an option is defect. If the configuration changes, the drive freezes
the hardware configuration, trips, and refuses to start up.
Thus avoiding any unintended parameter changes.
-
When replacing the safety option, note the following:
•If the firmware version has changed, configured functions and stated parameters may no longer be supported or may have been
modified. Adapt the configuration in the MCT 10 Set-up Software.
•Download the configuration to the safety option again.
Alternatively, copy the safe parameters using a graphical LCP, see 7.3.4 Copying Safe Parameter Set-up.
Prerequisites:
Reset all option parameters to factory setting to avoid trips caused by replacement of the safety option.
Order a new safety option at Danfoss.
Procedure
1. Replace the defective option, see
At the 1st power-up, the drive recognizes different configurations between the safety option and the drive if the safety
parameters are not set default values.
2. Select Frequency converter.
3. If configured, enter the password for the copied safety option configuration from the LCP.
4. Accept to download the safe parameters to the drive/safety option.
5. Select OK.
6. Restart the drive.
7. Download the configuration data again from either:
MCT 10 Safe Plug-in to the safety option via RS485 or USB, or
An LCP in the drive to the safety option.
A checksum is saved along with the file to allow for identification for the duplicated safety option parameters. Follow the guided
sequence on the LCP display to transfer the safety option parameters to a safety option.
4.1 Installing the Option.
Service and Repair
Verify that the correct safety parameter file is transferred to the safety option. Perform a commissioning test, see 5.2.5
Commissioning Test.
7.3.4 Copying Safe Parameter Set-up
Procedure
1. Prepare a commissioning report.
2. Select [0] All to LCP in parameter 0-50 LCP Copy. Monitor the upload on the progress bar.
3. Install the LCP with all the copied parameters on the drive that has to be updated.
4. Select [2] All from LCP in parameter 0-50 LCP Copy. The normal password protection can be applied in parameter 0-60 Main Menu
Password.
5. Enter the password for copied SO configuration (=safe parameters) from LCP.
6. Accept the download of the safe parameters to the drive, which has now a new configuration assigned to it.
7. Reset the drive to activate the new configuration.
7.3.4.1 Password Protection LCP Copy and Safe Parameter Mismatch
Optionally, a password protection can be used for the function LCP copy (see table 15) and if there is a parameter mismatch (see table
16). Password protection can be enabled/disabled in parameter 0-69 Password Protection of Safety Parameters. The password is set in
parameter 0-68 Safety Parameters Password. Default password is 300.
The password protection of the safety parameters is enabled.
Copying the safety parameters from the LCP into the drive is selected.
The safety parameters get copied from the LCP into the drive.
Service and Repair
If password protection is enabled in parameter 0-69 Password Protection of Safety Parameters, enter the correct LCP-copy/parameter mismatch password (parameter 0-68 Safety Parameters Pass-word).
If the entered password is correct, this overlay message is shown for some seconds.
If the entered password is wrong, this overlay message is shown for some seconds. Then the password can be entered again.
Decision box for continuing overwriting the existing data or to abort the procedure.
Press [OK] to complete the customization of the safety option. A reset is required to finalize this
procedure.
Service and Repair
Press [Cancel] to abort the customization of the safety option. A reset is required to finalize this
procedure.
Table 16: Mismatch Between Safety Parameters in the Safety Option and in the Drive
MessageDescription
Whenever there is mismatch of safety parameters within the safety option and the drive, this selection form is shown on the LCP. Select between the ‘safety data on safe option’ or the ‘safety
data on frequency converter’ as valid data.
If selecting [SO:…], the customization of the safety option is completed and a reset is required to
finalize this procedure.
If selecting [VLT:…] and the password protection in parameter 0-69 Password Protection of Safety
Parameters is enabled, enter the correct LCP-copy/parameter mismatch password (parameter 0-68
Safety Parameters Password).
If the entered password is correct, this overlay message is shown for some seconds.
If the entered password is wrong, this overlay message is shown for some seconds. Then the password can be entered again.
Service and Repair
Decision box for continuing overwriting the existing data or to abort the procedure.
Press [OK] to complete the customization of the safety option. A reset is required to finalize this
procedure.
Press [Cancel] to abort the customization of the safety option. A reset is required to finalize this
procedure.
Service and Repair
Illustration 40: Possible Parameter Set-up
7.4 Commissioning Test
The commissioning test for systems with safety functions is focused on validating the functionality of safety monitoring and stop
functions configured in the drive system.
The test objective is to verify proper configuration of the defined safety functions and of test mechanisms and to examine the response
of specific monitoring functions to the explicit input of values outside tolerance limits. Test safety-configured monitoring functions
running in the final set-up.
When commissioning/recommissioning, note the following:
•Secure the site in accordance with the regulations (barrier, warning signs, and more). The system may only be commissioned/
recommssioned by qualified personnel.
•Refer to the information and specifications stated in the operating guide of the relevant programmable control system.
•During commissioning/recommissioning, make sure that no personal injury and/or material damage can occur, even if the plant/
machine moves unintentionally.
•When commissioning the safety option, read the safety guidelines in the operating guide for the drive.
7.4.2 Before Running the Commissioning Test
The system integrator/machine manufacturer runs a commissioning test of the safety option to verify and document the correct
selection of the safety option parameter values. The system integrator/machine manufacturer hereby proves to have tested the
effectiveness of the safety functions used. Run the commissioning test based on the risk analysis. All applicable standards and
regulations must be adhered to.
Check that:
•The machine is properly wired.
•The effectiveness of all safety components used in the application fulfills the requirements.
•All safety equipment, such as protective door monitoring devices, light barriers, or emergency stop switches, is connected and
ready for operation.
•All motor parameters and command parameters must be set correctly on the drive.
Run a commissioning test of the safety option in the following situations:
•After the configuration of each machine.
•After changing the safety option parameters.
•After making changes to the machine (as per applicable standards and regulations).
7.4.2.1 Checking Effectiveness of Safety Functions
Procedure
1. Document each individual step of the test.
2. Note the checksum of the safety option parameters in the records.
3. Do NOT release the system unless it has successfully passed all individual steps of the test.
4. Restart the drive and check that the motor runs normally.
7.4.3 Safety Functions in the Drive
After making, for example, LCP copy of safe parameters, a commissioning test is required. Use these short versions of the
commissioning test reports to follow and approve the test sequence.
This chapter provides troubleshooting tables for diagnosing fault conditions associated with the safety option.
The safety option differentiates between fatal error and alarm.
Table 23: Fault Types
Fault
type
Fatal error
AlarmFunctional fault, caused by an external process. Both sys-
Table 24: LED Status Indicators
ColorModeDescription
GreenFlashingSystem OK, configuration validated.
GreenPermanentSystem OK, input or output activated.
YellowFlashingSystem OK, configuration not yet validated.
RedFlashingAlarm.
RedPermanentFatal error.
All external failures can be removed by giving a reset signal (via LCP, DI2a, and digital inputs on control card or via fieldbus depending
on configuration). All internal failures can be removed by power cycle, parameter 42-90 Restart Safe Option and configuration.
DescriptionEffect on the
system
Severe exceptional error caused by the program run in the
safety option. Cyclic program sequence is no longer possible for safety-related reasons. The last active function is
shown. The system is in stop mode.
tems continue to run cyclically and serve all requests from
the communication interfaces. Sensing of the external
process is also maintained.
Output S37 is
switched off
Output S37 is
switched off
Reset condition
Reset possible by power cycling the
drive or restart the safety option via
parameter 42-90 Restart Safe Option.
Reset possible via parameterizable input DI2, reset on LCP/DI or via fieldbus or via parameter 42-90 RestartSafe Option.
8.1.1 Messages
Any errors on the safety option are indicated on the drive display with different messages.
The following options are available for detailed diagnosis and fault detection:
•LEDs on the front of the safety option provide information on operating states. The LEDs are used to indicate the status of the
option, that is active safety functions, failures, and warnings, if any.
•LCP text or information via bus display the status of the safety functions (for example SS1a).
The following is shown in online mode in the MCT 10 Set-up Software:
•Status of the safety option input and output errors, messages, and the corresponding remedies are shown in the expanded
diagnosis system of the MCT 10 Set-up Software.
•Check that data for feedback (PPR., type of feedback, and gear ratio) are
entered correctly.
•Direction of feedback is
wrong.
•Due to use of feedback filter the dynamic of the system does not match with
dynamic of feedback filter
(parameter 42-15 FeedbackFilter). System is ramping
too fast.
•Feedback signals are not
received at all.
•No proper shielding of
feedback cables.
Status of LED 1 and LED2 depends on safety function
state assigned to DI1 and DI2.
•Make a recustomization
with correct data if needed.
•Set parameter 42-12 En-coder Direction to the opposite value.
•Decrease the ramping
time on the drive.
•Try to run the system at,
for example, 60 RPM. If
error 99, Int Fail Feedback
error
•Improve shielding of
feedback cables and motor cables.
•First, power cycle the drive or
restart the safety option via
parameter 42-90 Restart Safe
Status of LED 1 and LED2 depends
on safety function state assigned to
DI1 and DI2.
Red
constant
Option.
•If the problem persists, contact Danfoss.
•First, power cycle the drive or
restart the safety option via
parameter 42-90 Restart Safe
Red
constant
Option.
•If the problem persists, contact Danfoss.
•Safety input
connected
to DI2 has
illegal signal level.
•Sensor is
broken.
•Check that the configuration
of DI2 parameter 42-21 Type is
set correctly or that the connected sensor is installed according to specification.
•Extend discrepancy time on
the safe input tab in the MCT
Red
constant
10 Safe Plug-in via parameter14-22 Operation Mode.
76Int Fail DI1 in
PUST: Reaction STO
77Int Fail fail-
safe data
CRC mismatch: Reaction STO
•Safety input
connected
to DI1 has
illegal signal level.
•Sensor is
broken.
The CRC of the
safety option
does not match
the stored CRC
value on the
drive.
•Check that the configuration
of DI1 parameter 42-21 Type,
sub-index [0], is set correctly
or that the connected sensor
is installed according to specification.
•Extend discrepancy time on
the safe input tab in the MCT
10 Safe Plug-in via parameter14-22 Operation Mode.
Configure the safety option with
MCT 10 safe plug-in or by CRC select/LCP copy
See 115See 115Status of LED 1 and LED2 depends on safety
function state assigned to DI1 and DI2.
See 116See 116Red flashing, cycle
See 70See 70Red constant
See 70See 70Red constant
See 113See 113Red constant.Status depends on
Red constant.Red flashing, cycle
safety function state
assigned to DI2.
Red flashing, cycle
(on 500 ms, off
500 ms)
(on 500 ms, off
500 ms)
Red flashing, cycle
(on 500 ms, off
500 ms)
(on 500 ms, off
500 ms)
Red flashing, cycle
(on 500 ms, off
500 ms)
242Ext Fail DI2: Reaction
SS1b
243Ext Fail Prec Thresh
Timer Elapsed: Reaction SS1b
244Ext Fail SF activation
Speed Suspension: Reaction SS1b
252Internal failure safety
option
See 114See 114Status depends on
Safety function state
assigned to DI1.
See 115See 115Red flashing, cycle
See 116See 116Red flashing, cycle
Power cycle the
drive. If
the problem persists, contact Danfoss.
Red constant.Red flashing, cycle
(on 500 ms, off
500 ms)
(on 500 ms, off
500 ms)
(on 500 ms, off
500 ms)
8.2.1 Safety Option Warning
A warning message notifies that an issue exists on the safety option. It is not handled as an internal or external failure. These messages
are defined to indicate that a manual user action is required.
At any possible failure or warning indicated from the safety option, the LCP shows warning, !Safe Option Failure [W252] at the
least.
8.2.2 Safety Option Reset Message
For some messages, the safety option requires an acknowledgement of an ongoing action or failure on the safety option. The safety
option uses Safe Option RESET as a Restart and Failure Acknowledgement.
Table 33: LCP Reset Messages
LCP messageDescription
In the following cases, the safety option requests a restart and failure acknowledgement signal:
•The safety option is in safety function pending-state (remark: Occurs only if reset behavior is
set/configured to Manual).
•After a power cycle with a safety function.
•In PUST (power up self-test), if an external failure occurred before power cycle.
•When an external failure occurred.
•When customization was aborted or completed.
•At the reception of a general reset (required after blank initial state or in the customization
state).
The safety option indicates that it is PUST State (Power Up Self Test).
•Ensure that no safe function is active after a power cycle.
A safety function is pending at the start-up, if the drive was powered down while a safety function was active. It is also pending, when the drive was powered down while the safety option has
detected a failure during an active safety function.
The safety option requests a Restart and Failure Acknowledge signal, which is always required after a PUST and when a safety function gets released and is configured to be confirmed that the
motor is able to run.
Occurs only if general reset is performed from MCT 10. It is an indication to the user. The safety
option is set to blank initial state and safe parameters are set to default.
Zero speed timer contains the remaining time until the fail prec thresh timer elapsed after the
monitoring time expires. The safety option signals Warning.
PUST warning has occurred. Warning cause: Expiry of PUST timer. Memory test required, perform
power cycle.
Warnings and Alarms
DI1 offline warning has occurred. Warning cause: Expiry of offline timer for DI1.
DI2 offline warning has occurred. Warning cause: Expiry of offline timer for DI2.
Speed monitoring suspension warning has occurred. Warning cause: Suspension of speed monitoring for certain duration.
Manual reset time≤5 ms (safety option), ≤5 ms (drive), ≤10 ms (fieldbus)
Manual reset pulse time10 µs (safety option and drive)
Automatic reset time≤4 ms
Start-up reset time≤5 s (parameter 42-90 Restart Safe Option)
9.4.4 Response Time
Input to output response time≤2 ms
Emergency stop until beginning of SS1/SLS≤7 ms
Cross fault detection time≤3 ms (@activated output)
9.4.5 Safety Characteristic Data
NO TI CE
The safety-related characteristic data are valid for all safety functions. All units used within a safety function must be considered
when calculating the safety characteristic data.