Variable speed drives
for synchronous and asynchronous motors
Safety integrated function manual
02/2014
S1A91443
www.schneider-electric.com
Important information
The information provided in this documentation contains general descriptions and/or technical characteristics
of the performance of the products contained herein. This documentation is not intended as a substitute for
and is not to be used for determining suitability or reliability of these products for specific user applications. It
is the duty of any such user or integrator to perform the appropriate and complete risk analysis, evaluation and
testing of the products with respect to the relevant specific application or use thereof. Neither Schneider
Electric nor any of its affiliates or subsidiaries shall be responsible or liable for misuse of the information
contained herein. If you have any suggestions for improvements or amendments or have found errors in this
publication, please notify us.
No part of this document may be reproduced in any form or by any means, electronic or mechanical, including
photocopying, without express written permission of Schneider Electric.
All pertinent state, regional, and local safety regulations must be observed when installing and using this
product. For reasons of safety and to help ensure compliance with documented system data, only the
manufacturer should perform repairs to components.
When devices are used for applications with technical safety requirements, the relevant instructions must be
followed.
Failure to use Schneider Electric software or approved software with our hardware products may result in
injury, harm, or improper operating results.
Failure to observe this information can result in injury or equipment damage.
Read these instructions carefully, and look at the equipment to become familiar with the device before trying
to install, operate, or maintain it. The following special messages may appear throughout this documentation
or on the equipment to warn of potential hazards or to call attention to information that clarifies or simplifies a
procedure.
The addition of this symbol to a Danger or Warning safety label indicates that an electrical hazard
exists, which will result in personal injury if the instructions are not followed.
This is the safety alert symbol. It is used to alert you to potential personal injury hazards. Obey all
safety messages that follow this symbol to avoid possible injury or death.
DANGER
DANGER indicates an imminently hazardous situation, which, if not avoided, will result in death or serious
injury.
WARNING
WARNING indicates a potentially hazardous situation, which, if not avoided, can result in death, serious
injury or equipment damage.
CAUTION
CAUTION indicates a potentially hazardous situation, which, if not avoided, can result in injury or
equipment damage.
NOTICE
NOTICE, used without the safety alert symbol, indicates a potentially hazardous situation which, if not
avoided, can result in equipment damage.
PLEASE NOTE
The word "drive" as used in this manual refers to the controller portion of the adjustable speed drive as defined
by NEC.
Electrical equipment should be installed, operated, serviced, and maintained only by qualified personnel. No
responsibility is assumed by Schneider Electric for any consequences arising out of the use of this product.
The purpose of this document is to provide information about safety functions incorporated in Altivar 61/71/
LIFT. These functions allow you to develop applications oriented in the protection of man and machine.
Please, read before the installation and programming manual.
This documentation is valid for the Altivar 61, Altivar 71, Altivar LIFT, Altivar 61Q, Altivar 71Q, Altivar 61 Plus
and Altivar 71 Plus drives.
ATV61 Plus Configuration Guide
90 kW ... 1400 kW / 380 - 415 V
90 kW ... 1800 kW / 500 - 525 V
110 kW ... 2400 kW / 690 V
ATV71 Plus Configuration Guide
90 kW ... 1300 kW / 380 - 415 V
90 kW ... 1500 kW / 500 - 525 V
110 kW ... 2000 kW / 690 V
ATV61 Plus-Marine
630 kW ... 1400 kW / 380 - 415 V
800 kW ... 2400 kW / 690 V
760655
755849
760643
755843
8P02534
8P02535
8P02503
8P02504
8P02526
S1A91443 02/20147
Title of DocumentationReference Number
ATV71 Plus-Marine
500 kW ... 1300 kW / 380 - 415 V
630 kW ... 2000 kW / 690 V
ATV61_71 Atex manualAAV49434
ATV61 Programming manual760649
ATV71 Programming_manual755855
ATV_LIFT programming manualBBV19478
ATV61_71 Canopen manual755865
ATV61_71 Cc-link manualAAV49429
ATV61_71 Ethernet manual755879
ATV61_71 Ethernet TCP Daisy Chain manualAAV69931
ATV61_71 EthernetIP manualAAV68822
ATV61_71 FIPIO manual755883
ATV61_71 Interbus manual755871
ATV61_71 PROFIBUS DPv1 manualAAV52935
ATV61 Apogee FLN P1 manualBBV10543
ATV61 Bacnet manual765274
ATV61 LonWorks_manual765273
ATV61 metasys N2 manualAAV33578
ATV61 multi pump manual765272
ATV61 communication parameters760661
ATV71 communication parameters755861
ATV71 Controller inside manual757062
ATV71 Devicenet manual755877
ATV71 Modbus integrated manual755863
ATV71 Modbus jbus manual755875
ATV71 Modbus plus manual755869
ATV71 profibus manual755873
ATV71 regen units manual757361
ATV71 Uni-Telway manual755867
ATV61 and 71 other option manuals: see www.schneider-electric.com.
8P02527
About the book
You can download the latest versions of the technical publications related to the Altivar 61 and 71 on
www.schneider-electric.com.
8
S1A91443 02/2014
Before you begin
Before you begin
What's in this Chapter?
This chapter contains the following topics:
TopicPage
Safety instructions10
Qualification of personnel and use12
1
S1A91443 02/20149
Safety instructions
The information provided in this manual supplements the product ma nuals.
Carefully read the product manuals before using the product.
Read and understand these instructions before performing any procedure with this drive.
HAZARD OF ELECTRIC SHOCK, EXPLOSION, OR ARC FLASH
z Only appropriately trained persons who are familiar with and understand the contents of this manual and
z The system integrator is responsible for compliance with all local and national electrical code
z Many components of the product, including the printed circuit boards, operate with mains voltage. Do not
z Do not touch unshielded components or terminals with voltage present.
z Motors can generate voltage when the shaft is rotated. Prior to performing any type of work on the drive
z AC voltage can couple voltage to unused conductors in the motor cable. Insulate both ends of unused
z Do not short across the DC bus terminals or the DC bus capacitors or the braking resistor terminals.
z Before performing work on the drive system:
z Install and close all covers before applying voltage.
Failure to follow these instructions will result in death or serious injury.
Before you begin
DANGER
all other pertinent product documentation and who have received safety training to recognize and avoid
hazards involved are authorized to work on and with this drive system. Installation, adjustment, repair and
maintenance must be performed by qualified personnel.
requirements as well as all other applicable regulations with respect to grounding of all equipment.
touch. Use only electrically insulated tools.
system, block the motor shaft to prevent rotation.
conductors of the motor cable.
- Disconnect all power, including external control power that may be present.
- Place a "Do Not Turn On" label on all power switches.
- Lock all power switches in the open position.
- Wait 15 minutes to allow the DC bus capacitors to discharge. The DC bus LED is not an indicator of the
absence of DC bus voltage that can exceed 800 Vdc.
- Measure the voltage on the DC bus between the DC bus terminals using a properly rated voltmeter to
verify that the voltage is < 42 Vdc.
- If the DC bus capacitors do not discharge properly, contact your local Schneider Electric representative.
DANGER
UNINTENDED EQUIPMENT OPERATION
z Read and understand this manual before installing or operating the drive.
z Any changes made to the parameter settings must be performed by qualified personnel.
Failure to follow these instructions will result in death or serious injury.
WARNING
DAMAGED DRIVE EQUIPMENT
Do not operate or install any drive or drive accessory that appears damaged.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
10
S1A91443 02/2014
Before you begin
WARNING
LOSS OF CONTROL
z The designer of any control scheme must consider the potential failure modes of control paths and, for
critical control functions, provide a means to achieve a safe state during and after a path failure. Examples
of critical control functions are emergency stop, overtravel stop, power outage, and restart.
z Separate or redundant control paths must be provided for critical control functions.
z System control paths may include communication links. Consideration must be given to the implications
of unanticipated transmission delays or failures of the link.
z Observe all accident prevention regulations and local safety guidelines.
z Each implementation of the product must be individually and thoroughly tested for proper operation before
1
being placed into service.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
1. For USA: Additional information, refer to NEMA ICS 1.1 (latest edition), “Safety Guidelines for the Application, Installation, and
Maintenance of Solid State Control” and to NEMA ICS 7.1 (latest edition), “Safety Standards for Construction and Guide for Selection,
Installation and Operation of Adjustable Speed Drive Systems.
CAUTION
INCOMPATIBLE LINE VOLTAGE
Before turning on and configuring the drive, ensure that the line voltage is compatible with the supply voltage
range shown on the drive nameplate. The drive may be damaged if the line voltage is not compatible.
Failure to follow these instructions can result in injury or equipment damage.
NOTICE
RISK OF DERATED PERFORMANCE DUE TO CAPACITOR AGING
The product capacitor performances after a long time storage above 2 years can be degraded.
In that case, before using the product , apply the following procedure:
z Use a variable AC supply connected between L1 and L2 (even for ATV61/71pppN4 references).
z Increase AC supply voltage to have:
- 80% of rated voltage during 30 min
- 100% of rated voltage during 30 min
Failure to follow these instructions can result in equipment damage.
S1A91443 02/201411
Qualification of personnel and use
Qualification of personnel
Only appropriately trained persons who are familiar with and understand the contents of this manual and all
other pertinent product documentation are authorized to work on and with this product. In addition, these
persons must have received safety training to recognize and avoid hazards involved. These persons must
have sufficient technical training, knowledge and experience and be able to foresee and detect potential
hazards that may be caused by using the product, by changing the settings and by the mechanical, electrical
and electronic equipment of the entire system in which the product is used.
All persons working on and with the product must be fully familiar with all applicable standards, directives, and
accident prevention regulations when performing such work.
Intended use
The functions described in this manual are only intended for use with the basic product; you must read and
understand the appropriate product manual.
The product may only be used in compliance with all applicable safety regulations and directives, the specified
requirements and the technical data.
Prior to using the product, you must perform a risk assessment in view of the planned application. Based on
the results, the appropriate safety measures must be implemented.
Since the product is used as a component in an entire system, you must ensure the safety of persons by
means of the design of this entire system (for example, machine design).
Before you begin
Operate the product only with the specified cables and accessories. Use only genuine accessories and spare
parts.
Any use other than the use explicitly permitted is prohibited and can result in hazards.
Electrical equipment should be installed, operated, serviced, and maintained only by qualified personnel.
The product must NEVER be operated in explosive atmospheres (hazardous locations, Ex areas).
12
S1A91443 02/2014
Overview
Overview
What's in this Chapter?
This chapter contains the following topics:
TopicPage
Introduction14
Standards and Terminology15
Basics16
2
S1A91443 02/201413
Introduction
The safety function incorporated in Altivar 61/71/LIFT, allows you to develop applications oriented in the
protection of man and machine.
Safety integrated function provides the following benefits:
z Replacement of external safety equipment
z Reduced wiring efforts and space requirements
z Reduced costs
The Altivar 61/71/LIFT drives are compliant with normative requirements to implement the safety function
Safety function as per IEC 61800-5-2
(STO) Safe Torque Off
The function purpose is to bring the motor into a no torque condition so it is relevant in terms of safety since
no torque is available at the motor level. Power modules are inhibited and the motor coasts dow or prohibits
the motor from starting.
Notation
The graphic display terminal (reference VW3A1101) menus are shown in square brackets.
Example: [COMMUNICATION]
The integrated 7-segment display terminal menus are shown in round brackets.
Example: (COM-)
Parameter names are displayed on the graphic display terminal in square brackets.
Example: [Fallback speed]
Parameter codes are displayed on the integrated 7-segment display terminal in round brackets.
Example: (LFF)
Overview
14
S1A91443 02/2014
Overview
Standards and Terminology
Technical terms, terminology and the corresponding descriptions in this manual are intended to use the terms
or definitions of the pertinent standards.
In the area of drive systems, this includes, but is not limited to, terms such as "safety function", "safe state",
"fault", "fault reset", "failure", "error", "error message", "warning", "warning message", etc.
Among others, these standards include:
z IEC 61800 series: "Adjustable speed electrical power drive systems"
z IEC 61508 series Ed.2: "Functional safety of electrical/electronic/programmable electronic safetyrelated
systems"
z EN 954-1 Safety of machinery - Safety related parts of control systems
z EN ISO 13849-1 & 2 Safety of machinery - Safety related parts of control systems
EC Declaration of Conformity
The EC Declaration of Conformity for the EMC Directive can be obtained on www.schneider-electric.com
ATEX certification
The ATEX certificate can be obtained on www.schneider-electric.com
Certification for functional safety
The integrated safety function is compatible and certified following IEC 61800-5-2 Ed.1 Adjustable speed
electrical power drive systems – Part 5-2 : Safety requirements – Functional
IEC 61800-5-2 as a product standard, sets out safety-related considerations of Power Drive Systems Safety
Related “PDS (SR) s” in terms of the framework of IEC 61508 series Ed.2 of standards.
Compliance with IEC 61800-5-2 standard, for the following described safety function, will facilitate the
incorporation of a PDS(SR) (Power Drive System with safety-related functions) into a safety-related control
system using the principles of IEC 61508, or the ISO 13849-1, as well as the IEC 62061 for process-systems
and machinery.
The defined safety function is:
z SIL 2 capability in compliance with IEC 61800-5-2 and IEC 61508 series Ed.2.
z Performance Level “d” in compliance with ISO 13849-1.
z Compliant with the Category 3 and 4 of European standard ISO 13849-1 (EN 954-1).
Also refer to Safety function capability, page 29
The safety demand mode of operation is considered in high demand or continuous mode of operation
according to the IEC 61800-5-2 standard.
The certificate for functional safety is accessible on www.schneider-electric.com.
.
S1A91443 02/201415
Basics
Functional Safety
Automation and safety engineering are two areas that were completely separated in the past but recently have
become more and more integrated.
Engineering and installation of complex automation solutions are greatly simplified by integrated safety
functions.
Usually, the safety engineering requirements depend on the application.
The level of the requirements results from the risk and the hazard potential arising from the specific application.
IEC 61508 standard
The standard IEC 61508 "Functional safety of electrical/electronic /programmable electronic safety-related
systems" covers the safety-related function. Instead of a single component, an entire function chain (for
example, from a sensor through the logical processing units to the actuator) is considered as a unit. This
function chain must meet the requirements of the specific safety integrity level as a whole. Systems and
components that can be used in various applications for safety tasks with comparable risk levels can be
developed on this basis.
SIL - Safety Integrity Level
The standard IEC 61508 defines 4 safety integrity levels (SIL) for safety functions. SIL1 is the lowest level and
SIL4 is the highest level. A hazard and risk analysis serves as a basis for determining the required safety
integrity level. This is used to decide whether the relevant function chain is to be considered as a safety
function and which hazard potential it must cover.
Overview
PFH - Probability of a dangerous Hardware Failure per Hour
To maintain the safety function, the IEC 61508 standard requires various levels of measures for avoiding and
controlling detected faults, depending on the required SIL. All components of a safety function must be
subjected to a probability assessment to evaluate the effectiveness of the measures implemented for
controlling detected faults. This assessment determines the PFH (probability of a dangerous failure per hour)
for a safety system. This is the probability per hour that a safety system fails in a hazardous manner and the
safety function cannot be correctly executed. Depending on the SIL, the PFH must not exceed certain values
for the entire safety system. The individual PFH values of a function chain are added. The result must not
exceed the maximum value specified in the standard.
SIL Safety Integrity
Level
4
3
2
1
Probability of a dangerous Failure per Hour
(PFH) at high demand or continuous demand
≥10
≥10
≥10
≥10
-9
… <10
-8
… <10
-7
… <10
-6
… <10
-8
-7
-6
-5
PL - Performance level
The standard IEC 13849-1 defines 5 Performance levels (PL) for safety functions. “a” is the lowest level and
“e” is the highest level. Five level (a, b, c, d, e) correspond to different values of average probability of
dangerous failure per hour.
Performance
level
e
d
c
b
a
Probability of a dangerous
Hardware Failure per Hour
Depending on the SIL for the safety system, the IEC 61508 standard and SFF, Safe Failure Fraction requires
a specific hardware detected fault tolerance HFT in connection with a specific proportion of safe failures SFF
(safe failure fraction).
The hardware detected fault tolerance is the ability of a system to execute the required safety function in spite
of the presence of one or more hardware detected faults.
The SFF of a system is defined as the ratio of the rate of safe failures to the total failure rate of the system.
According to IEC 61508, the maximum achievable SIL of a system is partly determined by the hardware
detected fault tolerance HFT and the safe failure fraction SFF of the system.
IEC 61508 distinguishes two types of subsystems (type A subsystem, type B subsystem). These types are
specified on the basis of criteria which the standard defines for the safety-relevant components.
Systematic errors in the specifications, in the hardware and the software, usage detected faults and
maintenance detected faults of the safety system must be avoided to the maximum degree possible. To meet
these requirements, IEC 61508 specifies a number of measures for detected fault avoidance that must be
implemented depending on the required SIL. These measures for detected fault avoidance must cover the
entire life cycle of the safety system, i.e. from design to decommissioning of the system.
S1A91443 02/201417
Overview
18
S1A91443 02/2014
Description
Description
What's in this Chapter?
This chapter contains the following topics:
TopicPage
(STO) Safe Torque Off20
3
S1A91443 02/201419
(STO) Safe Torque Off
Frequency
Actual
frequency
Time
(STO)
activation
The purpose of this function is to bring the motor into a no torque condition with motor coasts down or prohibits
the motor from starting. So it is relevant in terms of safety since no torque is available at the motor level.
The logic input “PWR” is always assigned to this function.
The (STO) status is accessible with the drive.
(STO) Normative reference
The normative definition of (STO) function is in §4.2.2.2 of the IEC 61800-5-2 (on the 07/2007 version):
"Power, that can cause rotation (or motion in the case of a linear motor), is not applied to the motor. The
PDS(SR)(Power Drive System with safety-related functi ons) will not provide energy to the motor which can
generate torque (or force in the case of a linear motor).
NOTE 1 This safety function corresponds to an uncontrolled stop in accordance with stop category 0 of IEC
60204-1.
NOTE 2 This safety function may be used where safe torque off (STO) is required to help prevent an
unexpected start-up.
NOTE 3 In circumstances where external influences (for example, falling of suspended loads) are present,
additional measures (for example, mechanical brakes) ma y be necessary to help prevent any hazard.
NOTE 4 Electronic means and contactors are not adequate for protection against electric shock, and additional
measures for isolation may be necessary."
Description
Safety function (SF) level required for (STO) function
Configuration SIL
(STO) with Preventa module SIL 2 PL "d"
The Preventa module is required for the machine environment because:
z For the machine environment (IEC60204-1 & Machine Directive), reset shall not initiate a restart in any
cases. One of the most constringent case is when PWR (STO) is activated, then the power supply is switch
off. In this case, if (STO) is deactivated during the loss of supply, the motor do not have to restart
automatically. The Preventa module can help prevent a spurious restart in the previous condition. So the
Preventa module is mandatory for machine applications.
z E_stop of several BDM in a PDS: the Preventa module has some safety outputs for application which
requires one or several safety outputs.
For other environments, the Preventa module is not required, except if the application requires it: System
fallback position.
(Safety Integrity Level)
according to IEC 61-508
PL
(Performance Level)
according to ISO-13849
20
S1A91443 02/2014
Incompatibility with safety functions
Incompatibility with safety functions
What's in this Chapter?
This chapter contains the following topics:
TopicPage
Prerequisites for using safety functions22
4
S1A91443 02/201421
Prerequisites for using safety functions
Some parameters have to be fulfilled for a proper operation:
z Motor size is adequate to the application and is not in the limit of its capacity
z Speed drive size has been properly chosen for the electrical mains, sequence, motor and application and
it is not in the limit of their catalogued capacities.
z If required, the adequate options are used. Example: like dynamic brake resistor or motor inductor.
z The drive is properly setting up for the right speed loop and torque characteristics for the application; the
speed profile of the reference is mastered by the drive control loop.
Incompatibility with safety functions
22
S1A91443 02/2014
Incompatibility with safety functions
Fault Inhibition
For some kind of detected fault, [Fault inhibit assign.](InH)can be requested to avoid the drive to stop
when the fault occurred. The fault inhibition goal is not compatible with the safe function behavior.
When a safe function is activated, detected fault generated by the safe function PrA can’t be inhibited.
Factory settings
If the drive is in safe mode and you active the factory settings only non safety parameters will be downloaded
in the drive. Safe parameters are not impacted by factory settings.
S1A91443 02/201423
Incompatibility with safety functions
24
S1A91443 02/2014
Safety monitoring
Safety monitoring
What's in this Chapter?
This chapter contains the following topics:
TopicPage
STO Function26
5
S1A91443 02/201425
STO Function
Description
Safety monitoring
When the dedicated PWR logical input is activated, the output power bridge of the drive is locked by the
Hardware in order to avoid any torque in the motor. The output power bridge of the drive is also locked by a
redundant software and hardware channel.
When the STO Function is active, the drive locks its output power bridge in order to avoid any torque in the
motor.
When a fault is detected into the hardware of the STO Function, the drive trips and locks its output power
bridge by the redundant hardware and software channel, even if the PWR Input is not activated.
If STO is Active, then Power Bridge is locked by Software and STO status (PrA) is activated and displayed.
If STO is Active and an error is detected, the drive trips in PrF detected fault.
26
S1A91443 02/2014
Technical data
Technical data
What's in this Chapter?
This chapter contains the following topics:
TopicPage
Electrical Data28
Safety function capability29
Certified architectures31
Process system SF - Case 132
Process system SF - Case 233
Process system SF - Case 335
Connection diagram conforming to IEC 61508 and IEC 60204-137
6
S1A91443 02/201427
Electrical Data
LI1
LI5
+24
0V
A1
ATV71Hppppp
PWR
+10
AI1+
AI2
AI1-
COM
COM
AO1
LI3
LI2
LI6
LI4
Reference
potentiometer
0 ± 10 V
or
X-Y mA
0 ± 10 V
or
X-Y mA
A1
ATVp1Hppppp
SW1
Ext
Source
Sink
Int
LI1
LI5
+24
0V
LI3
LI2
LI6
LI4
A1
ATVp1Hppppp
SW1
Ext
Source
Sink
Int
LI1
LI5
+24
0V
LI3
LI2
LI6
LI4
+24 V
0 V
24 V c supply
The Logic inputs and Logic outputs of the drive can be wired for logic type 1 or logic type 2.
Logic TypeActive state
1Output draws current (Sink)
2Output supplies flows from the input Current
Safe function only used in source mode, sink is not compatible with safe functions.
Signal inputs are protected against reverse polarity, outputs are short-circuit protected. The inputs and outputs
are galvanically isolated.
Control connection diagrams
Technical data
Current flows to the input
Current (Source)
Logic input switch (SW1)
The logic input switch (SW1) is used to adapt the operation of the logic inputs to the technology of the
programmable controller outputs.
• Set the switch to Source (factory setting) if using PLC outputs with PNP transistors.
• Set the switch to Sink Int or Sink Ext if using PLC outputs with NPN transistors.
• Switch SW1 set to “Source” position
UNINTENDED EQUIPMENT OPERATION
Prevent accidental grounding of logic inputs wired in "sink logic". Accidental grounding can result in
unintended activation of drive functions.
Protect the signal conductors against damage that could result in unintentional conductor grounding.
Failure to follow these instructions will result in death or serious injury.
• Switch SW1 set to “Source” position and use of an external power supply for the LIs
DANGER
28
S1A91443 02/2014
Technical data
Safety function capability
Safety functions of PDS (SR) are part of a global system
If qualitative and quantitative objectives of safety set by the final application requires to make some
adjustments to use the safety functions in a safe way, then the integrator of the BDM is responsible of these
complementary evolutions (for example management of the mecanichal brake on the motor).
Also, the output information generated by the utilization of safety functions (default relay activation, relay of
brake logic command, errors codes or information on the display, …) aren't considering safety
informations.Machine application
Function(STO)
Configuration
Standard
IEC 61800-5-2 /
IEC 61508 /
IEC 62061 (1)SIL2 CL
EN 954-1 (2)Category 3
(STO)
with Preventa
XPS AF or
equivalent
SIL2
Process application
ISO 13849-1 (3)
IEC 60204-1Category stop 0
(1) Because the standard IEC 62061 is an integration standard, this standard distinguishes the global safety function (which
is classify SIL2 for ATV61/71/LIFT according to diagrams Process system SF - Case 1, page 32
Case 2, page 33
(2) According to table 6 of IEC 62061 (2005)
(3) According to table 4 of EN13849-1 (2008)
Function(STO)
Configuration
Standard
IEC 61800-5-2 /
IEC 61508 /
IEC 62061 (1)SIL2 CL
(1) Because the standard IEC 62061 is an integration standard, this standard distinguishes the global safety function (which
is classify SIL2 for ATV61/71/LIFT according to diagrams Process system SF - Case 1, page 32
Case 2, page 33
Category 3
PL "d"
and Process system SF -
) from components which constitute the safety function (which is classify SIL2 CL for ATV61/71/LIFT)
(STO)
SIL2
and Process system SF -
) from components which constitute the safety function (which is classify SIL2 CL for ATV61/71/LIFT)
(1) Because the standard IEC 62061 is an integration standard, this standard distinguishes the global safety
function (which is classify SIL2 for ATV61/71/LIFT according to diagrams Process system SF - Case 1,
page 32
and Process system SF - Case 2, page 33 ) from components which constitute the safety function
(which is classify SIL2 CL for ATV61/71/LIFT)
(2) According to table 6 of IEC 62061 (2005)
(3) According to table 4 of EN13849-1 (2008)
Preventive annual activation of the safety function is recommended. However the safety levels are reached
with lower margins without annual activation.
Note: The table above is not sufficient to evaluate the PL of a PDS. The PL evaluation has to be done at the
system level. The fitter or the integrator of the BDM has to do the system PL evaluation by including sensors
data with numbers from the table above.
Technical data
SFF92%91%91%91%92 %
PFH
TypeBBBBB
HFT11111
DC avg70,40%68,30%71,20%69,70%69,70%
SIL capability22222
SIL CL capability22222
Category33333
PLddddd
Category33333
MTTFd in years18001900175018501850
1 E-8 h
-1
1 E-8 h
-1
1 E-8 h
-1
1 E-8 h
-1
1 E-8 h
-1
Drive sizes table
Please refer to the tables, page 39
EN ISO 13849 standard
This European Standard specifies the validation process, including both analysis and testing, for the safety
functions and categories for the safety-related parts of control systems. Descriptions of the safety functions
and the requirements for the categories are given in EN 954-1 (ISO 13849-1) which deals the general
principles for design. Some requirements for validation are general and some are specific to the technology
used. EN ISO 13849-2 also specifies the conditions under which the validation by testing of the safety-related
parts of control systems should be carried out.
Isolation distances and interval are sized at least according to IEC 60264-1. See the following table
Printed circuits boards/assemblies
Fault considered Fault exclusionRemarks
Short-circuit between two
adjacent tracks/pads
Open-circuit of any trackNone-
for correspondence between product sizes and references.
Short-circuits between
adjacent conductors in
accordance with
remarks 1) to 3).
The base material used is according to IEC 60249 and the creepage distances and clearances are dimensioned at least to
IEC 60664-1: 1992 with at least pollution/installation category III.
The printed side(s) of the assembled board is covered with an agoing-resistant varnish or a protective layer covering all conductor
paths in accordance with IEC 60664-3
All enclosures of the safety-related parts of the control system, including those mounted remotely, should provide a degree of protection of at least IP54 [see EN 60529 (IEC 60529)], when
mounted as specified.
30
S1A91443 02/2014
Technical data
Certified architectures
NOTE: For the certification relative to functional aspects, only the PDS(SR) (Power Drive System with safety-
related functions) will be in consideration, and not the complete system in which fits into to help to ensure the
functional safety of a machine or a system/process.
These are the two architectures certified:
z Process system SF - Case 1, page 32
z Process system SF - Case 2, page 33
z Process system SF - Case 3, page 35
z Safety according to IEC 61508 and IEC 60204-1, page 37
Safety functions of PDS (SR) (Power Drive System with safety-related functions) are part of a global system.
If qualitative and quantitative objectives of safety set by the final application require to make some adjustments
to use the safety functions in a safe way, then the integrator of the BDM (background debug module) is
responsible of these complementary evolutions (for example management of the mechanical brake on the
motor).
Also, the output information generated by the utilization of safety functions (default relay activation, relay of
brake logic command, errors codes or information on the display, …) are not considering safety informations.
S1A91443 02/201431
Technical data
S2
A123 33Y213
A2
PE
14 24 34
Y43
Y44
Y1
K2K1
48 V, 115 V, 230 V
K1
K2
T
ESC
XPS AC
S1
F1
L1
N
U / T1
V / T2
W / T3
R / L1
U1
W1
V1
M
3 a
S / L2
T / L3
A1
(1)
(4)
ATVp1Hppppp
+24
PWR
R1A
R1C
R1B
LI1
LI6
LI2
P0
PA / +
PB
PC / -
(2)
(3)(3)
Logic
Process system SF - Case 1
Connection diagrams conforming to standards EN 954-1 category 3, ISO 13849-1 and IEC/EN 61508 capacity SIL2, stopping
category 0 in accordance with standard IEC/EN 60204-1
This connection diagram is suitable for use with machines with a short freewheel stop time (machines with low
inertia or high resistive torque).
When the stop request is activated, the motor power supply is cut immediately and it stops in accordance
with category 0 of standard IEC/EN 60204-1.
Note: This diagram must be used for hoisting applications if a mechanical brake is controlled by an ATV71.
A contact on the Preventa XPS AC module must be inserted in the brake control circuit to engage it safely
when the (STO) Safe Torque Off function is activated.
32
(1)Line choke (if used)
(2)Standardized coaxial cable, type RG174/U according to MIL-C17 or KX3B according to NF C 93-550,
external diameter 2.54 mm /0.09 in., maximum length 15 m / 49.21 ft. The cable shielding must be earthed
(3)Use cable ends DZ5CE020 (yellow) on wires connected to PWR and +24 inputs
(4)Braking resistor (if used)
- Standard EN 954-1 category 3 and ISO 13849-1 require the use of a dual-contact stop button (S1).
- S1 is used to activate the Power Removal safety function.
- S2 is used to initialize the Preventa module when powering up or after an emergency stop. ESC enables
the use of other initialization conditions for the module.
- One Preventa module can be used for the STO function on several ATV61/71/LIFT drives.
- A logic output on the Preventa module can be used to indicate reliably that the drive is operating in safe
conditions.
Note:
For preventive maintenance, the STO function must be activated at least once a year.
The drive power supply must be turned off and then on again before carrying out this preventive maintenance.
The drive logic output signals cannot be considered as safety-type signals.
Install interference suppressors on all inductive circuits near the drive or coupled to the same circuit (relays,
contactors, solenoid valves, etc).
Choice of associated components:
Please refer to the catalog.
S1A91443 02/2014
Technical data
Process system SF - Case 2
Connection diagram conforming to standards EN 954-1 category 3, ISO 13849-1 and IEC/EN 61508 capacity SIL2, stopping
category 1 in accordance with standard IEC/EN 60204-1
This connection diagram is suitable for use with machines with a long freewheel stop time (machines with high
inertia or low resistive torque).
WARNING
LOSS OF CONTROL
This diagram must not be used for hoisting applications. Use process system SF - Case 1.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
When the stop request is activated, deceleration of the motor, controlled by the drive, is requested first. Then,
after a time delay corresponding to the deceleration time, the STO function is activated.
Example:
- 2-wire control
- LI1 assigned to forward
- LI2 assigned to reverse
L1
F1
(max. 4 A)
N
S1
A11357 67
XPS-ATE
T
(1)
S11S21
B1
S12
K1K2
S22
Time (s)
Timer 2
Timer 1
LOGIC
K1
23
K3
K1
A2
PE
(1)
S2
S33
K3
K2
K2K4K1
K3
K4
Y1Y2 Y3 Y4 Y514 246858
ESC
K2
K4
77
78Y88 Y89 Y90 Y91
(A1/A2)
(S12)
+24V
Y+
(S22)
to PLC
c
(Stop1)
A1
ATVp1Hppppp
U1
R / L1
U / T1
3 a
V1
M
S / L2
V / T2
W1
(2)
T / L3
W / T3
(1)
LI1
P0
LI2
PA / +
(3)
PC / -
PWR
(4)(4)
+24
R1A
R1B
R1C
LI6
PB
(5)
(1)In this example, the logic inputs LIp are wired as “Source” but can be wired as “Sink Int” or “Sink Ext”.
(2)Line choke (if used)
(3)Standardized coaxial cable, type RG174/U according to MIL-C17 or KX3B according to NF C 93-550, external
diameter 2.54 mm /0.09 in., maximum length 15 m / 49.21 ft. The cable shielding must be earthed.
(4)Use cable ends DZ5CE020 (yellow) on wires connected to PWR and +24 inputs
(5)Braking resistor (if used)
S1A91443 02/201433
Technical data
- Standard EN 954-1 category 3 and ISO 13849-1 require the use of a dual-contact stop button (S1).
- S1 is used to activate the STO function.
- S2 is used to initialize the Preventa module when powering up or after an emergency stop. ESC enables
the use of other initialization conditions for the module.
- One Preventa module can be used for the STO function on several ATV61/71/LIFT drives. In this case the
time delay must be set to the longest stopping time.
- A logic output on the Preventa module can be used to indicate reliably that the drive is operating in safe
conditions.
Note:
For preventive maintenance, the STO function must be activated at least once a year.
The drive power supply must be turned off and then on again before carrying out this preventive maintenance.
The drive logic output signals cannot be considered as safety-type signals.
Install interference suppressors on all inductive circuits near the drive or coupled to the same circuit (relays,
contactors, solenoid valves, etc).
Choice of associated components:
Please refer to the catalog.
34
S1A91443 02/2014
Technical data
Process system SF - Case 3
Multi-drive conforming to standards EN 954-1 category 3, ISO 13849-1 and IEC/EN 61508 capacity SIL2, stopping
category 1 in accordance with standard IEC/EN 60204-1
This connection diagram is suitable for use with machines with a long freewheel stop time (machines with high
inertia or low resistive torque).
.
WARNING
LOSS OF CONTROL
This diagram must not be used for hoisting applications. Use process system SF - Case 1.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
L1
F1
(max. 4 A)
A11357 67
XPS-ATE
T
(1)
A2
PE
(1)
N
S2
S11S21
S33
B1
S1
S12
K1K2
K3
S22
Time (s)
LOGIC
Timer 2
Timer 1
K1
K2
K2 K4K1
K3
K4
Y1Y2 Y3 Y4 Y514 246858
ESC
23
K1
K2
77
K3
K4
78Y88 Y89 Y90 Y91
(A1/A2)
(S12)
+24V
Y+
(S22)
to PLC
c
(Stop1)
A1
ATVp1Hppppp
A1
ATVp1Hppppp
U1
U1
R / L1
U / T1
3 a
R / L1
U / T1
3 a
V1
V1
M
M
S / L2
V / T2
S / L2
V / T2
W1
W1
(3)
T / L3
W / T3
(3)
T / L3
W / T3
LI2
PA / +
LI2
PA / +
(4)
(5)(5)
LI6
PB
PC / -
(6)
(4)
LI6
PB
PC / -
(6)
PWR
(5)(5)
PWR
+24
R1A
R1B
R1C
+24
R1A
R1B
R1C
(2)
LI1
P0
(2)
LI1
P0
(1) 115/230 V ~ only.
(2) In this example, the logic inputs LIo are wired as "Source" but can be wired as "Sink Int" or "Sink Ext".
(3) Line choke (if used)
(4) Standardized coaxial cable, type RG174/U according to MIL-C17 or KX3B according to NF C 93-550, external diameter
2.54 mm /0.09 in., maximum length 15 m / 49.21 ft. The cable shielding must be earthed.
S1A91443 02/201435
Technical data
(5) Use cable ends DZ5CE020 (yellow) on wires connected to PWR and +24 inputs.
(6) Braking resistor (if used)
When the stop request is activated, deceleration of the motor, controlled by the drive, is requested first. Then,
after a time delay corresponding to the deceleration time, the STO function is activated.
Example:
- 2-wire control
- LI1 assigned to forward.
- LI2 assigned to reverse.
- Standard EN 954-1category 3 and ISO 13849-1 require the use of a dual-contact stop button (S1).
- S1 is used to activate the STO function.
- S2 is used to initialize the Preventa module when powering up or after an emergency stop. ESC enables the
use of other initialization conditions for the module.
- One Preventa module can be used for the STO safety function on several ATV61/71/LIFT drives. In this case
the time delay must be set to the longest stopping time.
A Logic output on the Preventa module can be used to indicate reliably that the drive is operating in safe
conditions.
Note: For preventive maintenance, the STO function must be activated at least once a year. The drive power
supply must be turned off and then on again before carrying out this preventive maintenance. The drive logic
output signals cannot be considered as safety-type signals.
Install interference suppressors on all inductive circuits near the drive or coupled to the same circuit (relays,
contactors, solenoid, valves, etc).
Choice of associated components:
Please refer to the catalog.
36
S1A91443 02/2014
Technical data
S1
U / T1
V / T2
W / T3
R / L1
U1
W1
V1
M
3 a
S / L2
T / L3
A1
(1)
(4)
ATVp1Hppppp
+24
PWR
R1A
R1C
R1B
LI1
LI6
LI2
P0
PA / +
PB
PC / -
(3)(3)
(2)
Connection diagram conforming to IEC 61508 and IEC 60204-1
Connection diagram conforming to the standard IEC/EN61508 Capacity SIL2, Stopping category 0 in accordance with the
standard IEC/EN 60204-1, without protection against supply interruption or voltage reduction an d subsequent rotation.
S1: Emergency Stop
(1)Line choke (if used)
(2)Standardized coaxial cable, type RG174/U according to MIL-C17 or KX3B according to NF C 93-550,
external diameter 2.54 mm /0.09 in., maximum length 15 m / 49.21 ft. The cable shielding must be earthed
(3)Use cable ends DZ5CE020 (yellow) on wires connected to PWR and +24 inputs
(4)Braking resistor (if used)
S1A91443 02/201437
Technical data
38
S1A91443 02/2014
Appendix
Appendix
What's in this Chapter?
This chapter contains the following topics:
TopicPage
ATV61 Product sizes40
ATV71 Product sizes44
7
S1A91443 02/201439
ATV61 Product sizes
Correspondence table
This table allows making the correspondence between the size and the reference of the drive.