Driving safely
January 1st 2004

Unidrive SP from Control Techniques sets a new benchmark for drive safety, preventing motor motion with an integrated secure disable function Often in modern drive systems, some high integrity means has to be provided of preventing a motor shaft from being set in motion by a drive. In most conventional systems this requirement is fulfiled by safety contactors, which are an additional component and have to be installed by the user in line with current European regulations to ensure safety compliance. Now, in a new development, both the cost and the complexity of fitting external safety devices can be avoided. This development is Control Techniques Unidrive SP, a new AC drive complete with its own integrated Secure Disable function, that can be incorporated into the safety system of a machine. The reliability of the Secure Disable function is superior to that offered by virtually any single-channel electromechanical device such as a contactor. In design terms SD is like having a special highly reliable contactor built in to the drive output, but there are no moving parts, no extra costs, and no special requirements for preventing the contactor from opening on load. As a result, SD offers the ideal solution for eliminating contactors, including special safety contactors, from systems where the prevention of movement is important to avoid safety hazards or expensive damage. The Secure Disable function is failsafe in operation, so that when the SD input is disconnected the drive will not operate the motor, even if combinations of components within the drive have failed. It is also independent of the drive firmware; as such it meets the requirements of EN954-1 category 3 for the prevention of motor operation. (EN954-1 is the EC harmonised standard for the safety of control systems of machinery, and is listed under the EC Machinery Directive 98/37/EC.) Secure Disable differs from competing systems in that it has been designed into the Unidrive SP from first principles. By careful design of fail-safe electronic circuits it has avoided the need for expensive additional option modules or safety relays, and offers superior integrity for lower cost. Most systems available in competing drives use the same basic principle as the Unidrive SP, which is to interrupt the power supply to the opto-coupler LEDs. However, competing drives generally use a relay to interrupt the power and provide electrical isolation and/or signal level shifting. Even though the relay is usually a special high reliability type, it still has the possibility to fail in the closed direction. In order to detect this, the relay must be of the connected-movement design; so that if the main contacts remain closed their malfunction can be detected by an external circuit through an auxiliary contact. This is a standard method for monitoring safety relays. However, if the relay does fail in the closed direction then the drive may become enabled before the failure is detected. Because of this, the drive with an external test circuit can only meet category 2 of EN954-1. For a category 3 application it is still necessary to use one external contactor to prevent the motor from being driven due to this first potential fault. SECURE DISABLE: HOW IT WORKS Any AC induction motor requires a rotating magnetic field to produce torque, and this, in turn, requires a three-phase source of alternating current at the motor connections. The drive controlling the motor has available a single internal DC supply, which is converted to AC by the continual active switching action of six power semiconductor devices (IGBTs). There are no component faults in this part of the circuit that can cause the motor to operate unintentionally. The switching signals are conveyed from the control circuit to the IGBTs by opto-couplers which use light-emitting diodes (LEDs) to transmit commands across the electrical isolation barrier. With the Unidrive SPs Secure Disable system, the power supply to the LEDs is provided by a fail-safe circuit from the enable input. The switching sequence can therefore only reach the IGBTs if the enable input is present, or if a highly unlikely combination of unrevealed faults has occurred which has allowed the input to receive power. How Secure Disable Can Be Employed Secure Disable can be used in a wide variety of control circuits where provision is needed to prevent the motor from producing torque. The following examples are in order of increasing integrity: Application Examples of Secure Disable 1) Replacement of single safety contactor In the conventional system shown a contactor interrupts the connections to the motor. A feedback contact with connected movement enables the contactor state to be monitored in a safety interlock circuit, which is tested periodically. An unsafe failure of the contactor is therefore detected, but could still lead to a loss of the disable function until the next test. With Secure Disable no monitoring is required, since the drive has no single component failure modes in the unsafe direction. The safety contactor and its monitoring circuit are eliminated. The wire to the enable input has to be physically protected against short-circuit to a positive DC supply which could cause inadvertent enable. This is achieved by physical segregation or by a grounded cable screen. The possibility of a short circuit then becomes an excluded fault according to prEN954-2. 2) Replacement of two safety contactors In the conventional circuit shown there are two contactors each with connected movement contacts. If one contactor fails in the unsafe direction then this is detected by the control circuit the next time the enable command is removed. The system remains safe because the other contactor removes the supply from the drive. With Secure Disable, again no monitoring is required, since the drive has no single component failure modes in the unsafe direction and most faults are detected. Both safety contactors and their monitoring circuit are eliminated. Again it is essential that the wire to the enable input has to be physically protected against short-circuit to a positive DC supply which could cause inadvertent enable. This is achieved by physical segregation or by a grounded cable screen. NEW GUIDE Control Techniques has produced a guide, which gives a simple overview and explanation of how the Secure Disable function in the Unidrive SP fits into the overall scheme of safe machine design. The guide takes a broad look across the safety spectrum, encompassing Risk Assessment, Basic Concepts & General Principles for Design, Standards for Control Systems, and also includes typical examples of safety interlock systems with their respective costs and advantages/disadvantages. Copies of the new guide are available from Control Techniques Marketing Department, Tel: 01686 612900.

More articles from Control Techniques: