Using functional safety in AC drives

Above all else, safety is of overriding importance in the operation of machinery. This has led the European Union (EU) to demand that machines meet essential health and safety requirements before they can be placed on the market within the EU.

On the technological side, there have been developments in electronic control systems that have affected how AC drives can fulfil a safety function. Emergency stop buttons, electromechanical safety relays and limit switches are increasingly being replaced by electronics. 

The standard governing the safety related functions of VSDs is EN 61800-5-2, with the main requirements being those governing the stopping of machinery in a safe way. As well as setting requirements for design principles of safety-related drive systems, the standard also defines a number of standardised safety functions for drives.

Stopped but not shut down 

Perhaps the most essential of these is the safe torque-off or STO function, which temporarily cuts the voltage to the motor without the need to shut down the whole drive. Safe cleaning and maintenance of processing machinery can then be carried out, while the drive remains ready to resume normal operations. 

Instead of contactors, STO simply disables drive output modulation and safely removes the drive’s ability to make the motor produce torque. If electrical maintenance needs to be carried out, the conventional method of lock-off isolation would still be needed. The use of STO is for short-term periods only, during normal production process changes.

Advanced monitoring

STO can be combined with more advanced monitoring functions, such as time-delay relays or so called configurable safety systems. Related functions are safe-stop, which brings the machinery to a safe stop if certain conditions are detected, either when the motor speed reaches a specified level or after a time delay.

Other functions such as safe brake control (SBC) provides a safe output signal to control the motor’s mechanical brake, while the safely limited speed (SLS) function prevents the motor from exceeding the specified safe speed.

Such configurable systems become viable when several safety functions are implemented in the same system. For single safety functions, dedicated components such as time delay relays are more practical.

External safety components are usually wired and configured to operate together with the drive. Developing an application usually requires wiring and configuration of the two devices individually so that they can work together. 

Integrated safety

The next logical step is to integrate the safety functionality into the drive itself, saving on wiring, freeing-up inputs and outputs and saving space. Commissioning mainly consists of setting parameter values and behaviour options.  Another advantage is that a single fieldbus connection can be used for both regular and safety communication.

An example of this approach is a recently launched drive that offers STO as well as an optional module offering some of the functions certified under the Machinery Directive. These are: SS1 (Safe Stop 1), which ramps the controlled motor down to zero speed; SSE (Safe Stop Emergency), emergency stop ramped; SBC (Safe Brake Control), used for proper safe management of a crane brake; SMS (Safe Max Speed), typically used on centrifuges to prevent damage; and SLS (Safely-Limited Speed), which ensures safe limited speeds for motions like jogging and threading.

Developing drive-integrated safety is challenging for drive manufacturers, yet this is still cheaper than achieving the same functionality with external safety components. The best drives vendors are prepared to offer support to help users get the drive that meets their needs. They will provide the correct safety functionality to meet a given risk assessment, ensuring that safety is always the first priority.