Kostal INVEOR M Kurzanleitung Seite 4

Classification two-channel EN ISO 13849-1 with dynamic testing
The classification of the two-channel STO function with dynamic testing meets the
following requirements:
Designation Value
Safety measure Pulse block
PL e
Category 4
MTTFd 167 [a] Mean time to failure (dangerous)
DC 99 [%]
T 20 years
Max. diagnosis test
Daily
interval
Table: Classification of two-channel EN ISO 13849-1, with dynamic testing
The precise way in which a diagnosis test interval works is described in chapter 7 and
in the "Functional safety" operating instructions.
Classification one-channel (reduced SIL and PL)
The one-channel classification is the result of parallel connection of the two
STO inputs. The safety classification is thus reduced to the following values.
IMPORTANT INFORMATION
 The classification may be reduced due to false connection technology (e.g. one-
channel) during installation/planning!
 An external 1-channel structure, bridged to both STO inputs, means that the
safety level no longer meets SIL3 or PLe.
Designation Value
Safety measure Pulse block
SIL 1
PFH 1.81e-08 Probability of hazardous failures
SFF 99.24 %
T 20 years
PL c
Category 1
MTTFd 56 years Mean time to failure (dangerous)
DC 60 [%]
Table: Classification one-channel IEC 61508 and EN ISO 13849
IMPORTANT INFORMATION
When an external control system carries out a test of the connection in the
application 100 times more often than a "sharp" requirement of the STO function,
SIL 2 and PL d are achieved.
2 Type key/scope of application
The INVEOR line of drive controllers contains variants with and without
STO safety function. These variants are clearly recognisable by the product key. The
STO safety function cannot be retrofitted
Type key/scope of application
The following table provides an overview of devices with STO function:
INVEOR M
INV Mx IV01 PWxx LPxx AP10
INV Mx IV01 PWxx LPxx AP2x
INV Mx IV01 PWxx LPxx AP5x
INVEOR MP
INV MPx VS01 IV01 PWxx LPxx AP10
INV MPx VS01 IV01 PWxx LPxx AP2x
INV MPx VS01 IV01 PWxx LPxx AP5x
3 Technical data
Technical data, general
 Technical data, general
Technical data STO
Designation
STO max. response time
PELV/SELV power supply for STO input voltage (rating)
PELV/SELV tolerance for STO input voltage
(referring to rating)
Current consumption per STO channel with rated voltage
Start-up peak current (2.5 ms)
Compatibility: Max. OSSD pulse
Compatibility: Min. OSSD pulse period time
STO Input Low
STO Input High
STO Input High when operating with OSSD signals
Table: Technical data STO
- 4 -
The STO response team is the time between the deactivation of the STO input signal to
the definite fail-safe pulse block.
Explanation
---
Performance level
---
Diagnosis coverage
Duration of usage
STO input
The maximum STO response time of 50 ms is to be taken into account when using
the machine
Explanation 4 Safety functions
---
STO function (Safe Torque Off)
Safety Integrity Level
After the STO function is triggered, the drive is switched off (impulse block) and the
per hour
drive control runs down without braking (when no brake has been activated).
Proportion of safe failures
Duration of usage
Performance Level
The shut-down time must be considered in this application.
---
5 Application instructions - Safety
Diagnosis coverage
Restarting protection
In the event of dangerous loads having an external effect, a hazard can originate
from the STO status when no further measures are taken.
In addition to the switching examples, the instructions on the subject of "Restarting"
from the standards DIN EN ISO 13849-1 (BGIA Report 2/2008) and IEC 60204 are to be
considered.
The resetting of a safety requirement alone may not automatically result in the
restarting of the drive. Restarting may only be made possible through a fault
acknowledgement (manual reset) at the safety switching device.
Depending on the parameters set, it is possible for the drive controller to start up
automatically.
Internal auxiliary voltage
The 24 V supply of the application PCB is found in accordance with the SELV/PELV
requirement on terminal X5 and can be used as supply voltage for the STO channels. In
GHxx DKxx COxx this application case, a max. of 30 mA is available for additional external components.
GHxx DKxx COxx
GHxx DKxx COxx
6 Parameterisation
We recommend deactivating the "auto acknowledgement" of a fault (Parameter 1.181),
as otherwise an immediate restart can occur as soon as the fault is no longer present.
STO
The restart protection (not safety-related, parameter 1.132) should under no
circumstances be deactivated, as otherwise an immediate restart can occur when the
GHxx DKxx OAxx COxx
STO voltage is activated.
GHxx DKxx OAxx COxx
GHxx DKxx OAxx COxx
7 Diagnosis
The status of the STO function is signalled with the help of a potential-free diagnosis
contact that is locked in the safe status. The two-channel, deactivated impulse block is
thus displayed. This contact can be used as a response to a higher level control unit.
Diagnosis safety function
STO 1 STO 2
Off Off
On Off
Value Unit Off On
50 ms
On On
24 VDC
± 25 %
typ. 65 mA
 The maximum delay time between the activation of the safety function by the
400 mA
input-side safety device and the closing of the contact is 50 ms.
1 ms
 This reaction time is to be observed when using the machine and configured in
10 ms
accordance with the external fault diagnosis.
0..5 V
18..30 V
External dynamic test
19.2..30 V
An external dynamic test is necessary in order to achieve diagnosis coverage of 99%
and the resulting safety parameters. The STO channels are supplied with all possible
logical statuses and the expected status of the diagnosis relay is queried before each
motor activation is enabled.
IMPORTANT INFORMATION
IMPORTANT INFORMATION
IMPORTANT INFORMATION
IMPORTANT INFORMATION
Contact Note
closed Neither STO channel is supplied:
STO active
open Status implausible:
Channels show unequal result
open Status implausible:
Channels show unequal result
open Both STO channels are supplied:
Operation possible
IMPORTANT INFORMATION
- 5 -
8 Terminal assignment
The input terminal X310 serves the purpose of input-side connection of
electromechanical and electronic safety switching devices.
In addition to the safety-related inputs, the response contacts are available on
terminals X310.5 and X310.6 (diagnosis).
Terminal assignment X310
Control connections for functional safety
Terminal assignment X310
Terminal no. Designation Assignment
Control input 1 for the STO function
1 STO 1
(0 V/24 V)
2 GND STO 1 Reference potential STO 1 (0 V)
Control input 2 for the STO function
3 STO 2
(0 V/24 V)
4 GND STO 2 Reference potential STO 2 (0 V)
Normally open contact for response of STO to
5 C1
external control system (diagnosis)
Normally open contact for response of STO to
6 C2
external control system (diagnosis)
9 Installation/disassembly/commissioning
The installation and disassembly instructions, as well as the information concerning
commissioning refer in this document only to the subject area of "functional safety".
Installation
 Installation
STO connection cable
With reference to the STO connection line, the "elimination of errors with regard to
short circuit" is achieved in accordance with DIN EN 13849-2 in that a separate,
shielded cable is used for each channel.
Shielding is to be applied at both ends.
If only one shielded cable is used for both STO channels, a safety switch must be used
to detect possible crossovers between the channels to qualify for observation of the
"elimination of errors short circuit".
The maximum cable length for the connection of the STO channels is 30m.
The cable cross-section is to be designed in such a way to ensure the required
minimum input voltage of 18 V or 19.2 V during operation with OSSD signals.
Wiring instructions for control terminals X5 and X310:
Sizes A - D
Terminals: Plug terminal clamp with activation button
(slot screwdriver, max. width 2.5 mm)
Connection cross- 0.5 to 1.5 mm², single-wire, AWG 20 to AWG 14
section:
Connection cross- 0.75 to 1.5 mm², fine-wired, AWG 18 to AWG 14
section:
Connection cross- 0.5 to 1.0 mm², fine-wired
section:
(core end sleeves with and without plastic collars)
Length of stripped 9 to 10 mm
insulation:
 Disassembly
 Commissioning
STO validation
In the context of commissioning, it is absolutely necessary to request the STO function of
the drive controller in order to ensure problem-free function.
To this purpose the STO function is requested with running motor. The motor must then
run down.
The diagnosis function must also be checked. Refer to operating manual for more details.
SS1 Validation
The INVEOR drive controller is not equipped with a safety-related input which provides the
SS1 function.
The SS1 validation thus contains the check of the STO safety function of the drive
controller and the check of the external safety switching device, which requests the STO
function upon expiry of the set time.
10 Dealing with malfunctions
 Error detection and troubleshooting
 Malfunction overview
 Fault display
 Fault-finding and troubleshooting
11 Maintenance
 Maintenance
 Maintenance checklist
SS1 Validation
The STO function is requested when the motor is running. The motor must then run down.
In accordance with the selected safety application (refer to operating manual for more
details), the correct functioning of the diagnosis or of the dynamic test must also be
documented.
- 6 -