Danfoss iC7 Series Functional Safety User Guide

Danfoss iC7 Series Functional Safety

Introduction

Version History

This guide is regularly reviewed and updated. All suggestions for improvement are welcome.
The original language of this guide is English.

Table 1: Version History

The information in this version is valid for iC7-Automation frequency converters up to 1260 A.
AQ319741840653, version 0201| Minor updates.
The information in this version is valid for iC7-Automation frequency converters up to 106 A.
AQ319741840653, version 0102| First release.
The information in this version is valid for iC7-Automation frequency converters up to 43 A.

Purpose of this Operating Guide

This operating guide provides information on the functional safety features of the iC7 drives and is targeted at users already familiar with the Danfoss iC7 series. It is intended as a supplement to the drive-specific guides.
The guide includes instructions on how to verify that the built-in functional safety features are active, and about configuring the safety features.

Additional Resources

Additional resources are available to help understand the features, and safely install and operate the iC7 products:

• Safety guides, which provide important safety information related to installing iC7 drives.
• Installation guides, which cover the mechanical and electrical installation of drives, or functional extension options.
• Design guides, which provide technical information to understand the capabilities of the iC7 drives for integration into motor control and monitoring systems.
• Operating guides, which include instructions for control options, and other components for the drive.
• Application guides, which provide instructions on setting up the drive for a specific end use. Application guides for application software packages also provide an overview of the parameters and value ranges for operating the drives, configuration examples with recommended parameter settings, and troubleshooting steps.
• Facts Worth Knowing about AC Drives, available for download on www.danfoss.com.
• Other supplemental publications, drawings, and guides are available at www.danfoss.com.
  Latest versions of Danfoss product guides are available for download at http://drives.danfoss.com/downloads/portal/.

Abbreviations

Table 2: Abbreviations Related to Functional Safety

(for pneumatic and electromechanical components).
Cat.| EN ISO 13849-1:2015| Category, level “B, 1–4”
CCF| –| Common cause failure
FIT| –| Failure in time: 1E-9/hour
HFT| EN IEC 61508-4:2010| Hardware fault tolerance: HFT = n means that n+1 faults could cause a loss of the safety function.
MTTFd| EN ISO 13849-1:2015| Mean time to failure – dangerous. Unit: Years are divided into Low, Medium, and High.
PFH| EN IEC 61508-4:2010| Probability of dangerous failures per hour. Consider this value if the safety device is operated in high demand or continuous mode of operation, where the frequency of demands for operation made on a safety- related system is greater than 1 per year.
PFD| EN IEC 61508-4:2010| Average probability of failure on demand, value used for low demand operation.
PL| EN ISO 13849-1:2015| Discrete level used to specify the ability of safety- related parts of control systems to perform a safety function under foreseeable conditions. Levels divided into a to e.
PLr| –| Required performance level (the required performance level for a particular safety function).
SIL| EN IEC 61508-4:2010| Safety integrity level
STO| EN IEC 61800-5-2:2017| Safe Torque Off
SS1| EN IEC 61800-5-2:2017| Safe Stop 1
SRECS| –| Safety-related electrical control system
SRP/CS| EN ISO 13849-1:2015| Safety-related parts of control systems
PDS/SR| EN IEC 61800-5-2:2017| Power Drive System (safety-related)

Safety

Qualified Personnel for Working with Functional Safety

Only qualified personnel can install, configure, commission, maintain, and decommission functional safety features and functions.
Qualified personnel for working with functional safety features are qualified electrical engineers, or persons who have received training from qualified electrical engineers, and are suitably experienced to operate devices, systems, plants, and machinery in accordance with the general standards and guidelines for safety technology.
Furthermore, they must:

• Be familiar with the basic regulations concerning health and safety/accident prevention.

• Have read and understood the safety guidelines given in this manual.

• Have a good knowledge of the generic and specialist standards applicable to the specific application.
  Installers and system designers of power drive systems (safety-related) (PDS(SR)) are responsible for:

• Hazard and risk analysis of the application.

• The overall safety of the application.

• Identifying safety functions required and allocating SIL or PL to each of the functions, other subsystems, and the validity of signals and commands from them.

• Designing appropriate safety-related control systems, such as hardware, software, and parameterization

General Safety Considerations

When installing or operating the AC drive, pay attention to the safety information given in the instructions. For more information about safety guidelines for installation, see the product-specific safety guide that is included in the drive shipment. For more information about safety guidelines for operating the drive, see the product-specific operating guide.

NOTICE

After installing the safety functions, perform a commissioning test.
A successful commissioning test is required after the initial installation, and after each change to the installation or application involving functional safety.

• If the commissioning test fails, safe operation cannot be guaranteed.

WARNING

RISK OF ELECTRIC SHOCK
The STO safety function does not provide electrical safety. The STO function itself is not sufficient to implement the Emergency Off function as defined by IEC 60204-1:2018. Using the STO function to implement Emergency-Off may lead to death or personal injury.

• Emergency-Off requires measures of electrical isolation, for example, by switching off mains via an extra contactor.

iC7 Functional Safety

Safe Torque Off (STO)

NOTICE
Select and apply the components in the safety control system appropriately to achieve the required level of operational safety.
Before integrating and using STO in an installation, carry out a thorough risk analysis on the installation to determine whether the STO functionality and safety levels are appropriate and sufficient.

The Safe Torque Off (STO) function is a component in a safety control system. STO prevents the unit from generating the power required to rotate the motor.
The iC7 drives are available with:

• Safe Torque Off (STO), as defined by EN IEC 61800-5-2:2017.
• Stop category 0, as defined in EN IEC 60204-1:2018.

The STO function is available for iC7-Automation drives with functional safety option code +BEF1. Specific hardware revisions are listed in the appendix of the functional safety certificate.

STO Activation

The STO function is activated by removing the voltages at the STO inputs of the frequency converter. By connecting the frequency converter to external safety devices providing a safe delay, an installation for a Safe Stop 1 can be obtained. External safety devices must fulfill the required Cat./PL or SIL when connected to STO inputs.
With default settings, the frequency converter issues a fault, trips the unit and coasts the motor to a stop, when the STO function is activated. Manual restart is required.
Use the STO function to stop the frequency converter in situation, where a safety function is required. In normal operating mode when STO is not required, use the standard stop function instead.

Automatic/Manual Restart Behavior

The STO default state prevents unintended restarts (Restart Prevention Behavior).

NOTICE
The prevention of unintended restart after STO deactivation does not fulfill a SIL 2 or SIL 3 requirement. If unintended restart is critical to the installation, this has to be controlled by the use of STO, both after STO activation and at normal start-up scenarios, for example after normal power cycle.

CAUTION

The default restart behavior is set to Manual. Before switching to Automatic, ensure that requirements of EN ISO 12100:2011 paragraph 6.3.3.2.5 are fulfilled.

Terminating STO and Resuming Normal Operation

1. Reapply 24 V DC supply to STO inputs.
2. Give a reset signal (via bus, digital I/O, or the control panel.

Set the STO function to automatic restart by setting the value of parameter 7.2.1 Safe Torque Off Response from default value Fault (manual reset) to value Warning (automatic reset).
Automatic reset means that STO is terminated and normal operation is resumed, when the 24 V DC is applied to STO inputs. No reset signal is required.

System Configuration Security

iC7 drives are equipped with a hardware security chip, and the application software includes both mandatory and configurable security features that prevent unauthorized access to the drive, ensure secure connectivity to the drive, and protect the drive against unauthorized software modifications.
For more details on the security features included in the application software, refer to application software documentation.

Configurable security features can be adjusted according to application requirements. Depending on the software version of the frequency converter, the parameters can be password-protected.

Frequency Converters with Functional Safety Group 1 (Not Upgradable)

Frequency converters with STO (+BEF1) provide the Safe Torque Off (STO) safety function with a dual-channel, galvanically isolated input, and an STO feedback signal for diagnostic purposes.
The drive integrates the STO functionality via the functional safety I/O terminals as described in Table 3.
The iC7 drive with STO functionality is designed and approved suitable for the requirements of:

• Category 3 in EN ISO 13849-1.
• Performance Level “e” in EN ISO 13849-1.
• SIL 3 in IEC 61508 and EN 61800-5-2.

The STO safety function is active if one or both of the STO inputs are not connected to a +24 V signal. The frequency converter is not able to go to the RUN state. For more information, see Table 4.
Prerequisites for normal operation (STO function is not active) are:

• STO A and STO B signals are energized.
• No internal faults are active.

All control input and outputs are galvanically isolated from supply voltage (PELV) and other high voltage terminals, unless otherwise specified.

Table 3: Functional Safety I/O Terminals in Frequency Converters

Table 4: Instances of the STO Function and STO Feedback Output

STO inputs| Operating conditions| STO function| STO feedback signal| Fault or warning text
---|---|---|---|---
Both inputs energized with 24V DC| Normal operation| Deactivated| Deactivated| No faults or warnings
Power removed from both in- puts| STO demand| Activated| Activated| “STO activated” (1)
Only one input energized| Failure in demand or due to internal fault| Activated| Deactivated| “STO – Fault [channel name]” (2)

1. Regular STO demand: Can be either fault or warning depending on restart settings.
2. Failure in demand or due to internal fault (always a “fault”, not configurable). Indicated after discrepancy timer (500 ms) elapsed.

STO Properties

For flexible adaptation to the safety system, the STO inputs contain the following properties:

• Galvanic isolation of terminals: The functional safety I/O terminal blocks on the control board (X31, X32) have separate, galvanically isolated inputs to allow, for example, interchanging of the polarities of the STO input terminals as shown in Illustration 7 and Illustration 8.

• Test pulse filtering: Several control modules test their safe outputs using Test Pulse Pattern (on/off tests), to identify faults due to either short or cross circuiting. When connecting the STO inputs with a safe output of a control module, test pulses shall not activate STO. For that reason, test pulses for no longer than 2 ms will be ignored on the STO input lines.
  Illustration 1: Test Pulse Filtering
  

• Asynchronous input tolerance: The input signals at the STO terminals are not always synchronous. If the discrepancy between the two signals is longer than 500 ms, the drive indicates a STO fault as described in Table 4. This feature does not delay the activation of the STO function.
  Illustration 2: Discrepancy Time
  

STO Failure

An internal hardware failure might lead to a mode where an external STO request does not lead to the de-energizing of the motor. The PFH/PFD and MTTF values stated in Functional Safety Standards and Performance reflect the probability of this fault. Any other STO-related, internal failures lead directly to an unrequested activation of the STO function, or effect only one of the 2 redundant STO channels. Failures effecting a single channel are detectable when performing the diagnostic test specified in Operation and Maintenance.

STO Feedback

STO feedback is a single channel feedback signal which can be used for diagnostic purposes, and for providing an indication of an active STO. It can help to achieve better safety capability on system level, for example, in retrofit cases, where a diagnostic feedback to the safety system is required.

Illustration 3: STO Feedback Example (1/2)

It can also be used as a digital output for providing a status signal. In this case the load could be a digital input of a PLC.

Illustration 4: STO Feedback Example (2/2)

The STO feedback works similar to a contactor which is closed as soon as both STO input channels are de-energized.

Installation

STO Installation for Frequency Converters with Functional Safety Group 1

(STO – Not Upgradable)

For motor connection, AC mains connection, and control wiring, follow the instructions for safe installation in the documentation shipped with the drive. All functional safety related wiring must be done on terminal blocks X31 and X32. See Illustration 5 for the location of the terminals.

NOTICE

If multi-stranded wires are used in the installation, ferrules or other suitable means must be used to prevent a single core from short-circuiting with adjacent pins.

Illustration 5: Functional Safety Terminals

Table 5: Functional Safety I/O Terminals in Frequency Converters

Terminal X31| | | Terminal X32|
---|---|---|---|---
Numbering| Terminal Name| Functions| Numbering| Terminal Name| Functions
41| 24 V| + 24 V DC Output| 45| GND| 0 V/GND
42| S.INA+| + STO Input Channel A| 46| S.INA–| – STO Input Channel A
43| S.INB+| + STO Input Channel B| 47| S.INB–| – STO Input Channel B
44| S.FB+| + STO Feedback| 48| S.FB–| – STO Feedback

The frequency converter is shipped without any wiring to the functional safety I/O terminals. As a result, all safe inputs are de-energized and STO is active.

1. If the STO safety function is not needed, wire the terminal block as shown in Illustration 6, or use the STO jumper clips from the accessory bag, and mount them on X31 and X32. This ensures that both STO inputs are energized with 24 V DC for enabling normal operation.
   Illustration 6: Wired Terminal Block (on the Left) and STO Jumper Clip (on the Right)
   

Connection Examples

Due to the galvanic isolation of the STO inputs, various connections and different polarities are possible in the wiring. For example, connect a safety actuator to STO input terminals, and set the voltage references as shown in Illustration 7 and Illustration 8. Setups with the same voltage level on both channels (+24 V) are supported, but also setups with different voltage levels (+24 V and GND).

NOTICE

To avoid stacking and drifting of voltages to a dangerous level, GND PELV of the drive and the external safety device must be interconnected.

Illustration 7: STO Connection Example for Using the Same Polarities (Channel A and Channel B = 24 V)

Illustration 8: STO Connection Example for Using Different Polarities

For other wiring examples, see application software documentation.

Commissioning

Safety Instructions for Commissioning

See Safety and the relevant drive operating guides for more instructions on safety. Always observe the instructions provided by the motor manufacturer.

WARNING

RESIDUAL ROTATION
The STO function can be used for asynchronous, synchronous, and permanent magnet motors. Two faults can occur in the power semiconductor of the drive. When using synchronous or permanent magnet motors, a residual rotation can result from the faults.
The rotation can be calculated to angle = 360/(number of poles). The application using synchronous or permanent magnet motors must consider this residual rotation and ensure that it does not pose a safety risk. The situation is not relevant for asynchronous motors.

Commissioning Test

After installation and before first operation, a commissioning test using STO is required. The commissioning test is also required after each modification of the installation or application that involves STO.

NOTICE

After installing the safety functions, perform a commissioning test.
A successful commissioning test is required after the initial installation, and after each change to the installation or application involving functional safety.

• If the commissioning test fails, safe operation cannot be guaranteed.

To perform a commissioning test:

• See Commissioning Test for STO Applications in Manual Restart Mode if STO is set to manual restart mode (parameter Safe Torque Off Response is set to default setting Fault, reset required (manual reset).
• See Commissioning Test for STO Applications in Automatic Restart Mode if STO is set to automatic restart mode (parameter Safe Torque Off Response is set to Warning, no reset required (automatic reset).

Commissioning Test for STO Applications in Manual Restart Mode

Table 6: Commissioning Test in Manual Restart Mode

safety device while the frequency converter drives the motor (that is, the mains supply is not interrupted).| □
5| Verify that the motor coasts.
It may take a long time for the motor to stop.| □
6| If a control panel is mounted, check if STO activated is shown on the control panel.| □
If the control panel is not mounted, check if STO activated is listed in the event log.
7| If the STO feedback is utilized, verify that STO is activated by checking the state of the STO Feedback. See Illustration 4.| □
8| Reapply 24 V DC to STO inputs.| □
9| Ensure that the motor remains in the coasted state, and any connected relays remain activated.| □
10| Send a reset signal via fieldbus, digital I/O, or the control panel.| □
11| Ensure that the motor becomes operational and runs within the original speed range.| □

Commissioning Test for STO Applications in Automatic Restart Mode

Table 7: Commissioning Test in Automatic Restart Mode

safety device while the frequency converter drives the motor (that is, the mains supply is not interrupted).| □
5| Verify that the motor coasts.
It may take a long time for the motor to stop.| □
6| If a control panel is mounted, check if STO activated is shown on the control panel.| □
If the control panel is not mounted, check if STO activated is listed in the event log.
7| If the STO feedback is utilized, verify that STO is activated by checking the state of the STO Feedback. See Illustration 4.| □
8| Reapply 24 V DC to STO inputs.| □
9| Ensure that the motor becomes operational and runs within the original speed range.| □

Operation and Maintenance

Functional Tests

• It is required for PL e or SIL3 to conduct a functional test every 3 months to detect any failure or malfunction of the STO functionality.
• It is required for PL d or SIL2 to conduct a functional test every 12 months to detect any failure or malfunction of the STO functionality.
• It is recommended, but not required for PL c or SIL1 to conduct a functional test every 12 months to detect any failure or malfunction of the STO functionality.

NOTICE

If the functional test fails, safe operation cannot be guaranteed.

1. Conduct the functional test by performing the steps described in Functional Test Using the STO Feedback Signal or Functional Test Without Using the STO Feedback Signal.

Functional Test Using the STO Feedback Signal
The feedback signal (that is, Reference) is active whenever the STO function is activated internally by both redundant STO channels (A+B). It is an easy indicator that both channels are working.

Table 8: Functional Test Using the STO Feedback Signal

input channel A and B** simultane- ously while the frequency converter drives the motor (that is, the mains supply is not interrupted).| □
6| Verify that the motor coasts.

It may take a long time for the motor to stop.

| □
7| Verify that the STO Feedback output signals an active STO. The output signals a full STO only when both chan- nels are invoked.| □
8| Give a start command to verify that the STO function blocks the drive’s operation. The motor must not start.| □
9| Reapply 24 V DC to STO inputs.| □
10| Optional step, only with the manual reset mode setting:
Send a reset signal via fieldbus, digital I/O, or control panel.| □
11| Ensure that the motor becomes operational and runs within the original speed range.| □

Functional Test Without Using the STO Feedback Signal
As an alternative solution, it is also possible to verify the STO function without the feedback signal. In this case, both channels have to be tested separately.

Table 9: Functional Test Without Using the STO Feedback Signal

the frequency converter drives the motor (that is, the mains supply is not interrupted).| □
5| Verify that the motor coasts.

It may take a long time for the motor to stop.

| □
6| If a control panel is mounted, check if STO – Fault Ch A is shown on the control panel.| □
7| If the control panel is not mounted, check if STO – Fault Ch A is listed in the event log.| □
8| Give a start command to verify that the STO function blocks the drive’s operation. The motor must not start.| □
9| Reapply 24 V DC to STO inputs.| □
10| Send a reset signal via fieldbus, digital I/O, or control panel.| □
11| Ensure that the motor becomes operational and runs within the original speed range.| □
12| Remove the 24 V DC voltage supply to STO input channel B terminals while the frequency converter drives the motor (that is, the mains supply is not interrupted).| □
13| Verify that the motor coasts.

It may take a long time for the motor to stop.

| □
14| If a control panel is mounted, check if STO – Fault Ch B is shown on the control panel.| □
15| If the control panel is not mounted, check if STO – Fault Ch B is listed in the event log.| □
16| Give a start command to verify that the STO function blocks the drive’s operation. The motor must not start.| □
17| Reapply 24 V DC to STO inputs.| □
18| Send a reset signal via fieldbus, digital I/O, or control panel.| □
19| Ensure that the motor becomes operational and runs within the original speed range.| □

Diagnostic Tests

If the STO feedback signal is utilized, conduct an extra test for SIL3 every 24 months to detect any STO feedback functionality failures.

Table 10: Diagnostic Test for STO Feedback Signal

while the frequency converter drives the motor (that is, the mains supply is not interrupted).| □
6| Verify that the motor coasts.

It may take a long time for the motor to stop.

| □
7| If a control panel is mounted, check if STO – Fault Ch A is shown on the control panel.| □
8| If the control panel is not mounted, check if STO – Fault Ch A is listed in the event log.| □
9| Verify that the STO Feedback output does not signal an active STO. (The output signals a full STO only when both channels are invoked.)| □
10| Give a start command to verify that the STO function blocks the drive’s operation. The motor must not start.| □
11| Reapply 24 V DC to STO inputs.| □
12| Send a reset signal via fieldbus, digital I/O, or control panel.| □
13| Ensure that the motor becomes operational and runs within the original speed range.| □
14| Remove the 24 V DC voltage supply to STO input channel B terminals while the frequency converter drives the motor (that is, the mains supply is not interrupted).| □
15| Verify that the motor coasts.

It may take a long time for the motor to stop.

| □
16| If a control panel is mounted, check if STO – Fault Ch B is shown on the control panel.| □
17| If the control panel is not mounted, check if STO – Fault Ch B is listed in the event log.| □
18| Verify that the STO Feedback output does not signal an active STO. (The output signals a full STO only when both channels are invoked.)| □
19| Give a start command to verify that the STO function blocks the drive’s operation. The motor must not start| □
20| Reapply 24 V DC to STO inputs.| □
21| Send a reset signal via fieldbus, digital I/O, or control panel.| □
22| Ensure that the motor becomes operational and runs within the original speed range.| □

Specifications

Functional Safety Standards and Performance

All safety functions in the iC7 drives meet the requirements of the standards listed in this chapter.

Table 11: Functional Safety Standards and Performance

13849-1:2015,

EN ISO 13849-2:2012

EN IEC 61800-5-2:2007
EMC Directive (2014/30/EU)| EN IEC 61800-3:2018 – second environ- ment
EN IEC 61326-3-1:2017
Low Voltage Directive (2014/35/EU)| EN IEC 61800-5-1:2017
Safety standards| Safety of Machinery| EN ISO 13849-1:2015, IEC 60204-1:2018
Functional Safety| IEC 61508-1:2010, IEC 61508-2:2010,

EN IEC 61800-5-2:2017

Safety function| EN IEC 61800-5-2:2017 Safe Torque Off (STO)
IEC 60204-1:2018 Stop Category 0
Safety performance| EN ISO 13849-1:2015
Category| Cat 3
Coverage of diagnostic (functional) test| >90% (Medium)
Performance Level| Up to PL e
Maximum diagnostic test interval for related perform- ance level| PL e: 3 months
PL d: 12 months
Mean Time to Dangerous Failure| High (100 years per channel)
IEC 61508:2010
Safety Integrity Level| Up to SIL 3
Maximum diagnostic test interval for related safety in- tegrity level| SIL 3: 3 months
SIL 2: 12 months
Probability of Dangerous Failure per Hour| PFH: < 8 FIT
Probability of Dangerous Failure on Demand| PFD: < 5·10-4
HFT| Hardware Fault Tolerance = 1
Subsystem Classification| Type A
Proof Test Interval T1| 20 years
Mission time TM| 20 years
Reaction time| Input to output response time| < 30 ms (1)
Fault reaction time| < 30 ms
Mode of operation| High demand, Low demand, and Continuous

1. Input to output response time with shielded cables. Otherwise, a maximum of 20 ms might be added to this value under worst case EMC conditions.

Technical Data

Control input and outputs are galvanically isolated from supply voltage (PELV) and other high voltage terminals, unless otherwise specified.

Table 12: 24 V digital input for STO input (Functional Safety Group 1, +BEF1)

Table 13: 24 V digital outputs for STO feedback

Table 14: Auxiliary Voltages

Operating Conditions

Table 15: Operating Conditions for Functional Safety

corresponding to EN IEC 61800-5-1:2017 PD2 – non-condensing.
For PD2 condensing environments, the product must be installed in IP54/NEMA 12 cabinet as per EN IEC 60529 AMD 2:2013 , or similar.

Check the operating conditions for each drive from the product-specific design guide or operating guide. Latest versions of Danfoss product guides are available for download at http://drives.danfoss.com/downloads/portal/.

Cable Specifications

Table 16: Cable Sizing for Connectors X31, X32

Wire type| Cross section [mm 2 (AWG)]| Stripping length [mm (in)]
---|---|---
Solid| 0.5-1.5 (24-16)| 10 (0.4)
Flexible| 0.5-1.5 (24-16)| 10 (0.4)
Flexible with ferrule w/o plastic sleeve| 0.5-1.5 (24-16)| 10 (0.4)
Flexible with ferrule w plastic sleeve| 0.5 (24)| 10 (0.4)

Any information, including, but not limited to information on selection of product, its application or use, product design, weight, dimensions, capacity or any other technical data in product manuals, catalogues descriptions, advertisements, etc. and whether made available in writing, orally, electronically, online or via download, shall be considered informative, and is only binding if and to the extent, explicit reference is made in a quotation or order confirmation. Danfoss cannot accept any responsibility for possible errors in catalogues, brochures, videos and other material. Danfoss reserves the right to alter its products without notice. This also applies to products ordered but not delivered provided that such alterations can be made without changes to form, fit or function of the product. All trademarks in this material are property of Danfoss A/S or Danfoss group companies. Danfoss and the Danfoss logo are trademarks of Danfoss A/S. All rights reserved.

Customer Support

Danfoss A/S
Ulsnaes 1
DK-6300 Graasten
drives.danfoss.com

References

• Global AC drive manufacturer - Danfoss Drives | Danfoss
• Search | Danfoss
• Engineering Tomorrow | Danfoss
• Engineering Tomorrow | Danfoss

Read User Manual Online (PDF format)

Read User Manual Online (PDF format)  >>

Download This Manual (PDF format)

Download this manual  >>