Machinery safety-related control systems used to be implemented alongside the general machine control system to monitor the safety circuits and force the machine’s movements to be halted in the event of an emergency pushbutton being pressed or a guard being opened. Today, thanks partly to changes in international machinery safety standards and partly to technological developments, safety and standard controls are being integrated more closely together.

Machine builders and end users can both benefit from the simplified design and improved diagnostics, and further benefits for the end user include greater machine availability and improved usability – especially in terms of set-up and maintenance.

One of the fastest growing areas of safety and standard control integration is in inverter and servo drives; many of the leading suppliers now offer products with a ‘safe stop’ (or ‘safe torque off’) feature suitable for Safety Category3 applications (as per EN954-1, Safety of machinery. Safety related parts of control systems. General principles for design), while a smaller number have developed drives with more sophisticated functions or higher-integrity safety.

Because drives with built-in safety inevitably contain electrical, electronic and programmable electronic (E/E/PE) safety-related systems, they fall within the remit of IEC61508 (Functional safety of electrical/electronic/programmable electronic safety-related systems). However, IEC61508 is a basic functional safety standard that sets a framework for other standards – such as that covering machinery, namely ENIEC62061 (Safety of machinery – Functional Safety of safety-related electrical, electronic and programmable electronic control systems). It is also being used by IEC technical committees for creating product standards, and the first of these to be published were IEC61800-5-1 (Adjustable speed electrical power drive systems. Safety requirements –electrical, thermal and energy) and IEC61800-5-2 (Adjustable speed electrical power drive systems. Safety requirements – functional).

Both IEC61800-5-1 and IEC61800-5-2 were published on 16th July 2007, with the plan being that they will be harmonised to the Machinery Directive shortly. Once ENIEC61800-5-2 is available, it is intended that it will provide requirements and recommendations to ensure that functional safety is maintained in the design, development, integration and validation of power drive systems (PDSs) for use in safety-related control applications (ie PDS(SR)s).

Machine builders need not concern themselves with complying with the new standard, as it is aimed at the manufacturers of PDS(SR)s. But machine builders do need to appreciate that, under the standard, a PDS(SR) will provide specific safety-related functions that each has its own safety integrity level (SIL) capability and probability of dangerous failure per hour (PFHd). This information will be required by the machine builder in order to integrate the PDS(SR) within a wider safety-related control system designed in accordance with ENIEC62061.

Integrated safety

Lenze believes that its 9400 series servo drives offer major cost savings in machine construction by incorporating machine safety into the drive (Fig.1). These savings arise from reducing the number of external control components, which, in turn, reduces the panel size. In addition, the resulting simpler control system reduces machine build times and the time needed for commissioning. Safety in the drive also delivers a faster response to safety signals, which can result in reduced downtime and smaller machine footprints.

A Lenze9400 safety module for safe torque off is available, reference SM100, which is certified to EN954-1 Safety Category 4. As the power isolation of the motor is achieved within the drive, the power cables between the drive and the motor need not be interrupted by a contactor. This removes a potentially troublesome focal point for EMC interference, as well as saving the cost of the contactor, the panel space required and the time needed to connect it. Normally safety isolation is achieved by a further contactor on the input to the drive. This means that on restart a delay of tens of seconds is required while the drive capacitors recharge. With the Lenze plug-in safety modules, this contactor is also unnecessary, so restarts can be instantaneous – thereby saving in machine process times.

Safe torque off means an uncontrolled stop with the machine coasting to a halt, which may not be suitable for many types of high-speed machines. Such machines stop quicker under a powered stop, where the drives and motors act as brakes, regenerating energy. This type of powered stop can also be performed safely and is known as safe stop. The Lenze9400 servo drives achieve this with the SM300 plug-in module that meets EN954-1 Safety Category3. Known as safe stop 1, this safety function removes power to the motor so that the machine can be moved manually. Safe stop2, on the other hand, which is offered by the LenzeSM301 module, maintains the electrical supply to the motor so that the machine is held safely in a fixed position.

The SM301 module also provides a number of other safety functions, including safe torque off, safe stop 1, safe limited speed, safe maximum speed, operator selection mode with confirmation, and safe speed feedback.

In addition, the module benefits from four safe inputs for active or passive sensors, a configurable safe output and an optional connection to a Profisafe safety fieldbus.

Lenze’s9400 servo drives offer more safety functions than most others, and the use of simple plug-in modules to determine the functionality is particularly elegant. B&R has integrated safety into its ACOPOSmulti motion controllers for multi-axis applications (Fig.2). In this case, however, the system is based on Ethernet Powerlink Safety (EPLsafety). As well as safe stop1 and safe stop2, the ACOPOSmulti also offers safe limited speed, safe limited step, safe absolute position and safe direction of rotation.

Siemens Automation & Drives offers the Sinamic S120 single- and multi-axis drives with the Siemens ‘Safety Integrated’ concept (Fig.3). These drives therefore incorporate the following safety functions: safe torque off, safe stop1, safe stop2, safe brake control, safe brake ramp, safe operating stop, safe limited speed and safe speed monitoring. In addition, the drive can be connected to a Profisafe fail-safe fieldbus network.

Pilz is one of the best known suppliers of machinery safety control products in Europe, and it launched the PMCprotego D safe servo amplifiers in March2007 (Fig.4). These utilise a plug-in safety card suitable for single-axis applications, and the intention is to use Safetynet p (which is based on Ethernet) to enable multi-axis applications to be handled.

Rexroth’s Indradrive with ‘Safety on Board’ (Fig.5) offers safe torque off, safe stop1, safe stop2, safe standstill, safe limited speed, safe limited increment, safe limited maximum rotational speed, and safe direction of rotation.

Safety expansion card slot

As was stated earlier, many suppliers of drives are limiting the safety functionality to an EN954-1 Safety Category3 safe torque off (safe stop). Typical of this type of product are the Danfoss VLT Automationdrive FC 300 (0.25kW to 1000kW power range), the Danaher MotionS700 drive (which also has an additional slot for a safety expansion card to support safety functions such as safely reduced speed and safe operational stop), and Rockwell Automation offers Driveguard (Safety Category3 safe torque off) as an option on its Powerflex40P, Powerflex70 and Powerflex700S AC drives. In addition, the ESR Pollmeier Triodrive and Mididrive D/xS model AC servo drives have safe torque off up to Safety Category4, and Baumüller offers its b maXX4400 servo controllers with a choice of Safety Category3 or 4 safe stop functions (Fig.6).

There will, of course, be other inverter drives and servo drives on the market with safety functionality, and the IEC61800-5-2 standard also provides scope for other safety functions. These include: safe speed range; safe limited acceleration; safe acceleration range; safe limited torque; safe torque range; safe motor temperature; safe brake control; and safe cam.

With increased safety functionality, there are benefits in sharing the safety data with a more sophisticated safety monitor and controller via a fail-safe industrial fieldbus. At EMO2007, Siemens Automation and Drives (A&D) presented new integrated safety functions for its Sinumerik840D machine tool controllers (Fig.7). The safety functions – including sufficient safe cams for detecting up to 30 traversing ranges – meet all the requirements of IEC61508SIL2 as well as ENISO13849-1 performance level (PL) d.

More interesting, however, is the way Siemens has equipped the units with a new DP/AS-i F-Link that the company says links Asisafe to Profisafe for the first time. The compact network transition (F-Link) collects

safety-related signals via the AS-i fieldbus and transfers them via Profibus to the higher-level safety controller, enabling simple and low-cost connection between the two fieldbus systems.

By introducing the 4F-DI/3F-DO Profisafe module, Siemens has created a version of the ET200SI/O system that matches the requirements of machine tools. The new module has four safe inputs and three safe outputs and fulfils the requirements both of SIL2 (IEC61508) and PLd (ENISO13849). It can be used with the Sinumerik840Dsl as well as in the Sinumerik840D powerline.

This latest development from Siemens illustrates how the market is progressing, towards safety that is integrated within individual machine components – such as drives and controllers – and within overall control systems via shared fieldbuses and data.