Safe motion functions

Modern drive solutions not only examine how axes are switched on and off, but also look at the potential risks that may arise during operation of the axes. The functions employed to avoid/reduce these risks are summarized here under the heading of “Safe motion functions”.



The safe operating stop (SOS) has already been described with the safe stop 2 (SS2) safety function. It monitors the standstill position while the motor is in a controlled loop status. Once the safety function has been lifted, the production or machining process can be continued with no loss of precision. This function is generally used in combination with a safe stop 2 (SS2) function, as standstill monitoring usually involves a braking process. As described above, the limit value can be specified as both a speed threshold and a position window.

Application of the safe operating stop (SOS) function is generally intended for the standstill phases of a   process. A typical situation would be access to a danger point during process intervention. An operator stops production using a command such as “Stop at end of cycle”, for example. Once the plant has stopped, the safe operating stop (SOS) function is activated, after which the guard locking device on the access gate is unlocked. The plant can now be accessed without risk.





Safely limited acceleration (SLA) and Safe acceleration range (SAR)
Safety functions relating to acceleration monitoring are not widely used in the current state-of-the-art technology.In servo drive technology, Ferraris sensors are used to detect acceleration only in special applications of machine tools or printing machinery. Standard drives cannot process these signals in their control loops; monitoring of these acceleration signals is very complex in practice.

Safely limited speed (SLS)
Safely limited speed (SLS) is probably the best known safety function. In practice this safety function is often applied as safely reduced speed. As a result, a defined transition from the operating speed in automatic mode to the reduced speed in setup mode must be guaranteed. If the monitoring function detects that the limit value has been violated, the drive must be shut down safely. The manner in which the shutdown is achieved depends on the application; it is best to aim for defined braking using the SS1 function, followed by removal of power.

Without drive-integrated safety functions, the implementation of this function was associated with high material costs or functional restrictions. Where axes are moved in jog mode during setup, the potential axis speed in the event of an error is a key aspect of any risk analysis. Operators must be protected from any hazard that would lead to an uncontrolled axis start-up in the event of an error. When the safely limited speed (SLS) function is used for these jog functions, the solution provides the shortest possible reaction time in the event of an error. This reduces the risks to the operator significantly, as any uncontrolled axis start-up would be  detected at the onset and would result in a safe shutdown.



 Safe speed range (SSR)
The safe speed range (SSR) can be used to monitor a safe minimum speed, for example. Again, the reaction that occurs when a value falls below the stated limit value depends heavily on the application. Drive axes may be coupled, in which case an appropriate reaction must be triggered when shutting down the drive (e.g. selective shutdown).

Safe speed range (SSR) can generally be used for permanent process monitoring. Risks cannot always be eliminated just by limiting the capacity for speeds to suddenly increase. Speeds that reduce suddenly as the result of an error can also present a risk. If axes are operating at a defined distance, a speed that drops abruptly on just one of the two axes may create a risk of crushing. These are the cases for which the safe speed range (SSR) function have been defined and developed. This function would be used to shut down the relevant axes, thereby eliminating any hazard to the machine operator.


Safely limited torque (SLT) and safe torque range (STR)
Like acceleration monitoring, the problem with torque or force monitoring is the lack of suitable or established sensor technology. Torque measuring systems are not widely used on standard drives, but servo drive technology provides the option for indirect measurement via the motor current. The motor current is proportional to the motor's force or torque, so the hazard resulting from a hazardous movement is limited. Non-hazardous values as regards the effect of forces can be found in the limit value list 2003, in the BIA Report. Such a procedure may only be carried out via drive-integrated safety technology.


Safely limited position (SLP)
Safe position monitoring ensures that the motor does not exceed a preset position limit value. If a limit value is violated, the motor is braked using a safe stop. The stopping performance achievable from a technical point of view must be taken into account. Below the limit value there are no restrictions in terms of acceleration or speed of the motor. Absolute position detection is required for this safety function. Absolute encoders may be used or relative measuring systems may be combined with a safe reference run.


Safely limited increment (SLI)
The motor is allowed to travel a permitted distance following a start command. A safe stop function must be triggered once the limit value is reached. If the permitted distance is exceeded, this must be detected and the drive must be safely brought to a standstill. Encoder systems with relative measurement are sufficient for this safety function.

Safe direction (SDI)
This prevents the motor from moving in an invalid direction. This safety function is frequently used in combination with safely limited speed (SLS) in setup mode. Here too, the drive-integrated solution enables the fastest possible shutdown.



Safe cam (SCA)
A safe output signal indicates whether the motor is positioned inside a specified range. These ranges are absolute position windows within a motor rotation. The basic function involves safe monitoring of absolute positions, which is why appropriate sensor systems must be used.

Safe speed monitoring (SSM)
The safe speed monitoring safety function (SSM) is very closely related to safely limited speed (SLS). However, if a limit value is violated there is no functional reaction from the components that are monitored, merely a safe message which can be evaluated and processed by a higher level safety control system. On one side the control system can perform more complex reaction functions, while on the other, the safety function can be used for process monitoring.

Safe stop functions

When considering safety on axes, the main factors are to prevent the axes from starting up unexpectedly and to shut down moving axes safely in the case of danger. The corresponding functions are summarized here under the heading of “Safe stop functions”.

Safe torque off (STO)
The power to the motor is safely removed, so that no further movement is possible. It is not necessary to monitor plant at a standstill. If an external force effect is to be anticipated, additional measures should be provided to safely prevent any potential movement (e.g. mechanical brakes). Classic examples are vertical axes or applications with high inertia. This safety function corresponds to a category 0 stop (uncontrolled stop) in accordance with IEC 60204-1. If the function is triggered during operation, the motor will run down in an uncontrolled manner, which is not desirable in practice. That is why this function is generally used as a
safe reset lock or in conjunction with the safety function SS1.

Modern servo amplifiers include an integrated safe shutdown path, so devices are now available that prevent unexpected start-up and shut down safely in the case of danger.


 

Safe stop 1 (SS1)
With safe stop 1 (SS1), defined motor braking is part of the safety function. When the motor is at standstill, the STO function is triggered. There are various options for implementing these requirements; the key factor is the dovetailing of safety technology and drive technology. This safety function corresponds to a category 1 stop ( controlled stop) in accordance with IEC 60204-1.




In many applications, drives cannot simply be shut down as they would then run down slowly, which could cause a hazard. Also, an uncontrolled run down of this type often takes considerably longer than controlled axis braking. The safe stop 1 function (SS1) monitors controlled braking of the axis directly within the servo amplifier. Once the set braking ramp has run its course, the drive is shut down safely. The reaction times are reduced compared with external monitoring solutions; as a result, in many cases the safety distances to the danger points can also be reduced. This provides a number of benefits, such as improved ergonomics for the plant operator, space savings due to the reduced distance between the guards and the danger points and, last but not least, cost savings.


Safe stop 2 (SS2)
With safe stop 2 (SS2), defined motor braking is again part of the safety function. When the motor is at standstill, a safe operating stop (SOS) is triggered. Unlike safe stop 1 (SS1), the motor at standstill is in closed loop operation. This means that the standstill position is held precisely, due to the active control loop. Again, there are several options for implementing these requirements. This safety function corresponds to a category 2 stop ( controlled stop) in accordance with IEC 60204-1.




So what are the benefits of the safe stop 2 (SS2) function? If the axes no longer need to be shut down at standstill, they will actively hold their current position, so the synchronization between axes and process is no longer lost. As a result, the axes can be restarted immediately at any time, which clearly increases plant availability. Here too, the drive-integrated function leads to shorter reaction times, thereby minimizing the risks. The monitoring functions’ response times have a direct influence on the potential channels available until a safety shutdown occurs. As the reaction times are used in the calculation of the safety distances, the benefits listed for the safe stop 1 function will also apply here.



 

Safety functions in accordance with EN 61800-5-2

Today’s state-of-the-art technology stop functions to have a drive-integrated solution. This solution reduces the space requirement in the control cabinet and also the amount of wiring necessary, as additional external components required in the past, such as contactors, are now superfluous. Even additional components to monitor standstill or speed are now surplus to requirements. Servo amplifiers with integrated safety functions in
accordance with EN 61800-5-2 are now available, providing much simpler solutions, even for complex safety requirements. The standard EN 61800-5-2 divides safety functions into stop functions and miscellaneous safety functions. The description is only rudimentary and allows a great deal of freedom in how it is implemented and interpreted. This is particularly evident with the stop functions, which are among the most complex of safety functions. The implementation method can vary greatly, but so too can the external behavior of the safety
functions.

When the safety functions are operated in practice, subsequent effects can often be attributed to the poor  quality of the sensor signals or to the actual behavior of an electrical drive in general. Poorly tuned control  loops and EMC are frequently the cause of restricted availability of safe drive axes. One example of this is the definition of standstill: On a closed loop system, zero speed is more of a theoretical value. Depending on the quality of the control loops, some jitter may be observed around the zero position; if the limit value was set to zero, this would immediately trigger a reaction on account of a limit value violation. The safety function would
shut the drive down safely – at the expense of system availability. In this case it helps to define a standstill threshold > 0, where the permitted speed is still non-hazardous. An alternative is to define a position window, from which the motor may not deviate. In this case, even the slightest movements would not lead to a limit  value violation.

To guarantee the security of the manufacturing and production process as well as the safety of personnel, safety functions may also be permanently active, without the requirement of the plant remaining in a special operating mode. Several components and their respective interfaces must be considered in order to implement the safety functions; the whole safety chain must be considered when calculating the required safety integrity.
It is not mandatory for the safety functions listed in EN 61800-5-2 to be implemented using drive integrated safety. An external solution may also be used.

Safety Chain