Hi guys does anyone know any standards for estops used along side VSDs. I’ve seen people connect them in a few different ways and wanted to know your opinions. Can we just cut the run signal to the VSD through the systems estop circuit or should we cut power to the VSD all together?
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations JAE on being selected by the Eng-Tips community for having the most helpful posts in the forums last week. Way to Go!
VSD control 2
- Thread starter Jk1996
- Start date
-
1
- #2
It becomes more complicated with a VFD, requiring more consideration of what you consider “safety” when using them. In some cases, the VFD can be used to brake a motor FASTER than it will coast to a stop, in other cases you may need to make it take LONGER to come to a stop to avoid more dangerous consequences. There is no single answer.
Part of that too involves how the VFD is programmed to Stop normally when the Run command is removed, i.e. if you do have it programmed for a controlled decel, but you do NOT want that in an emergency, then simply removing the Run command will trigger that normal controlled decel. On top of that issue lies the reliability of your control system, because if something reinitializes the Run command, it runs again. So many better VFDs now come with a safety feature called “Safe Torque Off” (STO) that disables the transistors immediately, overriding any programming in the VFD. Tying that to a qualified “Safety Relay” is the safest way to implement an E-Stop, so long as you DONT want the faster braking aspect.
If you post more details on the machine the VFD is being used on, we might be able to narrow the responses for you.
" We are all here on earth to help others; what on earth the others are here for I don't know." -- W. H. Auden
Part of that too involves how the VFD is programmed to Stop normally when the Run command is removed, i.e. if you do have it programmed for a controlled decel, but you do NOT want that in an emergency, then simply removing the Run command will trigger that normal controlled decel. On top of that issue lies the reliability of your control system, because if something reinitializes the Run command, it runs again. So many better VFDs now come with a safety feature called “Safe Torque Off” (STO) that disables the transistors immediately, overriding any programming in the VFD. Tying that to a qualified “Safety Relay” is the safest way to implement an E-Stop, so long as you DONT want the faster braking aspect.
If you post more details on the machine the VFD is being used on, we might be able to narrow the responses for you.
" We are all here on earth to help others; what on earth the others are here for I don't know." -- W. H. Auden
jraef is right, what kind of stop metod you need to use is dependent on the motordriven function, if you have hanging loads for example.
The most common way is as he says to break electric and then apply break.
European standars also requires that you physically remove the power to motor/VSD in a "open" break point if it isn't a safety product.
If the VSD is classified as a safety product you will have things like Safe Torque Off and a lot off safe signals to use.
But if it is a "normal" VSD you might need to use the enable and especially the inhibit signals.
Enable usually, if it goes zero brakes electric and then put the break on.
The inhibit turns off the inverter output stage, meaning it will coast out.
So with old equipment you usually take a way the enable and after a measured time (stopp time) you take a way the inhibit, and if you want to be really "secure" you take away the incoming power too.
In all cases it is important that the break is dimensioned to stop the equipment at a power outage if not for personal safety so for the machine, at a power outages the electric break will not work.
To have a correct emergency stop function is depending on the risks, there need to be at least two separate ways of stopping the motor so if one fails the other one must work and you need to have monitoring on both so that you know if something stopps working.
The level of security that needs to be applied is not something that can be copied or read from a book, it has to be evaluated from case to case in a risk analyzes.
Of course one can always choice to build to the highest level of security every time, if the cost isn't a problem.
Best Regards A
“Logic will get you from A to Z; imagination will get you everywhere.“
Albert Einstein
The most common way is as he says to break electric and then apply break.
European standars also requires that you physically remove the power to motor/VSD in a "open" break point if it isn't a safety product.
If the VSD is classified as a safety product you will have things like Safe Torque Off and a lot off safe signals to use.
But if it is a "normal" VSD you might need to use the enable and especially the inhibit signals.
Enable usually, if it goes zero brakes electric and then put the break on.
The inhibit turns off the inverter output stage, meaning it will coast out.
So with old equipment you usually take a way the enable and after a measured time (stopp time) you take a way the inhibit, and if you want to be really "secure" you take away the incoming power too.
In all cases it is important that the break is dimensioned to stop the equipment at a power outage if not for personal safety so for the machine, at a power outages the electric break will not work.
To have a correct emergency stop function is depending on the risks, there need to be at least two separate ways of stopping the motor so if one fails the other one must work and you need to have monitoring on both so that you know if something stopps working.
The level of security that needs to be applied is not something that can be copied or read from a book, it has to be evaluated from case to case in a risk analyzes.
Of course one can always choice to build to the highest level of security every time, if the cost isn't a problem.
Best Regards A
“Logic will get you from A to Z; imagination will get you everywhere.“
Albert Einstein
BrianPetersen
Mechanical
The integrity of a safety system involves ISO 13849-1, among others. That standard is not simple to deal with.
Much depends on the age of the equipment involved. If you go back a number of years, before "safe torque off" was invented, and before compliance with ISO 13849-1 was something that needed to be considered, it was pretty common to just cut the run signal inputs, rightly or wrongly. Nowadays ... don't do that, unless the risk assessment indicates that it is permissible (e.g. very low-risk application). Standard motion-command drive inputs are not considered to be safety-rated.
It's not uncommon to use a controlled-stop followed by a delayed-safe-off: Remove the motion command immediately in order to activate the dynamic-braking function, then after either a time delay or a detection that the motion has stopped, open the STO inputs and, where applicable, have the mechanical brake apply. You can readily obtain safety relays with immediate-off and delayed-off contacts in order to implement this.
Depending upon the risk analysis, the equipment may need to incorporate guard-locking so that people cannot access the moving parts until the motion is known to be stopped.
Safe-torque-off can take the form of hard-wired dual-channel inputs to a safety-inputs terminal block on the drive, or it can take the form of the drive being a safety network node on a ProfiSafe or ethernet safe I/O network, in which case, a safety PLC is making the decisions about what to do.
Much depends on the age of the equipment involved. If you go back a number of years, before "safe torque off" was invented, and before compliance with ISO 13849-1 was something that needed to be considered, it was pretty common to just cut the run signal inputs, rightly or wrongly. Nowadays ... don't do that, unless the risk assessment indicates that it is permissible (e.g. very low-risk application). Standard motion-command drive inputs are not considered to be safety-rated.
It's not uncommon to use a controlled-stop followed by a delayed-safe-off: Remove the motion command immediately in order to activate the dynamic-braking function, then after either a time delay or a detection that the motion has stopped, open the STO inputs and, where applicable, have the mechanical brake apply. You can readily obtain safety relays with immediate-off and delayed-off contacts in order to implement this.
Depending upon the risk analysis, the equipment may need to incorporate guard-locking so that people cannot access the moving parts until the motion is known to be stopped.
Safe-torque-off can take the form of hard-wired dual-channel inputs to a safety-inputs terminal block on the drive, or it can take the form of the drive being a safety network node on a ProfiSafe or ethernet safe I/O network, in which case, a safety PLC is making the decisions about what to do.
- Thread starter
- #5
Thanks guys it’s a funny one this as someone has retro fitted the VSD to an old bit of plant. The pump used to be direct on line and pump speed adjusted through the gearbox. The panel has a safety relay which all the machines motor contractors use. I don’t think I would class the pump as being high risk as the pump small 0.55kw progressive cavity pump. But then again as you’ve stated there’s probably more work to be done then just cutting the run signal through the existing DOL contractor auxiliary.
Well since it is a pump I would think that cutting the enable and or inhibit to the VSD with the safety relay or contactor would be enough, look in the manual to se what options you have.
There is more then just guys here. ;-)
Best Regards Anna![[ponytails2]](/data/assets/smilies/ponytails2.gif "[ponytails2] [ponytails2]")
“Logic will get you from A to Z; imagination will get you everywhere.“
Albert Einstein
There is more then just guys here. ;-)
Best Regards Anna
“Logic will get you from A to Z; imagination will get you everywhere.“
Albert Einstein
-
1
- #7
BrianPetersen
Mechanical
Depends what the pump is pumping, and what are the consequences of it failing to stop when requested to do so. Risk assessment.
FreddyNurk
Electrical
as BrianPetersen states, and whilst it may be likely that your initial assessment is correct, you'll still need to check on what the pump is doing and what happens in a failure.
Or, conversely, its not the pump that needs to be assessed, its the process that the pump takes part in that needs assessment.
EDMS Australia
Or, conversely, its not the pump that needs to be assessed, its the process that the pump takes part in that needs assessment.
EDMS Australia
Since this is a old system with the same safety functionality now as before with the difference that there is a VCD between the contactor and the motor (that’s an assumption)
It is not more or less safe now than before if that is all that is changed and the contactor/s are still controlled and monitored by the safety relay.
Depending on whether there is one or two contactors for the power to the VCD and if the motor has a brake or not,
the safety level might be improved.
Since you say it is an old VCD I make the assumption that there is no real safety functions in it.
Neither Run or Enable is considered to be a safe function on an old drive.
The closes you can get is Inhibit if it has that.
Best Regards A
“Logic will get you from A to Z; imagination will get you everywhere.“
Albert Einstein
It is not more or less safe now than before if that is all that is changed and the contactor/s are still controlled and monitored by the safety relay.
Depending on whether there is one or two contactors for the power to the VCD and if the motor has a brake or not,
the safety level might be improved.
Since you say it is an old VCD I make the assumption that there is no real safety functions in it.
Neither Run or Enable is considered to be a safe function on an old drive.
The closes you can get is Inhibit if it has that.
Best Regards A
“Logic will get you from A to Z; imagination will get you everywhere.“
Albert Einstein
- Thread starter
- #10
Thanks guys for your answers. My concern was if the contact fused for the run signal but maybe I’m over thinking this. The only difference now then before is there is an VSD in the place of the motor contractor so as red snake pointed out it’s no less safe than what it was before.
Well that is different from what I meant.
If the VSD is in-between the original contactors and the motor it is the same.
But if the contactors are gone and replaced with the VCD that is different, and not good.
If you could present some kind of drawing that might help decide if more needs to be done.
Even if the personal security function is okey there might be machine security functions that might be useful to have.
Best Regards A
PS. It is never wrong to overthink things ;-) that is how you learn.
If the VSD is in-between the original contactors and the motor it is the same.
But if the contactors are gone and replaced with the VCD that is different, and not good.
If you could present some kind of drawing that might help decide if more needs to be done.
Even if the personal security function is okey there might be machine security functions that might be useful to have.
Best Regards A
PS. It is never wrong to overthink things ;-) that is how you learn.
- Thread starter
- #12
Oh right sorry. I’m not sure if there is any drawings for this bit of kit. But no the contractor is only being used as a relay really the run signal of the machine energises that contactor which uses it’s normally open contact as a run signal to the VSD the VSD is feed straight off a breaker. So what’s been done before when the VSD has failed is the cables feeding the VSD go through the contactor supplying the motor in direct on line
BrianPetersen
Mechanical
So, back to the original question, what happens when someone presses "emergency stop"?
Does the contactor in series with the 3-phase power break supply via physically opened contacts, of the 3-phase power to the machine (before or after the VFD doesn't matter), yes or no?
It is allowed to use a "safe torque off" implementation in accordance with ISO 13849-1 and the appropriate PL in accordance with the risk assessment as a protective-stop function. Most modern VFD STO functions give PL d, which is good enough most of the time (but do the risk assessment to verify, and check the documentation for the particular drive that you are using).
It is allowed to break power to the motor in the 3-phase power by physically opened contacts. Whether one contactor or two (redundant) depends again upon risk assessment.
It is not allowed by today's standards to rely solely upon removal of a non-safety-rated "run" command to the drive for an "emergency stop" function except maybe, perhaps, in the most trivial of risk circumstances.
It is frequently found in old equipment designs, that this was done all the time. That doesn't make it right.
Old drives had a tendency to be extremely unhappy, of the "let out the magic smoke" variety, in case of disconnecting supply power under load or interrupting the connection from the drive to the motor when the motor is under load. That doesn't make it excusable to do it by the non-safety-rated "run" input and disregard the physical interruption.
A "category 1" stop is a controlled stop under power followed by disconnection. That's allowed, in most circumstances, although machines with significant coasting or overrun may require attention paid to how the safeguarding is done, to avoid the coasting representing a hazard.
Does the contactor in series with the 3-phase power break supply via physically opened contacts, of the 3-phase power to the machine (before or after the VFD doesn't matter), yes or no?
It is allowed to use a "safe torque off" implementation in accordance with ISO 13849-1 and the appropriate PL in accordance with the risk assessment as a protective-stop function. Most modern VFD STO functions give PL d, which is good enough most of the time (but do the risk assessment to verify, and check the documentation for the particular drive that you are using).
It is allowed to break power to the motor in the 3-phase power by physically opened contacts. Whether one contactor or two (redundant) depends again upon risk assessment.
It is not allowed by today's standards to rely solely upon removal of a non-safety-rated "run" command to the drive for an "emergency stop" function except maybe, perhaps, in the most trivial of risk circumstances.
It is frequently found in old equipment designs, that this was done all the time. That doesn't make it right.
Old drives had a tendency to be extremely unhappy, of the "let out the magic smoke" variety, in case of disconnecting supply power under load or interrupting the connection from the drive to the motor when the motor is under load. That doesn't make it excusable to do it by the non-safety-rated "run" input and disregard the physical interruption.
A "category 1" stop is a controlled stop under power followed by disconnection. That's allowed, in most circumstances, although machines with significant coasting or overrun may require attention paid to how the safeguarding is done, to avoid the coasting representing a hazard.
Brian Peterson has cited the best answer.
A "category 1" stop is a controlled stop under power followed by disconnection. That's allowed, in most circumstances, although machines with significant coasting or overrun may require attention paid to how the safeguarding is done, to avoid the coasting representing a hazard.
NFPA and NEC Codes dictate how and where E-Stop and S/S devices are located in relation to machines and operators. Codes also provide criteria for electrical disconnect means and their location.
Of major concern is machines with high inertial flywheels such as large log band mill headrigs or high tonnage stamping machines. Heavy conveying systems or infeed/outfeed systems for steel lines or bulk handled materials fall into this category as well but operator safety in addition to electrical emergency stop controls calls for physically protected areas in case of machine crashes.
Best,
TF
A "category 1" stop is a controlled stop under power followed by disconnection. That's allowed, in most circumstances, although machines with significant coasting or overrun may require attention paid to how the safeguarding is done, to avoid the coasting representing a hazard.
NFPA and NEC Codes dictate how and where E-Stop and S/S devices are located in relation to machines and operators. Codes also provide criteria for electrical disconnect means and their location.
Of major concern is machines with high inertial flywheels such as large log band mill headrigs or high tonnage stamping machines. Heavy conveying systems or infeed/outfeed systems for steel lines or bulk handled materials fall into this category as well but operator safety in addition to electrical emergency stop controls calls for physically protected areas in case of machine crashes.
Best,
TF
Dear Mr. Jk1996 Jul 21 15:56
" Hi guys does anyone know any standards for estops used along side VSDs. I’ve seen ...... Can we just cut the run signal to the VSD through the systems estop circuit or should we cut power to the VSD all together?".
1. There are numerous valid proposals pointing out that not only to stop the motor or the VSD, but also the consequences of the while system shall be taken into consideration.
2. I would like to suggest to hard-wire the N.C. contact of the E-stop push-button (witch is always self-latching with a big knob coloured Red with a big yellow disc) in series with the under-voltage release of the supply branch MCB/MCCB. This would be the positive way of ensuring an E-stop; if the system can take it.
Che Kuan Yau (Singapore)
" Hi guys does anyone know any standards for estops used along side VSDs. I’ve seen ...... Can we just cut the run signal to the VSD through the systems estop circuit or should we cut power to the VSD all together?".
1. There are numerous valid proposals pointing out that not only to stop the motor or the VSD, but also the consequences of the while system shall be taken into consideration.
2. I would like to suggest to hard-wire the N.C. contact of the E-stop push-button (witch is always self-latching with a big knob coloured Red with a big yellow disc) in series with the under-voltage release of the supply branch MCB/MCCB. This would be the positive way of ensuring an E-stop; if the system can take it.
Che Kuan Yau (Singapore)
- Status
Similar threads
- Locked
- Question
- Question
- Locked
- Question