VFD's & Estops

A bit off topic, but I'm sure this esteemed group will have some guidance. We are having a debate at our site on the proper use of a Estop with a VFD on a mixer application. Several folks are in the camp all that is needed is to put the Estop in line with the stop circuit. Others like myself are in the camp that the Estop needs to go thru a safety relay and enable the stop, disable the start and in the case of a AB753 we should use the safe torque option to disable the firing of the IGBT's. I also thin the safety relay monitoring should report back to DCS. Looking for guidance and opinion on the proper way to make sure we have a safe machine.

Risk assessment
v
v
Safety Performance level of stopping required
v
v
If performance level required is low, then use the stop circuit
v
v
If performance level required is high, use safe torque off with a safety relay.
v
v
Verify Design
v
v
Commission (Keep record)

If it can cause permanent injury if the estop fails, I would say stop circuit is not enough.

Any true estop needs to remove power to the motor....either through an approved safe off option on the drive or an interrupting contactor. Beyond that the level of feedback and interlocks that the vfd is stopped would be dictated by risk assesment. Is the mixer accessible for example or sealed in a vessel.

Here is a couple of articles on the subject:
http://machinerysafety101.com/2009/03/06/emergency-stop-whats-so-confusing-about-that/

http://control.com/thread/1026147460

Regards,

cornbread said:

the Estop needs to go thru a safety relay and enable the stop, disable the start and in the case of a AB753 we should use the safe torque option to disable the firing of the IGBT's. I also thin the safety relay monitoring should report back to DCS. Looking for guidance and opinion on the proper way to make sure we have a safe machine.

Click to expand...

I agree with the safety relay to turn off power to the Normally Closed stop input. Since you can program the drive (or at least I think you can) to over-ride stop with the start button - also agreed to disable the start.

Both of these assume that the IO board on the drive has not failed and left the inputs in last state. So the safe torque option you describe sounds good. Does it also interface through that same IO board on the drive?

Monitoring this type of failure with the DCS also sounds like a good idea, but I don't see this as a safety item. Stopping the mixer is the priority.

Do you have the drive fed by a contactor or some other load break device? If you are worried about serious injury to personnel, I'd be tempted to add a contactor upstream of the drive that simply drops power to the drive entirely when the EStop is pressed. I'm not aware of any possible damage to the drive by simply turning off the power. 2 sets of contacts on the EStop would be required - 1 to power the contactor and one to drive the safety relay. In my opinion, it would be best to isolate those 2 circuits.

I would not put the contactor after the drive, since I know that some FOC schemes are unstable if the load (motor) is removed.

cornbread,

You should ALWAYS kill the power to the vfd when using an estop. period !
the reason being is that the control line could be damaged or shorted.
the vfd input could fail and not recognize the stop signal.
We HAD a vfd input go bad and it kept going when the stop signal was sent. The only thing that kept that employee from getting hurt was someone hit the estop which killed all motor power. The person was doing the installation at the time and was troubleshooting a limit switch on a conveyor. His shirt sleeve got caught on a carrier.


james

Kill power to VFD or use STO. I too have seen only the Run signal being opened when the E-Stop is hit. Very bad practice. I almost always use a time-delay safety relay to command a stop, then open up the STO circuit.

Originally posted by James Mcquade:

You should ALWAYS kill the power to the vfd when using an estop. period !

Click to expand...

So, not much for Safe Torque Off, it would appear.

I assume you are using dual series contactors with the appropriate feedback contacts to achieve this separation of power.

Keith

STO was designed and certified for a reason. I use it and rely on it when appropriate. There are few safety reasons to remove input power.

kamenges,

I have never dealt with safe torque off, please explain.
In regards to killing power, that was the only way we could get the drive on the conveyor to stop. hitting the stop button didn't work because the input in the drive itself went bad in the on position. We pulled the drive and wired it on a bench with no signal to the drive for run and applied power, it ran a motor. Since then, we kill the power.

james

If the drive has STO, then that should be used instead of removing power. Much better for the drive to do it that way.

This is the system where people will physically be working on the mixer blades, right ?

In my opinion, the only right way to do this is with a lockable disconnect between the motor and the drive.

If you stop the motor before opening the disconnect (even with no safety relay of any sort) you won't damage the drive when you open that disconnect.

Even if you had the most reliable ever e-stop circuit imaginable (like S.T.O. plus a safety relay), it can still be reset and restarted unless you physically prevent access to the reset circuit.

If you're going to do that, why not use a lockable disconnect that is completely infallible ?

My first job out of college was working for Phil Sharpe at his eponymous mixer company. Phil made it clear that a mixer and vessel could happily send us home in a bucket if we didn't have the lockout key on a chain around our necks.

hitting the stop button didn't work because the input in the drive itself went bad in the on position.

Click to expand...

This is exactly what "Safe Torque Off" circuits are designed to prevent; they completely disable the power transistors and the drive cannot fail in an energized state no matter what kind of power circuit or logic system malfunction occurs.

Our plan for people safety when cleaning the blades is to use a KillArk or similar device (Disconnect / plug) where the operator stops the drive via the stop PB and opens the local disconnect and unplugs the motor. The disconnect will have a set of axillary contact that will interlock to the drive to shut if off should they forget to hit the stop button. I think we have cleaning the mixer covered? Comments? Great discussion and I appreciate everyone's input. Looking forward to additional comments.

At the end of the day, it comes down to risk assessment. What are you trying to prevent with an e-stop? Process upset, equipment damage and/or people damage. That will dictate what you need to provide.