Servo Power in a Safety Circuit

So there's no standard which outlines a proper policy that I know of for handling buss power to servo controllers through a safety circuit. Most modern Servo Controllers have some sort of safe torque off terminal or safety ethernet for stopping a drive, but for years now I have made it a standard practice to run the buss power of my servo controllers through 2 redundant force guided relays in series controlled by the appropriate safety circuit before landing them on the servo controllers.

Does anyone have a similar practice or an argument to support or repeal this practice? Is the Safe Torque Off terminals (or equivalent) good enough?

Thoughts appreciated.

timryder said:

So there's no standard which outlines a proper policy that I know of for handling buss power to servo controllers through a safety circuit. Most modern Servo Controllers have some sort of safe torque off terminal or safety ethernet for stopping a drive, but for years now I have made it a standard practice to run the buss power of my servo controllers through 2 redundant force guided relays in series controlled by the appropriate safety circuit before landing them on the servo controllers.

Does anyone have a similar practice or an argument to support or repeal this practice? Is the Safe Torque Off terminals (or equivalent) good enough?

Thoughts appreciated.

Click to expand...

The servo systems that I've used are rated for SIL2/PLd/Cat3. This is less than the maximum possible safety ratings for machines (SIL3/PLe/Cat4), but your risk assessment should realistically tell you if it is sufficient or not. I've seen numerous plants and systems (mostly at major automotive assembly plants) with servo drives, using the built in STO controlled over Profinet/Profisafe. No local IO wiring required. I've seen lots of robots controlled with equivalent mechanisms.

Besides STO, there are some other interesting safety modes like Safe Limited Speed (drive only runs below a specified speed, if it detects speeds above that then the drive goes to STO). They can increase safety during maintenance/loading/testing situations where completely stopping/dropping power is not feasible.

My familiarity is mostly with the European standards. From what I've seen, the US standards don't forbid using the safety built into the drives. However, I also don't think they talk much about what is sufficient, they just say what is allowed and not allowed, and the lawyers sort out the rest.

timryder said:

I have made it a standard practice to run the buss power of my servo controllers through 2 redundant force guided relays in series controlled by the appropriate safety circuit before landing them on the servo controllers.

Click to expand...

That has always been our standard practice as well: two force-guided contactors in series wired into an appropriate safety controller (dual outputs, shorts/cross-wiring monitoring, EDM etc.) to supply main power to all the servo drives.

If we use a drive that has additional safety functions, we typically would choose "Safe Stop 2" where the motor remains at rest locked, its position being monitored, and the drive going to STO in case some external force moves the motor outside of a predefined range.

mk42 said:

The servo systems that I've used are rated for SIL2/PLd/Cat3. This is less than the maximum possible safety ratings for machines (SIL3/PLe/Cat4), but your risk assessment should realistically tell you if it is sufficient or not. I've seen numerous plants and systems (mostly at major automotive assembly plants) with servo drives, using the built in STO controlled over Profinet/Profisafe. No local IO wiring required. I've seen lots of robots controlled with equivalent mechanisms.

Besides STO, there are some other interesting safety modes like Safe Limited Speed (drive only runs below a specified speed, if it detects speeds above that then the drive goes to STO). They can increase safety during maintenance/loading/testing situations where completely stopping/dropping power is not feasible.

My familiarity is mostly with the European standards. From what I've seen, the US standards don't forbid using the safety built into the drives. However, I also don't think they talk much about what is sufficient, they just say what is allowed and not allowed, and the lawyers sort out the rest.

Click to expand...

That's right the only thing I'm missing at the above is the delayed switch off safety relay which allows the servo to ramp down before stopping in case of an interrupted motion.
The reason for that delay is: The servo force is way better than the mechanical brake of the motor. This brake is designed to hold the position and not to decelerate the device.

The way to protect servo systems is pretty much the same as used to protect VFD drive systems.

It all depends on your risk assessment and what safety rating is required but STO covers all but the most severe situation at this point in time.

If using safety isolation contactors its best to use them on the Load /output side of the VFD or servo drive as cycling input power to servo and VFD drives can reduce the life of the equipment and this is even more pronounced in places where the estop is used for a glorified stop button and not true emergencies.

The only caveat to using safety isolation contactors on the load / motor side of the drive is that you need to make sure the motor /load is fully stopped before opening the contactors to prevent damage to the drive.

Many people say this delay is a problem in an estop circuit but i have always found this is from people who have not done a risk assessment on their system or done a very poor job doing it because in almost all cases you don't want to open load side contactor and leave the motor load at the mercy of it's load or inertia, etc.

What I mean is that a delayed but aggressive controlled stop from the VFD or servo drive is almost always better then just releasing the motor load to the mercy of physics which is what you are doing if you just open the isolation contactors no matter if they are line or load side when you do it without engaging a controlled stop.