AOP30 Advanced Operator Panel

An Advanced Operator Panel (AOP30) is installed in the cabinet door of the converter for operation, monitoring and commissioning tasks.

The user is guided by interactive menus through the drive-commissioning screens. When commissioning the drive for the first time, only 6 motor parameters (which can be found on a motor rating plate) have to be entered on the AOP30. The control is then optimized automatically to fine-tune the converter to the motor.

The AOP30's two-stage safety concept prevents unintentional or unauthorized changes to settings. Operation of the drive from the operator panel can be disabled by the keyboard lock so that only parameter values and process variables can be displayed on the operating panel. The OFF key is factory-set to active but can also be deactivated by the customer. A password can be used to prevent the unauthorized modification of converter parameters.

German, English, French, Italian, Spanish and Chinese are stored on the CU320-2 Control Unit CompactFlash card as operator panel languages. Russian, Polish and Czech are available in addition to these standard panel languages. These can be downloaded free of charge from the Internet under the following link:
http://support.automation.siemens.com/

Examples of plain-text displays at various phases of operation are shown below.

The First commissioning process is performed using the operator panel.

Only 6 motor parameters have to be entered: Power, speed, current, cos ?, voltage and frequency of the motor.

This information can be found on the motor rating plate, and must be entered into the screens on the display by following a short, menu-assisted procedure. The motor cooling method must also be specified.

The next screen contains the parameter values that are used to automatically optimize the control.

During operation, actual data are output on the display as absolute values, such as setpoint and actual values, or it is possible to parameterize up to three process variables as a quasi-analog bar display.

Any alarms which occur are signaled by flashing of the yellow ALARM LED, faults by the red FAULT LED which is then lit. There is also an indication of the cause displayed in plain text on the display's status line (with counter/remedial measures).

Communication with higher-level control and customer terminal block

A PROFIBUS or PROFINET interface on the CU320-2 Control Unit is provided as standard as the customer control interface.

This interface can be used to connect the system to the higher-level controller using analog and digital signals, or to connect additional units.

The inputs and outputs available as standard can be optionally expanded by up to 2 TM31 Terminal Modules (refer to the description of options, option G60 or G61). To simplify configuration and commissioning of the drive, the TM31 Terminal Module can be preset to a variety of factory settings.

For additional information, please refer to the SINAMICS Low Voltage Engineering Manual.

Open-loop and closed-loop control functions

SINAMICS S150 has a high-dynamic vector control with speed and current control – with and without speed actual value feedback.

Software and protective functions

The software functions available as standard are described below:

Power unit protection

Safety Integrated functions

The integrated safety functions of SINAMICS provide highlyeffective application-oriented protection for personnel and machinery. The Safety Integrated functions are implemented electronically and therefore offer short response times in comparison to solutions with externally implemented monitoring functions.

The trend toward greater complexity and increasing modularity of machines is increasingly seeing a shift in safety functions away from the classical central safety functions (for example, shutdown of the complete machine using a main switch) and into the machine control system and the drives. Frequently, this also significantly increases the productivity. This is because, for instance, equipping times can be reduced and during these equipping times, depending on the machine type, other parts can still continue to produce.

Integrated safety functions act much faster than those of a conventional design. The safety of a machine is increased further with Safety Integrated. Furthermore, thanks to the faster method of operation, safety measures controlled by integrated safety systems are perceived as less of a hindrance by the machine operator, therefore significantly reducing the motivation to consciously bypass safety functions.

The safety functions in the device and communication via PROFIsafe have already been certified. This simplifies configuring the safety functions and especially the acceptance of the plant or system by an authorized testing body when compared to safety solutions made up of individual safety components.

Legal framework

Machine and plant builders must ensure that their machines or plants neither present risks due to electric shock, heat or radiation nor due to functional faults. In Europe, for example, compliance with the machinery directive is legally stipulated by the EU industrial safety directive.

In order to ensure compliance with this directive, it is recommended that the corresponding harmonized European standards are applied. This initiates the assumption of conformity and gives manufacturers and operators the legal security when complying with both national regulations and EU directives. The machine manufacturer uses the CE marking to document the compliance with all relevant directives and regulations in the free movement of goods.

Safety-related standards

Functional safety is specified in various standards. EN ISO 12100 and EN ISO 14121-1, for example, are concerned with the design and risk assessment of machines. EN 62061 (only applicable for electrical and electronic control systems) and EN ISO 13849-1 (previously EN 954-1) define the functional and safety-related requirements of control systems with relevance to safety.

The above-mentioned standards define different safety requirements that the machine has to satisfy in accordance with the risk, frequency of a dangerous situation, probability of occurrence and the opportunities for recognizing impending danger.

• EN 954?1: Categories B, 1 … 4 (from the end of 2011 will be replaced by EN ISO 13849?1)
• EN ISO 13849?1: Performance Level PL a … e
• EN 62061: Safety Integrity Level SIL 1 … 3

Safety functions integrated in the drive with SINAMICS

The safety functions integrated in SINAMICS satisfy the equirements of

• Category 3 according to EN 954?1 (from the end of 2011 will be replaced by EN ISO 13849?1)
• Safety Integrity Level (SIL) 2 according to EN 61508
• Performance Level (PL) d according to EN ISO 13849?1

In addition, the Safety Integrated functions of SINAMICS are generally certified by independent institutes. An up-to-date list of certified components is available on request from your local Siemens office.

Safety Basic Functions and Safety Extended Functions

The Safety Integrated functions of the SINAMICS drive system are subdivided into what are known as Safety Basic Functions and Safety Extended Functions (terminology according to IEC 61800?5?2):

Basic Functions
• Safe Torque Off (STO)
• Safe Stop 1 (SS1, time-controlled)
• Safe Brake Control (SBC)

The Safety Basic functions are included in the standard scope of delivery of the drive and can be used without requiring any additional license. The user can activate these functions at any time. An encoder is not required for their use.

The Safety Basic Functions are controlled as follows:

• Via terminals at the Control Unit and at the power unit
• Via PROFIBUS or PROFINET with PROFIsafe profile (from version 3 (last position of the Order No. ? 3) and Drives SW Version V2.6 SP2)
Extended Functions
• Safe Torque Off (STO)
• Safe Stop 1 (SS1, time-controlled and acceleration controlled)
• Safe Stop 2 (SS2)
• Safe Operating Stop (SOS)
• Safely-Limited Speed (SLS)
• Safe Speed Monitor (SSM)
• Safe Direction (SDI)

Safety Extended Functions require a safety license depending on the axes. Depending on the control, additional DRIVE-CliQ components are required.

Note: Extended Functions require a sine-cosine encoder and therefore a SMC20 Sensor Module Cabinet Mounted to evaluate the encoder signals (option K48).

The Safety Extended Functions are controlled as follows:

• Via the TM54F Terminal Module
• Via PROFIBUS or PROFINET with the PROFIsafe profile

The Safety Integrated functions currently available in SINAMICS S150 are subsequently described in more detail (terms as defined in IEC 61800?5?2):

Safe Torque Off (STO)

Function description

This function prevents unexpected starting according to EN 60204-1 Section 5.4. Safe Torque Off disables the control of the power unit, preventing a potentially hazardous torque (corresponds to Stop Category 0 according to EN 60204-1). The drive is reliably torque-free. This state is monitored internally in the drive.

Under Extended Functions, STO can also be controlled via the TM54F Terminal Module or PROFIsafe.

Application, customer benefits

STO has the immediate effect that the drive cannot supply any torque-generating energy. STO can be used wherever the drive will naturally reach a standstill due to load torque or friction in a sufficiently short time or when "coasting down" of the drive will not have any relevance for safety.

Safe Brake Control (SBC)

Function description

The Safe Brake Control SBC is used to control holding brakes, which are active in the no-current state, e.g. motor holding brakes (actuated using spring force). The brake is controlled through two channels in a safety-relevant fashion.

Safe Brake Control is executed when activating the operational brake control, Safe Torque Off function and when safety monitoring functions respond, which cause the power unit to be safely inhibited.

Note 1: The Safe Brake Control does not detect mechanical faults in the brake, for example worn brake pads.

Note 2: An additional Safe Brake Adapter (SBA) is required (option K88 or K89, for a description see SINAMICS S120 Chassis Format Units, Supplementary system components).

Application, customer benefits

In conjunction with STO and SS1, SBC can also be activated. After switching off the torque-generating energy, SBC offers the possibility to safely control a holding brake at the motor; for example, to prevent hanging/suspended axes from sagging.

Safe Stop 1 (SS1, time-controlled, without encoder; Basic Safety Function)

Function description

The Safe Stop 1 function can safely stop the drive in accordance with EN 60204-1, Stop Category 1. When the SS1 function is selected, the drive independently brakes along a quick stop ramp (OFF3) and Safe Torque Off and Safe Brake Control (if enabled) are activated when the selected safety delay time has expired.

Application, customer benefits

When activating the stop function, if the drive does not come quickly enough to a standstill as a result of the load torque, then it can be actively braked by the converter. As a result of this integrated fast brake function, frequently it is possible to eliminate mechanical brakes which wear, or to reduce the load on them. This means that maintenance costs and stress on the machine can be reduced.

Safe Stop 1 (SS1, time and acceleration controlled, with sine-cosine encoder; Extended Safety Function)

Function description

The Safe Stop 1 function can safely stop the drive in accordance with EN 60204-1, Stop Category 1. When the SS1 function is selected, the drive independently brakes along a quick stop ramp, the deceleration is monitored (OFF3) and Safe Torque Off and Safe Brake Control (if enabled) are automatically activated when the selected safety delay time has expired.

Application, customer benefits

When activating the stop function, if the drive does not come quickly enough to a standstill as a result of the load torque, then it can be actively braked by the converter. As a result of this integrated fast brake function, frequently it is possible to eliminate mechanical brakes which wear, or to reduce the load on them. This means that maintenance costs and stress on the machine can be reduced.

Safe Stop 2 (SS2, with sine-cosine encoder)

Function description

The Safe Stop 2 function can safely stop the drive in accordance with EN 60204-1, Stop Category 2. When the SS2 function is selected, the drive brakes autonomously along a quick stop ramp (OFF3). In contrast to SS1, the drive control remains operational afterwards, i.e. the motor can supply the full torque required to maintain the actual position. Standstill is safely monitored (Safe Operating Stop function, SOS).

Application, customer benefits

Just the same as for SS1, the drive is independently braked when the stop function is selected. Contrary to SS1, also at standstill, the drive can provide the full torque.

Safe Stop 1 (SS1) and Safe Stop 2 (SS2) with Safe Acceleration Monitor (SAM, with sine-cosine encoder)

For the Extended Functions Safe Stop 1 (SS1) and Safe Stop 2 (SS2) with SAM, during braking, the acceleration is safely monitored (SAM) in order to identify faults already during the braking phase.

Safe Operating Stop (SOS, with sine-cosine encoder)

Function description

The Safe Operating Stop function constitutes safe standstill monitoring. The drive control remains in operation. The motor can therefore deliver the full torque to hold the current position. The actual position is reliably monitored. In contrast to safety functions SS1 and SS2, the speed setpoint is not influenced autonomously. After SOS has been selected, the higher-level control must bring the drive to a standstill within a parameterized safe time ?t and then hold the position setpoint. After the time ?t has expired, SOS is activated and monitored to ensure that the actual standstill position is not left.

Application, customer benefits

SOS is the ideal function for all those applications for which the machine or parts of the machine must be at a safe standstill for certain machining steps, but where the drive must also supply a holding torque.

Safely-Limited Speed (SLS, with sine-cosine encoder)

Function description

Using the Safely-Limited Speed function, the drive is monitored against a parameterizable maximum velocity. Four different limit values can be activated. Just the same as for SOS, the speed setpoint is not independently influenced. After SLS has been selected, the higher-level control must bring the drive to below the selected velocity limit within a parameterizable time ?t.

Application, customer benefits

When setting-up many machines operating personnel must work on the machine as it rotates. This must either be done in steps, because the dangerous area must always be exited at each start, or alternatively, the operator works at the machine while it moves and is therefore exposed to an increased risk. When using the SLS function, a considerable amount of time can be saved – and it is still guaranteed that the operating personnel are safe. For this purpose, the drive velocity can be safely limited to a safe low level. The selectable wait time until SLS is activated allows the drive control to run-down the coordinated axes in a controlled fashion.

Safe Speed Monitor (SSM, with sine-cosine encoder)

Function description

The Safe Speed Monitor function supplies a safety feedback signal (high active) if the drive falls below a selectable velocity limit value. Contrary to the functions described above, there is no drive-based fault response when the limit value is exceeded.

Application, customer benefits

The safety SSM feedback signal can be used in a higher-level control for safety-relevant responses. The higher-level safety control can flexibly respond to the signal, depending on the particular situation, as there is no drive-based response when the limit value is exceeded. For example, using the SSM signal, a protective door can be released after a non-hazardous velocity is reached.

Safe Direction (SDI, with sine-cosine encoder)

Function description

The SDI function ensures that the drive can only rotate in the selected direction.

Deviation from the direction of rotation currently being monitored is detected reliably and the configured drive-integrated fault reaction is initiated. It is possible to select which direction of rotation is to be monitored.

Application, customer benefits

The SDI function is used when the drive may only move in one direction. A typical application is to permit the operator access to a danger zone, as long as the machine is rotating in the safe direction, i.e. away from the operator. In this state, the operator can feed material into the work zone/remove material from the work zone without danger.

The function saves the use of external components e.g. speed monitors and the associated wiring. The release of a danger zone, while the machine is moving away from the operator, increases productivity. Without the SDI function, the machine must be safely stopped during material loading and removal.

PROFIsafe

PROFIsafe is an open communication standard, that facilitates standard and safety-relevant communication along one communication path (hard-wired or wireless). As a consequence, a second, separate bus system is not required. The telegrams that are sent are continually monitored to ensure safety-relevant communication. Possible errors such as telegrams that have been lost, repeated or received in the incorrect sequence etc. are avoided. This is done by consecutively numbering the telegrams in a safety-relevant fashion, monitoring their reception within a defined time and transferring an ID for transmitter and receiver of a telegram. Further, a cyclic redundancy check CRC (cyclic redundancy check) is performed.

SINAMICS S150 supports the PROFIsafe profile, based on PROFIBUS as well as on PROFINET

Licensing

The Safety Integrated Basic Functions do not require a license.

A license is, however, required for each axis with safety functions in the case of Safety Integrated Extended Functions. It is irrelevant which safety functions are used and how many.

A license required for SINAMICS S150 can be optionally ordered with the equipment (option K01).

Refer to the section Supplementary system components for the order numbers of the CompactFlash cards.

An overview of the SINAMICS Safety Integrated functions plus their boundary conditions is provided in the following table:

¹⁾ In addition for SINAMICS S120 Cabinet Modules and SINAMICS S150 Converter Cabinet Units.

²⁾ Safe Brake Adapter has been released from firmware version 4.4.

³⁾ For SINAMICS S120 Cabinet Modules and SINAMICS S150 Converter Cabinet Units as option K87.

⁴⁾ The Safety Integrated Extended Functions require a sine-cosine encoder to sense the motor speed. Possible encoder evaluation units SMC20, SMI20, SME20/25/120/125.

The principle of operation of Safety Integrated

Two independent shutdown paths

There are two shutdown paths that are independent of one another.

All shutdown paths are low active. This therefore ensures that when a component fails or there is a wire break, then the system always goes into the safe state. When a fault is detected in the shutdown paths, the Safe Torque Off or Safe Stop 1 function (depending on the parameterization, also refer to the table above) is activated and a restart is prevented.

Two-channel monitoring structure

All of the hardware and software functions important for Safety Integrated are implemented in two independent monitoring channels (e.g. shutdown paths, data management, data comparison). The safety-relevant data in the two monitoring channels is cyclically compared crosswise.

The monitoring functions in each monitoring channel are based on the principle that before a particular action, there must be a defined state, and after the action there must be a specific feedback. If this expectation is not fulfilled in a monitoring channel, then the drive is shutdown through two channels and the appropriate signal output.

Forced checking procedure using a test stop

In order to fulfill the requirements of EN 954-1 (at the end of 2011, will be replaced by EN ISO 13849-1) and IEC 61508 regarding early fault detection, the functions and the shutdown paths must be tested within a specific time period at least once to ensure that they are operating correctly. This must be realized either cyclically and manually or the test stop must be automatically initiated as part of the process. The test stop cycle is monitored, and after a specific time has been exceeded, an alarm is output.

A test top does not require a power on. The acknowledgment is realized when deselecting the test stop request.

When the machine is operational, it can be assumed that there is no risk for personnel as a result of the appropriate safety equipment (e.g. protective doors). As a consequence, the user is only made aware of the forced checking procedure that is required using an alarm, and is requested to perform the forced checking procedure at the next possible opportunity.

Examples for performing the forced checking procedure:

• When the drives are stationary after switching-on the system
• Before opening the protective door
• In a specified rhythm (e.g. every 8 hours)
• In the automatic mode, time and event-triggered