En Iso13849-1 Pl=D; Inverter Output State When Safe Torque Off (Sto) Is Activated - Fuji Electric FRENIC-HVAC User Manual

E
11.1.4.3 N ISO13849-1 PL=d
European Standard EN ISO13849-1 PL=d (Safety of machinery–Safety related parts of control systems)
prescribes the basic safety requirements for machinery categorized according to the requirement level.
Category 3 represents the requirements that the machinery shall be designed with redundancy so that a
single fault does not lead to the loss of the safety function. Table 11.3 shows an outline of the category
levels and their safety requirements. For detailed requirements, refer to EN ISO13849-1 PL=d.
Categor
y
SRP/CS and/or their protective equipment, as
B
well as their components, shall be designed,
constructed,
combined in accordance with relevant
standards so that they can withstand the
expected influences. Basic safety principles
shall be used.
Requirements of Category B shall apply.
1
Well-tried components and well-tried safety
principles shall be used.
Requirements of Category B and the use of
2
well-tried safety principles shall apply.
Safety function shall be checked at suitable
intervals by the machine control system.
Requirements of Category B and the use of
3
well-tried safety principles shall apply.
Safety-related parts shall be designed, so that
- a single fault in any of these parts does not
lead to the loss of the safety function, and
- whenever reasonably practicable, the single
fault is detected.
Requirements of Category B and the use of
4
well-tried safety principles shall apply.
Safety-related parts shall be designed, so that
- a single fault in any of these parts does not
lead to a loss of the safety function, and
- the single fault is detected at or before the
next demand upon the safety function, but if
this
accumulation of undetected faults shall not
lead to the loss of the safety function.
11.1.4.4

Inverter output state when Safe Torque Off (STO) is activated

Turning the emergency stop button ON, switches OFF EN1 and EN2 inputs, bringing the inverter into the
Safe Torque Off (STO). This activates a waiting time provided by the H16 parameter; this time can be
modified using the standard keypad: AUTO (100 ms as default mode), from 0.0 (equivalent to 0.1s) to
30.0 seconds. Once the H16 waiting time has elapsed, the STO diagnosis is executed. The STO diagnosis
requires less than one second to be completed.
Figure 11.6 shows the timing scheme to apply when the emergency stop button is turned OFF with the
inverter being stopped. Input to the EN1 and EN2 comes ON, making the inverter ready to run.
Figure 11.6 Inverter Output State when the Emergency Stop Button is Turned OFF with the Inverter being Stopped
Table 11.3
Summary of requirements
selected, assembled and
detection is not possible,
11-11
11.1 Compliance with European Standards
System behavior
The occurrence of a fault can lead to the
loss of the safety function.
The occurrence of a fault can lead to the
loss of the safety function but the
probability of occurrence is lower than
for Category B.
The occurrence of a fault can lead to the
loss of the safety function between the
checks. The loss of safety function is
detected by the check.
When a single fault occurs, the safety
function is always performed. Some,
but not all, faults will be detected.
Accumulation of undetected faults can
lead to the loss of the safety function.
When a single fault occurs, the safety
function is always
Detection of accumulated
reduces the probability of the loss of the
safety function (high DC). The faults
will be detected in time to prevent the
loss of the safety function.
an
performed.
faults