Siemens SINAMICS S120 Function Manual page 26

Fundamental safety instructions
1.3 Residual risk
Residual risk for a single-encoder system
Within a single-encoder system:
a) A single electrical fault in the encoder
b) A break of the encoder shaft (or loose encoder shaft coupling), or a loose encoder
housing will cause the encoder signals to remain static (that is, they no longer follow a
movement while still returning a correct level), and prevent fault detection while the drive is
in stop state (for example, drive in SOS state).
Generally, the drive is held by the active closed-loop control. Especially for drives with
suspended load, from a closed-loop control perspective, it is conceivable that drives such
as these move without this being detected.
The risk of an electrical fault in the encoder as described under a) is only present for few
encoder types employing a specific principal of operation.
• All of the faults described above must be included in the risk analysis of the machine
• Failsafe detection of slip on the encoder shaft - or a broken encoder shaft connection.
• For excluding the fault under b):
See also
Safe Brake Control (SBC) (Page 78)
24
WARNING
manufacturer. Additional safety measures have to be taken for drives with
suspended/vertical or pulling loads - e.g. in order to exclude faults under a):
– Use of an encoder with analog signal generation
– Use of a two-encoder system
You can implement failsafe detection of slip on the encoder shaft or a broken motor-
encoder shaft by checking the plausibility of the acquired safety-relevant actual value
with respect to the expected setpoint. If the actual value does not lie within a
configurable tolerance bandwidth around the setpoint within a defined time, then it can
be assumed that there is either slip - or that there is a broken connection between the
encoder and the motor. You must ensure this monitoring functionality in the safety user
program according to SIL 2 or PL d.
– Perform an FMEA regarding encoder shaft breakage (or slip of the encoder shaft
coupling) as well as loose encoder housings and use a fault exclusion process
according to IEC 61800-5-2, or
– Implementation of a two-encoder system (the encoders must not be mounted on the
same shaft).
Function Manual, 12/2018, 6SL3097-5AR00-0BP1
Safety Integrated