EN ACS800 SafetyOptions E A4

Options for ABB industrial drives
Wiring, start-up and operation instructions

Safety options for ACS800 cabinet-installed drives
(+Q950, +Q951, +Q952, +Q963, +Q964, +Q967 and +Q968)
List of related manuals
Manual Code (EN)
AIR-COOLED SINGLE DRIVE HARDWARE MANUALS

ACS800-07/U7 Hardware Manual (45 to 560 kW / 50 to 600 hp) 3AFE64702165
ACS800-07 (+V992) Hardware Manual (500 to 2800 kW) 3AUA0000068936
ACS800-17 Hardware Manual (55 to 2500 kW / 75 to 2800 hp) 3AFE68397260
ACS800-37 Hardware Manual (55 to 2700 kW / 75 to 3000 hp) 3AFE68557925
ACS800-38 low harmonic drives for outdoor use Hardware Manual 3AUA0000116357
AIR-COOLED MULTIDRIVES MANUALS

ACS800 Multidrive and Multidrive Modules Safety Instructions 3AFE64760432
ACS800 Multidrive and Multidrive Modules Planning the Electrical 3AFE64783742
Installation
ACS800-307 (+V992) and ACS800-507 (+V992) cabinet-installed diode 3AFE68557925
supply units hardware manual
ACS800-207 Cabinet-installed IGBT Supply Units Hardware Manual 3AFE68233810
ACS800-107 Inverter Units Hardware Manual 3AFE68233453
LIQUID-COOLED SINGLE DRIVE HARDWARE MANUALS

ACS800-07LC Hardware Manual 3AFE68620902
LIQUID-COOLED MULTIDRIVES HARDWARE MANUALS

ACS800-207LC IGBT Supply Unit Hardware Manual 3AFE68822092
ACS800-307LC, -507LC, -1107LC, -1207LC Diode Supply Unit 3AFE68715474
Hardware Manual
ACS800-107LC Inverter Unit Hardware Manual 3AFE68715491
FIRMWARE MANUALS
Applicable control program firmware manuals
OPTION MANUALS AND GENERAL SAFETY GUIDES

Safety options for ACS800 cabinet-installed drives (+Q950, +Q951, 3AUA0000026238
+Q952, +Q963, +Q964, +Q967 and +Q968) Wiring, start-up and
operation instructions
ACS800-01/U1/04/04LC/04M/U4/11/U11/14/31/U31/104/104LC Safe 3AUA0000063373
torque off function (+Q967) Application guide
Functional safety; Technical guide No. 10 3AUA0000048753
Safety and functional safety; A general guide 1SFC001008B0201
ABB Safety information and solutions www.abb.com/safety
Manuals and quick guides for I/O extension modules, fieldbus adapter
modules, etc.
You can find manuals and other product documents in PDF format on the Internet. See section
Document library on the Internet on the inside of the back cover. For manuals not available in the
Document library, contact your local ABB representative.
Wiring, start-up and operation
instructions
Safety options for ACS800 cabinet-installed drives
(+Q950, +Q951, +Q952, +Q963, +Q964, +Q967 and

+Q968)
Table of contents
 2015 ABB Oy. All Rights Reserved. 3AUA0000026238 Rev E

EN
EFFECTIVE: 2015-07-06
5
Table of contents
1. Introduction to the manual

What this chapter contains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Applicability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Safety data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Safety instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Installation and maintenance work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Example circuit diagrams of this manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Target audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Related documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
General rules, notes and definitions concerning the safety options . . . . . . . . . . . . . . . . 13
Validation procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Example parameter settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
List of standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2. Prevention of unexpected start-up (+Q950)

What this chapter contains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Applicable standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Start-up and validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3. Category 0 emergency stop (+Q951)

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Parameter settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Standard control program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
System control program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Operation principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
ACS800-07 frames R5, R6, R7, R8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
ACS800-07 with main contactor (option +F250) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
ACS800-07LC with main contactor (option +F250) . . . . . . . . . . . . . . . . . . . . . . . . . . 23
ACS800-307/507 with main contactor (option +F250) . . . . . . . . . . . . . . . . . . . . . . . . 24
ACS800-307LC/507LC with main contactor (option +F250) . . . . . . . . . . . . . . . . . . . 25
ACS800-07 with main breaker (option +F255) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
ACS800-07LC with main breaker (option +F255) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
ACS800-17/37 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
ACS800-17LC/37LC frames R7i + R7i and R8i + R8i . . . . . . . . . . . . . . . . . . . . . . . . 29
ACS800-17LC/37LC frames 2×R8i + 2×R8i and up (option +F255) . . . . . . . . . . . . . 30
ACS800 multidrives with main breaker (option +F255) . . . . . . . . . . . . . . . . . . . . . . . 31
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
6
How to activate the emergency stop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

How to reset the emergency stop circuit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Fault tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Safety data (SIL, PL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Category 0 emergency stop with opening the main contactor (+Q951) . . . . . . . . . . 34
Category 0 emergency stop with opening the main circuit breaker (+Q951) . . . . . . 36

What this chapter contains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Standard control program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
System control program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
ACS800-07 frames R5, R6, R7, R8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
ACS800-07/17/37/07LC and ACS800-17LC/37LC frames R7i + R7i and R8i + R8i 42
ACS800 multidrives and ACS800-17LC/37LC frames 2×R8i + 2×R8i and up . . . . . 43
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Fault tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Safety data (SIL, PL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Category 0 emergency stop without opening the main contactor / circuit breaker
(+Q963) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Standard control program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
System control program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Operation principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
ACS800-07 frames R5, R6, R7 and R8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
ACS800-17/37 and ACS800-07LC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
ACS800-17LC/37LC frames 2×R8i + 2×R8i and up with main breaker
(option +F255) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
ACS800-07 with main contactor (option +F250) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
ACS800 air-cooled multidrives with main contactor (option +F250) . . . . . . . . . . . . . 56
ACS800 liquid-cooled multidrives with main contactor (option +F250) . . . . . . . . . . . 57
ACS800-07 with main circuit breaker (option +F255) . . . . . . . . . . . . . . . . . . . . . . . . 58
ACS800 multidrives with main circuit breaker (option +F255) . . . . . . . . . . . . . . . . . 59
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Fault tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
7
Safety data (SIL, PL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

Category 1 emergency stop with opening the main contactor (+Q952) . . . . . . . . . . . 62
Category 1 emergency stop with opening the main circuit breaker (+Q952) . . . . . . . 64

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Standard control program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
System control program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
ACS800-07/17/37/07LC and ACS800-17LC/37LC frames 2×R8i + 2×R8i and up . . . 69
ACS800 multidrives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Fault tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Category 1 emergency stop without opening the main contactor / circuit breaker
(+Q964) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
7. Safe torque off (+Q967)

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
Fault tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
8. Prevention of unexpected start-up with STO (+Q968)

Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
Use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Fault tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Prevention of unexpected start-up with STO (+Q968) . . . . . . . . . . . . . . . . . . . . . . . . 85
8
9. Maintenance
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Proof test interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Competence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Residual risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Intentional misuse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Decommissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
10. Declaration of Conformity

Compliance with the European Machinery Directive . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Further information
Product and service inquiries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Product training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Providing feedback on ABB Drives manuals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Document library on the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Introduction to the manual 9
1
Introduction to the manual
What this chapter contains

This chapter describes the manual in short.
Applicability
The manual applies to the following cabinet-installed drive types: ACS800-07,
ACS800-07LC, ACS800-17, ACS800-37, ACS800-38, ACS800-17LC, ACS800-37LC and
air-cooled and liquid-cooled ACS800 multidrives.
Note concerning options +Q951 and +Q952 for drives equipped with contactor: The
manual covers large ACS800-07 drives with option +V992 only and air-cooled ACS800
multidrive supply units -307 and -507 with option +V992 only. Only information related to
options +Q951 and +Q952 applies to the ACS800-38 drives with restrictions given in the
ACS800-38 hardware manual.
10 Introduction to the manual
Safety data
The safety data for the Emergency stop and Safe torque off options given in this manual
applies to basic solutions. The safety data depends on where the option is used. Consider,
for example, the following:
1. How often is the contactor or circuit breaker is opened? Note: The contactor or circuit
breaker may also be opened in a use not related to the emergency stop.
2. At how many percentage of nominal current the contactor or circuit breaker is opened?
Contact your local ABB representative if application-specific calculations are needed.
The safety data given in this manual is for high or continuous mode of operation (as
defined in IEC 61508, EN/IEC 62061 and EN ISO 13849-1). Contact your local ABB
representative if you need safety data according to low demand mode of operation.
The following fault exclusions have been made in all safety data given in this manual:
• any short and open circuits in the cables of the safety circuit
• any short and open circuit in the cabinet terminal blocks of the safety circuits.
Note: The safety data of ACS800 multidrives and single drives with application-
engineered safety circuits is delivered with the drive and may differ from the data given in
this manual.
Note: The safety data given in this version of the manual applies to drives manufactured
on or after the publication date of this manual. For drives manufactured earlier, refer to
previous versions of this manual.
Safety instructions
WARNING! Read and follow all safety instructions given for the drive. Ignoring the
safety instructions can cause physical injury or death, or damage to the
equipment.
This manual does not repeat the complete safety instructions but summarizes the
instructions related to the safety circuits within the scope of this manual. The instructions
which apply to all safety circuits are given in this section and the option-specific safety
instructions in the appropriate chapter.
In addition to this manual,
• for single drives, see the drive hardware manual
• for multidrives, see ACS800 Multidrive and Multidrive Modules Safety Instructions
(3AFE64760432 [English]).
 Installation and maintenance work

After making additions to the drive safety circuit or modifying it, or changing circuit boards
inside the drive, always test the functioning of the safety circuit according to the start-up
and validation instructions. Any changes in the electrical installations of the drive may
affect the safety performance or operation of the drive unexpectedly. All customer-made
changes are on the customer’s responsibility.
 Example circuit diagrams of this manual

The purpose of the example circuit diagrams is to help in understanding the operation of
the safety functions. The diagrams do not cover all possible details and variants of the
drives. The component designations do not necessarily match to each drive.
WARNING! Never connect, test or measure a drive based on the diagrams of this
manual. Each delivery is unique. Before starting the work on the electric circuits of
a drive, always refer to the delivery-specific circuit diagrams.
Note: The circuit diagrams of the drive depend on the selected control program. In this
manual, the example circuit diagrams of ACS800 single drives apply with ACS800
standard control program (Single drive without option code for control program, options
+N664 and +N679) and the example circuit diagrams of ACS800 multidrives with ACS800
system control program (multidrives without option code for control program, options
+N671 and +N677).
Target audience
The manual is intended for people who install, start-up, use and service the safety options
of the drive. Read the manual before working on the drive. You are expected to know the
fundamentals of electricity, wiring, electrical components and electrical schematic
symbols.
Contents
The chapters of this manual are briefly described below.
Introduction to the manual introduces this manual.
Prevention of unexpected start-up (+Q950) describes the +Q950 Prevention of
unexpected start-up function and instructs how to wire, start-up, use and maintain it.
Category 0 emergency stop (+Q951) describes the +Q951 emergency stop option and
instructs how to wire, start-up, use and maintain it. The safety data is also given.
Safe torque off (+Q967) describes the +Q967 Safe torque off function and instructs how to
wire, start-up, use and maintain it.
Prevention of unexpected start-up with STO (+Q968) describes the +Q968 Prevention of
unexpected start-up with STO function and instructs how to wire, start-up, use and
maintain it. The safety data is also given.
Maintenance gives maintenance instructions for the safety functions.
Declaration of Conformity contains the Compliance with the European Machinery Directive
statement and the Declaration of Conformity.
Related documents
• Drive hardware and inverter firmware manuals. See the inside of the front cover
• Circuit diagrams delivered with the drive
Abbreviations
Abbreviations used in this manual are listed below.
Abbreviation Reference Description
ASTO - Safe torque off board
CCF EN ISO 13849-1 Common cause failure (%)
CMRB - Relay and interface board
DC EN ISO 13849-1 Diagnostic coverage
FIT IEC 61508 Failure In time: 1E-9 hours
HFT IEC 61508 Hardware fault tolerance
MTTFd EN ISO 13849-1 Mean time to dangerous failure: (The total number of life units) /
(the number of dangerous, undetected failures) during a particular
measurement interval under stated conditions
PFH IEC 61508 Probability of dangerous failures per hour
PL EN ISO 13849-1 Performance level: corresponds SIL, Levels a-e
POUS EN 1037 Prevention of unexpected start-up
SFF IEC 61508 Safe failure fraction (%)
SIL IEC 61508 Safety integrity level
SS1 EN 61800-5-2 Safe stop 1
STO EN 61800-5-2 Safe torque off
T1 IEC 61508 Proof test interval
General rules, notes and definitions concerning the

safety options
 Validation procedure
IEC 61508 requires that the final assembler of the machine validates the operability of the
safety circuit with an acceptance test. A complete acceptance test using the start-up
checklist given under section Start-up and validation is required:
• at initial start-up of the safety function
• after moving started-up safety-related objects
• after any software or hardware change or maintenance action relevant to the safety
function.
Authorized person
The acceptance test of the safety function must be carried out by an authorized person
with expertise and knowledge of the safety function. The test report must be documented
and signed by the authorized person.
Acceptance test reports

Signed acceptance test reports must be stored in the logbook of the machine. The report
shall include documentation of start-up activities and test results, references to failure
reports and resolution of failures. Any new acceptance tests performed due to changes or
maintenance shall be logged into the logbook.
 Example parameter settings

The parameter settings in this manual are the default values of the ACS800 standard
control program (Single drive without option code for control program, options +N664 and
+N679) or ACS800 system control program (multidrives without option code for control
program, options +N671 and +N677).
For other control programs, refer to their firmware manuals for the appropriate parameter
settings. Note: For example, if the parameter default value in the control program is RAMP
but the safety function requires COAST, the parameter value must be changed.
List of standards
EN 1037:1995 + A1:2008 Safety of machinery – Prevention of unexpected start-up
EN ISO 12100:2010 Safety of machinery – Basic concepts, general principles for design
EN ISO 13849-1:2008 Safety of machinery – Safety-related parts of control systems – Part 1:
General principles for design
EN ISO 13849-2:2012 Safety of machinery – Safety-related parts of control systems – Part 2:
Validation
EN ISO 13850:2008 Safety of machinery – Emergency stop equipment, functional aspects –
Principles for design
ISO 14118:2000 Safety of machinery – Prevention of unexpected start-up
EN 60204-1:2006 + A1:2009 Safety of machinery. Electrical equipment of machines. Part 1: General
IEC 60204-1:2005 + A1:2008 requirements.
EN/IEC 61800-5-2:2007 Adjustable speed electrical power drive systems - Part 5-2: Safety
requirements – Functional
IEC 61508 Edition 1 Functional safety of electrical/electronic/programmable electronic safety-
related systems
IEC 61511:2003 Functional safety – Safety instrumented systems for the process industry
sector
EN/IEC 62061:2005 + AC:2010 Safety – Functional safety of electrical, electronic and programmable
electronic control systems
Prevention of unexpected start-up (+Q950) 15
2
Prevention of unexpected start-
up (+Q950)

This chapter describes the +Q950 Prevention of unexpected start-up function and instructs
how to wire, start-up, use and maintain it.
Description
The Prevention of unexpected start-up function disables the control voltage of the power
semiconductors of the drive output stage, thus preventing the motor-side converter from
generating the voltage required to rotate the motor. By using this function, short-time
operations (like cleaning) and/or maintenance work on non-electrical parts of the
machinery can be performed without switching off the power supply to the drive.
The operator activates the Prevention of unexpected start-up function using a switch
mounted on a control desk. When the function is activated, the switch is opened, and an
indicator lamp will light.
Note: This Prevention of unexpected start-up function is not SIL/PL classified in ACS800
drives.
WARNING! The Prevention of unexpected start-up function does not disconnect

the voltage of the main and auxiliary circuits from the drive. Therefore
maintenance work on electrical parts of the drive or the motor can only be carried
out after isolating the drive system from the main supply.
16 Prevention of unexpected start-up (+Q950)
 Applicable standards
The Prevention of unexpected start-up function complies with the following standards:
EN/IEC 60204-1:1997; ISO 14118:2000, EN 1037:1996, EN ISO 12100:2003,
EN 954-1:1996, EN ISO 13849-2:2003.
Wiring
For connections to the drive, see the circuit diagram(s) delivered with the drive. The user
must acquire and install the components and cables drawn with a dotted line.
Install on a control desk near the machinery:
• switching/disconnecting device for the circuitry. For example, use a type of a switch
that can be locked to open position. “Means shall be provided to prevent inadvertent,
and/or mistaken closure of the disconnecting device.” EN 60204-1:1997.
• indicating lamp; on = starting the drive is prevented, off = drive is operative.
Start-up and validation

Action
It is a good practice to verify the operation of the Prevention of unexpected start-up function as
described under Validation procedure, page 13.
Follow the safety instructions, see section Safety instructions, page 11.
Ensure that the drive can be run and stopped freely during the start-up.
Stop the drive (if running), switch the input power off and isolate the drive from the power line by a
disconnector.
Check the Prevention of unexpected start-up circuit connections against the circuit diagram.
Close the disconnector and switch the power on.
Test the operation of the Prevention of unexpected start-up function when the motor is stopped:
• Give a stop command for the drive (if running) and wait until the motor shaft is at standstill.
• Activate the Prevention of unexpected start-up function and give a start command for the drive.
• Ensure that the drive does not start and the motor stays at standstill.
• Deactivate the Prevention of unexpected start-up function.
Prevention of unexpected start-up (+Q950) 17
Use
Activate the function as follows:
• Stop the drive. Use the stop key of the panel (local mode) or give the stop command
through the I/O or fieldbus interface.
• Open the switch activating the Prevention of unexpected start-up function of the drive.
-> The indication lamp (if installed) is lit.
• Lock the switch to the open position.
• Before starting the work on the machinery, ensure that the motor shaft is at standstill
(not freely rotating).
Inactivate the function in reverse order.
Note: The Prevention of unexpected start-up function is not intended for stopping the
drive. If a running drive is stopped by using the Prevention of unexpected start-up function,
the drive will cut off the motor supply voltage and the motor will coast to stop.
When the function is activated, the switch is opened, and an indicator lamp will light.
Maintenance
See chapter Maintenance.
18 Prevention of unexpected start-up (+Q950)
Category 0 emergency stop (+Q951) 19
3
Category 0 emergency stop
(+Q951)

This chapter describes the +Q951 emergency stop option and instructs how to wire, start-
up, use and maintain it. The safety data is also given.
Description
Option +Q951 corresponds to an uncontrolled stop in accordance with stop category 0 of
EN/IEC 60204-1. The option opens the main contactor or main circuit breaker of the drive,
thus, switching off the supply power. In large drives which have a supply unit controlled by
a control board of its own, function +Q951 gives also a stop command to the supply unit.
Motor(s) coasts to stop after the power is cut off.
Standards complied with: EN/IEC 60204-1:2006 + A1:2009, EN ISO 12100:2010,
EN 62061:2005 + AC:2010, EN ISO 13849-1:2008, EN ISO 13849-2:2012,
EN ISO 13850:2008, IEC 61511:2003 and IEC 61508 Edition 1.
20 Category 0 emergency stop (+Q951)
Parameter settings
 Standard control program
The start interlock input is connected to digital input DIIL at the drive control board. The
appropriate emergency stop parameter setting is given in the table below.
Parameter Appropriate value
21.09 START INTRL FUNC OFF2 STOP
 System control program

The emergency stop input is connected to digital input DI1 at the drive control board. The
21.04 EME STOP MODE COAST STOP

Operation principle
The operation principle of the emergency stop option is shown in the examples below.
 ACS800-07 frames R5, R6, R7, R8

This section is valid with ACS800 standard control program (+N664 and +N679).
Initial status: Drive is in operation. See section Parameter settings, page 20.
Step Operation
1 User pushes S20.
2 Contacts of S20 de-energize A21:K1 and A21:K2. -> Relay K13 and main contactor K1 de-energize.
3 Contact of K13 switches off Start interlock signal (DIIL) at the drive control board.
Main contacts of K1 open and switch off the power supply for the drive and motor.
4 Drive stops and motor coasts without power.
 ACS800-07 with main contactor (option +F250)

This section is valid with ACS800 standard control program (+N664 and +N679) for ACS800-07 frames D4 +
2×R8i and above with options +Q951, +F250 and +V992.
Step Operation
1 User pushes S20.
2 Contacts of S20 de-energize A21:K1 and A21:K2. ->
• Start interlock signal (DIIL) at the drive control board and the supply on/off signal switch off.
• Relays K1 (and K2) de-energize via A44.
3 Main contacts of K1 (and K2) open and switch off the power supply for the drive and motor.
 ACS800-07LC with main contactor (option +F250)

Step Operation
1 User pushes S20.
• Relays K11 and K12 de-energize.
3 Main contacts of K1 open and switch off the power supply for the drive and motor.
 ACS800-307/507 with main contactor (option +F250)

This section is valid with ACS800 system control program (+N671 and +N677) for ACS800-307 and ACS800-
507 with options +Q951, +F250 and +V992.
Initial status: Drive is in operation. See section Parameter settings, page 20. *) main contactor feedback.
Step Operation
1 User pushes S20.
• Emergency stop signal (DI1) at the drive control boards and the supply on/off signal switch off.
• Relay A26 de-energizes. -> Relays K1 (and K2) de-energize via A44.
 ACS800-307LC/507LC with main contactor (option +F250)

This section is valid with ACS800 system control program (+N671 and +N677) for ACS800-307LC and
ACS800-507LC with options +Q951 and +F250.
Initial status: Drive is in operation. See section Parameter settings, page 20. *) main contactor feedback.
Step Operation
1 User pushes S20.
• Emergency stop signal (DI1) at the drive control boards and the supply on/off signal switch off.
• Relay A26 de-energizes. -> Relays K11 and K12 de-energize.
 ACS800-07 with main breaker (option +F255)

Step Operation
1 User pushes S20.
• Main breaker Q1 de-energizes.
3 Main contacts of Q1 open and switch off the power supply for the drive and motor.
 ACS800-07LC with main breaker (option +F255)

This section is valid with ACS800 standard control program (+N664 and +N679) for ACS800-07LC with
options +Q951 and +F255.
Step Operation
1 User pushes S20.
• Relays K11 and K12 de-energize. -> Main breaker Q1 de-energizes.
3 Main contacts of main breaker Q1 open and switch off the power supply for the drive and motor.
 ACS800-17/37
Step Operation
1 User pushes S20.
Start interlock signal (DIIL) at the drive control board switches off.
Relays K13 and K15 de-energize. -> Main contactor K1 (main breaker Q1) de-energizes.
3 Main contacts of main contactor K1 (main breaker Q1) open and switch off the power supply for the
drive and motor.
 ACS800-17LC/37LC frames R7i + R7i and R8i + R8i

Step Operation
1 User pushes S20.
Start interlock signal (DIIL) at the drive control board switches off.
Relays K13 and K15 de-energize. -> Main contactor K1 de-energizes.
3 Main contacts of main contactor K1 open and switch off the power supply for the drive and motor.
 ACS800-17LC/37LC frames 2×R8i + 2×R8i and up (option +F255)

This section is valid with ACS800 standard control program (+N664 and +N679) for ACS800-17LC and
ACS800-37LC units of frames 2×R8i + 2×R8i and up with options +Q951 and +F255.
Initial status: Drive is in operation. See section Parameter settings, page 20. *) main breaker feedback.
Step Operation
1 User pushes S20.
• Start interlock signal (DIIL) at the drive control board switches off.
• Relay A26 de-energizes. -> Relays K11 and K12 de-energize. -> Main breaker Q1 de-energizes.
 ACS800 multidrives with main breaker (option +F255)

This section is valid with ACS800 system control program (+N671 and +N677) for the following product types:
• ACS800-207 with options +Q951 and +F255; ACS800-307 with options +Q951, +F255 and +V992;
ACS800-507 with options +Q951, +F250 and +V992; ACS800-407 with options +Q951 and +F255
• ACS800-207LC with options +Q951 and +F255; ACS800-307LC with options +Q951 and +F255;
Initial status: Drive is in operation. See section Parameter settings, page 20. *) main breaker feedback.
Step Operation
1 User pushes S20.
• Emergency stop signal (DI1) at the drive control board switches off.
• Extension relay A26 de-energizes.
3 Contacts of A26 de-energize relays K11 and K12. Contacts of K11 and K12 de-energize main breaker
Q1.
Wiring
One emergency stop push-button is installed on the cabinet door and wired to the drive at
the factory. Wire the additional emergency stop push-buttons to the appropriate terminal
block inside the drive cabinet. See the circuit diagrams delivered with the drive.

Setting of application program parameters is not needed (see section Parameter settings,
page 20).
Action
WARNING! Follow the Safety instructions, page 11. Ignoring the instructions can cause
physical injury or death, or damage to the equipment.
disconnector.
Check the emergency stop circuit connections against the circuit diagram.
Test the operation of the Emergency stop function when the motor is running as follows:
• Start the drive and ensure that the motor is running. If possible, use motor speed close to the
maximum speed of the application.
• Push the emergency stop push button.
• Ensure that the drive stops the motor by coasting and displays a warning or fault. For description
of the warning, see the Firmware manual.
• Ensure that the selected emergency stop function behaves as described in the Firmware manual.
• Ensure that the motor stays at standstill.
• Turn the emergency stop push button clockwise until the button releases.
• Press the blue lit emergency stop reset button (if installed). The blue light goes out.
• Turn the manual operating switch on the front door to position S for 2 seconds. The main
contactor or circuit breaker closes. The drive and motor become live.
• Restart the drive and check that the drive operates normally.
Repeat the test from each operating location (emergency stop push button).
Document and sign the acceptance test report which verifies that the safety function is safe and
accepted to operation.
Use
When the emergency stop is not activated, the drive operates normally. When the
emergency stop is activated, the main contactor or circuit breaker is de-energized. Start is
only possible after the emergency stop and any faults have been reset.
 How to activate the emergency stop

Push the emergency stop push-button. The emergency stop activates and the button
locks in the “ON” position.
 How to reset the emergency stop circuit
WARNING! Ensure that it is safe to apply input voltage: It is safe to start

the motor. All cabinet doors are closed.
Step What to do What happens
1 Turn the emergency stop push-button clockwise The emergency stop deactivates.
until the button releases.
2 Frames 2×R8i and up: Press the blue lit reset The blue light goes out.
button on the cabinet door.
Note: The “start” command has to be removed once before the drive starts (according to
EN/IEC 60204-1 a reset shall not initiate a restart).
Maintenance
Fault tracing
See the drive firmware manual for the warning and fault messages generated by the drive.
Safety data (SIL, PL)

Emergency stop total delay: < 250 ms (< 1.5 seconds in ACS800-07 and multidrive units
with +V992 supply and main contactor if the discharging circuit of relay A44 has failed.)
 Category 0 emergency stop with opening the main contactor

(+Q951)
The components that are included in the safety data calculations are shown in the safety
block diagrams below. The data is calculated with small breaking current (normal situation
when the contactor is opened) at one day contactor switching (one opening and closing)
intervals. The emergency stop is estimated to be used once a week. The emergency stop
push button is included in the values. For descriptions of the abbreviations, see page 14.
Emergency Emergency Main

stop push stop relay contactor
button –A21 –K1
–S20
ACS800-07 frames R5 to R8
Diode supply Diode supply

Emergency Emergency Module relay unit U1.1 unit U1.4
stop push stop relay board Main Main
button –A21 –A44 contactors contactors
–S20 –K1 –K1
–K2 –K2
ACS800-07 n×R8i (units with +V992 supply)
Emergency Emergency Auxiliary Main

stop push stop relay relays contactor
button –A21 –K11 –K1
–S20 –K12
ACS800-07LC
Emergency Emergency Auxiliary Main

stop push stop relay relays contactor
button –A21 –K13 –K1
–S20 –K15
ACS800-17/37 frames R6, R7i and R8i and ACS800-17LC/37LC frames R7i and R8i
ACS800-07 frames R5 to R8, ACS800-07LC, ACS800-17/37 and ACS800-17LC/37LC

6-pulse single drives with contactor and Emergency stop push button, one day switching
interval
ACS800 drive type SIL / PL PFH2) DC Cat. CCF Lifetime SC HFT T11)
SILCL [1/h] [%] [a] [a]
07-0075-3…-0205-3 2 d 2.7E-7 >90 2 65 20 2 0 20
07-0105-5…-0255-5
07-0070-7…-0400-7
-17/37-0060-3…-0210-3 2 d 3.7E-7 >60 2 65 20 2 0 20
-17/37-0070-5…-0260-5
-17/37-0060-7… -0400-7
-17LC/37LC-0110-3 …-0260-3
-17LC/37LC-0120-5 …-0310-5
-17LC/37LC-0130-7 …-0470-7
-07-0260-3…-0490-3 2 d 2.7E-7 >90 2 65 20 2 0 20
-07-0320-5…-0610-5
-07-0440-7…-0610-7
-17/37-0260-3…-0490-3 2 d 3.7E-7 >60 2 65 20 2 0 20
-17/37-0320-5…-0580-5
-17/37-0440-7
-17/37-0540-7
-07LC-0390-3
-07LC-0470-5
-07LC-0700-7
-07LC-04LC-0350-3 …-0580-3
-17LC/37LC-0410-5 …-0690-5
-17LC/37LC-0630-7
1) See also section Proof test interval on page 88. Code: 3AXD00000596275 Rev C
2) PFH values according to ISO 13849-1.
ACS800-07 frames nxR8i

interval
SILCL [1/h] [%] [a] [a]
-07-0610-3 2 d 2.8E-7 >60 2 65 20 2 0 20
-07-0760-5
-07-0750-7…-1060-7
-07-0770-3…-1230-3 2 d 2.8E-7 >60 2 65 20 2 0 20
-07-0910-5…-1540-5
-07-1160-7…-2120-7
-07-1540-3…-1850-3 2 d 2.9E-7 >60 2 65 20 2 0 20
-07-1820-5…-2310-5
-07-2320-7… -3190-7
-07-3490-7 2 d 5.9E-7 >60 2 65 20 2 0 20
 Category 0 emergency stop with opening the main circuit breaker

(+Q951)
block diagram below. The data is calculated at one week circuit breaker switching (one
opening and closing) interval. The emergency stop is estimated to be used once a month.
The emergency stop push button is included in the values. For descriptions of the
abbreviations, see page 14.
Emergency Emergency Main circuit

stop push stop relay breaker
button –A21 –Q1
–S20
ACS800-07 frames n×R8i
Emergency Emergency Auxiliary Main circuit

stop push stop relay relays breaker
button –A21 –K13 –Q1
–S20 –K15
ACS800-17/37 frames n×R8i
Emergency Emergency Auxiliary Main circuit

stop push stop relay relays breaker
button –A21 –K11 –Q1
–S20 –K12
ACS800-07LC
Emergency Emergency Extension Auxiliary Main circuit

stop push stop relay relays relays breaker
button –A21 –A26 –K11 –Q1
–S20 –K12
ACS800-17LC/37LC frames 2×R8i and up
ACS800-07, ACS800-07LC and ACS800-17/37 drives

6-pulse single drives with circuit breaker, one week switching interval, 0% switching
current
SILCL [1/h] [%] [a] [a]
-07: nxR8i 2 d 2.7E-7 >90 2 65 20 2 0 20
-17/37-0640-3… 2 d 3.7E-7 >60 2 65 20 2 0 20
-17/37-0780-5…
-17/37-0790-7…
-07LC-0470-3…-2370-3
-07LC-0550-5…-2790-5
-07LC-0940-7…-3970-7
-07LC-2940-3 2 d 3.7E-7 >60 2 65 20 2 0 20
-07LC-3510-3
-07LC-3470-5
-07LC-4150-5
-07LC-4630-7… -6620-7
ACS800-17LC and ACS800-37LC frames 2…10xR8i

current
SILCL [1/h] [%] [a] [a]
-17LC/37LC-0870-3…-2220-3 2 d 3.7E-7 >60 2 65 20 2 0 20
-17LC/37LC-1030-5…-2640-5
-17LC/37LC-0950-7…-3620-7
-17LC/37LC-3300-3 2 d 3.7E-7 >60 2 65 20 2 0 20
-17LC/37LC-3930-5
-17LC/37LC-4630-7…
ACS800-07, ACS800-07LC and ACS800-17/37

current
SILCL [1/h] [%] [a] [a]
-07: nxR8i 2 d 2.9E-7 >90 2 65 20 2 0 20
-17/37-0640-3… 2 d 3.9E-7 >60 2 65 20 2 0 20
-17/37-0780-5…
-17/37-0790-7…
-07LC-0470-3…-2370-3
-07LC-0550-5…-2790-5
-07LC-0940-7…-3970-7
-07LC-2940-3 2 c 1.4E-6 >60 2 65 20 2 0 20
-07LC-3510-3
-07LC-3470-5
-07LC-4150-5
-07LC-4630-7… -6620-7
ACS800-17LC and ACS800-37LC frames 2…10xR8i

current
SILCL [1/h] [%] [a] [a]
-17LC/37LC-0870-3…-2220-3 2 d 3.9E-7 >60 2 65 20 2 0 20
-17LC/37LC-1030-5…-2640-5
-17LC/37LC-0950-7…-3620-7
-17LC/37LC-3300-3 2 c 1.4E-6 >60 2 65 20 2 0 20
-17LC/37LC-3930-5
-17LC/37LC-4630-7…
4
(+Q963)

Description
Option +Q963 corresponds to an uncontrolled stop in accordance with stop category 0 of
EN 60204-1. The option activates the Safe torque off function which disables the control
voltage of the power semiconductors of the drive output stage, thus preventing the inverter
from generating the voltage required to rotate the motor. The motor coasts to stop. The
main contactor/breaker of the drive will not be opened.
Emergency stop function +Q963 complies with the following standards:
EN/IEC 60204-1:2006 + A1:2009, EN ISO 12100:2010, EN 62061:2005 + AC:2010,
EN ISO 13849-1:2008, EN ISO 13849-2:2012, EN ISO 13850:2008, IEC 61511:2003 and
IEC 61508 Edition 1.
The Safe torque off function complies with the following standards: EN 61800-5-2:2007,
EN ISO 13849-1:2008, EN ISO 13849-2:2012, IEC 61508 Edition 1, IEC 61511:2003 and
EN 62061:2005 + AC:2010.
Note: Emergency stop function +Q963 is supported only with Standard control program
(options +N664 and +N679) and ACS800 system control program (options +N671 and
+N677).
Parameter settings
The start interlock input is connected to digital input DIIL at the drive control board. The

appropriate emergency stop parameter default setting is given in the table below.
21.04 EME STOP MODE COAST STOP

 ACS800-07 frames R5, R6, R7, R8

+Q968
Step Operation
1 User pushes S20.
2 Contacts of S20 de-energize A21:K1 and A21:K2. -> Safety relay A40 de-energizes. -> Safe torque off
function activates. IGBT gate drivers cannot operate.
Note concerning drives with option +Q968: When the drive is in operation, customer’s STO switch
is in position 1. The user can activate the Safe torque off function by turning the STO switch to position
0 regardless of the position of S20.
3 Motor coasts to stop.
 ACS800-07/17/37/07LC and ACS800-17LC/37LC frames R7i + R7i

and R8i + R8i
This section is valid with ACS800 standard control program (+N664 and +N679) for the following product
types:
• ACS800-07 frames D4 + 2×R8i and above with options +Q963 and +V992
• ACS800-07LC with option +Q963
• ACS800-17 and ACS800-37 with option +Q963
• ACS800-17LC and ACS800-37LC frames R7i + R7i and R8i + R8i with option +Q963.
+Q968
Step Operation
1 User pushes S20.
• Inverters start interlock signal (DIIL) at the drive control board switches off.
• Safety relay A40 de-energizes. -> Safe torque off function activates. IGBT gate drivers cannot
operate.
 ACS800 multidrives and ACS800-17LC/37LC frames 2×R8i + 2×R8i

and up
• ACS800-207 with option +Q963; ACS800-307 with options +Q963 and +V992; ACS800-507 with options
+Q963 and +V992; and ACS800-407 with option +Q963
• ACS800-207LC with option +Q963; ACS800-307LC with option +Q963; and ACS800-507LC with option
+Q963
• ACS800-17LC and ACS800-37LC frames 2×R8i + 2×R8i and up with option +Q963.
+Q968
‘) emergency stop feedback.
Step Operation
1 User pushes S20.
2 Contacts of S20 de-energize A21:K1 and A21:K2.
-> Inverters emergency stop signal (DI1) at the drive control board switches off.
-> Auxiliary relay A26 de-energizes.
3 A26 de-energizes safety relay(s) A40. -> Safe torque off function activates. IGBT gate drivers cannot
operate.
Wiring

Setting of application program parameters is not needed. See section Parameter settings,
page 40.
Action
disconnector.
Test the operation of the Emergency stop function when the motor is running:
• Ensure that the drive stops the motor by coasting and displays a warning or fault. For description
of the warning, see the Firmware manual.
Use

2 Frames 2×R8i and up: Press the blue lit reset The blue light goes out.
button on the cabinet door.
Maintenance
Fault tracing

Emergency stop total delay: < 300 ms
 Category 0 emergency stop without opening the main contactor /

circuit breaker (+Q963)
block diagrams below.
Emergency Emergency Safe torque Drive module

stop push stop relay off relay unit U1
button –A21 –A40
–S20
Emergency Emergency Safe torque Inverter unit Inverter unit

stop push stop relay off relay unit U2.1 U2.n
–S20
ACS800-07 n×R8i
Emergency Emergency Safe torque Inverter unit Inverter unit

stop push stop relay off relay unit U11.1 U11.n
–S20
ACS800-07LC/17/37 and ACS800-17LC/37LC frames R7i and R8i
Emergency Emergency Emergency Safe torque Inverter Inverter

stop push stop relay stop off relay unit unit unit
button –A21 extension unit –A40 U11.1 U11.n
–S20 –A26
ACS800-17LC/37LC frames 2×R8i

ACS800-07/07LC/17/37 all frames and ACS800-17LC/37LC frames R7i-R8i with

Emergency stop push button
Values correspond to Emergency stop being activated one time per month.
ACS800 drive frame SIL / PL PFH2) DC Cat. CCF Lifetime SC HFT T11)
size SILCL [1/h] [%] [a] [a]
R5 2 d 4.4 E-8 >90 2 65 20 2 0 20
R6 2 d 4.4 E-8 >90 2 65 20 2 0 20
R7, R7i, R8, R8i 2 d 4.4 E-8 >90 2 65 20 2 0 20
2×R8i 2 d 4.5 E-8 >90 2 65 20 2 0 20
3×R8i 2 d 4.6 E-8 >90 2 65 20 2 0 20
4×R8i 2 d 4.7 E-8 >90 2 65 20 2 0 20
5×R8i 2 d 4.8 E-8 >90 2 65 20 2 0 20
6×R8i 2 d 4.9 E-8 >90 2 65 20 2 0 20
7×R8i 2 d 5.0 E-8 >90 2 65 20 2 0 20
8×R8i 2 d 5.0 E-8 >90 2 65 20 2 0 20
9×R8i 2 d 5.1 E-8 >90 2 65 20 2 0 20
10×R8i 2 d 5.2 E-8 >90 2 65 20 2 0 20
ACS800-17LC/37LC frames 2...10xR8i with Emergency stop push button

2×R8i 2 d 4.6 E-8 >90 2 65 20 2 0 20
3×R8i 2 d 4.6 E-8 >90 2 65 20 2 0 20
4×R8i 2 d 4.7 E-8 >90 2 65 20 2 0 20
5×R8i 2 d 4.8 E-8 >90 2 65 20 2 0 20
6×R8i 2 d 4.9 E-8 >90 2 65 20 2 0 20
7×R8i 2 d 5.0 E-8 >90 2 65 20 2 0 20
8×R8i 2 d 5.1 E-8 >90 2 65 20 2 0 20
9×R8i 2 d 5.2 E-8 >90 2 65 20 2 0 20
10×R8i 2 d 5.3 E-8 >90 2 65 20 2 0 20
5
(+Q952)

Description
Option +Q952 corresponds to a controlled stop in accordance with stop category 1 of
EN 60204-1. After the emergency stop command has been given, the drive first
decelerates the motor to a standstill according to a preset ramp time. Then, the main
contactor or circuit breaker is switched off. The time delay is 6…60 seconds in ACS800
single drives and 60…600 seconds in ACS800 multidrives. 60…600 second time delays
for ACS800 single drives and 6…60 second time delays for ACS800 multidrives are
available as application engineered units.
Standards complied with: EN/IEC 60204-1:2006 + A1:2009, EN ISO 12100:2010,
EN 62061:2005 + AC:2010, EN ISO 13849-1:2008, EN ISO 13849-2:2012,
EN ISO 13850:2008, IEC 61511:2003 and IEC 61508 Edition 1.
Parameter settings
With Standard control program, digital I/O extension module RDIO-01 is configured as an
emergency stop signal interface at the factory. In case optional module slots 1 and 2 on
the RDCU Control Unit are reserved, the I/O extension module is placed on an AIMA-01
I/O Module Adapter.
The emergency stop function reads the emergency stop request through digital input DI2
of the digital I/O extension module (RDIO) and acknowledges the request through RDIO
relay output RO1. The start interlock input is connected to digital input DIIL at the drive
control board.
Parameter Appropriate value / Description

Additional start interlock to ensure that the drive cannot
start when the emergency stop is active.
22.07 EM STOP RAMP TIME According to the application

control board acknowledges the request through its relay output RO1.
14.01 DO1 CONTROL OFF
21.04 EME STOP MODE STOP RAMPING
21.05 EMSTOP DER MAX L * Maximum deceleration rate for the emergency stop
ramp monitoring. Set according to the application.
0…18000 rpm/s
21.06 EMSTOP DER MIN L * Minimum deceleration rate for the emergency stop
0…18000 rpm/s
21.07 EMSTOP DEC MON DEL* Time delay between the emergency stop signal and the
start of the deceleration monitoring.
0…100 s
22.04 EME STOP RAMP According to the application
* These parameters define and activate the ramp monitoring feature of emergency stop.
Using ramp monitoring is highly recommended, especially if the SPEED CORRECTION
(23.04) term or TORQUE STEP (26.03) in used.
Operation principle
The operation principle of the emergency stop option is shown in the examples below.
 ACS800-07 frames R5, R6, R7 and R8

Step Operation
1 User pushes S20.
• Drive control board gets emergency stop request (RDIO -> RMIO).
• Delay counter of relays K1t and K2t starts.
• Time relay K21 is de-energized and its delay counter starts.
3 Control board acknowledges the emergency stop request. ->
• The feedback chain closes and K21 re-energizes.
• Drive starts ramping down the speed and the motor decelerates to standstill.
4 Application-specific delay time ends and K1t and K2t de-energize. Contacts of K1t and K2t de-
energize A22. -> Relay K13 de-energizes. ->
• Start interlock input (DIIL) at the drive control board de-energizes.
• Main contactor K1 de-energizes.
5 Main contactor K1 opens. The main circuit of the drive de-energises and the motor is unable to
generate torque.
Note: If the control board does not acknowledge the emergency stop request is 2 seconds, K21 de-energizes
A22.
 ACS800-17/37 and ACS800-07LC

This section is valid with ACS800 standard control program (+N664 and +N679) for the following drive types
• ACS800-17 and ACS800-37
• ACS800-07LC when relays K13 and K15 are replaced with relays K11 and K12.
Step Operation
1 User pushes S20.
energize A22. ->
• Main contactor K1 (or circuit breaker Q1) de-energizes.
5 Main contactor K1 (or circuit breaker Q1) opens. The main circuit of the drive de-energises and the
motor is unable to generate torque.
A22.

This section is valid with ACS800 standard control program (+N664 and +N679) for the following drive types:
• ACS800-17LC frames R7i + R7i and R8i + R8i with contactor (+F250)
• ACS800-37LC frames R7i + R7i and R8i + R8i with contactor (+F250).
Step Operation
1 User pushes S20.
energize A22. ->
generate torque.
A22.
 ACS800-17LC/37LC frames 2×R8i + 2×R8i and up with main breaker

(option +F255)
Step Operation
1 User pushes S20.
energize A26. ->
• Relays K11 and K12 de-energize
• Main breaker Q1 de-energizes.
5 Main breaker Q1 opens. The main circuit of the drive de-energises and the motor is unable to generate
torque.
A26.
 ACS800-07 with main contactor (option +F250)

Step Operation
1 User pushes S20.
energize A22. ->
• Main contactors K1 (and K2) de-energize through A44.
5 Main contactors K1 (and K2) open. The main circuit of the drive de-energises and the motor is unable
to generate torque.
A22.
 ACS800 air-cooled multidrives with main contactor (option +F250)

ACS800-507 with options +Q952, +F250 and +V992; and ACS800-407 with options +Q951 and +F250.
*)
Step Operation
1 User pushes S20.
• Emergency stop inputs DI1 at drive control boards get emergency stop request.
• Drive starts ramping down the speed and the motor decelerates to standstill. If the ramp monitoring
(ACS800 System control program 21.05…21.07) is activated, drive starts the monitoring.
energize A26. ->
• Main contactors K1 (and K2) de-energize through A44.
5 Main contactors K1 (and K2) open. The main circuit of the drive de-energises and the motor is unable
to generate torque.
A26.
 ACS800 liquid-cooled multidrives with main contactor (option

+F250)
• ACS800-207LC with options +Q952 and +F250; ACS800-307LC with options +Q952 and +F250;
Step Operation
1 User pushes S20.
energize A26. ->
generate torque.
A26.
 ACS800-07 with main circuit breaker (option +F255)

Step Operation
1 User pushes S20.
energize A22. ->
• Main circuit breaker Q1 de-energizes.
5 Main circuit breaker Q1 opens. The main circuit of the drive de-energises and the motor is unable to
generate torque.
A22.
 ACS800 multidrives with main circuit breaker (option +F255)

This section is valid with ACS800 system control program (+N671 and +N677) the following product types:
ACS800-507 with options +Q952, +F250 and +V992: and ACS800-407 with options +Q951 and +F255
• ACS800-207LC with options +Q952 and +F255; ACS800-307LC with options +Q951 and +F255; and
*)
Step Operation
1 User pushes S20.
• Emergency stop inputs DI1at the drive control boards get emergency stop request.
energize A26. ->
• Main circuit breaker Q1 de-energizes.
5 Main circuit breaker Q1opens. The main circuit of the drive de-energises and the motor is unable to
generate torque.
A26.
Wiring

Action
disconnector.
Set the delay time in relay A21. The time should be set a bit longer than the worst case (longest)
ramp delay. After this delay, the relay contacts will open and the safe state will be achieved.
Set the ramp time of parameter 22.07 EM STOP RAMP TIME (or 22.04 EME STOP RAMP)
according to the application requirements. If the ramp time is changed, check that the delay time of
relay A21 is slightly longer. ACS800 system control program: We also recommend that you activate
the emergency stop ramp monitoring. See parameters 21.05…21.07.
Using ramp monitoring is highly recommended, especially if the SPEED CORRECTION (23.04)
term or TORQUE STEP (26.03) in used.
If the AIMA-01 Module Adapter is in use, check that its node address is the same as in the circuit
diagram delivered with the drive. See AIMA-01 I/O Module Adapter User’s Manual (3AFE64661442
[English]).
Test the operation of the Emergency stop function when the motor is running:
• Ensure that the drive ramps down the motor speed to zero and stops before the time set in relay
A21.
• Try to start the drive.
• Turn the manual operating switch on the front door to position S for 2 seconds. The main
contactor or circuit breaker closes. The drive and motor become live.
Use

2 Press the blue-lit reset button to reset the The blue light goes out.
emergency stop circuit.
Maintenance
Fault tracing
See the drive firmware manual for the warning and fault messages given by the drive.

Emergency stop total delay: < 250 ms + application-specific ramp time (< 1.5 seconds in
ACS800-07 and multidrive units with +V992 supply and main contactor if the discharging
circuit of relay A44 has failed.)
 Category 1 emergency stop with opening the main contactor

(+Q952)
block diagrams below. The data is calculated with small breaking current (the drive ramps
down the current before opening the contactor) at one day contactor switching intervals.
The emergency stop is estimated to be used once a week. The emergency stop push
button is included in the values. For descriptions of the abbreviations, see page 14.
Emergency Emergency Emergency Main
stop push stop relay stop contactor
button –A21 extension unit –K1
–S20 –A22
Diode supply
Emergency Emergency Emergency Module relay unit(s) U1.1 to
stop push stop relay stop board U1.4
button –A21 extension unit –A44 Main
–S20 –A22 contactors:
K1, K2
ACS800-07 frames n×R8i (units with +V992 supply)
Emergency Emergency Emergency Auxiliary Main

stop push stop relay stop relays contactor
button –A21 extension unit –K11 –K1
–S20 –A22 –K12
ACS800-07LC

–S20 –A22 –K15
ACS800-17/37

–S20 –A22 –K15
ACS800-17LC/37LC frames R7i and R8i
ACS800-07 frames R5...R8, ACS800-07LC, ACS800-17/37 and ACS800-17LC/37LC

interval
SILCL [1/h] [%] [a] [a]
07-0075-3…-0205-3 2 d 2.7E-7 >90 2 65 20 2 0 20
07-0105-5…-0260-5
07-0070-7…-0400-7
-17/37-0060-3…-0210-3 2 d 3.7E-7 >60 2 65 20 2 0 20
-17/37-0070-5…-0260-5
-17/37-0060-7… -0400-7
-17LC/37LC-0110-3 …-0260-3
-17LC/37LC-0120-5 …-0310-5
-17LC/37LC-0130-7 …-0470-7
-07-0260-3…-0490-3 2 d 2.7E-7 >90 2 65 20 2 0 20
-07-0320-5…-0580-5
-07-0440-7…-0610-7
-17/37-0260-3…-0490-3 2 d 3.7E-7 >60 2 65 20 2 0 20
-17/37-0320-5…-0610-5
-17/37-0440-7
-17/37-0540-7
-07LC-0390-3
-07LC-0470-5
-07LC-0700-7
-17LC/37LC-0350-3…-0580-3
-17LC/37LC-0410-5… -0690-5
-17LC/37LC-0630-7
ACS800-07 frames nxR8i

interval
SILCL [1/h] [%] [a] [a]
-07-0610-3 2 d 2.8E-7 >60 2 65 20 2 0 20
-07-0760-5
-07-0750-7…-1060-7
-07-0770-3…-1230-3 2 d 2.8E-7 >60 2 65 20 2 0 20
-07-0910-5…-1540-5
-07-1160-7…-2120-7
-07-1540-3…-1850-3 2 d 2.9E-7 >60 2 65 20 2 0 20
-07-1820-5…-2310-5
-07-2320-7… -3190-7
-07-3490-7 2 d 5.9E-7 >60 2 65 20 2 0 20
 Category 1 emergency stop with opening the main circuit breaker

(+Q952)
block diagrams below. The data is calculated at one week circuit breaker switching
intervals. The emergency stop is estimated to be used once a month. The emergency stop
push button is included in the values.
Emergency Emergency Emergency Main circuit

stop push stop relay stop breaker
button –A21 extension unit –Q1
–S20 –A22
Emergency Emergency Emergency Auxiliary Main circuit

stop push stop relay stop relays breaker
button –A21 extension unit –K11 –Q1
–S20 –A22 –K12
ACS800-07LC

–S20 –A22 –K15
ACS800-17/37

–S20 –A26 –K12
ACS800-07, ACS800-07LC, ACS800-17/37 and ACS800-17LC/37LC

current
SILCL [1/h] [%] [a] [a]
-07: nxR8i 2 d 2.7E-7 >90 2 65 20 2 0 20
-17/37-0640-3… 2 d 3.7E-7 >60 2 65 20 2 0 20
-17/37-0780-5…
-17/37-0790-7…
-07LC-0470-3…-2370-3
-07LC-0550-5…-2790-5
-07LC-0940-7…-3970-7
-17LC/37LC-0870-3…-2220-3
-17LC/37LC-1030-5…-2640-5
-17LC/37LC-0950-7…-3620-7
-07LC-2940-3 2 d 3.7E-7 >60 2 65 20 2 0 20
-07LC-3510-3
-07LC-3470-5
-07LC-4150-5
-07LC-4630-7… -6620-7
-17LC/37LC-3300-3
-17LC/37LC-3930-5
-17LC/37LC-4630-7…
ACS800-07, ACS800-07LC, ACS800-17/37 and ACS800-17LC/37LC

current
SILCL [1/h] [%] [a] [a]
-07: nxR8i 2 d 2.9E-7 >90 2 65 20 2 0 20
-17/37-0640-3… 2 d 3.9E-7 >60 2 65 20 2 0 20
-17/37-0780-5…
-17/37-0790-7…
-07LC-0470-3…-2370-3
-07LC-0550-5…-2790-5
-07LC-0940-7…-3970-7
-17LC/37LC-0870-3…-2220-3
-17LC/37LC-1030-5…-2640-5
-17LC/37LC-0950-7…-3620-7
-07LC-2940-3 2 c 1.4E-6 >60 2 65 20 2 0 20
-07LC-3510-3
-07LC-3470-5
-07LC-4150-5
-07LC-4630-7…-6620-7
-17LC/37LC-3300-3
-17LC/37LC-3930-5
-17LC/37LC-4630-7…
6
(+Q964)

Description
Option +Q964 corresponds to a controlled stop in accordance with stop category 1 of
EN 60204-1. The option corresponds to Safe Stop 1 (SS1) function defined in EN 61800-
5-2. After the emergency stop command has been given, the drive first decelerates the
motor to standstill according to a preset ramp time. Then, the drive activates the Safe
torque off function which disables the control voltage of the power semiconductors of the
drive output stage, thus preventing the inverter from generating the voltage required to
rotate the motor. The time delay is 6…60 seconds in ACS800 single drives and 60…600
seconds in ACS800 multidrives. 60…600 second time delays for ACS800 single drives
and 6…60 second time delays for ACS800 multidrives are available as application
engineered units.
Emergency stop function +Q964 complies with the following standards:
EN/IEC 60204-1:2006 + A1:2009, EN ISO 12100:2010, EN 62061:2005 + AC:2010,
EN ISO 13849:1:2008, EN ISO 13849-2:2012, EN ISO 13850:2800, IEC 61511:2003 and
IEC 61508 Edition 1.
The Safe torque off function complies with the following standards: EN 61800-5-2:2007,
EN ISO 13849-1:2008, EN ISO 13849-2:2012, IEC 61508 Edition 1, IEC 61511:2003 and
EN 62061:2005 + AC:2010.
Note: Emergency stop function +Q964 is supported only with Standard control program
(options +N664 and +N679) and ACS800 system control program (options +N671 and
+N677).
Parameter settings
With Standard control program, digital I/O extension module RDIO-01 is configured as an
emergency stop signal interface at the factory. In case optional module slots 1 and 2 on
the RDCU Control Unit are reserved, the I/O extension module is placed on an AIMA-01
I/O Module Adapter.
The emergency stop function reads the emergency stop request through digital input DI2
of the digital I/O extension module (RDIO) and acknowledges the request through RDIO
relay output RO1. The start interlock input is connected to digital input DIIL at the drive
control board.

Additional start interlock to ensure that the drive cannot
start when the emergency stop is active.
22.07 EM STOP RAMP TIME According to the application

control board acknowledges the request through its relay output RO1.
14.01 DO1 CONTROL OFF
21.04 EME STOP MODE STOP RAMPING
21.05 EMSTOP DER MAX L * Maximum deceleration rate for the emergency stop
0…18000 rpm/s
21.06 EMSTOP DER MIN L * Minimum deceleration rate for the emergency stop
0…18000 rpm/s
21.07 EMSTOP DEC MON DEL* Time delay between the emergency stop signal and the
start of the deceleration monitoring.
0…100 s
22.04 EME STOP RAMP According to the application
* These parameters define and activate the ramp monitoring feature of emergency stop.
Using ramp monitoring is highly recommended, especially if the SPEED CORRECTION
(23.04) term or TORQUE STEP (26.03) in used.
Operation principle
 ACS800-07/17/37/07LC and ACS800-17LC/37LC frames 2×R8i +
2×R8i and up
This section is valid with ACS800 standard control program (+N664 and +N679) for the following drive types
• ACS800-07, ACS800-17, ACS800-37, ACS800-07LC
• ACS800-17LC and ACS800-37LC when A22 is replaced with A26.
+Q968
Step Operation
1 User pushes S20.
energize A22. -> Start interlock input (DIIL) at the drive control board de-energizes.
5 Relay A40 de-energizes.
6 Safe torque off function activates. IGBT gate drivers cannot operate.
A22.

This section is valid with ACS800 standard control program (+N664 and +N679) for ACS800-17LC and
ACS800-37LC frames R7i + R7i and R8i + R8i with options +Q964 and +F250.
+Q968
*) emergency stop feedback.
Step Operation
1 User pushes S20.
energize A22. -> Start interlock input (DIIL) at the drive control board de-energizes.
5 Relay A40 de-energizes.
A22.
 ACS800 multidrives
This section is valid with ACS800 system control program (+N671 and +N677).
+Q968
*) emergency stop feedback.
Step Operation
1 User pushes S20.
3 Control boards acknowledge the emergency stop request. ->
• The feedback chain closes and K21 is re-energizes.
(ACS800 system control program 21.05…21.07) is activated, drive starts the monitoring.
energize A26.
5 Relay(s) A40 de-energize.
A26.
Wiring

Action
disconnector.
Set the delay time in relay A21. The time should be set a bit longer than the worst case (longest)
ramp delay. After this delay, the relay contacts will open and the safe state will be achieved.
Set the ramp time of parameter 22.07 EM STOP RAMP TIME (or 22.04 EME STOP RAMP)
according to the application requirements. If the ramp time is changed, check that the delay time of
relay A21 is slightly longer. ACS800 system control program: We also recommend that you activate
the emergency stop ramp monitoring. See parameters 21.05…21.07.
Using ramp monitoring is highly recommended, especially if the SPEED CORRECTION (23.04)
term or TORQUE STEP (26.03) in used.
If the AIMA-01 Module Adapter is in use, check that its node address is the same as in the circuit
diagram delivered with the drive. See AIMA-01 I/O Module Adapter User’s Manual (3AFE64661442
[English]).
Test the operation of the Emergency stop function when the motor is running as follows:
• Ensure that the drive ramps down the motor speed to zero and stops before the time set in relay
A21.
• Try to start the drive.
Use

2 Press the blue-lit reset button to reset the The blue light goes out.
emergency stop circuit.
Maintenance
Fault tracing
See the drive firmware manual for the warning and fault messages given by the drive.

Emergency stop total delay: < 300 ms + application-specific ramp time
 Category 1 emergency stop without opening the main contactor /

circuit breaker (+Q964)
Emergency Emergency Emergency Safe torque Drive module

stop push stop relay stop off relay unit U1
button –A21 extension unit –A40
–S20 –A22
Emergency Emergency Emergency Safe torque Inverter

stop push stop relay stop off relay unit unit(s)
button –A21 extension unit –A40 U2.1 to U2.n
–S20 –A22

button –A21 extension unit –A40 U11.1 to
–S20 –A22 U11.n
ACS800-07LC/17/37 and ACS800-17LC/37LC frames R7i and R8i

button –A21 extension unit –A40 U11.1 to
–S20 –A26 U11.n
ACS800-07/07LC/17/17LC/37/37LC with Emergency stop push button

R5 2 d 4.4 E-8 >90 2 65 20 2 0 20
R6 2 d 4.4 E-8 >90 2 65 20 2 0 20
R7, R7i, R8, R8i 2 d 4.5 E-8 >90 2 65 20 2 0 20
2×R8i 2 d 4.6 E-8 >90 2 65 20 2 0 20
3×R8i 2 d 4.6 E-8 >90 2 65 20 2 0 20
4×R8i 2 d 4.7 E-8 >90 2 65 20 2 0 20
5×R8i 2 d 4.8 E-8 >90 2 65 20 2 0 20
6×R8i 2 d 4.9 E-8 >90 2 65 20 2 0 20
7×R8i 2 d 5.0 E-8 >90 2 65 20 2 0 20
8×R8i 2 d 5.1 E-8 >90 2 65 20 2 0 20
9×R8i 2 d 5.2 E-8 >90 2 65 20 2 0 20
10×R8i 2 d 5.2 E-8 >90 2 65 20 2 0 20
Safe torque off (+Q967) 77
7
Safe torque off (+Q967)

This chapter describes the +Q967 Safe torque off function and instructs how to wire, start-
up, use and maintain it.
Description
The Safe torque off function disables the control voltage of the power semiconductors of
the drive output stage, thus preventing the inverter from generating the voltage required to
rotate the motor. By using this function, short-time operations (like cleaning) and/or
maintenance work on non-electrical parts of the machinery can be performed without
switching off the power supply to the drive.
Safe torque off option +Q967 does not include a safety relay.
Option +Q967 supports the Safe torque off (STO) function according to standards:
EN 61800-5-2:2007; EN ISO 13849-1:2008, EN ISO 13849-2:2012, IEC 61508 Edition 2,
IEC 61511:2003 and EN 62061:2005 + AC:2010.
78 Safe torque off (+Q967)
Operation principle
+24 V
Customer wiring
1. User turns the STO switch to open (0) position.

2. STO input on the inverter ASTO board de-energizes.
3. Inverter ASTO board cuts off the control voltage from the inverter IGBTs. PWR OK
LED on the ASTO board goes off.
4. Motor coasts to stop (if running) and cannot start while the STO switch is in 0 position.
Wiring
Wire a STO switch for disconnecting the power supply to the STO connectors of the drive.
See the circuit diagrams delivered with the drive.

Setting of application program parameters is not needed.
Action
disconnector.
Check the STO circuit connections against the circuit diagram.

Safe torque off (+Q967) 79
Action
Test the operation of the STO function when the motor is stopped.
Ensure that the drive operates as follows:
• Open the STO circuit with the STO switch. The drive displays a warning. For description of the
warning, see the Firmware manual.
• Check that the STO function blocks the drive operations: Start the drive. The drive displays a
warning. The motor should not start rotating.
• Close the STO circuit with the STO switch.
• Check that the STO function allows the normal operation of the drive: start, control of the motor
speed and stop.
Restart the drive and check that the motor runs normally.
Test the operation of the STO function when the motor is running as follows:
• Start the drive and ensure the motor is running.
• Open the STO circuit with the STO switch.
• Ensure that the motor stops and the drive trips.
• Reset the fault and try to start the drive.
• Ensure that the motor stays at standstill and the drive operates as described above in testing the
operation when the motor is stopped.
• Close the STO circuit with the STO switch.
Use
• Stop the drive. Use the stop key of the control panel (local mode) or give the stop
command through the I/O or fieldbus interface.
• Open the switch activating the Safe torque off of the drive.
Deactivate the function in reverse order.
Note: It is not recommended to stop the drive by using the Safe torque off function. If a
running drive is stopped by using the The safe torque off function, the drive will cut off the
motor supply voltage and the motor will coast to stop. If this causes danger or is not
acceptable, the drive and machinery must be stopped using the appropriate stopping
mode before using the Safe torque off function.
80 Safe torque off (+Q967)
Maintenance
Fault tracing

See ACS800-01/U1/04/04LC/04M/U4/11/U11/14/31/U31/104/104LC Safe torque off
function (+Q967) Application guide (3AUA0000063373 [English]).
Prevention of unexpected start-up with STO (+Q968) 81
8
Prevention of unexpected start-
up with STO (+Q968)

This chapter describes the +Q968 Prevention of unexpected start-up with STO function
and instructs how to wire, start-up, use and maintain it. The safety data is also given.
Description
The Prevention of unexpected start-up with STO function disables the control voltage of
the power semiconductors of the drive output stage, thus preventing the inverter from
generating the voltage required to rotate the motor. By using this function, short-time
operations (like cleaning) and/or maintenance work on non-electrical parts of the
machinery can be performed without switching off the power supply to the drive.
Option +Q968 supports the Safe torque off (STO) function according to standards
EN 61800-5-2:2007, EN ISO 13849-1:2008, EN ISO 13849-2:2012, IEC 61508 Edition 1,
IEC 61511:2003 and EN 62061:2005 + AC:2010. The function also corresponds to
Prevention of unexpected start-up of EN 1037.
82 Prevention of unexpected start-up with STO (+Q968)
Operation principle
POUS
1. User turns the POUS switch to open (0) position.

2. Safety relay A40 de-energizes and opens contacts 13-14 and closes contacts 41-42.
3. Indication lamp on the control desk goes on. STO input on the inverter ASTO board
de-energizes.
4. ASTO board cuts off the control voltage from the inverter IGBTs. PWR OK LED on the
ASTO board goes off.
5. Motor coasts to stop (if running) and cannot start while the POUS switch is in 0
position.
Wiring
Wire the POUS switch and indication lamp according to the circuit diagram delivered with
the drive.

Setting of application program parameters is not needed.
Action
Ensure that the drive can be run and stopped freely during the start-ups.
disconnector.
Check the POUS and STO circuit connections against the circuit diagram.
Test the operation of the POUS function when the motor is stopped as follows:
Ensure that the drive operates as follows:
• Open the POUS circuit with the POUS switch. The drive displays a warning. For description of the
warning, see the Firmware manual.
• Check that the POUS function blocks the drive operations: Start the drive. The drive displays a
warning. The motor should not start rotating.
• Close the POUS circuit with the POUS switch.
• Check that the POUS function allows the normal operation of the drive: start, control of the motor
speed and stop.
Test the operation of the POUS function when the motor is running:
• Start the drive and ensure the motor is running.
• Open the POUS circuit with the POUS switch.
• Ensure that the motor stops and the drive trips.
• Check that the indication lamp (if installed) is lit.
• Reset the fault and try to start the drive.
• Ensure that the motor stays at standstill and the drive operates as described above in testing the
operation when the motor is stopped.
• Close the POUS circuit with the POUS switch.
Use
• Stop the drive. Use the stop key of the control panel (local mode) or give the stop
command through the I/O or fieldbus interface.
• Open the switch activating the Safe torque off of the drive. -> The indication lamp (if
installed) is lit.
Deactivate the function in reverse order.
Note: It is not recommended to stop the drive by using the POUS function. If a running
drive is stopped by using the Safe torque off function, the drive will cut off the motor supply
voltage and the motor will coast to stop. If this causes danger or is not acceptable, the
drive and machinery must be stopped using the appropriate stopping mode before using
the POUS function.
Maintenance
Fault tracing

 Prevention of unexpected start-up with STO (+Q968)
Customer POUS relay Drive module

POUS switch unit U1
unit –A40
Customer POUS relay Inverter unit Inverter unit

POUS switch unit U2.1 U2.n
unit –A40
ACS800-07/07LC frames n×R8i
Customer POUS relay Inverter unit Inverter unit

POUS switch unit U11.1 U11.n
unit –A40
ACS800-17/37/17LC/37LC
ACS800-07/07LC/17/17LC/37/37LC without POUS switch

ACS800 drive frame SIL / PL PFH DC Cat. CCF Lifetime SC HFT T11)
R5 2 d 8.3E-10 >90 2 65 20 2 0 20
R6 2 d 6.6E-10 >90 2 65 20 2 0 20
R7, R7i, R8, R8i 2 d 1.1E-9 >90 2 65 20 2 0 20
2×R8i 2 d 2.0E-9 >90 2 65 20 2 0 20
3×R8i 2 d 2.9E-9 >90 2 65 20 2 0 20
4×R8i 2 d 3.8E-9 >90 2 65 20 2 0 20
5×R8i 2 d 4.6E-9 >90 2 65 20 2 0 20
6×R8i 2 d 5.5E-9 >90 2 65 20 2 0 20
7×R8i 2 d 6.4E-9 >90 2 65 20 2 0 20
8×R8i 2 d 7.2E-9 >90 2 65 20 2 0 20
9×R8i 2 d 8.1E-9 >90 2 65 20 2 0 20
10×R8i 2 d 9.0E-9 >90 2 65 20 2 0 20
ACS800-07/07LC/17/17LC/37/37LC with POUS switch

Values correspond to safety function being activated one time per day.
R5 2 d 4.4 E-8 >90 2 65 20 2 0 20
R6 2 d 4.4 E-8 >90 2 65 20 2 0 20
R7, R7i, R8, R8i 2 d 4.4 E-8 >90 2 65 20 2 0 20
2×R8i 2 d 4.5 E-8 >90 2 65 20 2 0 20
3×R8i 2 d 4.6 E-8 >90 2 65 20 2 0 20
4×R8i 2 d 4.7 E-8 >90 2 65 20 2 0 20
5×R8i 2 d 4.8 E-8 >90 2 65 20 2 0 20
6×R8i 2 d 4.8 E-8 >90 2 65 20 2 0 20
7×R8i 2 d 4.9 E-8 >90 2 65 20 2 0 20
8×R8i 2 d 5.0 E-8 >90 2 65 20 2 0 20
9×R8i 2 d 5.1 E-8 >90 2 65 20 2 0 20
10×R8i 2 d 5.2 E-8 >90 2 65 20 2 0 20
Maintenance 87
9
Maintenance

This chapter gives maintenance instructions for the safety function.
Maintenance
After the operation of the safety circuit has been tested at start-up, it does not need any
scheduled maintenance during its specified lifetime.
In addition to proof testing, it is a good practice to check the operation of the safety
function when other maintenance procedures are carried out on the machinery. Do the
acceptance test described in section Start-up and validation.
If you change any wiring or component after the start-up, or restore parameters to their
factory default values, you must:
• Use only ABB approved spare parts.
• Register the change to the change log for the safety circuit.
• Test the safety function again after the change. Obey the rules given in section Start-
up and validation.
• Document the tests and store the report into the logbook of the machine.
88 Maintenance
Proof test interval

After the operation of the safety function is validated at start-up, the safety function must
be maintained by periodic proof testing. In high demand mode of operation, the maximum
proof test interval is 20 years. In low demand mode of operation, the maximum proof test
interval is 2 years (high or low demand as defined in IEC 61508, EN/IEC 62061 and
EN ISO 13849-1). Regardless of the mode of operation, it is a good practice to check the
operation of the safety function at least once a year. Do the test as described under
section Start-up and validation.
The person responsible for the design of the complete safety function should also note the
Recommendation of Use CNB/M/11.050 published by the European co-ordination of
Notified Bodies for Machinery concerning dual-channel safety-related systems with
electromechanical outputs:
• When the safety integrity requirement for the safety function is SIL 2 (HFT = 1) or PL d
(cat. 3), the proof test for the function must be performed at least every 12 months.
This is a recommendation and depends on the required (not achieved) SIL/PL. For
example, contactors, breakers, safety relays, contactor relays, emergency stop buttons,
switches etc. are typically safety devices which contain electromechanical outputs. The
STO circuit of the drive does not contain any electromechanical components.
Competence
The maintenance and proof test activities of the safety function must be carried out by a
competent person with expertise and knowledge of the safety function as well as
functional safety, as required by IEC 61508-1 clause 6.
Residual risk
The safety functions are used to reduce the recognized hazardous conditions. In spite of
this, it is not always possible to eliminate all potential hazards. Therefore the warnings for
the residual risks must be given to the operators.
Intentional misuse
The safety circuit is not designed to protect a machine against intentional misuse.
Decommissioning
When you decommission a safety circuit or a drive, make sure that the safety of the
machine is maintained until the decommissioning is complete.
Declaration of Conformity 89
10
Declaration of Conformity

This chapter contains the Compliance with the European Machinery Directive statement
and the Declaration of Conformity.
Compliance with the European Machinery Directive

The drive is an electronic product which is covered by the European Low Voltage
Directive. However, the drive internal safety functions of this manual are in the scope of
the Machinery Directive as safety components. These functions comply with European
harmonized standards such as EN/IEC 61800-5-2. The declaration of conformity is shown
below.
90 Declaration of Conformity
Declaration of Conformity 91
92 Declaration of Conformity
Further information
Product and service inquiries
Address any inquiries about the product to your local ABB representative, quoting the type
designation and serial number of the unit in question. A listing of ABB sales, support and
service contacts can be found by navigating to www.abb.com/searchchannels.
Product training
For information on ABB product training, navigate to new.abb.com/service/training.
Providing feedback on ABB Drives manuals

Your comments on our manuals are welcome. Navigate to
new.abb.com/drives/manuals-feedback-form.
Document library on the Internet

You can find manuals and other product documents in PDF format on the Internet at
www.abb.com/drives/documents.
Contact us
www.abb.com/drives
www.abb.com/drivespartners
3AUA0000026238 Rev E (EN) 2015-07-06

EN ACS800 SafetyOptions E A4

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

EN ACS800 SafetyOptions E A4

Uploaded by

Copyright:

Available Formats

Options for ABB industrial drives

Wiring, start-up and operation instructions

AIR-COOLED SINGLE DRIVE HARDWARE MANUALS

AIR-COOLED MULTIDRIVES MANUALS

LIQUID-COOLED SINGLE DRIVE HARDWARE MANUALS

LIQUID-COOLED MULTIDRIVES HARDWARE MANUALS

OPTION MANUALS AND GENERAL SAFETY GUIDES

(+Q950, +Q951, +Q952, +Q963, +Q964, +Q967 and

 2015 ABB Oy. All Rights Reserved. 3AUA0000026238 Rev E

1. Introduction to the manual

2. Prevention of unexpected start-up (+Q950)

3. Category 0 emergency stop (+Q951)

How to activate the emergency stop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

4. Category 0 emergency stop (+Q963)

5. Category 1 emergency stop (+Q952)

Safety data (SIL, PL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

6. Category 1 emergency stop (+Q964)

7. Safe torque off (+Q967)

8. Prevention of unexpected start-up with STO (+Q968)

10. Declaration of Conformity

What this chapter contains

 Installation and maintenance work

 Example circuit diagrams of this manual

ASTO - Safe torque off board

CCF EN ISO 13849-1 Common cause failure (%)

CMRB - Relay and interface board

DC EN ISO 13849-1 Diagnostic coverage

FIT IEC 61508 Failure In time: 1E-9 hours

HFT IEC 61508 Hardware fault tolerance

PFH IEC 61508 Probability of dangerous failures per hour

PL EN ISO 13849-1 Performance level: corresponds SIL, Levels a-e

POUS EN 1037 Prevention of unexpected start-up

SFF IEC 61508 Safe failure fraction (%)

SIL IEC 61508 Safety integrity level

SS1 EN 61800-5-2 Safe stop 1

STO EN 61800-5-2 Safe torque off

T1 IEC 61508 Proof test interval

General rules, notes and definitions concerning the

Acceptance test reports

 Example parameter settings

What this chapter contains

WARNING! The Prevention of unexpected start-up function does not disconnect

Start-up and validation

Close the disconnector and switch the power on.

What this chapter contains

Parameter Appropriate value

21.09 START INTRL FUNC OFF2 STOP

 System control program

Parameter Appropriate value

21.04 EME STOP MODE COAST STOP

 ACS800-07 frames R5, R6, R7, R8

 ACS800-07 with main contactor (option +F250)

 ACS800-07LC with main contactor (option +F250)

 ACS800-307/507 with main contactor (option +F250)

 ACS800-307LC/507LC with main contactor (option +F250)

 ACS800-07 with main breaker (option +F255)

 ACS800-07LC with main breaker (option +F255)

 ACS800-17LC/37LC frames R7i + R7i and R8i + R8i

 ACS800-17LC/37LC frames 2×R8i + 2×R8i and up (option +F255)

 ACS800 multidrives with main breaker (option +F255)

Start-up and validation

Close the disconnector and switch the power on.

 How to activate the emergency stop