Functional safety for industrial motor drives

Industrial functional safety refers to the overall safety of a system or product if specific commands and functions are executed correctly. Historically, industrial applications supported simple hardware and software combinations to ensure functionally safe execution and equipment protection. But today’s industrial products and systems have increasingly complex microelectronics, including high-megahertz microcontrollers (MCUs), microprocessing units (MPUs), field-programmable gate arrays (FPGAs) and application-specific integrated circuits (ASICs). The software now includes sophisticated control algorithms, state machines and user interface functions, and the added complexity of hardware and software integration is challenging for designers to assess and implement.

MCUs that include mixed-signal sensing can control various motors such as alternating current induction, brushless and brushed motors. To make these systems functionally safe, however, these standards evolved that apply to industrial drives:

  • International Electrotechnical Commission (IEC) 61800-5-2: safety requirements for adjustable-speed electrical power drive systems.
  • Safety integrity levels (SILs) as defined by IEC 61508.
  • Performance levels (PLs) as defined by the International Organization for Standardization (ISO13849) machinery safety standard.

Industrial drives and functional safety

TI C2000™ MCUs control the power stages that drive electrical machines and power-conversion systems like digital power and solar inverters. Functional safety is applicable in all of these systems. Variable-speed electrical drive systems can directly affect machine safety and human safety. These involve the safe operation of high-voltage motors and motion during power up and sustained operation. This environment is often hostile to operators and demands safety and protection so that the machine, material and operator are safe in the event of an electrical, electronic or mechanical failure.

Variable frequency drives (VFDs) are built with real-time controllers that generate pulse-width modulation (PWM) signals to switch the high-voltage power electronics that drive motors. Efficient PWM generation involves complex algorithms based on real-time feedback (both analog and digital) from the motor assembly. MCUs are capable of not only generating motor-control signals, but also detecting faults within their own resources and in connected motor system components. Additionally, they can issue a safe torque off (STO) signal to shut the power stage down in case of a credible fault.

STO signals are often associated with ancillary signals that allow braking of the related motion equipment to avoid damage to material and operators. Although this is a normal operation for VFD controllers, its long term operation has significant risk and no guarantee that STO signals will be issued under all operating conditions.

An STO signal is the basic safety function in the majority of the industrial systems that extend protection to the power stage and related motion equipment. The IEC 61800-5-2 standard offers an exhaustive list of drive safety functions to allow small and big motion systems to reach a functionally safe state. The execution of these safety functions requires additional MCU processing power and sensing methods.

Although the drive safety functions are well defined, the MCU logic circuits implementing safety functions have to meet the next levels of functional safety requirements. Functional safety standards such as IEC 61508 outline several requirements for MCUs classified as Type B elements. IEC 61508 defines normative chapters for systematic, random failure metrics and software methodologies so that these MCUs may perform functionally safe operation with high confidence. The diagnostics capabilities of these MCUs at the hardware and software level may allow components to reach SILs of 1, 2, 3 and 4.

Motor systems cannot reach functional safety compliance unless they comply with ISO 13849 machinery directive and metrics, even with an MCU’s diagnostic capability. According to ISO 13849, all motor- and machinery-related safety functions (such as STO signals) are required to have a PL using a well-designed safety logic circuit with deterministic diagnostic capabilities. In general, all motor safe-functions (STO signals defined by IEC 61800-5-2) can reach a PL if the safety circuit is also designed to meet a category 3 or category 4 type of topology.

Categories and PLs are ISO 13849 terminologies and metrics defined to guarantee that safe functions (STO signals) occur with a high certainty. Category 3 and 4 (hardware fault tolerant [HFT] = 1) topologies are the most popular two-channel logic with each MCU channel (SIL 2, with DC > 90% capable, minimum) along with channel-independent feedback sensing logic to monitor the motion system (Figure 1). The resulting functional safety module or circuit shown in Figure 1 (the orange box) can monitor the main drive controller and motion system and issue an STO signal when detecting a fault.

Figure 1: Two-channel functional safety module example

 An STO from this certified safety module can come from either of the MCUs when any fault is detected. These MCUs are in constant communication about machine health and the motion system, and at any instant at least one of the MCUs will have the mastership to issue an STO signal or advanced STO signals (Safe Limited Speed –SLS, Safe Brake Control-SBO etc) to safely shut down the motor and motion equipment under all operating conditions. This two-channel circuit is certifiable by functional safety assessors and its STO action is capable of reaching SIL 3 and a PL of PLd or PLe. PLd and PLe indicate a higher probability of dangerous failures per hour, which is greater than 10-7 and 10-8, respectively.

The C2000 F2837x and F28004x MCU families are built with inherent functional safety features to handle any real-time power stage control very efficiently. C2000 MCUs can also serve as an external drive safety controller MCU at a reasonably low cost. The C2000 SafeTI™ collateral is a rich assembly of documentation, tools and software diagnostic libraries that can help you navigate the complex certification process of your functionally safe drive systems or equipment.