
B-63494EN/02 1.OVERVIEW
- 5 -
1.3.2 Compliance with the Safety Standard (EN954-1, Category 3)
The dual check safety function satisfies the requirements of Category
3 of the safety standard EN954-1.
Category 3 requires the following:
• The safety function of a safety-related portion must not degrade
when a single failure occurs.
• Single errors must be detected at all times when natural
execution is possible.
To satisfy these requirements, the dual check safety function is
implemented using the two-channel configuration shown below.
CNC
CPU
CN
CPU
Monitor
CPU
Monito
CPU
Motor detector signal
Door switch signal
Magneti
contacto
Shut off power
Shut off power
CNC controller
Cross-check
of data and
results
Monitoring of servo motor and spindle motor movement
Data output from the detector built into each motor is transferred to
the CNC through the amplifier. The safety of this path is ensured by
using motors and amplifiers specified by FANUC.
Cross-monitoring using 2 CPUs
Two CPUs built into the CNC are used to cross-monitor the safety
function. Each CPU is periodically checked for errors. If one
system fails, the servo system and spindle can be stopped safely.
Power shutoff via two paths
If an error is detected, the power is shut off via two power shutoff
paths. The paths need to be tested for built-up failures within a
certain time.
Input signal safety
Safety-related input signals such as the protection door lock/unlock
signal are monitored doubly. If a mismatch between the two
occurrences of a signal is detected, the power to the motor drive
circuit is shut off. This cross-check is constantly made.