Safety Functions Table

Description

Universal Robots safety functions and safety I/O are PLd Category 3 (ISO 13849-1), where each safety function has a PFH value less than 1.8E-07.

The PFH values are updated to include greater design flexibility for supply chain resilience.

For safety I/O the resulting safety function including the external device, or equipment, is determined by the overall architecture and the sum of all PFHs, including the UR robot safety function PFH.

The Safety Functions tables presented in this chapter are simplified. You can find the comprehensive versions of them here: https://www.universal-robots.com/support
SF1 Emergency Stop (according to ISO 13850)

 

See footnotes
Description What happens? Tolerance Affects

Pressing the Estop PB on the pendant1 or the External Estop (if using the Estop Safety Input) results in a Stop Cat 1 3with power removed from the robot actuators and the tool I/O. Command1 all joints to stop and upon all joints coming to a monitored standstill state, power is removed.

For the integrated functional safety rating with an external safety-related control system or an external emergency stop device that is connected to the Emergency Stop input, add the PFH of this safety-related input to the PFH of this safety function’s PFH value (less than 1.8E-07).

Category 1 stop (IEC 60204-1)

--

Robot including robot tool I/O

 

SF2 Safeguard Stop 4 (Protective Stop according to ISO 10218-1)
Description What happens? Tolerance Affects

This safety function is initiated by an external protective device using safety inputs that initiate a Cat 2 stop3. The tool I/O are unaffected by the safeguard stop. Various configurations are provided. If an enabling device is connected, it's possible to configure the safeguard stop to function in automatic mode ONLY. See the Stop Time and Stop Distance Safety Functions4. For the functional safety of the complete integrated safety function, add the PFH of the external protective device to the PFH of the Safeguard Stop.

Category 2 stop (IEC 60204-1) SS2 stop (as described in IEC 61800-5-2)

--

Robot

SF3 Joint Position Limit (soft axis limiting)
Description What happens? Tolerance Affects

Sets upper and lower limits for the allowed joint positions. Stopping time and distance is not a considered as the limit(s) will not be violated. Each joint can have its own limits. Directly limits the set of allowed joint positions that the joints can move within. It is set in the safety part of the User Interface. It is a means of safety-rated soft axis limiting and space limiting, according to ISO 10218-1:2011, 5.12.3.

Will not allow motion to exceed any limit settings. Speed could be reduced so motion will not exceed any limit. A robot stop will be initiated to prevent exceeding any limit.

5°

Joint (each)
SF4 Joint Speed Limit
Description What happens? Tolerance Affects

Sets an upper limit for the joint speed. Each joint can have its own limit. This safety function has the most influence on energy transfer upon contact (clamping or transient). Directly limits the set of allowed joint speeds which the joints are allowed to perform. It is set in the safety setup part of the User Interface. Used to limit fast joint movements, e.g. risks related to singularities.

Will not allow motion to exceed any limit settings. Speed could be reduced so motion will not exceed any limit. A robot stop will be initiated to prevent exceeding any limit.

1.15 °/s

Joint (each)

Joint Torque Limit

Exceeding the internal joint torque limit (each joint) results in a Cat 03. This is not accessible to the user; it is a factory setting. It is NOT shown as an e-Series safety function because there are no user settings and no user configurations.

SF5 Called various names: Pose Limit, Tool Limit, Orientation Limit, Safety Planes, Safety Boundaries
Description What happens? Tolerance Affects

Monitors the TCP Pose (position and orientation) and will prevent exceeding a safety plane or TCP Pose Limit. Multiple pose limits are possible (tool flange, elbow, and up to 2 configurable tool offset points with a radius) Orientation restricted by the deviation from the feature Z direction of the tool flange OR the TCP. This safety function consists of two parts. One is the safety planes for limiting the possible TCP positions. The second is the TCP orientation limit, which is entered as an allowed direction and a tolerance. This provides TCP and wrist inclusion/ exclusion zones due to the safety planes.

Will not allow motion to exceed any limit settings. Speed or torques could be reduced so motion will not exceed any limit. A robot stop will be initiated to prevent exceeding any limit. Will not allow motion to exceed any limit settings.

3° 40 mm

TCP

Tool flange

Elbow
SF6 Speed Limit TCP & Elbow
Description What happens? Tolerance Affects

 

Monitors the TCP and elbow speed to prevent exceeding a speed limit.

Will not allow motion to exceed any limit settings. Speed or torques could be reduced so motion will not exceed any limit. A robot stop will be initiated to prevent exceeding any limit. Will not allow motion to exceed any limit settings.

 

50 mm/s

  

TCP

SF7 Force Limit (TCP & Elbow)
Description What happens? Tolerance Affects

The Force Limit is the force exerted by the robot at the TCP (tool center point) and “elbow”. The safety function continuously calculates the torques allowed for each joint to stay within the defined force limit for both the TCP & the elbow. The joints control their torque output to stay within the allowed torque range. This means that the forces at the TCP or elbow will stay within the defined force limit. When a monitored stop is initiated by the Force Limit SF, the robot will stop, then “back-off” to a position where the force limit was not exceeded. Then it will stop again.

Will not allow motion to exceed any limit settings. Speed or torques could be reduced so motion will not exceed any limit. A robot stop will be initiated to prevent exceeding any limit. Will not allow motion to exceed any limit settings.

25N

TCP

SF8 Momentum Limit
Description What happens? Tolerance Affects

 

The momentum limit is very useful for limiting transient impacts. The Momentum Limit affects the entire robot.

Will not allow motion to exceed any limit settings. Speed or torques could be reduced so motion will not exceed any limit. A robot stop will be initiated to prevent exceeding any limit. Will not allow motion to exceed any limit settings.

 

3kg m/s

  

Robot

SF9 Power Limit
Description What happens? Tolerance Affects

This function monitors the mechanical work (sum of joint torques times joint angular speeds) performed by the robot, which also affects the current to the robot arm as well as the robot speed. This safety function dynamically limits the current/ torque but maintains the speed.

Dynamic limiting of the current/torque

10W

Robot

SF10 UR Robot Estop Output
Description What Happens Affects

When configured for a Robot <Estop> output and there is a robot stop, the dual outputs are LOW. If there is no Robot <Estop> Stop initiated, dual outputs are high. Pulses are not used but they are tolerated.

These dual outputs change state for any external Estop that is connected to configurable safety inputs where this input is configured as an Emergency Stop input.

For the integrated functional safety rating with an external safety-related control system, add the PFH of this safety-related output to the PFH of the external safety-related control system.

For the Estop Output, validation is performed at the external equipment, as the UR output is an input to this external Estop safety function for external equipment.

NOTE: If the IMMI (Injection Moulding Machine Interface) is used, the UR Robot Estop output is NOT connected to the IMMI. There is no Estop output signal sent sent from the UR robot to the IMMI.This is a feature to prevent an unrecoverable stop condition.

 Dual outputs go low in event of an Estop if configurable outputs are set

External connection to logic and/or equipment

 

For SF11, SF12, SF13, SF14 and SF17: The integrated functional safety performance requires adding this PFH to the PFH of the external logic (if any) and its components.

SF11 UR Robot Moving: Digital Output
Description What Happens Affects

Whenever the robot is moving (motion underway), the dual digital outputs are LOW. Outputs are HIGH when no movement. The functional safety rating is for what is within the UR robot.

If configurable outputs are set:

  • - When the robot is moving (motion underway), the dual digital outputs are LOW.
  • - Outputs are HIGH when no movement.
    		•

    External connection to logic and/or equipment

    SF12 UR Robot Not stopping: Digital Output
    Description Affects

    When the robot is STOPPING (in process of stopping or in a stand-still condition) the dual digital outputs are HIGH. When outputs are LOW, robot is NOT in the process or stopping and NOT in a stand-still condition. The functional safety rating is for what is within the UR robot.

    External connection to logic and/or equipment

    SF13 UR Robot Reduced : Digital Output
    Description Affects

     

    When the robot is using a reduced configuration (or reduced config is initiated), the dual digital outputs are LOW. See below. The functional safety rating is for what is within the UR robot. The integrated functional safety performance requires adding this PFH to the PFH of the external logic (if any) and its components.

     

    External connection to logic and/or equipment

    SF14  UR Robot Not Reduced: Digital Output
    Description Affects
     

    Whenever the robot is NOT using a reduced configuration (or reduced config is not initiated), the dual digital outputs are LOW. The functional safety rating is for what is within the UR robot. The integrated functional safety performance requires adding this PFH to the PFH of the external logic (if any) and its components.

    External connection to logic and/or equipment
    SF15 Stopping Time Limit
    Description What happens? Tolerances Affects

    Real time monitoring of conditions such that the stopping time limit will not be exceeded. Robot speed is limited to ensure that the stop time limit is not exceeded.

    The stopping capability of the robot in the given motion(s) is continuously monitored to prevent motions that would exceed the stopping limit. If the time needed to stop the robot is at risk of exceeding the time limit, the speed of motion is reduced to ensure the limit is not exceeded. A robot stop will be initiated to prevent exceeding the limit.

    The safety function performs the same calculation of the stopping time for the given motion(s) and initiates a cat 0 stop if the stopping time limit will be or is exceeded.

    Will not allow the actual stopping time to exceed the limit setting. Causes decrease in speed or a robot stop so as NOT to exceed the limit

    50 ms

    Robot

    SF16 Stopping Distance Limit
    Description What happens? Tolerances Affects

    Real time monitoring of conditions such that the stopping distance limit will not be exceeded. Robot speed is limited to ensure that the stop distance limit will not be exceeded.

    The stopping capability of the robot in the given motion(s) is continuously monitored to prevent motions that would exceed the stopping limit. If the time needed to stop the robot is at risk of exceeding the time limit, the speed of motion is reduced to ensure the limit is not exceeded. A robot stop will be initiated to prevent exceeding the limit.

    The safety function performs the same calculation of the stopping distance for the given motion(s) and initiates a cat 0 stop if stopping time limit will be or is exceeded.

    Will not allow the actual stopping time to exceed the limit setting. Causes decrease in speed or a robot stop so as NOT to exceed the limit

    40 mm

    Robot

    SF17 Safe Home Position "monitored position"
    Description What happens? Tolerances Affects

    Safety function which monitors a safety rated output, such that it ensures that the output can only be activated when the robot is in the configured and monitored “safe home position”.

    A stop cat 0 is initiated if the output is activated when the robot is not in the configured position.

    The “safe home output” can only be activated when the robot is in the configured “safe home position”

     1.7 °

    External connection to logic and/or equipment

    Table 1 footnotes

    1Communications between the Teach Pendant, controller and within the robot (between joints) are SIL 2 for safety data, per IEC 61784-3.

    2Estop validation: the pendant Estop pushbutton is evaluated within the pendant, then communicated¹ to the safety controller by SIL2 communications. To validate the pendant Estop functionality, press the Pendant Estop pushbutton and verify that an Estop results. This validates that the Estop is connected within the pendant, the estop functions as intended, and the pendant is connected to the controller.

    3Stop Categories according to IEC 60204-1 (NFPA79). For the Estop, only stop category 0 and 1 are allowed according to IEC 60204-1.

    • Stop Category 0 and 1 result in the removal of drive power, with stop cat 0 being IMMEDIATE and stop cat 1 being a controlled stop (e.g. decelerate to a stop then removal of drive power). With UR robots, a stop category 1 is a controlled stop where power is removed when a monitored standstill is detected.

    • Stop Category 2 is a stop where drive power is NOT removed. Stop category 2 is defined in IEC 60204-1. Descriptions of STO, SS1 and SS2 are in IEC 61800-5-2. With UR robots, a stop category 2 maintains the trajectory, then retains power to the drives after stopping.

    4It is recommended to use the UR Stop Time and Stop Distance Safety Functions. These limits should be used for your application stop time/ safety distance values.