MDC2460 with PLC controlled AGV

I am integrating a Roboteq MDC2460 into my AGV platform. The newest design that i am currently building consists of a Rockwell Safety PLC with Safe 24VDC output and Input cards and a navigation PC and Safety Scanners for mapping and safety data. My question is about the best practice for stopping the vehicle safely without damaging components? I read this in the user manual,

The battery must be connected in permanence to the controller’s Red wire(s) or
VMot terminal via a high-power emergency switch SW2 as additional safety measure.
Partially discharged batteries may not blow the fuse, while still having enough
power left to cause a fire. Leave the switch SW2 closed at all times and open only
in case of an emergency. Use the main On/Off switch SW1 for normal operation.
This will prolong the life of SW2, which is subject to arcing when opening under
high current with consequent danger of contact welding.

So does this mean that i should use "SW1" to turn off my controller in a safety scanner violation situation or "SW2"? Currently i have designed the circuitry to remover power from "SW2" (Which is 2 safety rated motor contactor's 25 amps each wired in series for redundancy) in the event of any safety violation. I also have the brakes to each motor wired to Relays powered by DOUT1 and DOUT2. I would like to make sure that arcing is minimised and that the brakes are locked when motor power is removed if CTRL Power is not. Currently CTRL Power is switched by the manual disconnect. If the disconnect is on then CTRL Power is on.

Second Question is what would be the proper way over CANOpen to enable both motors at zero speed? My navigation controller sends me a command to enable each motor first before ever sending a command to move.

Thanks

Hopefully I can clear up some confusion:

The emergency condition that our documentation and nomenclature refers to a condition that can cause damage to the controller itself. It does not refer to a condition that poses safety risks. Therefore, there it is not recommended to shut off SW2 for human safety condition reasons. This will result in the controller floating FETs controlling it's output stage, and all connected motors will be able to spin freely. This is also true of an emergency stop.

In your application, you shouldn't turn off either contactor when there is an unsafe condition detected. Instead, you can implement a safety stop, which sets each motor output to 0, or implement your own safety routine. Just be careful - quickly shutting motor power to 0 can actually result in an emergency condition due to regeneration.

The requirement for this application is that when the safety zone of the scanner is infringed upon the power to the motors must be shut off and the brake locked. To minimize the sudden stop i am monitoring two warning zones that are larger than my safety zone. When warning zone 1 is infringed i go to slow speed, when warning zone 2 is infringed i issue a controlled stop which allows deceleration. But in the instance someone was to suddenly jump in front of the AGV while moving it wouldnt issue these commands and result in killing power and locking brakes. I know this isnt ideal in anyway. I am going to make my safety zone large enough that i can allow at least a half second delay of holding the contactors high after a safety infringement to allow time for a stop command to be issued and lock the brake. What would be your recommendation knowing the safety criteria that i have to meet? The issue with just using a single signal like a safety stop input is that its not redundant or safety rated hardware that i can tell.

If you would like to just shut off the motors, shutting off SW2 will accomplish this. Voltage on Power Control is not available to the motor outputs.

Yes I want to shut off power to the motors to be in a safe state. What about placing the contactors or a single contactor on the output side Between drive and motor? Instead of between battery and drive. Or have one contact in each position? Would it be safer or easier on the hardware to open the circuit here? This is how I would normally do this in an industrial scenario on a machine.

Yes, that approach is fine. The only concern is that disconnecting your motor leads will let the motor spin freely unless it is braked mechanically. If this is not acceptable, you should consider using a double throw switch to short the motor leads, or connect them to a break resistor that will provide electrical braking.

I have a mechanical brake on each motor.

Thanks for your help. I’m going to try what I have wired already and then I may test with a contactor at input and output.

Any recommendations on the second question in my original post? About just enabling the motors and sitting at zero speed over CANopen? I’m using SDO since I only have one controller on my CANopen network and I’m not really worried about bandwidth. It seems that the SDO is easier to use without having to scrip user variables. I just need to control a speed loop.

What do you mean by enabling the motor? Are you referring to releasing the mechanical brake, or is there something else I am missing.

yes releasing the mechanical brake. I have each motors brakes controlled by DOUT1 and DOUT2. But now whenever i manually move the wheel the brake releases? I dont want the brake to release unless the motor has a command. So now if i were to sit the vehicle on any inclined surface at all the brake would release due to the load on the motor.