Safety manual

Safety manual miControl®

Safety manual for safe torque off (STO)

This safety manual was translated from the original user manual

Introduction

This safety manual applies to the following drive controllers:

mcDSA-F1x series

  • mcDSA-E25XC Revision DF.1, P/N 1512840*
  • mcDSA-E25XC-SSI Revision DF.1, P/N 1515709*
  • mcDSA-E25XC-EtherCAT Revision DF.1, P/N 1513850*
  • mcDSA-E25XC-PROFINET Revision DF.1, P/N 1513851*
  • mcDSA-E27XC Revision DF.1, P/N 1512841*
  • mcDSA-E27XC-SSI Revision DF.1, P/N 1515710*
  • mcDSA-E27XC-STO Revision DF.1, P/N 1513167*
  • mcDSA-E27XC-EtherCAT Revision DF.1, P/N 1513203*
  • mcDSA-E27XC-PROFINET Revision DF.1, P/N 1513852*
  • mcDSA-F15 Revision AF.1, P/N 1512842*
  • mcDSA-F15-SSI Revision AF.1, P/N 1515688*
  • mcDSA-F15-EtherCAT Revision AF.1, P/N 1513810*
  • mcDSA-F15-PROFINET Revision AF.1, P/N 1513853*
  • mcDSA-F17 Revision AF.1, P/N 1512843*
  • mcDSA-F17-SSI Revision AF.1, P/N 1515708*
  • mcDSA-F17-EtherCAT Revision AF.1, P/N 1513811*
  • mcDSA-F17-PROFINET Revision AF.1, P/N 1513854*

mcDSA-F3x series with housing

  • mcDSA-F30 Revision AF.1, P/N 1513986*
  • mcDSA-F30 Revision AF.1, P/N 1515456*
  • mcDSA-F30-HC Revision AF.1, P/N 1513999*
  • mcDSA-F30-HC Revision AF.1, P/N 1514241*
  • mcDSA-F32 Revision AF.1, P/N 1514169*
  • mcDSA-F32-HC Revision AF.1, P/N 1514170*
  • mcDSA-F35 Revision AF.1, P/N 1513892*
  • mcDSA-F35-HC Revision AF.1, P/N 1514025*
  • mcDSA-F35-HC Revision AF.1, P/N 1515599*
  • mcDSA-F35-EtherCAT Revision AF.1, P/N 1514231*
  • mcDSA-F35-EtherCAT-HC Revision AF.1, P/N 1514232*
  • mcDSA-F35-PROFINET Revision AF.1, P/N 1514233*
  • mcDSA-F35-PROFINET-HC Revision AF.1, P/N 1514234*
  • mcDSA-F37 Revision AF.1, P/N 1513893*
  • mcDSA-F37-HC Revision AF.1, P/N 1514235*
  • mcDSA-F37-EtherCAT Revision AF.1, P/N 1514236*
  • mcDSA-F37-EtherCAT-HC Revision AF.1, P/N 1514237*
  • mcDSA-F37-PROFINET Revision AF.1, P/N 1514238*
  • mcDSA-F37-PROFINET-HC Revision AF.1, P/N 1514239*

mcDSA-F3x series LP / M

  • mcDSA-E30-M-STO Revision AF.1, P/N 1515757*
  • mcDSA-F30-LP Revision AF.1, P/N 1513976*
  • mcDSA-F30-M Revision AF.1, P/N 1513985*
  • mcDSA-F30-M Revision AF.1, P/N 1515881*
  • mcDSA-F30-M-HC Revision AF.1, P/N 1514245*
  • mcDSA-F32-LP Revision AF.1, P/N 1514227*
  • mcDSA-F32-M Revision AF.1, P/N 1514225*
  • mcDSA-F32-M Revision AF.1, P/N 1515875*
  • mcDSA-F32-M-HC Revision AF.1, P/N 1514246*
  • mcDSA-F35-LP Revision AF.1, P/N 1513988*
  • mcDSA-F35-M Revision AF.1, P/N 1513990*
  • mcDSA-F35-M Revision AF.1, P/N 1515878*
  • mcDSA-F35-M Revision AF.1, P/N 1515865*
  • mcDSA-F35-M Revision AF.1, P/N 1515867*
  • mcDSA-F35-M-HC Revision AF.1, P/N 1514247*
  • mcDSA-F35-M-HC Revision AF.1, P/N 1515866*
  • mcDSA-F35-M-HC Revision AF.1, P/N 1515868*
  • mcDSA-F37-LP Revision AF.1, P/N 1514228*
  • mcDSA-F37-M Revision AF.1, P/N 1514226*
  • mcDSA-F37-M Revision AF.1, P/N 1515859*
  • mcDSA-F37-M Revision AF.1, P/N 1515861*
  • mcDSA-F37-M Revision AF.1, P/N 1515863*
  • mcDSA-F37-M-HC Revision AF.1, P/N 1514248*
  • mcDSA-F37-M-HC Revision AF.1, P/N 1515862*
  • mcDSA-F37-M-HC Revision AF.1, P/N 1515864*

the safety firmware version (SI_STO_Version):
  • 1.04.00.00 **
and the respective safety function:
  • "Safe torque off (STO)"
The user of the safety function (STO) must observe the latest version of the European Machinery Directive 2006/42/EC.

The manufacturer of the end product or the manufacturer's authorized representative must carry out a hazard analysis in line with the Machinery Directive before placing any machinery on the market.

An analysis of the hazards posed by the machinery must be performed and the necessary actions taken to reduce potential risks.

The safety function must be selected according to the actions demanded and the degree of risk minimization required.

The devices may only be installed and adjusted by fully qualified staff in accordance with the relevant standards.

Always ensure compliance with the relevant regional standards in the area of component application. Also observe the safety information for the devices and machines being controlled.

A fully qualified person is someone who

  • is capable of identifying and avoiding possible hazards due to their experience,
  • is familiar with the accident prevention regulations for the employed devices,
  • is capable of installing and putting into operation electric circuits and devices according to relevant standards.

Querying the revision and safety firmware version via the parameters:

  • *) 3020.01h DeviceSubCode
  • **) 3868.23h. SI_STO_Version

Safe torque off (STO) - description of the safety function

Designation

Safe torque off (STO)

Description

This function ensures that no torque-generating energy can reach the motor. This safety sub-function corresponds to an uncontrolled stop according to IEC 60204-1, stop category 0.

This safety sub-function can be used when energy shutdown is required to prevent unexpected start-up according to ISO 14118.

In circumstances where external influences (e.g. falling suspended loads) are present, further actions (e.g. mechanical brakes) may be necessary to prevent hazards.

The safety function as an electronic device does not provide adequate protection against electric shock or other electrical risks.

The safety function is only approved for controlling brushless DC motors (BLDC). The drive controllers with this safety function do not have an operating mode for controlling brushed DC motors (DC).

If this function is activated, limited movement (180° maximum electric movement of the axis) is still possible in the event of a failure in the power section of the drive controller.

The safety-related section of the drive controller is designed in such a way that:
  • a single fault in the electronics does not lead to the loss of the safety function
  • the single fault is detected by the internal diagnostic function during or before the next safety function request and a fault is signalled

Safety factors

The STO function meets the requirements of DIN EN 61800-5-2:2017.

The STO function supports:
  • SIL 3 according to EN 61508:2010 and/or EN 62061:2021
  • PL e according to EN ISO 13849-1:2023

mcDSA-F1x series

Safety factors according to EN 62061 / EN 61508 | Safety factors according to EN ISO 13849
SIL = 3 | PL = e
PFH = 5.74*10-9 1/h | MTTFd = 2581 years
SFFChannel1 = 99.5 % SFFChannel2 = 99.3 % SFFPowerSupply = 99.75 % | Category = Cat. 3
 | DCAvg = 98,9 %

mcDSA-F3x series with housing

Safety factors according to EN 62061 / EN 61508 | Safety factors according to EN ISO 13849
SIL = 3 | PL = e
PFH = 1.355*10-8 1/h | MTTFd = 1248 years
SFFChannel1 = 99.55 % SFFChannel2 = 99.62 % SFFPowerSupply = 99.73 % | Category = Cat. 3
 | DCAvg = 98.53 %

mcDSA-F3x series LP / M

Safety factors according to EN 62061 / EN 61508 | Safety factors according to EN ISO 13849
SIL = 3 | PL = e
PFH = 1.921*10-8 1/h | MTTFd = 914 years
SFFChannel1 = 99.53 % SFFChannel2 = 99.60 % SFFPowerSupply = 99.75 % | Category = Cat. 3
 | DCAvg = 98.57 %

Operating conditions

mcDSA-F1x series (without EtherCAT)

Property | Unit | Value | Remarks
Supply voltage | PELV / SELV | Applies to drive controller and safety function
Temperature range ℃ -40 ... 55 gApplies to drive controller and safety function
Relative humidity
(non-condensing) 		% 5 ... 90 Applies to drive controller and safety function
Operating altitude | m | < 2000 | Applies to drive controller and safety function
Electromagnetic compatibility (EMC) EN 61800-3:2018 - Category C3 device intended for use in the second environment (industrial areas)
EN 61800-5-2:2017 - Safety requirements - Functional
environmental operating conditions To protect against environmental effects the device needs to be installed into an enclosure (e.g. casing, control box or electric cabinet) with IP Code IP54 or better.

Alternatively, the device may also be used in an environment which, analogously to IP54, satisfies the following conditions due to suitable measures (e.g. air-conditioning or air-filtering):
  • Protection against dust of harmful quantity
  • Protection against all-round splashing water
  • Prevention of condensation and dewing

mcDSA-F1x series with EtherCAT

Property | Unit | Value | Remarks
Supply voltage | PELV / SELV | Applies to drive controller and safety function
Temperature range ℃ -25 ... 40 gApplies to drive controller and safety function
Relative humidity
(non-condensing) 		% 5 ... 90 Applies to drive controller and safety function
Operating altitude | m | < 2000 | Applies to drive controller and safety function
Electromagnetic compatibility (EMC) EN 61800-3:2018 - Category C3 device intended for use in the second environment (industrial areas)
EN 61800-5-2:2017 - Safety requirements - Functional
environmental operating conditions To protect against environmental effects the device needs to be installed into an enclosure (e.g. casing, control box or electric cabinet) with IP Code IP54 or better.

Alternatively, the device may also be used in an environment which, analogously to IP54, satisfies the following conditions due to suitable measures (e.g. air-conditioning or air-filtering):
  • Protection against dust of harmful quantity
  • Protection against all-round splashing water
  • Prevention of condensation and dewing

mcDSA-F3x series with housing

Property | Unit | Value | Remarks
Supply voltage | PELV / SELV | Applies to drive controller and safety function
Temperature range ℃ -40 ... 55 gApplies to drive controller and safety function
Relative humidity
(non-condensing) 		% 5 ... 55 Applies to drive controller and safety function
Operating altitude | m | < 2000 | Applies to drive controller and safety function
Electromagnetic compatibility (EMC) EN 61800-3:2018 - Category C2 device intended for use in the second environment (industrial areas)
EN 61800-5-2:2017 - Safety requirements - Functional
environmental operating conditions To protect against environmental effects the device needs to be installed into an enclosure (e.g. casing, control box or electric cabinet) with IP Code IP54 or better.

Alternatively, the device may also be used in an environment which, analogously to IP54, satisfies the following conditions due to suitable measures (e.g. air-conditioning or air-filtering):
  • Protection against dust of harmful quantity
  • Protection against all-round splashing water
  • Prevention of condensation and dewing

mcDSA-F3x series LP / M

Property | Unit | Value | Remarks
Supply voltage | PELV / SELV | Applies to drive controller and safety function
Temperature range ℃ -40 ... 70 Applies to drive controller and safety function
Relative humidity
(non-condensing) 		% 5 ... 90 Applies to drive controller and safety function
Operating altitude | m | < 2000 | Applies to drive controller and safety function
Electromagnetic compatibility (EMC) EN 61800-3:2018 - Category C2 device intended for use in the second environment (industrial areas)
EN 61800-5-2:2017 - Safety requirements - Functional
environmental operating conditions To protect against environmental effects the device needs to be installed into an enclosure (e.g. casing, control box or electric cabinet) with IP Code IP54 or better.

Alternatively, the device may also be used in an environment which, analogously to IP54, satisfies the following conditions due to suitable measures (e.g. air-conditioning or air-filtering):
  • Protection against dust of harmful quantity
  • Protection against all-round splashing water
  • Prevention of condensation and dewing

Properties of the STO inputs

Input description:
Signal name | Description | Specification
STO-A | STO channel A | Low level = STO function request High level = power amplifier release Switching level Low = -30V < UIN < 5V Switching level High = 8V < UIN < 30V (60V) Current consumption = 3,5mA @ UIN = 24V UIN Max = 60V Galvanic isolation = no OSSD compatible = ja OSSD filter = 5ms Max. cable length < 30m
STO-B | STO channel B | Low level = STO function request High level = power amplifier release Switching level low = -30V < UIN < 5V Switching level high = 8V < UIN < 30V (60V) Current consumption = 3,5mA @ UIN = 24V UIN Max = 60V Galvanic isolation = nein OSSD compatible = ja OSSD filter = 5ms Max. cable length < 30m

  • The maximum response time of the STO function is 50ms
  • Behaviour of the inputs is indeterminate between UIN = 5V and 8V
  • Output signal switching device (OSSD) semiconductor outputs with test signal

Terminal configuration mcDSA-F1x series:

Signal name | Description | Specification
X4.4 | STO-A | STO channel A
X4.6 | STO-B | STO channel B

Terminal configuration mcDSA-F3x series:

Signal name | Description | Specification
X4.8 | STO-A | STO channel A
X4.1 | STO-B | STO channel B

Logic table:
STO-A | STO-B | Controller status | Description
L | L | STO activated, power amplifier blocked | Safety function activated, no diagnostic error
L | H | STO activated, power amplifier blocked | Safety function activated, diagnostic error = -5209/-5229 **
H | L | STO activated, power amplifier blocked | Safety function activated, diagnostic error = -5208/-5228 *
H | H | STO not activated, power amplifier operable | Safety function not activated, no diagnostic error

*) Errors are indicated by the red error LED, the error code can also be queried via CAN bus and an output can be activated as an error output (see also mcManual "3060.00h Output assignment - error")

Automatic restart

Automatic restart determines whether the controller restarts immediately with the movement when the safety function is switched off or whether the user must enable its release. Automatic restart is activated by default.

This function is set via bit 4 of the parameter "3868.05h Device Safe Torque Off Configuration". If bit 4 = 0, automatic restart is activated. If bit 4 = 1, renewed release via CAN bus is required. The movement is released via the parameter "3868.01h Device Safe Torque Off Commands" along with the command "0x43495053".

Wiring of the STO inputs

Wiring examples for drive controllers of the mcDSA-F1x series:

  • Simple Emergency Stop circuit
  • Safety PLC
Wiring with Emergency Stop button:

Wiring with safety PLC:

Wiring examples for drive controllers of the mcDSA-F3x series:

  • einfacher Notauskreis
  • Sicherheitssteuerung (Safety SPS)
Wiring with Emergency Stop button:

Wiring with safety PLC:

Testing the STO function

Testing of STO channel A:
  • Cut off STO channel A from power.
  • If the STO function is working correctly, the red error LED will be active permanently.
    In case of an active CAN connection, the error code -5209 can be read from the error register 3001.00h.
  • Reconnect STO channel A to power.
  • Clear the error through a digital input (Input assignment – error quitting, see mcManual parameter 3051.00h).
    In case of an active CAN connection, the error can also be cleared through setting value = 1 for parameter 3000.00h.
  • If the STO function is working correctly, the red error LED will become inactive.
    Simultaneously, the error code in the error register 3001.00h will also be reset.
Testing of STO channel B:
  • Cut off STO channel B from power.
  • If the STO function is working correctly, the red error LED will be active permanently.
    In case of an active CAN connection, the error code -5208 can be read from the error register 3001.00h.
  • Reconnect STO channel B to power.
  • Clear the error through a digital input (Input assignment – error quitting, see mcManual parameter 3051.00h).
    In case of an active CAN connection, the error can also be cleared through setting value = 1 for parameter 3000.00h.
  • If the STO function is working correctly, the red error LED will become inactive.
    Simultaneously, the error code in the error register 3001.00h will also be reset.
The test is successful if testing of both channels was completed successfully as described. If the test procedure is not working as described, check the wiring of the STO channels and the communication to the device. If this solves the problem, repeat the test from the beginning. If the STO test continues being unsuccessful, please contact our technical support.

Maintaining the STO function

Correct functioning of the STO function must be checked once every three months.

Service life

The estimated service life of the STO circuit is 20 years.

Troubleshooting

The automatic diagnostic function performs a cross comparison between STO-A and STO-B as well as between the input and the output of the circuit each time the STO function is requested. In addition, the diagnostic software is monitored for internal errors. The following error codes can be generated:
Error code | Description/Meaning | Action
-5208 | Input STO-B is low and input STO-A is high | Check cabling, perform STO test, replace devices
-5209 | Input STO-A is low and input STO-B is high | Check cabling, perform STO test, replace devices
-5228 | Output STO-B is low and output STO-A is high | Check cabling, perform STO test, replace devices
-5229 | Output STO-A is low and output STO-B is high | Check cabling, perform STO test, replace devices
-5230 | Input signals are not stable (oscillation) | Check cabling, perform STO test, replace devices
-30101 | Internal error (input and output STO-A not identical) | Replace device
-30102 | Internal error (input and output STO-A not identical) | Replace device
-30103 | Internal error (input and output STO-B not identical) | Replace device
-30104 | Internal error (input and output STO-B not identical) | Replace device
-30105 | Internal error (input and output STO-A and STO-B not identical) | Replace device
-30110 | Internal error (Diagnosis failed when switching on at STO-B) | Replace device
-30111 | Diagnosis failed when switching on at STO-A | Replace device
-30112 | Diagnosis failed when switching on at STO-A and STO-B | Replace device
-30114 | Internal error in the diagnostic software | Update firmware, replace device
-30115 | Internal error in the diagnostic software | Update firmware, replace device
-30116 | Internal error in the diagnostic software | Update firmware, replace device

Declaration of Conformity

https://www.micontrol.de/de/download

Version of the safety manual: 16
Copyright © 1997-2024, miControl ®, e-mail. Version 3.02.00.14