Festo CMMT-ST-C8-1C-S0 Series Operating Instructions Manual page 3

The device can be parameterised via a PC using either the real-time Ethernet
interface or the separate standard Ethernet interface.
The device is an extra-low-voltage controller. The load and logic power supply
must be provided by a PELV fixed power supply.
5
4
3
Fig. 2: System structure (example)
1 Servo drive CMMT-ST
2 Stepper motor or EC motor with
drive
3 Fixed power supply (or supplies)
for logic and load voltage (PELV)
4.2.1 Overview of connection technology
2
1
10
Fig. 3: Connections of the CMMT-ST (example CMMT-ST-C8-1C-EC)
1 Functional earth marking
2 Functional earth connection
3 [XF2 OUT] RTE interface port 2
4 [XF1 IN] RTE interface port 1
5 [X18] Standard Ethernet
6 [X1A] I/O interface
4.3 Safety sub-functions
4.3.1 Function and application
The servo drive CMMT-ST-...-S0 has the following safety-related performance fea-
tures:
4 PC with Ethernet connection for
parameterisation
5 Bus/network
3
4
5
6
7
8
9
7 [X2] Encoder connection
8 [X6] Motor connection
9 [X1C] Connection for the refer-
ence switch or limit switch
10 [X9] Load and logic voltage
(underneath)
– Safe torque off (STO/Safe torque off)
– Safe stop 1 time controlled (SS1-t/Safe stop 1 time controlled) with use of a
suitable external safety relay unit and appropriate servo drive circuitry
– Diagnostic contact STA for feedback of the active safety sub-function STO
4.3.2 Safety sub-function STO
Function and application of STO
The safety sub-function STO switches off the driver power supply for the power
semiconductor, thus preventing the power output stage from supplying the
energy required by the motor. The power supply to the drive is safely discon-
nected when the safety sub-function STO is active. The drive cannot generate
1
torque and so cannot perform any dangerous movements.
With suspended loads or other external forces, additional measures must be put
in place to prevent movements being performed (e.g. mechanical clamping units).
In the STO state, the standstill position is not monitored.
The machines must be stopped and locked in a safe manner. This especially
applies to vertical axes without automatic locking mechanisms, clamping units or
counterbalancing.
STO request
The safety sub-function STO is requested on 2 channels by simultaneously
switching off the control voltage at both control inputs #STO-A and #STO-B.
The signals of inputs #STO-A/B are low active, so they are marked with #.
The safe state is achieved after the safety sub-function STO has been requested if
all motor coils are switched off and current cannot flow through them.
NOTICE
2
Detent movement if the output stage fails.
If the output stage of the device fails when a safety sub-function STO is active, it
may result in the drive jerking with a limited detent movement of the rotor. The
maximum rotation angle/travel corresponds to the pole pitch of the motor used.
• Take this behaviour into account when designing the system's safety function.
After the safety sub-function STO has been requested and the request completed,
the functional controller enable must be activated.
Feedback via diagnostic contact STA
The state of the safety sub-function STO can be reported to the safety relay unit
via the diagnostic contact STA.
If the safety classification of SIL 3, cat. 3, Pl e is required for operation with an EC
motor, the diagnostic contact STA must be evaluated.
The diagnostic feedback signal STA has been designed as a potential-free contact
(opto relay). The diagnostic contact STA is only closed (conductive) when STO is
requested on 2 channels via the control inputs #STO-A and #STO-B. If the contact
is closed (conductive), the STO state has been achieved (safe state).
#STO-A #STO-B
Low level Low level
Low level High level
High level Low level
High level High level
Tab. 8: State of the diagnostic contact STA
If the safety sub-function STO is not requested but protective functions are trig-
gered simultaneously on both channels (#STO-A and #STO-B), e.g. if the voltage
at #STO-A and #STO-B is too high, the internal protective functions switch off the
channels as if STO had been requested and the diagnostic contact STA is closed
(safe state feedback).
Recommendation: The safety relay unit should check the state of the diagnostic
contact whenever there is an STO request. The state of STA must change
according to the logictable. The safety relay unit can cyclically test the #STO-A
and #STO-B signals for high level with low testpulses and for low level with high
testpulses, within the specified limits è 4.3.5 Safety relay unit.
The diagnostic contact STA is not evaluated in terms of safety engineering.
4.3.3 Safety sub-function SS1
Together with a suitable safety relay unit, the following can be achieved:
– Safe stop 1 time controlled (SS1-t/Safe stop 1 time controlled;) triggering of
motor deceleration and, after an application-specific time delay, triggering of
the safety sub-function STO
Safety sub-function SS1 è Manual Safety sub-function
4.3.4 Fault exclusion
Put suitable measures in place to prevent faulty wiring:
– Exclude wiring faults in accordance with EN 61800-5-2
– Configure the safety relay unit to monitor the outputs of the safety relay unit
and wiring up to the servo drive
4.3.5 Safety relay unit
Use suitable safety relay units with the following characteristics:
– 2-channel outputs with
– Detection of shorts across contacts
– Required output current (also for STO)
– Evaluation of the diagnostic contact of the servo drive
Safety relay units with test pulses can be used with the following restrictions:
– High test pulses up to a maximum length of 1 ms
– Low test pulses up to a maximum length of 1 ms
– Test pulses are not simultaneous/overlapping on #STO-A/B
STA-C1/C2
Diagnostic contact closed (low resistance)
Diagnostic contact open (high resistance)