ABB ACS880 Series User manual

Options for ABB drives
User’s manual
Prevention of unexpected start-up (option +Q950)
for ACS880 multidrives

List of related manuals
You can find manuals and other product documents in PDF format on the Internet. See
section Document library on the Internet on the inside of the back cover. For manuals not
available in the Document library, contact your local ABB representative.
General drive manuals Code (English)
Safety instructions for ACS880 multidrive cabinets and
modules
3AUA0000102301
Mechanical installation instructions for ACS880 multidrive
cabinets
3AUA0000101764
Electrical planning instructions for ACS880 multidrive
cabinets and modules
3AUA0000102324
Supply unit manuals
ACS880-207 IGBT supply units hardware manual 3AUA0000130644
ACS880-307 (+A003) diode supply units hardware manual 3AUA0000102453
ACS880-307 (+A018) diode supply units hardware manual 3AXD50000011408
ACS880-907 regenerative rectifier units hardware manual 3AXD50000020546
ACS880 IGBT supply control program firmware manual 3AUA0000131562
ACS880 diode supply control program firmware manual 3AUA0000103295
ACS880 regenerative rectifier control program firmware
manual
3AXD50000020827
Inverter unit manuals and guides
ACS880-107 inverter units hardware manual 3AUA0000102519
ACS880 primary control program firmware manual 3AUA0000085967
ACS880 primary control program quick start-up guide 3AUA0000098062
PC tool manuals
Start-up and maintenance PC tool Drive composer user’s
manual
3AUA0000094606
Functional safety design tool user’s manual 3AXD10000102417
Option manuals and guides
ACS-AP-x Assistant control panels user’s manual 3AUA0000085685
FSO-12 safety functions module user’s manual 3AXD50000015612
FSO-21 safety functions module user’s manual 3AXD50000015614
FSE-31 pulse encoder interface module user’s manual 3AXD50000016597
Functional safety; Technical guide No. 10 3AUA0000048753
Safety and functional safety; A general guide 1SFC001008B0201
ABB Safety information and solutions www.abb.com/safety
Manuals and quick guides for I/O extension modules,
fieldbus adapters, etc.

User’s manual
Prevention of unexpected start-up (option +Q950)
for ACS880 multidrives
3AUA0000145934 Rev E
EN
EFFECTIVE: 2018-02-02
2018 ABB Oy. All Rights Reserved.
Table of contents
4. Start-up and acceptance test

5
Table of contents
List of related manuals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1. Introduction to the manual
Contents of this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Applicability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Safety instructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Target audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Related documents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Exclusion of liability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Quick reference guide for implementing a safety system . . . . . . . . . . . . . . . . . . . . . . . . 10
2. Option description and instructions
Contents of this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Summary of wirings and settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Operation principle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Time scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Operation principle diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Wiring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Use of the safety function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Activating . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Resetting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
POUS indications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Fault reaction function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
FSO module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
FSE module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Safety encoder . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
STO function in the inverter units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3. Parameter settings
Contents of this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
FSO module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
General parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Parameters for the STO function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Parameters for the SSE function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Parameters for the POUS function . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
FSE module and safety pulse encoder parameters . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Inverter units parameter settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Safety pulse encoder parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4. Start-up and acceptance test
Contents of this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Safety encoder interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

6
Start-up and acceptance test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Checks and settings with no voltage connected . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Settings with voltage connected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Acceptance test procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
5. Maintenance
Contents of this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Proof test interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Competence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Residual risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Intentional misuse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Decommissioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
6. Technical data
Contents of this chapter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Safety data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Safety performance with different safety pulse encoders . . . . . . . . . . . . . . . . . . . . . 31
Safety data values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Safety component types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Safety block diagram . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Relevant failure modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Fault exclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Operation delays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
General rules, notes and definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Validation of the safety functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Validation procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Acceptance test reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Competence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Ambient conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Reporting problems and failures related to safety functions . . . . . . . . . . . . . . . . . . . 33
Related standards and directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Compliance with the European Machinery Directive . . . . . . . . . . . . . . . . . . . . . . . . . 34
Further information
Product and service inquiries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Product training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
Providing feedback on ABB Drives manuals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Document library on the Internet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Introduction to the manual 7
1
Introduction to the manual
Contents of this chapter
This chapter describes the manual in short and gives some general information for the
reader. The chapter also contains a quick reference for implementing a safety system.
Applicability
The manual applies to ACS880 multidrives which have the option +Q950: Prevention of
unexpected start-up with STO, with FSO. For the option +Q950, ABB installs the FSO-12
safety functions modules (option +Q973) or the FSO-21 safety functions modules (option
+Q972) to the inverter units. When safety pulse encoders are used, ABB installs the FSE-
31 pulse encoder interface modules (option +L521) and the FSO-21 modules to the
inverter units. Only the FSO-21 module supports the FSE-31 module and the use of safety
pulse encoders.
Required versions with the FSO-12 module:
•ACS880 primary control program: 1.80 or later
•FSO-12 safety functions module: revision C or later
•Drive composer pro: 1.6 or later.
Required versions with the FSO-21 module:
•ACS880 primary control program: 2.2 or later
•FSO-21 safety functions module: revision D or later
•FSE-31 pulse encoder interface module: revision D or later (if used)
•Drive composer pro: 1.8 or later.

8 Introduction to the manual
Safety instructions
Only a qualified electrician who has appropriate knowledge on functional, machine and
process safety is allowed to install, start up and maintain the safety circuit.
WARNING! This safety function does not disconnect the voltage of the main and
auxiliary circuits from the drive. Never work on the electrical parts of the drive or
the motor before you have also disconnected the drive system from the electric
supply, from rotating permanent magnet motors and from rotating motors equipped with
sine filters, and made sure by measuring that there is no dangerous voltage present.
WARNING! After you have made additions to the drive safety circuit or modified it,
changed circuit boards inside the drive, replaced the FSO or FSE module or
modified FSO module parameters, always test the operation of the safety circuit
according to its acceptance test procedure. The change can affect unexpectedly. All
customer-made changes are on the customer’s responsibility.
WARNING! The Safe torque off functionality is only achieved through the XSTO
connector of the inverter control unit. True Safe torque off functionality is not
achieved through the XSTO connectors of other control units (such as the supply
control unit or the brake control unit). In the supply and brake units, the XSTO input must
not be used for any safety function purposes to ensure personnel safety. The Safe torque
off function is supported by any ACS880 inverter or drive firmware. It is not supported by
supply or brake firmware.
WARNING! (With permanent magnet or synchronous reluctance [SynRM] motors
only) In case of a multiple inverter IGBT failure, the inverter can produce an
alignment torque which maximally rotates the motor shaft by
180/p(with permanent magnet motors) or 180/2p(with synchronous reluctance [SynRM]
motors) degrees regardless of the activation of the Safe torque off function. pdenotes the
number of pole pairs.
WARNING! Read and obey all safety instructions in ACS880 multidrive cabinets
and modules safety instructions (3AUA0000102301 [English]). If you ignore them,
injury or death, or damage to the equipment can occur.
This manual does not repeat the complete safety instructions of the drive but it only
includes the instructions related to the scope of this manual.
Target audience
This manual is intended for people who install, start up, use and service the drive safety
option. Read the manual before working on the drive. You are expected to know the
fundamentals of electricity, wiring, electrical components, electrical schematic symbols,
and functional safety.

Introduction to the manual 9
Contents
The chapters of this manual are briefly described below.
Introduction to the manual (this chapter) introduces this manual and gives safety
instructions.
Option description and instructions describes the safety function and instructs how to wire
and use it.
Parameter settings lists the parameters that you have to set for the safety function.
Start-up and acceptance test gives instructions on how to start up, test and validate the
safety function.
Maintenance gives instructions on how to maintain the safety function.
Technical data gives general rules, notes and definitions related to safety functions and
lists the related standards and directives.
Related documents
•Product manuals (see the inside of the front cover)
•Circuit diagrams delivered with the drive
•Part lists delivered with the drive
•Safety data report
Abbreviations
Abbreviations used in this manual are listed below.
Abbreviation Description Reference
DI Digital input
DO Digital output
FSE-31 Pulse encoder interface module
FSO-12 Safety functions module which does not support the use of encoders
FSO-21 Safety functions module which supports the FSE-31 module and the
use of safety encoders
GND Ground
HFT Hardware fault tolerance IEC 61508,
EN/IEC 62061
IGBT Insulated gate bipolar transistor
PL Performance level (levels are: a, b, c, d and e). Corresponds to SIL. EN ISO 13849-1
POUS Prevention of unexpected start-up EN 1037
R8i Frame size designation of the inverter unit
SIL Safety integrity level (levels are: 1, 2, 3 and 4) IEC 61508,
IEC 61511,
EN/IEC 62061,
EN/IEC 61800-5-2
SSE Safe stop emergency

10 Introduction to the manual
Exclusion of liability
ABB is not responsible for the implementation, verification and validation of the overall
safety system. It is the responsibility of the system integrator (or other party) who is
responsible for the overall system and system safety.
The system integrator (or other responsible party) must make sure that the entire
implementation complies with all relevant standards, directives and local electrical code,
and that the system is tested, verified and validated correctly.
Quick reference guide for implementing a safety system
STO Safe torque off. In this manual, this term is used in two different
contexts:
• the STO circuit in the drive (the drive STO function)
• the STO safety function in the FSO module.
Safety functions in the FSO module (eg, STO, SSE, SS1 and
POUS) activate the drive STO function, that is, open the drive STO
circuit. In addition, some safety functions can activate the STO
safety function in the FSO module, which in turn opens the drive
STO circuit.
EN/IEC 61800-5-2
Task
Select the appropriate functional safety standard for the implementation: EN ISO 13849-1,
EN/IEC 62061, IEC 61511 or other.
If you select EN/IEC 62061 or IEC 61511, make a safety plan. See EN/IEC 62061 or IEC 61511.
Assess safety: analyze and evaluate risks (estimate SIL/PL) and define risk reduction strategies.
Define the safety requirements.
Design the safety system. The part of the design made by ABB is described in chapter Option
description and instructions on page 11.
Verify the achieved SIL/PL with, for example, FSDT-01 Functional safety design tool or similar. See
Functional safety design tool user’s manual (3AXD10000102417 [English]).
Connect the wiring. See section Wiring on page 16.
Set the necessary parameters. See chapter Parameter settings on page 19.
Validate that the implemented system meets the safety requirements:
• Do the acceptance test. See chapter Start-up and acceptance test on page 25.
Write the necessary documentation.
Abbreviation Description Reference

Option description and instructions 11
2
Option description and
instructions
Contents of this chapter
This chapter describes the operation of the option +Q950: Prevention of unexpected start-
up and instructs how to wire and use it.
Overview
The option +Q950 uses the FSO-12 safety functions module (option +Q973) or the
FSO-21 safety functions module (option +Q972) for the Prevention of unexpected start-up
(POUS) safety function. ABB installs the FSO modules to the inverter units and sets
default parameter values for the option at the factory. The user installs and wires an
operating switch and an indication lamp (optional) on site. These are not included in the
delivery.
When safety pulse encoders are used in the safety application, also the FSE-31 pulse
encoder interface modules (option +L521) are installed in the inverter units. ABB installs
the FSE modules to the inverter units and sets the delivery configuration for the cabinet
safety option at the factory.
The user activates the POUS function with an operating switch mounted, for example, on
a control desk. When the switch is open (off), the POUS function is active and the POUS
indication lamp is on.
When the user switches off the POUS switch, he/she actually activates the Safe torque off
(STO) function in the inverter unit. The STO function disables the control voltage of the
power semiconductors of the inverter unit output stage. This prevents the inverter unit from
generating the torque required to rotate the motor(s). With this function, the user can do

12 Option description and instructions
short-time operations (like cleaning) and/or maintenance work on the non-electrical parts
of the machinery without switching off and disconnecting the drive.
For a detailed description of the Safe torque off function, see the inverter unit hardware
manual.
For more information on the FSO module, see FSO-12 safety functions module user’s
manual (3AXD50000015612 [English]) or FSO-21 safety functions module user’s manual
(3AXD50000015614 [English]).
For more information on the FSE module, see FSE-31 pulse encoder interface module
user’s manual (3AXD50000016597 [English]).
The design principles of the option +Q950 comply with EN ISO 13850.
The STO function complies with EN/IEC 61800-5-2. For a complete list of related
standards and European directives, see section Related standards and directives on
page 34.
Summary of wirings and settings
The wirings and settings of the POUS function are:
•The inverter units are equipped with the FSO safety functions modules (option +Q973
or +Q972). ABB installs the modules at the factory.
•The user must wire a dual-channel POUS switch to the FSO module. See section
Wiring on page 16.
•The user can wire a POUS indication lamp to the FSO module (optional).
•The digital input of the FSO module to which the POUS switch is connected, is
selected as the input for the POUS request. This is an FSO module parameter that
ABB sets at the factory. The user must check the setting at the start-up.
•The digital output of the FSO module to which the POUS indication lamp is connected,
is selected as the output for the POUS completed signal. This is an FSO module
parameter that ABB sets at the factory. The user must check the setting at the start-up.
Additional wirings when safety pulse encoders are used:
•The inverter units are equipped with the FSE-31 pulse encoder interface modules
(option +L521). ABB installs the modules at the factory.
•The motors must be equipped with safety pulse encoders. The user installs the safety
pulse encoders and wires them to the FSE modules. The user must make sure that
the required safety integrity (SIL/PL) can be achieved with the used safety encoder(s).
For a detailed description of wirings, see sections Operation principle diagram on page 14
and Wiring on page 16. For a detailed description of parameter settings, see chapter
Parameter settings on page 19.

Option description and instructions 13
Operation principle
Time scheme
This time scheme diagram illustrates the operation of the POUS function. This safety
function uses the POUS function of the FSO module. For more information, see the FSO
module user’s manual.
A POUS indication delay (see parameter POUS.13): An additional security delay. The POUS
completed indication (parameter POUS.22) becomes active after this delay.
Step Description
1 The user stops the motor(s).
2 After the motor(s) have reached the zero speed, the user switches the POUS switch off (open). The
FSO module activates the inverter unit STO function.
Note: If the user activates the POUS function when the motor is running, the FSO module activates
the inverter unit STO function, the motor(s) coasts to a stop and the FSO module generates a fault.
3 After time A has elapsed, the POUS indication lamp turns on (POUS completed indication).
4 The user switches the POUS switch on (closed). The FSO module deactivates the inverter unit STO
function and turns off the POUS indication lamp. The user can start the motor(s) again.
Note: In this case, automatic acknowledgement of the POUS function is selected (parameter
POUS.02).
5 The user restarts the motor(s).
1
24
POUS switch
(POUS request)
STO status
(POUS status)
A
POUS
indication lamp
3 5
Motor speed
Time

14 Option description and instructions
Operation principle diagram
This diagram shows the connections of two FSO modules in a network (without the safety
encoder interface). For more information, see the circuit diagrams of the delivery.
Controlunit
STO
cable
STO
113:3POUSrequest1 113:7POUSindication
FSO
DI DO
XSTO
~
M
3~
114:3POUSrequest2
GND
113:6
Sxx Pxx
Controlunit
STO
cable
STO
113:3POUSrequest1
113:7POUSindication
FSO
DI DO
XSTO
~
M
3~
114:3POUSrequest2
GND
113:6
Pxx
Sxx POUS switch for 24 V (user-defined)
Pxx POUS indication lamp (user-defined)
FSO FSO safety functions module (on the inverter unit control board)
DI Digital input
DO Digital output
GND Ground
The dash-dot line ( ) indicates a user-defined installation.
The dash line ( ) indicates an additional network.

Option description and instructions 15
Initial status: The drive is in operation and the motor is not running.
Step Operation
1. The user activates the POUS function by switching off the POUS switch [Sxx].
This activates the POUS function in the FSO module.
2. The FSO module de-energizes the STO inputs on the inverter units control boards. This activates
the inverter units STO function. The inverter units indicate the status. See section POUS
indications on page 17.
3. The POUS indication lamp [Pxx] switches on.
4. The user cannot start the motor(s) while the inverter units STO function is on.
5. Normal operation resumes after the user:
• switches on the POUS switch [Sxx]
• resets the inverter units (if parameter 31.22 STO indication run/stop has been set so that a fault
is generated, see page 23).

16 Option description and instructions
Wiring
The POUS switch and indication lamp for the POUS function are not factory-installed. The
user must install and wire them to the inverter units on site.
There is an extension terminal block [X68] for the connections to the FSO module inside
the inverter unit cabinet. This terminal block is the user interface. The FSO module
connectors [X113] and [X114] have been wired to [X68]. This table shows the connections
between the extension terminal block and the FSO module.
There is a separate user interface (terminal block [X957]) inside the cabinet.
ABB installs the FSO module and the wirings between the FSO modules and the inverter
units at the factory.
The FSO module has double terminals for the connection of the POUS switch.Wire the
POUS switch to the appropriate terminals in the extension terminal block [X68]. See the
table above, section Operation principle diagram on page 14 and the circuit diagrams of
the delivery.Obey these general rules.
1. Use only double-contact switches. We recommend approved and lockable switches.
2. Connect the switch with two conductors (two-channel connection).
Note: Keep the channels separate. If you use only one channel, or if the first and
second channels are connected together (for example, in a chain), the cross-fault
detection of the FSO module trips and activates the STO function of the inverter unit.
Note: If you change the input and the parameter settings in the FSO module into a
one-channel implementation, it affects the safety integrity of the safety function. The
safety data that ABB has calculated for the function is not valid.
3. Use a shielded, twisted pair cable. We recommend a double-shielded cable and gold-
plated contacts in the POUS switch.
4. The maximum allowed cable length between the inverter unit and the POUS switch
(for the whole loop) is 250 m (820 ft).
5. Obey the general control cable installation instructions given in the inverter unit
hardware manual.
If you use a POUS indication lamp, wire it to the appropriate terminals in the extension
terminal block [X68]. We recommend an LED indication lamp. The maximum allowed
cable length between the inverter unit and the indication lamp (for the whole loop) is 250 m
(820 ft). See the table above, section Operation principle diagram on page 14 and the
circuit diagrams of the delivery.
FSO
X113:
X68 FSO
X114:
X68
13 1 17
24 2 18
35 3 19
46 4 20
57 5 21
6 8,9 6 22, 23
710 7 24
811 8 25
912 9 26
10 13, 14, 15, 16 10 27, 28, 29, 30

Option description and instructions 17
When safety pulse encoders are used, ABB installs the FSO-21 and FSE-31 modules and
the wirings between the FSO modules and the inverter units at the factory.
The user must wire the safety pulse encoders to the FSE modules on site. Obey these
rules:
•Use a double-shielded, twisted pair cable.
•The maximum allowed cable length between the safety pulse encoder and the FSE
module is 300 m (980 ft).
For more information, see FSE-31 pulse encoder interface module user’s manual
(3AXD50000016597 [English]).
Use of the safety function
Activating
Switch off the POUS switch.
Resetting
You do not need to push any reset button to restore to normal operation after deactivating
the POUS function. The reset input in the FSO module is set to auto reset mode at the
factory. However, you must reset the inverter units if they have tripped on fault at the
activation of the POUS function. The reaction of the inverter units depends on parameter
settings. See chapter Parameter settings on page 19.
POUS indications
When the POUS function is active:
•the POUS indication lamp is on.
The indications that the FSO module generates are configurable. For more information,
see chapter Parameter settings on page 19 and chapter Fault tracing in the FSO module
user’s manual.
Fault reaction function
Definition: The safety function has a ‘fault reaction function’ that attempts to bring the
systems to a safe state if it detects any failure within the safety system:
•a short or open circuit or redundancy failure of the POUS switch wiring chain,
•any internal failure within the FSO or FSE modules, the safety encoder or inverter unit
STO.
This section describes the fault reaction functions in the FSO and FSE modules, the safety
encoder and the inverter units.
FSO module
The fault reaction function of the FSO module trips the inverter unit if it detects a failure.
The FSO module activates the STO or Safe stop emergency (SSE) function. This
activates on the inverter unit STO function. The inverter unit STO function is active until the
fault has been repaired.
The FSO module goes into the Fail-safe mode. The FSO module LED STATUS/FAULT is
red until the fault has been repaired.

18 Option description and instructions
To exit the Fail-safe mode, remove the cause of the fault and reset the FSO module by
switching the power off and on, by pressing the Boot FSO button on the Safety view of
Drive composer pro or with inverter unit parameter 96.09 FSO reboot.For more
information, see the inverter unit firmware manual and the FSO module user’s manual.
FSE module
When a safety function is active, the fault reaction function of the FSO module trips the
inverter unit if it detects a failure in the FSE module. The FSO module activates the STO
function. This activates the drive STO function. The inverter unit STO function is active
until the fault has been repaired.
When there are no active safety functions, the fault reaction function depends on the value
of FSO parameter S_ENCGEN.11 FSE diagnostic failure reaction (see section General
parameters on page 20).
The FSO module goes into the Fail-safe mode. The FSO module LED STATUS/FAULT is
red and the FSE module LED STATUS is off until the fault has been repaired. Also the
inverter unit indicates some of the FSE module faults.
To exit the Fail-safe mode, remove the cause of the fault and reset the FSO module by
switching the power off and on, by pressing the Boot FSO button on the Safety view of
Drive composer pro or with inverter unit parameter 96.09 FSO reboot.
For more information, see the inverter unit firmware manual, FSO-21 safety functions
module user’s manual (3AXD50000015614 [English]) and FSE-31 pulse encoder interface
module user’s manual (3AXD50000016597 [English]).
Safety encoder
The FSE module indicates the internal faults of the safety encoder as cabling faults. This
activates the fault reaction function in the FSE module. This causes the FSO module to go
into the Fail-safe mode (see previous sections).
The FSO module LED STATUS/FAULT is red and the FSE module LED ENC STATUS is
off until the fault has been repaired. Also the inverter unit indicates the safety encoder
fault.
To exit the Fail-safe mode, remove the cause of the fault and reset the FSO module by
switching the power off and on, by pressing the Boot FSO button on the Safety view of
Drive composer pro or with inverter unit parameter 96.09 FSO reboot.
The safety encoder goes into the Safe state. To exit the Safe state, remove the cause of
the fault and reboot the safety encoder (for example, by switching the power off and on).
For more information, see the inverter unit firmware manual, FSO-21 safety functions
module user’s manual (3AXD50000015614 [English]) and FSE-31 pulse encoder interface
module user’s manual (3AXD50000016597 [English]).
STO function in the inverter units
The STO function in the inverter units has internal fault diagnostics and a fault reaction
function which causes a fault trip in case it detects a redundancy fault of STO control
signals or any internal failure. See the hardware and firmware manuals of the inverter unit.

Parameter settings 19
3
Parameter settings
Contents of this chapter
This chapter lists the parameters that you have to set in the FSO modules and the inverter
units.
Introduction
The person who configures the safety functions in the FSO module must be a competent
person as required by IEC 61508-1 clause 6. In this context, the person must have
expertise and knowledge of functional safety, the safety functions as well as the
configuration of the FSO module. We recommend our training courses on the FSO
module.
The example parameter values in this chapter are the delivered default values for the
example POUS safety function presented in this manual (+Q950). We also assume that
the FSO module is only used in this safety function and not in any other safety function at
the same time. However, the actual deliveries vary. You must always check the pre-set
parameter values against the delivery specific circuit diagrams and your application needs,
and adjust the parameter values when necessary.
FSO module
You need the Drive composer pro PC tool to set the FSO module parameters, and a
password to be able to download the configuration to the FSO module from Drive
composer pro. For the default password of the FSO module, see the FSO module user’s
manual. For more information on the Drive composer pro PC tool, see Start-up and
maintenance PC tool Drive composer user’s manual (3AUA0000094606 [English]).
Note: When the motor is running, you cannot change the password, adjust the
parameters, or upload or download the FSO configuration file.

20 Parameter settings
Follow the configuration steps described in the FSO module user’s manual, chapter
Configuration.
There are parameters that you must set always and parameters that are related only to
certain safety functions. These tables list all the parameters that you must check and set
for the option +Q950. The example values apply only to the option +Q950.
General parameters
These parameters are common to all safety functions.
Parameters for the STO function
These parameters are related to the STO function of the FSO module. The FSO module
can activate the STO function in internal fault situations.
Index Name Example
value
Description
FSOGEN.21 Motor nominal
speed
1500 rpm Sets the nominal motor speed. Adjust the default value to
meet the ratings of the motor in use.
FSOGEN.22 Motor nominal
frequency
50 Hz Sets the nominal motor frequency. Adjust the default value to
meet the ratings of the motor in use.
FSOGEN.41 Power-up
acknowledgement
Automatic Sets the power-up acknowledgement method of the FSO
module.
Automatic: You do not need to push a reset button after
switching on the FSO module. The FSO module generates
the acknowledgement signal automatically after the power-up.
Manual: The FSO module reads the external
acknowledgement signal through the digital input defined by
parameter FSOGEN.42.
Make sure that the value is Automatic.
FSOGEN.42 Acknowledgement
button input
None Selects the digital input for the acknowledgement signal when
parameter FSOGEN.41 Power-up acknowledgement or
STO.02 STO acknowledgement has value Manual.
In the safety function described in this manual, parameters
FSOGEN.41 Power-up acknowledgement and STO.02 STO
acknowledgement have value Automatic, and this digital input
is not used. The safety function is configured not to require a
reset/acknowledgement of the safety function after power-up
or the removal of the safety function request.
Index Name Example
value
Description
STO.02 STO acknowledgement Automatic Sets the acknowledgement method used in the STO, SSE and
SS1 functions.
Automatic: The FSO module generates the STO
acknowledgement signal automatically, and the user does not
have to press a reset button (see parameter FSOGEN.42
Acknowledgement button input).
Note: The default value after factory reset is Manual. Always
check this parameter after factory reset.
STO.11 STO input A None Sets the digital input that is connected to the primary input of
the STO function.
The safety option described in this manual does not use this
function and the value must be None.
Note: The default value after factory reset is
DI X113:1&X114:1. Always check this parameter after factory
reset.