CG Emotron OSTO 100 User manual

Emotron OSTO_100 option board for
safety function Safe Torque Off (STO)
for Emotron FDU/VFX 2.1 and CDU/CDX 2.1 AC drives
Emotron VFXR, Emotron FDUL
Instruction manual
English, Geman

Emotron OSTO_100 option board for
safety function Safe Torque OFF (STO)
For Emotron FDU/VFX 2.1 and CDU/CDX
2.1 AC drives
Emotron VFXR, Emotron FDUL
Instruction manual
English
Original instructions
Document number: 01-7513-11
Edition: r0
Date of release: 10 May 2021
© Copyright CG Drives & Automation Sweden AB 2012-2021.
CG Drives & Automation retains the right to change
specifications and illustrations in the text, without prior
notification. The contents of this document may not be copied
without the explicit permission of CG Drives & Automation
Sweden AB.

CG Drives & Automation 01-7513-11r0 5
Contents
1. General information................................................................ 7
1.1 Intended use ............................................................................................ 10
2. Safety information ................................................................ 11
2.1 Notes on safety and symbols used ........................................................ 13
2.2 Technical information.............................................................................. 13
2.3 Risk analysis ............................................................................................ 13
2.4 Trained staff............................................................................................. 14
2.5 When working on the machine ............................................................... 14
2.6 Repair and modifications ........................................................................ 15
2.7 Disposal.................................................................................................... 15
3. Functional description .......................................................... 16
3.1 OSSD support........................................................................................... 16
3.2 STO status feedback signal .................................................................... 17
3.3 Deactivation of STO ................................................................................. 19
3.4 Response time ......................................................................................... 20
4. Technical data ..................................................................... 22
4.1 Safety data ............................................................................................... 22
4.2 Interface description with electrical data .............................................. 24
4.3 System timing information ...................................................................... 27
4.4 Environmental conditions ....................................................................... 27
5. Electrical installation ............................................................. 29
6. Connections and wiring ....................................................... 30
6.1 Wiring........................................................................................................ 30
6.2 EMC environment .................................................................................... 31
6.3 Cable requirements ................................................................................. 31
6.4 Cascading................................................................................................. 32
6.5 Safety sensors ......................................................................................... 32

6CG Drives & Automation 01-7513-11r0
7. Commissioning and maintenance, acceptance &
functional tests .................................................................... 34
7.1 Periodic inspection................................................................................... 34
7.2 Acceptance test........................................................................................ 35
7.3 In case of fault.......................................................................................... 35
8. Faults and diagnostics ......................................................... 36
8.1 Resetting STO condition........................................................................... 38
8.2 Diagnostics via communication interface .............................................. 39
9. Appendix ............................................................................. 40
9.1 Manual wiring check ................................................................................ 40
9.2 Requirements on power supply............................................................... 40
9.3 Mounting instruction ................................................................................ 41
9.4 Connection examples............................................................................... 47
9.5 Certificate.................................................................................................. 52
9.6 Abbreviations ............................................................................................ 54

CG Drives & Automation 01-7513-11r0 General information 7
1. General information
The OSTO_100 option board for safety function Safe Torque Off (STO) is an
extension of the Emotron AC drive used for functional safety purposes to
achieve e.g. prevention of unexpected startup of motor (POUS) or Emergency
stop. This ensures the safety of both the operator and the machinery in
accordance with the Machine Directive.
During normal operation, safety equipment prevents people from accessing
hazardous areas. Sometimes work needs to be carried out in hazardous areas.
Function POUS may for instance be used in cases where tools connected to
motor shaft should be replaced or e.g. when cleaning the motor area (supply
voltage to the AC drive may remain enabled during this maintenance work).
The STO is a basic foundation which can be supplemented with additional
safety functions to also achieve e.g. safety function Safe Stop 1 (SS1-t). Working
principle of SS1-t is to utilize the AC drive to brake the motor down to
standstill before STO is activated. For safety function SS1-t, additional external
safety components are required (e.g. safety relay).
This manual contains technical data of the Emotron OSTO_100 option board
and explains the operation and connection of the board. The Safe Torque Off
function works according to the standards EN IEC 61800-5-2:2017, EN IEC
61508:2010, EN ISO 13849-1:2008 and EN IEC 62061:2005.
The AC drive control board in the Emotron AC drive provides pulse width
modulated (PWM) signals to the IGBT gate driver circuits on the Power board
via the safe torque off (STO) circuitry as depicted in Figure 1.
The STO will become activated if any of the two safety input channels STO1 or
STO2 become deactivated or upon abnormal electrical fault in The Emotron
OSTO_100 option. During normal operation condition both channels will be
deactivated simultaneously. Deactivation of only one channel can imply a fault
in e.g. wiring.

8 General information CG Drives & Automation 01-7513-11r0
Fig. 1 System block schematics
OSTO_100 option board has two external safety inputs denoted STO1 and
STO2. The safety function is activated by disconnecting 24Vdc input. When
STO is active, all PWM signals from the AC drive control board to the IGBT
gate driver circuits on the power board will be inhibited by a safe de-energizing
principle. The power board is then unable to generate any rotary field and the
motor will be torque-free.
Example: Using a 4-pole motor may upon an abnormal power fault in IGBTs
result in residual movement of 180° / 2, i.e. maximum 90°. This residual risk
shall be known and documented.
Figure 2 shows the gate terminals of upper- and lower IGBTs on the power
board along with a connected three-phase motor (M).
NOTE: A short on any IGBT-leg (power transistors) can still result in a
residual movement of the motor shaft. The residual movement in degrees is
equial to 180°/ ‘number of pole pairs’ in the motor.
Control board OSTO_100 option Power board
STO1 STO2

CG Drives & Automation 01-7513-11r0 General information 9
Fig. 2 IGBT gate driver on power board
Upon activation of safety function STO the system must be reset by re-enabling
both STO safety inputs (by applying 24Vdc) and by re-enabling run signal to
Emotron AC drive (edge controlled digital input signal for function RUN needs
to be toggled). After this the motor can be operated normally again. Reset
procedure for a latched STO condition is described in detail in section
“Resetting STO condition” on page 38.
The Emotron OSTO_100 option alone provides a stop function equivalent to
‘stop category 0’ according to EN 60204-1.
EN IEC 60204-1 ‘stop category 1’ can be achieved in a system together with a
safety position switch along with a safety switching device (like e.g. Pilz PNOZ
s5), where the safety switching device is also wired to e.g. Run/Enable signal on
the drive to achieve a controlled stop where STO becomes activated after a delay
(this safe delay must be handled by the safety switching device (safety
component), thus a delay handled by e.g. a generic PLC is not allowed).
Further, the safety switching device have the feature of providing diagnostics for
a connected emergency stop button wiring, i.e. to detect faulty wiring.
M
UVW

10 General information CG Drives & Automation 01-7513-11r0
For more information on how to utilize the Emotron OSTO_100 option as safe
stop and wiring examples of different stop categories, see section “Connection
examples” on page 47.
1.1 Intended use
Emotron OSTO_100 option is a configurable option in the following Emotron
standard products in any enclosure type or supply voltage and current rating:
FDU/VFX 2.1, CDU/CDX 2.1, VFXR, FDUL
NOTE: When utilizing non-safe ‘Run’ or ‘Enable’ signals they must NOT be
wired together with any safety related circuit/signal.
NOTE: In case "Fire Mode" is activated in the Emotron standard product,
the activation of STO situation will overule the continuous operation
initiated by Fire Mode activation.

CG Drives & Automation 01-7513-11r0 Safety information 11
2. Safety information
Before you begin with installation, commissioning or powering up the unit for
the first time it is very important that you carefully study this Instruction
manual.
Following symbols can appear in this instruction or on the product itself.
Always read these first before continuing.
To achieve the highest level of safety, the Machine Directive defines three basic
principles:
• Elimination or reduction of risks due to design.
• Take necessary protective measures against risks which cannot be eliminated.
• Document residual risks and inform users about these risks.
When using the Emotron OSTO_100 option in a functional-safety related
application it is mandatory to use a higher-level safety switching device or
controller for activation purposes.
The Emotron OSTO_100 option may NOT be used unintended by e.g.
• Usage outside technical specifications.
NOTE: Additional information as an aid to avoid problems.
CAUTION!
Failure to follow these instructions can result in malfunction or
damage to the AC drive.
WARNING!
Failure to follow these instructions can result in serious injury to
the user in addition to serious damage to the AC drive.
HOT SURFACE!
Failure to follow these instructions can result in injury to the
user.

12 Safety information CG Drives & Automation 01-7513-11r0
• Usage for other safety functions besides what is approved in this manual.
• Any electrical or structural change of the board.
• In any other product type but the once listed in this manual.
The product:
• Must only be used for intended purpose.
• Must never be commissioned when showing signs of damage.
• Must never be modified in its hardware design.
• Must never be operated without intended covers.
The user shall also carefully observe and consider all documentation regarding
main Emotron product and OSTO_100 option as it is fundamental to obtain a
safe installation. The examples and procedural tests described in this document
are only proposals. It is up to the user to adapt these to specific applications. CG
Drives & Automation (CGDA) does not take responsibility for the suitability of
the procedures or circuit proposals as they are merely examples.
WARNING!
Disregarding the above basic safety measures may lead to
severe personal injury and damage to machinery.

CG Drives & Automation 01-7513-11r0 Safety information 13
2.1 Notes on safety and symbols used
2.2 Technical information
The technical documentation is a part of the product / machine. Due to that
the technical documentation contains important information and it shall be
kept near the machine at all times until the machine is finally disposed of. In
case the machine is sold, disposed or rented out, secure that the applicable
technical documentation follows the machinery.
2.3 Risk analysis
This documentation can only indicate the necessity of risk analysis. Users of
integrated safety systems must familiarize themselves with the relevant standards
and legislation. Before a machine can be marketed, machine manufacturers
must perform a risk analysis in accordance with the Machinery Directive so as
to determine the risk associated with the use of the machine.
WARNING!
• Failure to follow these instructions can result in serious injury to the
operator and/or machinery.
• The Safe Torque Off only guarantees a torque less motor, i.e. hazardous
voltages can still be present at the output of the drive controller while
STO is active. The STO safety function does NOT disconnect the voltage
to the mains or auxiliary circuits of the drive.
•The Emotron OSTO_100 option is NOT designed for ‘Emergency Off’
function (another aspect of functional safety which also includes reali-
zation of no voltage present after activation, described in DIN EN
60204-1:2006).
NOTE: If the Emotron OSTO_100 option is mounted into an Emotron AC drive
where the STO feature shall not be utilized, then both input channels STO1
and STO2 must be connected to 24Vdc SELV/PELV input to allow motor
operation.

14 Safety information CG Drives & Automation 01-7513-11r0
Risk assessment is described in detail in the DIN EN ISO 12100:2013-08:
Safety of machinery – general principles for design – risk assessment and risk
reduction. The result of the risk assessment of the machine determines the
category for safety-related control systems according to EN ISO 13849-1.
2.3.1 IGBT failure and STO – residual risk
If a drive experiences multiple power semiconductor failures (IGBT failures),
then the drive system can produce an alignment torque, which then rotates the
motor shaft by maximum “180/p” degrees, where p is equal to the pole pair
number of the connected motor. This residual risk can occur even though STO
function has been correctly activated. It shall however be noted that if it occurs
then it will be detected by the drive as a desaturation trip or fuses will blow.
2.4 Trained staff
As all machinery have residual risks to consider, only qualified/trained staff that
are aware of such residual dangers may carry out work / operate / dispose such a
machine. Qualified staff are defined as persons whom has acquired applicable
knowledge by professional training following applicable standards and
guidelines of safety engineering. IEC 60364 or CENELEC HD 384 describes
appropriate skills of staff more in detail.
•
Staff shall be familiar with installation, mounting, commissioning and operating
the product
.
• They should be qualified for their work.
• They can apply all applicable regulations for prevention of accidents according
to directives and laws applicable for the location of the installation.
It is of main importance that the technical documentation and in particular the
safety information is fully read, understood and observed. In addition, other
applicable legal requirements and validation regulations shall be followed at all
times.
2.5 When working on the machine
It is crucial that all work executed on the machine is performed in a safe way.
Procedure may be, but must not be limited to, the following procedure:
1. Disconnect power.
Secure that any additional auxiliary power is also disconnected.
2. Secure that the power cannot be turned on again.

CG Drives & Automation 01-7513-11r0 Safety information 15
3. Check that no voltage is present1.
4. To secure that fuse will blow in case power turned back on by accident –
short & ground power interface.
5. Make sure that possible adjacent live parts are covered / made inaccessible.
2.6 Repair and modifications
The user is NOT allowed to do electrically design changes to AC drives which
has the Emotron OSTO_100 option mounted as it is part of a safety solution.
Nor shall the safety function be disabled by any hardwiring of the safety inputs.
Neither repair nor modification of the Emotron OSTO_100 option board is
allowed. In case of suspected defect on option board, please return it to CG /
Emotron along with a detailed fault description.
2.7 Disposal
The enclosures of the drives are made from recyclable material as aluminum,
iron and plastic. Our AC-drives comply to RoHS II directive, and contain
electronic waste (e-waste). Any local or national regulations in force for the
disposal and recycling of e-waste must be complied with.
1. NOTE: Also consider/check residual voltage.
WARNING!
Always switch off the mains voltage before opening the AC and
wait at least 7 minutes to allow the capacitors to discharge.

16 Functional description CG Drives & Automation 01-7513-11r0
3. Functional description
The Emotron OSTO_100 option board is based on designated structure for
Category 4 of EN ISO 13849-1, which means that it has two safety input
channels. These input channels are independent of each other and must be
provided by an SELV/PELV 24Vdc source / safety switching device. This power
supply must not be used for connecting other auxiliary hardware. Do NOT use
the generic Emotron AC drives 24Vdc supply available on terminal strip of the
AC drive control board as it is the system voltage of the Emotron AC drive and
will be used both internally and for external sensors/actuators/auxiliary
hardware connected to the drive. The input signals shall be controlled
synchronously by the switching device.
3.1 OSSD support
The Emotron OSTO_100 option supports OSSD functionality.
OSSD stands for “Output Switching Signal Device”. This output type is
typically available on safety PLCs, safety light curtains and sensors. With a
conventional 24Vdc output it is not possible to detect short circuit on the
wiring, this is however possible with OSSD technology. The method is based on
transmitting short OSSD test pulses with low output voltage. During this test
pulse length the safety device reads back the output signal via digital input. In
case 24Vdc is present at the input during the test pulse sequence a fault is
triggered and the two built-in processors will safely switch off both outputs.
Thus, OSSD allows automatic monitoring of both short circuits and cross
circuits (between safety inputs) up to PLe according to EN ISO 13849-1.
WARNING!
The purpose of the Emotron OSTO_100 option is only to secure
that the motor is torque free. This means that dangerous high
voltages may still be applied to the motor while the Emotron
OSTO_100 option is active. Secure that live parts cannot be
touched and in case the supply voltage must be switched off
NOTE: in case "Fire Mode" is activated in the Emotron standard product, the
activation of STO situation will overrule the continuous operation initiated
by Fire Mode activation.

CG Drives & Automation 01-7513-11r0 Functional description 17
The cross circuit is detected by utilizing a staggered test pattern between the two
safety channels (out of sync test pulse).
3.2 STO status feedback signal
In addition to OSSD support, the Emotron OSTO_100 option board also
provides a non-safe ‘STO_STATUS_ISO’ output signal (open collector type,
pulled-up via supply voltage on X2:1) which mirrors the actual status of the gate
driver.
The STO_STATUS_ISO signal is active high, i.e. signal will be high when safe
state (Safe Torque Off active) is reached.
Note that a mismatch between STO1 and STO2 will also activate Safe Torque
Off function as STO_STATUS_ISO mirrors the actual state of the gate driver
NOTE: The receiving unit must support OSSD given the pulse length of the
test pulse and its periodicity. This Emotron OSTO_100 option have support
of OSSD test pulses with a maximum length of 1 ms, with a frequency up to
200 Hz.
NOTE: The status feedback signal is not intended for use of driving external
relay. In the case this is required you may utilize a relay output set to
function ‘STO active’. Detailed description is available in Emotron AC drive
instruction manual. Note that this output is also considered unsafe.
Table 1 Truth table of STO_STATUS_ISO
STO1 STO2 STO_STATUS_ISO Description
HIGH HIGH LOW Drive is active
HIGH LOW HIGH Safe torque off is acti-
vated (gate driver de-
energized)
LOW HIGH HIGH
LOW LOW HIGH
NOTE: The STO_STATUS_ISO feedback signal may not be used for
cascading.

18 Functional description CG Drives & Automation 01-7513-11r0
and whereas the gate driver will become powerless when any of the two STO-
inputs goes low (achieving a safe state).
The output signal STO_STATUS_ISO will not be affected by OSSD-test
pulses for test pulses ≤ 1 ms in length (filtered in hardware).
To properly activate STO safety function, both inputs STO1 and STO2 must be
switched off. During normal operation both inputs are switched off at the same
time (synchronized), but it is enough that one channel goes low to activate safe
state. After a response time of ≤ 15 ms has elapsed from one or both input
signals going low, the gate driver will become de-energized and thereby the
motor cannot generate any further torque.
WARNING!
When safe torque off is active, the motor will become torque
free. This means that any hanging/suspended or tensioned load
like e.g. cranes or hoists will require additional brakes or
mechanical interlocks to avoid residual risk of dropping loads.
Dropping loads may cause personal injury or property damage!
Further, make sure that no other residual risk can occur while
the motor is coasting down to zero speed.
DANGER!
The safety function “Safe torque off” (STO) must not be
mistaken for safety function “Emergency off” which also
ensures that the motor is electrically disconnected. Safety
function “Emergency off” requires additional equipment like a
mains switch with undervoltage coil to also achieve electrical
isolation.
WARNING!
Safety function STO must never be used for electrical
maintenance purposes. Before carrying out any electrical
maintenance, the AC drive must always be disconnected from
the power supply.

CG Drives & Automation 01-7513-11r0 Functional description 19
3.3 Deactivation of STO
When both STO1 and STO2 inputs are high it means that the STO is
deactivated and that the motor can rotate / produce torque.
To activate STO both STO-inputs shall be disconnected from 24Vdc supply
voltage simultaneously. The unsafe ‘STO_STATUS_ISO’ output is available to
diagnose the safety channel wiring as well as the actual gate driver status.
Upon detecting fault in electronics of OSTO_100 option e.g. incorrect voltage
level on PCB, the STO will be activated (safe state).

20 Functional description CG Drives & Automation 01-7513-11r0
3.4 Response time
Fig. 3 Timing diagram of OSTO_100 option
The Figure 3 above gives an example of how the Emotron OSTO_100 option
reacts to changes in inputs signals STO1 and STO2. At starting point we assume
that the motor is running at constant speed and both STO1 and STO2 input
signals are high, STO_STATUS_ISO is low (indicating disabled STO). At time
t1, STO1 signal goes low and after additional time of tresponse milliseconds
(@time t2), the gate driver is made powerless (regardless of state of input STO2)
and STO_STATUS_ISO output goes high to indicate an active Safe Torque Off
state. The Emotron OSTO_100 option has a tresponse time of ≤15 milliseconds.
t1t2t3t4
t
t
t
t
STO_STATUS_ISO
STO2
STO1
tresponse
0
1
0
1
0
1
STO ACTIVE
Motor speed