Festo CAMC-G-S1 User manual

CAMC-G-S1
Safety module
Manual | Safety
function, STO
8179141
2022-07d
[8179143]

Translation of the original instructions
CANopen®, DEVICENET®, EtherCAT®, EtherNet/IP®, PI PROFIBUS PROFINET® are registered trade-
marks of the respective trademark owners in certain countries.

Festo — CAMC-G-S1 — 2022-07d
3
Table of contents
1 About this document. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2 Safety and requirements for product use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1 Safety. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1.1 General safety instructions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1.2 Intended use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1.3 Foreseeable misuse. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1.4 Achievable safety level, safety function in accordance with EN ISO 13849-1/
EN 61800-5-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2 Requirements for product use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2.1 Technical prerequisites. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2.2 Qualification of the specialist technicians (requirements for staff). . . . . . . . . . 9
2.2.3 Diagnostic coverage (DC). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.2.4 Range of application and approvals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3 Product description of safety module CAMC-G-S1. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.1 Product overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.1.1 Purpose. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.1.2 Supported devices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.1.3 Operating elements and connections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.1.4 Scope of delivery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.2 Function and application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.2.1 Description of the STO safety function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.2.2 Overview of interface [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.2.3 Control inputs STO-A, 0V-A/STO-B, 0V-B [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.2.4 Feedback contact C1, C2 [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.2.5 24 V, 0 V auxiliary power supply [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.2.6 Status indicator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.2.7 DIL switch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.3 Functions in the motor controller CMMP-AS-...-M3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.4 Time response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.4.1 STO basic time response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.4.2 Time response of activation of STO in operation with restart. . . . . . . . . . . . . . 19
3.4.3 Time response of activation of SS1 in operation with restart. . . . . . . . . . . . . . 21
4 Assembly and installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.1 Mounting/removal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.2 Electrical installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.2.1 Safety instructions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.2.2 Connection [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
4.2.3 Minimum wiring for initial start-up [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
4.3 Sample circuits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.3.1 Safe Torque Off (STO). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4.3.2 Deceleration and Safe Torque Off (SS1, "Safe Stop 1"). . . . . . . . . . . . . . . . . . 27

4
Festo — CAMC-G-S1 — 2022-07d
5 Commissioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.1 Prior to commissioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.2 DIL switch setting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.3 Parameterisation with FCT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.3.1 Setting the configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
5.3.2 Apply module and status display of the module. . . . . . . . . . . . . . . . . . . . . . . . 31
5.3.3 Display permanent diagnostic memory of the motor controller. . . . . . . . . . . . 32
5.4 Function test, validation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
6Operation and use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.1 Obligations of the operator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.2 Maintenance and care. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.3 Protective functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.3.1 Voltage monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.3.2 Overvoltage and reverse polarity protection. . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.4 Diagnostics and fault clearance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.4.1 Status display. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
6.4.2 Error messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
7 Modification and module replacement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.1 Replacement of the safety module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.1.1 Repair. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.1.2 Disassembly and installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.2 Decommissioning and disposal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.3 Replacement of the previous CMMP-AS series with the CMMP-AS-…-M3. . . . . . . . . . . . 41
8Technical appendix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
8.1 Technical data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
8.1.1 Safety engineering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
8.1.2 General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
8.1.3 Operating and environmental conditions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
8.1.4 Electrical data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
9 Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Festo — CAMC-G-S1 — 2022-07d
About this document
5
1 About this document
Notes regarding this documentation
This documentation is intended to ensure that operators can work safely with the safety function STO
– "Safe Torque Off" in accordance with EN 61800-5-2 by using the safety module CAMC-G-S1 for the
motor controller CMMP-AS-...-M3.
–In addition, always observe the general safety regulations for the motor controller CMMP-AS-...-M3.
The general safety regulations for the CMMP-AS-...-M3 can be found in the hardware documentation,
GDCP-CMMP-M3-HW-... è Tab. 6 Documentation for the motor controller CMMP-AS-...-M3.
Observe the information regarding safety and the requirements for product use in è 2.2 Requirements
for product use.
Product identification
This documentation refers to the following versions:
• Safety module CAMC-G-S1, from revision 03.
• Motor controller CMMP-AS-…-M3, firmware from version 4.0.1501.1.1.
• FCT plug-in CMMP-AS from version 2.3.x.
Rating plate (example) Meaning
Order reference CAMC-G-S1
Part number 1501330
Production date XX
Serial number #nnnnn
Revision status Rev XX
Tab. 1: Rating plate CAMC-G-S1
Service
Please consult your regional Festo contact if you have any technical problems.
Specified standards/directives
Version
EN 61800-5-1:2007 + A1:2017 EN ISO 12100-1:2010
EN 61800-5-2:2007 EN ISO 13849-1:2015
EN 60204-1:2006 + A1:2009 + AC:2010 IEC 61131-2:2007
EN 62061:2005 + AC:2010 + A1:2013 + A2:2015 IEC 61508-1/.../-7:2010
Tab. 2: Standards/directives specified in the document

6
Festo — CAMC-G-S1 — 2022-07d
About this document
Manufacturing period
The first 2 characters of the serial number on the rating plate indicate the manufacturing period in
encrypted form è Tab. 1 Rating plate CAMC-G-S1. The letter specifies the manufacturing year and the
character after it (number or letter) indicates the manufacturing month.
Manufacturing year
X = 2009 A = 2010 B = 2011 C = 2012 D = 2013 E = 2014 F = 2015
H = 2016 J = 2017 K = 2018 L = 2019 M = 2020 N = 2021 P = 2022
R = 2023 S = 2024 T = 2025 U = 2026 V = 2027 W = 2028 X = 2029
Tab. 3: Year of manufacture (20-year cycle)
Manufacturing month
1 January 2 February
3 March 4 April
5 May 6 June
7 July 8 August
9 September O October
N November D December
Tab. 4: Manufacturing month
Type codes
Type CAMC-G-S1
CAMC Electric plug-in cards
G Safety module
S1 Safe torque off
Tab. 5: Type codes
Documentation
You will find additional information on the motor controller in the following documentation:
User documentation for the motor controller CMMP-AS-...-M3
Name, type Table of contents
Hardware manual,
GDCP-CMMP-M3-HW-...
Assembly and installation of motor controller CMMP-AS-...-M3
for all variants/performance classes (1-phase, 3-phase), pin
allocations, error messages, maintenance.
Functions manual,
GDCP-CMMP-M3-FW-...
Functional description (firmware) CMMP-AS-...-M3, notes for
commissioning.

Festo — CAMC-G-S1 — 2022-07d
About this document
7
User documentation for the motor controller CMMP-AS-...-M3
Name, type Table of contents
FHPP manual,
GDCP-CMMP-M3/-M0-C-HP-...
Control and parameterisation of the motor controller via the
Festo FHPP profile.
–Motor controller CMMP-AS-...-M3 with the following field-
buses: CANopen, PROFINET, PROFIBUS, EtherNet/IP, DEVI-
CENET, EtherCAT.
–Motor controller CMMP-AS-...-M0 with fieldbus CANopen.
CiA 402 (DS 402) manual,
GDCP-CMMP-M3/-M0-C-CO-...
Control and parameterisation of the motor controller via the
device profile CiA 402 (DS 402)
–Motor controller CMMP-AS-...-M3 with the following field-
buses: CANopen and EtherCAT.
–Motor controller CMMP-AS-...-M0 with fieldbus CANopen.
CAM Editor manual,
P.BE-CMMP-CAM-SW-...
Cam disc functions (CAM) of the motor controller CMMP-
AS-...-M3/-M0.
Safety module manual,
GDCP-CAMC-G-S1-...
Functional safety engineering for the motor controller with the
STO safety function.
Safety module manual,
GDCP-CAMC-G-S3-...
Functional safety engineering for the motor controller with the
STO, SS1, SS2, SOS, SBC, SLS, SSR, SSM safety functions.
Help for the FCT CMMP-AS plug-in User interface and functions of the CMMP-AS plug-in for the
Festo Configuration Tool è www.festo.com/sp.
Tab. 6: Documentation for the motor controller CMMP-AS-...-M3

8
Festo — CAMC-G-S1 — 2022-07d
Safety and requirements for product use
2 Safety and requirements for product use
2.1 Safety
2.1.1 General safety instructions
–Also always observe the general safety regulations for the motor controller CMMP-AS-...-M3.
The general safety regulations for the CMMP-AS-...-M3 can be found in the hardware documentation,
GDCP-CMMP-M3-HW-... è Tab. 6 Documentation for the motor controller CMMP-AS-...-M3.
NOTICE
Failure of the safety function!
The safety functions might fail if you do not comply with the parameters required for the surroundings
and connections.
• Observe the specified environmental and connection conditions, in particular the input voltage
tolerances è 8.1 Technical data.
NOTICE
Incorrect handling may damage the safety module or motor controller.
Incorrect handling may cause damage.
• Switch off the power supply before mounting and installation work. Do not switch on the supply
voltages until mounting and installation work is completely finished.
•Never unplug or plug the module from/into the motor controller when powered!
•Observe the handling specifications for electrostatically sensitive devices.
2.1.2 Intended use
The safety module CAMC-G-S1 is an extension of the motor controller CMMP-AS-...-M3 for implemen-
tation of the safety function:
–Safe Torque Off (STO) with SIL 3 in accordance with EN 61800-5-2/EN 62061/IEC 61508 and/or
category 4/PL e in accordance with EN ISO 13849-1.
The motor controller CMMP-AS-...-M3 with safety module CAMC-G-S1 is a product with safety-related
functions and intended for installation in machines or automation systems and to be used as follows:
–in excellent technical condition,
–in its original condition, without unauthorised modifications,
–within the limits of the product defined by the technical data è 8.1 Technical data,
–in an industrial environment.
The safety module CAMC-G-S1 can be operated in all motor controllers CMMP-AS-...-M3 that have the
Ext3 slot for safety engineering. It cannot be plugged into one of the Ext1 or Ext2 slots for interfaces.
NOTICE
In the event of damage caused by unauthorised manipulation or use other than the intended use, the
guarantee will be invalidated and the manufacturer will not be liable for damages.
2.1.3 Foreseeable misuse
The following are examples of foreseeable misuse and are not approved as intended use:
–use in a device other than the CMMP-AS-…-M3,
–use outdoors,

Festo — CAMC-G-S1 — 2022-07d
Safety and requirements for product use
9
–use in non-industrial areas (residential areas),
–use in applications where switching off can result in hazardous movements or conditions.
NOTICE
• The STO function must not be used as the sole safety function for drives subject to permanent
torque (e.g. suspended loads).
• Safety devices must not be bypassed.
• Repairs on the module are prohibited!
The STO (Safe Torque Off) function does not provide protection against electric shock, only against
dangerous movements!
è Hardware documentation, GDCP-CMMP-M3-HW-...
2.1.4 Achievable safety level, safety function in accordance with EN ISO 13849-1/EN 61800-5-2
The safety module fulfils the requirements for
–category 4/PL e in accordance with EN ISO 13849-1,
–SIL CL 3 in accordance with EN 62061,
and can be used in applications up to cat. 4/PL e in accordance with EN ISO 13849-1 and SIL 3 in
accordance with EN 61800-5-2/EN 62061/IEC 61508.
The achievable safety level depends on the other components used to implement a safety function.
2.2 Requirements for product use
–Make this documentation available to the design engineer, installer and personnel responsible for
commissioning the machine or system in which this product is used.
–Make sure that the specifications in the documentation are observed at all times. When so doing,
also take into account the documentation for the other components and modules (e.g. motor
controller, cables etc.).
–Take into account the legal regulations applicable for the location as well as:
–instructions and standards,
–regulations of testing organisations and insurers,
–national specifications.
–If the safety function is required, protection against automatic restart in accordance with the
required category must be installed. For example, an external safety relay unit can be used.
2.2.1 Technical prerequisites
General information on correct and safe use of the product, which must be observed at all times:
–Observe the connection and ambient conditions of the safety module (è 8.1 Technical data), the
motor controller and all connected components as specified in the technical data.
Only compliance with the limit values and/or load limits will enable operation of the product in
accordance with the relevant safety directives.
–Observe the notes and warnings in this documentation.
2.2.2 Qualification of the specialist technicians (requirements for staff)
The device may only be set into operation by a qualified electrical technician who is familiar with:

10
Festo — CAMC-G-S1 — 2022-07d
Safety and requirements for product use
–the installation and operation of electrical control systems,
–the applicable instructions for operating safety engineering systems,
–the applicable instructions for accident prevention and occupational safety and
–the documentation for the product.
2.2.3 Diagnostic coverage (DC)
Diagnostic coverage depends on the integration of the motor controller with the safety module into
the control loop system as well as the implemented diagnostics measures è 6.4 Diagnostics and fault
clearance.
If a potentially dangerous malfunction is recognised during diagnostics, appropriate measures must
be taken to maintain the safety level.
NOTICE
Check whether detection of shorts across contacts of the input circuit and the connection wiring is
required in your application.
If necessary, use a safety relay unit with detection of shorts across contacts to control the safety
module.
2.2.4 Range of application and approvals
The motor controller with integrated safety module is a safety device. For details of the safety-oriented
standards and test values that the product complies with and fulfils, see è 8.1 Technical data.
The product-relevant directives are listed in the declaration of conformity è www.festo.com/sp.
Product conformity
in accordance with EU EMC Directive
in accordance with EU Machinery Directive
in accordance with EU RoHS Directive
to UK EMC Regulations
to UK Supply of Machinery Regulations
to UK RoHS Regulations
Tab. 7: Product conformity

Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
11
3 Product description of safety module CAMC-G-S1
3.1 Product overview
3.1.1 Purpose
As processes become increasingly automated, protecting people from potentially hazardous move-
ments is becoming ever more relevant. Functional safety refers to measures required of electrical or
electronic equipment to reduce or eliminate dangers due to malfunctions. In normal operation, protec-
tive devices prevent human access to hazard zones. In certain operating modes, e.g. during set-up,
people need to have access to danger zones. In such situations, the operator must be protected by
measures incorporated into the drive and control system.
Integrated functional safety engineering provides the conditions required by controller and drive for
the implementation of protective functions. Planning and installation complexity is reduced. The use
of integrated functional safety engineering increases machine functionality and availability over the
levels achieved by conventional safety engineering.
Type Description
CAMC-G-S1 Safety module with STO function and DIL switches.
CAMC-G-S3 Safety module with the STO, SS1, SS2, SOS, SBC, SLS, SSR, SSM
functions and DIL switches.
CAMC-DS-M1 Switch module with DIL switches, no safety function.
Tab. 8: Overview of safety and switch modules for the CMMP-AS-...-M3
3.1.2 Supported devices
The safety module CAMC-G-S1 can be used in motor controllers exclusively in accordance with è 2.1.2
Intended use. The motor controllers CMMP-AS-…-M3 are supplied without a module in slot Ext3.
The safety functions of the integrated functional safety for safety-related stops described in this
documentation can be expanded with the use of the safety module CAMC-G-S1.
If a safety function is not required, the switch module CAMC-DS-M1 must be ordered and installed in
the Ext3 slot.
3.1.3 Operating elements and connections
The safety module CAMC-G-S1 has the following control components, connections and display compo-
nents:

12
Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
1
2
3
4
5
Fig. 1: Control section and connections CAMC-G-
S1
1
Motor controller CMMP-AS-…-M3 with slot
Ext3 for safety modules
2
Digital I/O interface [X40] for control of the
STO function
3
Pin 1 of the interface [X40]
4
LED for display of the operating status
(status of functional safety)
5
DIL switch (activation/configuration of
fieldbus communication in the motor con-
troller)
3.1.4 Scope of delivery
Safety module CAMC-G-S1
Safety module with mounting accessories
(2 screws with split washer)
Safe torque off module
Plug for control cables PHOENIX MiniCombicon MC 1.5/8STF3.81 BK
Brief description with assembly instructions German/English/Spanish/French/
Italian/Chinese
Tab. 9: Scope of delivery
3.2 Function and application
The safety module CAMC-G-S1 has the following performance characteristics:
–Reaching the "Safe Torque Off" (STO) function,
–Potential-free feedback contact for the operating status,
–Design as a module that can be plugged in from the outside thus enabling retrofits,
–Suitable exclusively for motor controllers of the series CMMP-AS-…-M3.
The “Safe Stop 1” (SS1) function can be implemented with a suitable external safety relay unit and
appropriate circuitry for the motor controller CMMS-AS-...-M3.
3.2.1 Description of the STO safety function
Use the “Safe Torque Off” function (STO) whenever you need to disconnect the energy supply to the
motor reliably in your application.
The “Safe Torque Off” function switches off the driver power supply for the power semiconductor, thus
preventing the power output stage from supplying the power required by the motor; see the diagram
below.

Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
13
1
23
4
45
6
7
Fig. 2: “Safe torque off” - functional principle for the CMMP-AS-…-M3
1
Safety circuit (switch, relay, safety relay
unit)
2
Safety module CAMC-G-S1
3
Power output stage in the CMMP-AS-…-M3
(only one phase shown)
4
Driver power supply
5
Motor connection
6
LED (green/yellow), status indicator
7
Feedback contact
The power supply to the drive is safely disconnected when the STO “Safe Torque Off” safety function
is active. The drive cannot generate torque and so cannot perform any dangerous movements. With
suspended loads or other external forces, additional measures must be taken to ensure that the load
does not drop (e.g. mechanical holding brakes). The standstill position is not monitored in the STO
“Safe Torque Off” state.
The machine must be brought to a standstill in a safe manner and secured, e.g. with a safety relay
unit. This especially applies to vertical axes without automatic locking mechanisms, clamping units or
counterbalancing.
NOTICE
There is a danger that the drive will advance if there are multiple errors in the CMMP-AS-…-M3.
If the power stage of the motor controller fails during the STO state (simultaneous short circuit of 2
power semiconductors in different phases), this can result in a limited detent movement of the rotor.
The rotation angle/travel corresponds to one pole pitch. Examples:
• rotary axis, synchronous machine, 8-pole è movement < 45° at the motor shaft.
• linear motor, pole pitch 20 mm è movement < 20 mm at the moving part.

14
Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
3.2.2 Overview of interface [X40]
The safety module has an 8-pin connection [X40] on the front for control inputs, feedback contact and
a 24 V auxiliary supply for external sensors è 4.2 Electrical installation.
The STO safety function is requested exclusively via the two digital control inputs STO-A and STO-B.
Safety circuitry for additional interfaces on the CMMD-AS-...-M3 motor controller is neither required
nor intended.
The safety module does not detect shorts across contacts of the input circuit.
The status of the motor controller is sent to an external safety relay unit via a potential-free feedback
contact (N/O contact). This means that a downward compatible interface can be implemented in a
mixed configuration consisting of CMMP-AS (previous series with the “safe stop” function via the [X3]
connection) and the CMMP-AS-…-M3 è 7.3 Replacement of the previous CMMP-AS series with the
CMMP-AS-…-M3. The interface [X40] allows direct connection of active and passive sensors, because a
24 V supply voltage (auxiliary supply) with associated reference potential is connected.
Ports Description
STO-A
0V-A
(Pin 1)
(Pin 2)
Control input A for the STO function with the associated reference potential
–"Safe Torque Off" (STO) request at low (logic 0), together with STO_B.
Control input 24 V, high active, based on EN 61131-2, signal level deviating from
è 8.1.4 Electrical data, è Tab. 31 Technical data: electrical data of the STO-A and
STO-B inputs.
STO-B
0V-B
(Pin 3)
(Pin 4)
Control input B for the STO function with the associated reference potential.
–"Safe Torque Off" (STO) request at low (logic 0), together with STO_A.
Control input 24 V, high active, based on EN 61131-2, signal level deviating è 8.1.4
Electrical data, è Tab. 31 Technical data: electrical data of the STO-A and STO-B
inputs.
C1)
C2)
(Pin 5)
(Pin 6)
Feedback contact for the "Safe Torque Off" status (STO), e.g. to an external con-
troller.
–Feedback contact open: "Safe Torque Off" (STO) not active
–Feedback contact closed: "Safe Torque Off" (STO) active
24V
0V
(Pin 7)
(Pin 8)
Auxiliary power supply, e.g. for safety-oriented peripherals (24 V DC logic power
supply of the motor controller).
Tab. 10: Function of the connections of the module [X40]
The connections are galvanically isolated in groups from one another and from the 24 V power supply
of the motor controller è 8.1.4 Electrical data, è Tab. 34 Technical data: electrical data of the
auxiliary supply output.

Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
15
3.2.3 Control inputs STO-A, 0V-A/STO-B, 0V-B [X40]
The STO (Safe Torque Off) safety function is requested via two channels with the two control inputs
STO-A and STO-B. They allow the direct connection of safe semiconductor outputs (electronic safety
relay units, active safety sensors, e.g. light curtains with OSSD signals) and switching contacts (safety
relay units with relay outputs, passive safety sensors, e.g. positively driven position switches) è Fig.
7.
In order to request the STO (Safe Torque Off) safety function, the 24 V control voltage is switched off
at both control inputs STO-A and STO-B (0 V).
If the two control ports are switched off simultaneously or within a defined discrepancy time, the STO
safety function is active.
Undervoltage monitoring is integrated for the STO-A and STO-B control inputs in order to rule out
invalid voltage ranges for the downstream electronics, as well as overvoltage monitoring to protect
against overvoltage.
Technical data for the control inputs in the specified operating range of logic voltages è 8.1.4
Electrical data, è Tab. 31 Technical data: electrical data of the STO-A and STO-B inputs.
Tolerance ranges are defined for the input voltage range of the STO-A and STO-B control inputs.
The amount of energy stored in the components of the safety module (e.g. capacitors) depends on
the magnitude of the input voltage. This amount of energy must be charged or discharged during
switching operations. The input voltage-dependent values are thus derived for the switch-off time for
the transition to the safe state (STO) and the tolerance time for OSSD signals (buffer time).
The requirements for the time response are derived from the technical data è 8.1.4 Electrical data.
The time response itself is described here è 3.4 Time response.
Discrepancy time
The transition between a safe and an unsafe state is initiated by level changes at the STO-A and STO-B
control inputs of the safety module CAMC-G-S1. According to the specification of the safety function,
both levels must be identical, otherwise an error message is generated. The state machine in the
motor controller internally monitors the driver supply voltages as a result of the control of the control
inputs. The level changes do not usually take place exactly simultaneously, for example, because of
component tolerances or bouncing outputs of safety controls. The firmware tolerates this as long as
the second input follows within a defined time, the so-called discrepancy time. If the time is exceeded,
the motor controller generates an error message.
A discrepancy time of 100 ms is the default.
Recommendation: always switch STO-A and STO-B simultaneously.
Test pulses
Temporary test pulses from safety controllers are tolerated and thus do not lead to the request of the
STO function.
The tolerance to test pulses from sensors with OSSD signals is designed for the operating range
according to è 8.1.4 Electrical data, è Tab. 32 Typical switch-off time and minimum tolerance time for
test pulses (OSSD signals). The permissible test pulse length depends on the control voltage level at
the STO-A and STO-B inputs.

16
Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
Example: input voltage for STO-A and STO-B = 24 V è OSSD signals with a test pulse length of 3.5 ms
are tolerated.
3.2.4 Feedback contact C1, C2 [X40]
If the STO function is not active, the feedback contact is opened. For example, this is the case if only
one of the two STO-A or STO-B control voltages is present, if the 24 V logic supply voltage is switched
off or the supply voltage fails.
When the STO function is active, the relay contact is closed.
The feedback contact is single-channel and may be used for diagnostic purposes, but not in the safety
circuit.
Electrical data of the feedback contact è 8.1.4 Electrical data, è Tab. 33 Technical data: electrical
data of the feedback contact C1/C2. Time response of the feedback contact è Tab. 32 Typical
switch-off time and minimum tolerance time for test pulses (OSSD signals).
When the 24 V supply of the basic unit is switched on and off, the switching status of the relay may
deviate briefly (approx. 100 ms) from the status of the STO-A and STO-B control inputs due to the
difference in speed at which the internal supply voltage starts up.
3.2.5 24 V, 0 V auxiliary power supply [X40]
The motor controller CMMP-AS...-M3 with the safety module CAMC-G-S1 provides a 24 V auxiliary
supply at [X40]. This can be employed when using the C1/C2 feedback contact or for power to external
active sensors.
Electrical data of the auxiliary power supply è 8.1.4 Electrical data, è Tab. 34 Technical data:
electrical data of the auxiliary supply output.
3.2.6 Status indicator
The safety module has an LED on the front to indicate the status of the safety function è 6.4.1 Status
display.
The status LED shows the operating status of the module (green = STO not active, yellow = STO
active). The display corresponds to the status of the C1/C2 feedback contact.
3.2.7 DIL switch
DIL switches are located on the front panel of the safety module. They do not have a safety function.
The meaning of the individual switches depends on the interface used for fieldbus communication.
The DIL switches can be used to activate/deactivate fieldbus communication and, for example, to set
up a device address.
3.3 Functions in the motor controller CMMP-AS-...-M3
The following functions in the motor controller CMMP-AS-...-M3 are not certified according to
EN 61800-5-2. They are functional supplements and offer additional diagnostic options.
Error messages generated by the safety module, e.g. exceeding the discrepancy time, are recorded
and evaluated by the non-safety-related state machine of the motor controller. If the conditions for an
error status are detected, an error message is generated. In this case, it cannot be guaranteed under
all circumstances that the power output stage has been safely switched off.

Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
17
The safety module CAMC-G-S1 exclusively controls the provision of the driver power supply for the
motor controller CMMP-AS-...-M3. Although the levels of the input voltage are monitored section by
section, the safety module does not have its own error evaluation mechanisms and also does not have
the option of displaying an error.
NOTICE
When error messages are acknowledged, all acknowledgeable errors regarding functional safety are
also acknowledged è 6.4.2 Error messages.
The motor controller CMMP-AS-M3 monitors the status of the STO-A and STO-B control inputs. As a
result, the request for the STO (Safe Torque Off) safety function is detected by the firmware of the
motor controller and various non-safety-related functions are then executed:
–detection of the shutdown of the driver power supply for the power semiconductors by the safety
module,
–switching off the drive control and the control of the power semiconductors (PWM),
–the holding brake control is switched off (if configured),
–state machine on the motor controller side with evaluation of the control (discrepancy time),
–detection of application-related error states,
–hardware diagnostics,
–status and error indication via display, digital outputs, fieldbuses etc.
NOTICE
A brake is actuated by the non-safety-relevant firmware of the motor controller.
NOTICE
If one of the STO-A or STO-B control inputs is deactivated while the power stage is active, this will
result in the drive coasting down without braking if the holding brake is not connected.
This may damage the machine. We therefore recommend connecting a holding brake to the motor
controller.
Please check whether the motors you are using with a holding brake are designed to brake and stop
the motor with the holding brake in the event of a fault.
A safe state with active control of the power semiconductors (PWM) can be requested. The status
of both driver supply voltages is recorded and evaluated in a 10 ms cycle. If they are unequal over
a longer period of time, an error message is triggered è 6.4.2 Error messages. The safety function
assumes that both signals have the same status. Unequal signals are only tolerated during a transition
period, the so-called "discrepancy time" è 3.2.3 Control inputs STO-A, 0V-A/STO-B, 0V-B [X40].
This state machine in the motor controller CMMP-AS-...-M3 has its own status parallel to the safety
module CAMC-G-S1. Due to the assessment of the discrepancy time, this state machine may only
reach the "safe state" with a significant delay. Accordingly, this state can only be signaled with a
significant delay via digital outputs or a fieldbus. The power output stage itself is then already "safely
switched off". This status machine is processed in a 10 ms cycle.
This results in a staggered reaction speed according to the following table:

18
Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
Function Reaction time Reaction
Switching time from
high to low
T_STO-A/B_OFF è 8.1.4 Electrical data, è Tab. 31 Technical
data: electrical data of the STO-A and STO-B
inputs
Switching time from
low to high
T_STO-A/B_ON
Detection of failure
Driver power supply
tReaction £ 125 μs Control of the power semiconductors (PWM) is
switched off
Activate holding brake tReaction £ 10 ms Actuation of the holding brake after detecting the
failure of the driver power supply
Signal evaluation and
status indicator
tReaction £ 10 ms Status transitions in the internal status machine,
triggering of an error message if necessary and
showing the status on the display
Tab. 11: Driver supply voltage acquisition and reaction times
3.4 Time response
The STO-A and STO-B inputs are functionally absolutely equivalent, therefore, the switching sequence
of STO-A/STO-B is interchangeable in all diagrams.
3.4.1 STO basic time response
The figure below shows the basic time response of the safety module. The times can be found in the
table below.

Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
19
Fig. 3: Basic time response when activating and deactivating the STO safety function
Time Description Value
T_STO-A/B_OFF STO-A/B – switching time from high to low è 8.1.4 Electrical data,
è Tab. 31 Technical data:
electrical data of the STO-A
and STO-B inputs
T_STO-A/B_ON STO-A/B – switching time from low to high
T_C1/C2_ON C1/2 – switching time for closing è 8.1.4 Electrical data,
è Tab. 33 Technical data:
electrical data of the feed-
back contact C1/C2
T_C1/C2_OFF C1/2 – switching time for opening
T_DRIVE_V Delay of the CMMP-AS-M3 0 … 10 ms
Tab. 12: Time specifications for the basic time response
3.4.2 Time response of activation of STO in operation with restart
The figure below shows the time response from switching off the control voltage at STO-A/B and the
process required to restart the device. The times can be found in the table below. Notes:
–The holding brake is controlled via the motor controller, not safety-related.
–The coasting of the motor is shown, independent of activation/deactivation of the brake.
–The setpoint value is only enabled when the holding brake delay T_BRAKE_V has expired.

20
Festo — CAMC-G-S1 — 2022-07d
Product description of safety module CAMC-G-S1
Fig. 4: Time response when activating the STO safety function with restart
Time Description Value
T_STO-A/B_OFF STO-A/B – switching time from high to low è 8.1.4 Electrical data,
è Tab. 31 Technical data:
electrical data of the STO-A
and STO-B inputs
T_STO-A/B_ON STO-A/B – switching time from low to high
T_DIN5_LOW Time that DIN5 must be low before STO-A/B is
switched on again
0 ms
T_DIN5_SU Time that DIN5 must still be low after switching
on STO-A/B again and changing the status of the
STO module
> 20 ms
T_DRIVE_V Delay of the CMMP-AS-M3 0 … 10 ms
T_BRAKE_V_ON Switch-off delay of the holding brake Depending on the brake 1)
T_BRAKE_V_OFF Switch-on delay of the holding brake Depending on the brake 2)
1) Physical delay time until the brake is applied.
2) Minimum time: physical delay time until the brake is released. This time can be parameterised with a higher value in the controller.
Tab. 13: Times for the time response when activating the STO safety function with restart