Festo CAMC-G-S3 Instruction Manual

Translation of the original instructions
© 2019 all rights reserved to Festo SE & Co. KG
1 Applicable documents
All available documents for the product èwww.festo.com/pk.
This brief description refers to the following versions:
– Safety module CAMC-G-S3, from revision 01 (overall revision 1.1).
– Motor controller CMMP-AS-…-M3, firmware from version 4.0.1501.2.1.
– FCT plug-in CMMP-AS from version 2.4.x.x with SafetyTool from version
1.0.x.x
Version
EN61800-5-1:2007 + A1:2017 ENISO13849-1:2015
EN61800-5-2:2017 EN60204-1:2006 + A1:2009 + AC:2010
Tab. 1 Standards specified in the document
2 Safety
2.1 General safety instructions
– Always additionally observe the general safety regulations on the motor con-
troller CMMP-AS-...-M3.
The general safety regulations for the CMMP-AS-...-M3 can be found in the hard-
ware documentation, GDCP-CMMP-M3-HW-....
NOTICE!
Failure of the safety function!
The safety function may fail if you do not comply with the parameters and condi-
tions required for the surroundings and connections.
• Observe the specified environmental and connection conditions, in particular
the input voltage tolerances è 12 Technical data.
NOTICE!
Incorrect handling may damage the safety module or motor controller.
Incorrect handling may cause damage.
• Switch off the supply voltages before mounting and installation work. Do not
switch on the supply voltages until mounting and installation work is com-
pletely finished.
• Never unplug or plug the module from/into the motor controller when
powered!
• Observe the handling specifications for electrostatically sensitive devices.
2.2 Intended use
The safety module CAMC-G-S3 serves exclusively as an extension of the motor
controller CMMP-AS-...-M3 to achieve the STO, SS1, SS2, SOS, SLS, SSR, SSM,
SBC safety functions in accordance with EN61800-5-2.
The motor controller CMMP-AS-...-M3 with safety module CAMC-G-S3 is a product
with safety-relevant functions and is intended for installation in machines or auto-
mated systems and for use as follows:
– in excellent technical condition,
– in its original condition, without unauthorised modifications,
– within the limits of the product defined by the technical data
è12 Technical data,
– in an industrial environment.
NOTICE!
In the event of damage caused by unauthorised manipulation or any form of use
other than that intended, the warranty is invalidated and the manufacturer is not
liable for damages.
2.3 Foreseeable misuse
The following examples of foreseeable misuse are among those not approved as
intended use:
– use in a device other than the CMMP-AS-…-M3,
– use outdoors,
– use in non-industrial areas (residential areas),
– use outside the limits of the product defined in the technical data,
– unauthorised modifications.
NOTICE!
• The STO function must not be used as the sole safety function for drives sub-
ject to permanent torque (e.g.suspended loads).
• Safety devices must not be bypassed.
• Repairs on the module are prohibited!
The STO (Safe Torque Off) function does not provide protection from electric
shock, only from hazardous movements!
2.4 Achievable safety level, safety function in accordance with
ENISO13849/EN61800-5-2
The safety module fulfils the basic test requirements of
– category4, PLe in accordance with ENISO13849-1
– SILCL3 in accordance with EN62061
and can be used in applications up to cat.4/PLe in accordance with
ENISO13849-1 and up to SIL3 in accordance with EN62061/IEC61508.
The achievable safety level depends on the other components used to implement
a safety function.
3 Requirements for product use
– Make the complete documentation available to the design engineer, installer
and personnel responsible for commissioning the machine or system in which
this product is used.
– Take into consideration the legal regulations applicable for the location as
well as:
– Instructions and standards,
– Regulations of testing organisations and insurers,
– National specifications.
3.1 Technical prerequisites
General information for the correct and safe use of the product, which must be
observed at all times:
– Observe the connection and ambient conditions of the safety module
(è 12 Technical data), the motor controller and all connected components as
specified in the technical data.
Only compliance with the limit values and/or load limits will enable operation
of the product in accordance with the relevant safety directives.
– Observe the notes and warnings in this documentation.
3.2 Qualification of the specialist technicians (requirements for staff)
The device may only be set into operation by a qualified electrical technician who
is familiar with:
– the installation and operation of electrical control systems,
– the applicable instructions for operating safety engineering systems,
– the applicable instructions for accident prevention and occupational safety
– the documentation for the product
3.3 Diagnostic coverage (DC)
Diagnostic coverage depends on the integration of the motor controller with
safety module into the control loop system, the motors/position encoders used
and the implemented measures for diagnostics.
If a potentially dangerous malfunction is recognised during diagnostics, appropri-
ate measures must be taken to maintain the safety level.
3.4 Range of application and approvals
The motor controller with built-in safety module is a safety device in accordance
with the Machinery Directive 2006/42/EC. The motor controller has the CE mark-
ing. For details of the safety-oriented standards and test values that the product
complies with and fulfils, see è 12 Technical data. The product-relevant EC dir-
ectives can be found in the declaration of conformity. Certificates and declara-
tions of conformity for this product èwww.festo.com/sp.
4 Product description
4.1 Supported devices
The safety module CAMC-G-S3 can be used in motor controllers exclusively in
accordance with section 2.2. The motor controllers CMMP-AS-…-M3 are supplied
without a safety module or switch module in the Ext3 slot.
Fig. 1 Safety module for slot Ext3
8125526
CAMC-G-S3
Safety module
8125526
2019-12a
[8125528]
Instructions| Safety function, Advanced Safety
Festo SE & Co. KG
Ruiter Straße 82
73734 Esslingen
Germany
[phone]
www.festo.com

4.2 Operating elements and connections
1Motor controller CMMP-AS-...-M3
27-segment display
3Safety module CAMC-G-S3
4I/O interface [X40A]/[X40B]
5LED (operating status indicator)
6DIP switch
7Functional earth connection (flat
plug 6.3 mm)
Fig. 2 Control section and connections CAMC-G-S3
5 Function and application
The following figure shows a typical drive system with integrated functional safety
engineering, comprising the following components:
– Motor controller CMMP-AS-...-M3,
– Safety module CAMC-G-S3,
– Synchronous servo motor, e.g. from the Festo series EMMS-AS/EMME-AS,
– Linear axis with second measuring system, e.g.Festo EGC-...-M...,
– Safe clamping unit.
Fig. 3 Safety module functional principle
6 Mounting/removal
The motor controller must be disconnected from all live cables before mounting
and removing the safety module.
WARNING!
Danger of electric shock if the safety module is not mounted.
Touching live parts causes severe injuries and may cause death.
Before touching live parts during maintenance, repair and cleaning work and
when there have been long service interruptions:
• Switch off power to the electrical equipment at the main switch and lock the
switch to prevent reactivation.
• After switch-off, wait at least 5minutes discharge time and check that there is
no power before accessing the controller.
NOTICE!
Incorrect handling may damage the safety module or motor controller.
• Switch off the supply voltages before mounting and installation work. Do not
switch on the supply voltages until mounting and installation work is com-
pletely finished.
• Never unplug/plug the module from/into the motor controller when powered!
• Observe the handling specifications for electrostatically sensitive devices. Do
not touch the PCB or the pins of the terminal strip in the motor controller.
Hold the safety module only by the front plate or the edge of the PCB.
Mounting the safety module
1. Insert the safety module CAMC-G-S3 into the empty Ext3 slot for safety mod-
ules so the PCB is in the lateral guides of the slot è Fig.1.
2. Carefully push in the safety module. Make sure that it does not jam. When
you have reached the rear contact strip within the motor controller, carefully
press it into the contact strip until it stops.
3. Then screw the safety module to the front of the motor controller housing
with the two screws. Tighten the screws to 0.4Nm ±10%.
Removing the safety module
1. Unscrew the screws on the safety module.
2. Loosen the safety module by a few millimetres by gently levering in the
recesses on the upper right and lower right corner of the front panel or grasp
the safety module by the attached mating plug.
3. Pull the safety module out of the slot.
7 Electrical installation
7.1 Safety instructions
The requirements of EN60204-1 must be fulfilled in the installation.
WARNING!
Danger of electric shock from voltage sources without protective measures.
• Only use PELV circuits in accordance with EN60204-1 (Protective Extra-Low
Voltage, PELV) for the electrical logic supply.
Also take into account the general requirements for PELV circuits in accord-
ance with EN60204-1.
The cables are connected with two plugs. As a result, the cables can remain
plugged into the plugs when replacing the safety module,for example.
• Make sure that no bridges etc.can be used parallel to the safety wiring.
ESD protection
Damage may be caused to the device or to other system parts at unassigned
plugs as a result of ESD (electrostatic discharge). Earth the system parts prior to
installation and use appropriate ESD equipment (e.g.shoes, earthing straps etc.).
7.2 Connection [X40]
The safety module CAMC-G-S3 has a combined interface for control and feedback
via the plug [X40].
Pin Identifier Plug Pin Identifier
1 DIN40A 13 DIN41A
2 DIN40B 14 DIN41B
3 DIN42A 15 DIN43A
4 DIN42B 16 DIN43B
5 DOUT40A 17 DOUT41A
6 DOUT40B 18 DOUT41B
7 DIN44 19 DOUT42A
8 DIN45 20 DOUT42B
9 DIN46 21 C1
10 DIN47 22 C2
11 DIN48 23 GND24
12 DIN49
X40A X40B
24 +24 V
Tab. 2
8 Commissioning
WARNING!
Failure of the safety function!
Lack of the safety function can result in serious, irreversible injuries, e.g.due to
unintentional movements of the connected actuator technology.
• Operate the safety module only:
– if it is installed and
– if all protective measures have been initiated.
• Validate the safety function to complete commissioning.
Commissioning in accordance with the EC Machinery Directive is the first intended
use of the machine by the end customer. Here, commissioning performed by the
manufacturer during assembly of the machine is being referred to.
è Incorrect circuitry, incorrect configuration, use of an incorrect safety module
or external components that have not been selected in accordance with the safety
category result in failure of the safety function.
• Carry out a risk assessment for your application and select the circuitry, con-
figuration and components accordingly.
8.1 Prior to commissioning
Carry out the following steps in preparation for commissioning:
1. Ensure that the safety module is correctly mounted.
2. Check the electrical installation (connecting cables, contact assignment
è 7 Electrical installation). All PE conductors connected?
8.2 DIP switch setting
• Set the DIP switches as described in the hardware documentation GDCP-
CMMP-AS-M3-HW-... or the documentation for the fieldbus.
8.3 Parameterisation with the parameterisation software for the CMMP-AS
The motor controller must be completely parameterised prior to parameterisation
of the safety module using the SafetyTool. Additional information on commission-
ing of the motor controller can be found in the parameterisation software help or,
possibly, in the functional description (firmware) for the CMMP-AS-...-M3, GDCP-
CMMP- M3-FW-...
Accepting the safety module
If an engineering change is detected, e.g.a module replacement, a non-acknow-
ledgeable error is triggered. The engineering change must be explicitly accepted
or confirmed in order to be able to place the application with the motor controller
back in operation. Every replacement of a safety module CAMC-G-S3, regardless

of with an identical safety module or a different module type (switch module
CAMC-DS-M1, safety module CAMC-G-S1) must always be confirmed.
The factory supplies the safety module in the “delivery status”:
– The safety module is “validated as a whole” with the parameterisation of the
factory setting and is thus functional. The motor controller can be commis-
sioned, and the power stage and controller enable can be set.
– All error messages due to a different parameterisation of the basic unit and
safety module are suppressed. Hence, you can perform basic commissioning
of the motor controller independently of complex safety-engineering peri-
pherals.
Minimum circuitry in the delivery status:
– The safety functions STO and SBC are requested via DIN40.
– DIN49 terminates the safety functions, DIN48 acknowledges errors.
Wiring must not be bypassed and must be validated in the machine. The delivery
status can also be recognised without parameterisation software or SafetyTool by
the green-red flashing LED of the safety module (if DIN40 is switched on and no
safety function is requested).
8.4 Parameterisation of the safety module with the SafetyTool
The safety module is then parameterised with special software, the SafetyTool.
The SafetyTool is called up from the included parameterisation software. For addi-
tional information èSafetyTool help.
8.5 Function test, validation
NOTICE!
The safety functions must be validated after installation and after any changes to
the installation.
This validation must be documented by the person who commissions the device.
As an aid to commissioning, you will find examples of check lists in the descrip-
tion of CAMC-G-S3-....
9 Diagnostics and fault clearance
9.1 Status display
Status and malfunctions are displayed directly by the two-colour LED of the safety
module.
Status display on the safety module
The safety module has an LED on the front to indicate the status of the safety
function. The status LED displays the operating status of the safety module. The
display is exclusively for diagnostics and must not be used in a safety-oriented
way.
LED Status Internal status
Flashes red “System Error” The entire system is in the “System Error” or
“Communication Error” status.
Lights up red “Safety Condition Violated”,
error response initiated
Violation of at least one of the currently required
safety functions.
Lights up yel-
low
“Safe State Reached”, safe
status achieved
Requested safety functions are in the status
“Safe State Reached”.
Flashes yellow “Safety Function Requested” At least one safety function requested.
Flashes
red/green
“Delivery Status” Delivery status
è 8.3 Parameterisation with the
parameterisation software for the CMMP-AS
Flashes green “Service” status No parameters present, parameters invalid or
parameterisation session is running.
Lights up
green
“Ready”, operational Operational, no safety function requested, no
errors.
Off “Initialisation Running” Initialisation 1: load parameters, initialisation
2: communication setup.
Tab. 3
Status display of the safety functions on the motor controller
Display of safety functions on the 7-segment display
STO S t O SOS S O S
SS1 S S 1 USF0
(...1, 2. 3)
U S F 0
SS2 S S 2 SBC S b C
Tab. 4
9.2 Malfunction messages
The motor controller displays malfunctions cyclically in the seven-segment display
on the front of the motor controller. Error messages are displayed by “E” (for
Error), a main index (xx) and a sub-index (y), e.g.E 5 1 0. Warnings have the same
number, but are shown with bars before and after, e.g.- 1 7 0 -. The following
table lists the error messages that are relevant for functional safety in the context
of the safety module.
èThe complete list of error messages can be found in the hardware documenta-
tion GDCP-CMMP-M3-HW-... of the motor controller used.
Error number
Main index Error type/class
Basic device error
51-x Control signals from the safety module, module type/identifier not OK
52-x Error in control sequence with the safety module
Error of the safety module
53-x Violation of a safety function
54-x Violation of a safety function
55-x System error: actual value recording/position encoder not OK
56-x System error: position recording/comparison not OK
57-x System error: inputs and outputs or internal test signals not OK
58-x System error: external/internal communication not OK
59-x System error of the firmware/hardware error of the safety module
Tab. 5
10 Operation and use
10.1 Obligations of the operator
The functionality of the safety device must be tested at appropriate intervals. It is
the responsibility of the operator to choose the type and frequency of the checks
within the specified time period. The manner in which the test is conducted must
make it possible to verify that the safety device is functioning perfectly in interac-
tion with all components.
10.2 Maintenance and care
The safety module is maintenance-free.
11 Repair, replacement of the safety module
11.1 Repair
èRepair or maintenance of the safety module is not permissible. If necessary,
replace the entire safety module.
– Always replace the safety module in case of a defect.
– Send the unchanged defective safety module with a description of the error
and the application back to Festo for analysis. Please contact your technical
consultant to clarify the modalities of the return.
11.2 Replacement of the safety module
If a safety module fails and has to be replaced, organisational measures must be
taken to ensure that an unsafe status is not created. This requires
–that the safety module is not replaced by another module type without safety
functionality (switch module).
–that the safety module is not replaced by another module type with less func-
tion range (CAMC-G-S3 for CAMC-G-S1).
– that the revision status of the new safety module matches that of the old
safety module or is compatible.
– that the parameterisation of the new safety module matches the paramet-
erisation of the defective safety module.
Observe required organisational measures to avoid errors when replacing the
module. For example,you must always generate a new validation report due to
the different serial number of the safety module.
Disassembly and installation
Before a module is replaced, the compatibility between the safety module and
basic unit must be checked.
Information on removal and installation of the safety module
è 6 Mounting/removal.
Accepting the safety module
After replacing the module, you must first accept the new safety module again
è 8 Commissioning.
Recommissioning with the SafetyTool
After accepting the replaced safety module, you must transfer the desired para-
meterisation to the safety module and then validate it. To do this, you must first
start the SafetyTool in online mode. You then have the following options, depend-
ing on the data present from the safety module that is to be replaced:
a) Reliable parameter set available for the safety module that is to be replaced:
– Open the parameter set in the SafetyTool and upload it to the safety module.
The basic information of the basic unit must match the parameter set.
b) Stored SafetyTool project is available that conforms to the parameterisation:
– Set the safety module to the factory setting if necessary.
– Open the SafetyTool project.
– Adjust basic information to the basic unit if they don't match.
– Then validate parameter pages and upload them to the safety module.
c) If there is no data stored for the safety module that is to be replaced:
– Set the safety module to the factory setting if necessary.
– Continue as with initial commissioning.
Regardless of variant a), b) or c), you must generate a new validation report with a
new validation code and new serial number for the safety module. If there is no
stored SafetyTool project, it should be supplied by the machine manufacturer.
After a replacement, a functional test is always required as well as validation
based on the validation plan provided by the machine manufacturer.
11.3 Decommissioning and disposal
Observe the information for dismantling the safety module
è 6 Mounting/removal.

Disposal
Observe the local regulations for environmentally appropriate disposal of elec-
tronic modules. The safety module is RoHS-compliant.
The material used in the packaging has been specifically chosen for its recyclabil-
ity.
12 Technical data
Safety engineering
Safety reference data
Safety functions STO, SS1, SS2, SOS, SLS, SSR, SSM, SBC in accordance with
EN61800-5-2
SIL SIL 31) Safety integrity level in accordance with EN61800-5-2,
EN61508 and EN62061
Category 41) Category in accordance with ENISO13849-1
Performance level PL e1) Performance level in accordance with ENISO13849-1
MTTFd[years] 8700 Mean time to dangerous failure in accordance with
ENISO13849-1
PFH [h-1] 9.5 x
10–9
Probability of a dangerous random hardware failure per
hour in accordance with EN61800-5-2, ENISO13849-1,
EN62061 and EN61508
DC [%] 97.5 Diagnostic coverage in accordance with EN61800-5-2,
EN61508 and ENISO13849-1 and EN62061
HFT 1 Hardware fault tolerance in accordance with
EN61800-5-2, EN62061 and EN61508
SFF [%] 99.5 Safe failure fraction in accordance with EN61800-5-2,
EN62061 and EN61508
T [years] 20 Proof test interval in accordance with EN61800-5-2,
EN61508 and EN62061
TM[years] 20 Service life in accordance with ENISO13849-1
Safety specifications
Type test The functional safety engineering of the product was certified by an
independent testing authority in accordance with section 2.4; see
EC-type examination certificate èwww.festo.com/sp
Certificate issuing authority TÜV Rheinland (German Technical Control Board), Certification
Body of Machinery, NB0035
Certificate no. 01/205/5165.02/19
Well-tried component Yes
1) Maximum achievable classification, limitations dependent on the safety function as well as the circuitry
and the encoders.
Tab. 6
General
Mechanical
Dimensions (L x
W x H)
[mm] 112.2 x 99.1 x 28.7
Weight [g] Approx.220
Note on materials RoHS-compliant
Approvals (safety module CAMC-G-S3 for motor controller CMMP-AS-…-M3)
In accordance with EU EMC DirectiveCE marking (see declaration of
conformity)
èwww.festo.com/sp In accordance with EU Machinery Directive
The device is intended for use in an industrial environment. Measures for interference suppression
may be required in residential areas.
Tab. 7
Operating and environmental conditions
Transport
Permissible temperat-
ure range
[°C] –25…+70
Humidity [%] 0…95, at max. 40°C ambient temperature
Maximum transporta-
tion duration
[weeks] Maximum 4 in the total product lifecycle
Storage
Permissible temperat-
ure range
[°C] –25…+55
Humidity [%] 5…95, non-condensing/protected against condensation
Permissible altitude [m] < 3000 (above sea level)
Ambient conditions CMMP-AS-...-M3 with safety module CAMC-G-S3 in Ext3
CMMP-AS-... C2-3A-M3 C5-3A-M3 C5-11A-P3-M3 C10-11A-P3-M3
Ambient temperature [°C] 0 … +35 0 … +40 0 … +40 0 … +40
Ambient temperature
with power reduction
[°C] +35 … +40 +40 … +50 +40 … +50 +40 … +45
Humidity [%] 0 … 90 (non-condensing). No corrosive media permitted in the
environment of the device.
Permissible setup altitude above sea level
– At nominal power [m] 1000
– With power
reduction
[m] 1000…2000
Degree of protection IP20 (mounted in CMMP-AS-...-M3).
Operating and environmental conditions
Vibration/shock Requirements of EN61800-5-1 and EN61800-2 are fulfilled.
Electrical operating conditions
Control voltage of the basic unit
24V control voltage (all inputs and outputs)
Galvanically isolated
potential areas
Potential-free signal contact C1/C2
System voltage [V] < 50 (24V PELV power supply in accordance with EN60204-1)
Overvoltage category
in accordance with
EN61800-5-1
3
2Pollution degree in
accordance with
EN61800-5-1 This must always be guaranteed with appropriate measures,
e.g.by installation in a control cabinet.
EMC operating conditions
Immunity to interfer-
ence
Requirements for “second environment” in accordance with
EN61800-3 (PDS of category C3)
Requirements in accordance with EN61326-3-1
Interference emission Requirements for “first environment with restricted
availability” in accordance with EN61800-3 (PDS of category
C2)
Tab. 8
Electrical data
Digital inputs DIN40A/B to DIN43A/B and DIN44 to DIN49
Input Type3 in accordance with IEC61131-2
Nominal voltage [V DC] 24
Permissible voltage
range
[V] –3…30
Digital outputs DOUT40A/B to DIN42A/B
Output High-side switch with pull-down
Voltage range [V DC] 18…30
Permissible output
current
IL,nominal
[mA] < 50
Signal contact C1/C2
Design Relay contact, N/O contact
Voltage range [V DC] 18…0
Output current IL,nominal [mA] < 200
Short circuit/overcur-
rent protection
Not short-circuit-proof, overvoltage-proof up to 60V
Service life of feed-
back contact
[nop] 10 x 106 (at 24V and IContact = 10mA, the service life is
reduced with higher load currents)
24V auxiliary power supply
Design Logic supply voltage routed over the motor controller (fed in at
[X9], not additionally filtered or stabilised). Protected against
reverse polarity, overvoltage-proof up to 60VDC
Nominal voltage [V] 24
Output current IL,nominal
(nominal)
[mA] 100
Cabling [X40]
Max. cable length [m] < 30
Shielding Use shielded cable for wiring outside the control cabinet.
Guide shielding into the control cabinet/attach to the side of
the control cabinet
Conductor cross section (flexible conductors, wire end sleeve with insulating collar)
– One conductor [mm2] 0.25…0.5
– Two conductors [mm2] 2x0.25 (with twin wire end sleeves)
Tightening torque of
mating plug
[Nm] 0.22…0.25
Tab. 9