Festo CMMP-AS M0 Series User manual

CMMP-AS-...-M0
Motor controller
Manual | Safety
function, STO
8179184
2022-07c
[8179186]

Translation of the original instructions
CiA® is a registered trademark of its respective trademark holder in certain countries.

Festo — CMMP-AS-...-M0 — 2022-07c
3
Table of contents
1 About this document. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2 Safety and requirements for product use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1 Safety. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.1 General safety instructions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.2 Intended use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.1.3 Achievable safety level, safety function in accordance with EN ISO 13849-1/
EN 61800-5-2. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 Requirements for product use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2.1 Technical prerequisites. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2.2 Qualification of the specialist technicians (requirements for staff). . . . . . . . . . 8
2.2.3 Diagnostic coverage (DC). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2.4 Range of application and approvals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3 Description of the safety function STO. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.1 Product overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.1.1 Purpose. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.1.2 Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.2 Function and application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.2.1 Description of the STO safety function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.2.2 Overview of interface [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.2.3 Control inputs STO-A, 0V-A/STO-B, 0V-B [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2.4 Feedback contact C1, C2 [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.2.5 24 V, 0 V auxiliary power supply [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.3 Functions in the motor controller CMMP-AS-...-M0. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.4 Time response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.4.1 STO basic time response. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.4.2 Time response of activation of STO in operation with restart. . . . . . . . . . . . . . 17
3.4.3 Time response of activation of SS1 in operation with restart. . . . . . . . . . . . . . 18
4 Assembly and installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.1 Mounting/removal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.2 Electrical installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.2.1 Safety instructions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.2.2 Connection [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.2.3 Minimum wiring for initial start-up [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
4.3 Sample circuits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.3.1 Safe Torque Off (STO). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
4.3.2 Deceleration and Safe Torque Off (SS1, "Safe Stop 1"). . . . . . . . . . . . . . . . . . 24
5 Commissioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5.1 Prior to commissioning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5.2 FCT support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5.2.1 Status display of the safety function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
5.2.2 Displaying log file of the motor controller. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
5.3 Function test, validation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

4
Festo — CMMP-AS-...-M0 — 2022-07c
6 Operation and use. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.1 Obligations of the operator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.2 Maintenance and care. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.3 Protective functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.3.1 Voltage monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.3.2 Overvoltage and reverse polarity protection. . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.4 Diagnostics and fault clearance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.4.1 Status display. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.4.2 Error messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
7 Modification and replacement of the motor controller. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.1 Repair or replacement of the integrated safety circuit. . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.2 Decommissioning and disposal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.3 Replacement of the previous CMMP-AS series with the CMMP-AS-…-M0. . . . . . . . . . . . 33
8 Technical appendix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
8.1 Technical data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
8.1.1 Safety engineering. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
8.1.2 General, operating and environmental conditions CMMP-AS-...-M0. . . . . . . . 36
8.1.3 Electrical data [X40]. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
9Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Festo — CMMP-AS-...-M0 — 2022-07c
About this document
5
1 About this document
Notes regarding this documentation
This documentation is a guide to safe working with the STO – "Safe Torque Off" safety function in
accordance with EN 61800-5-2 with use of the motor controller CMMP-AS-...-M0.
–In addition, always observe the general safety regulations for the motor controller CMMP-AS-...-M0.
The general safety regulations for the CMMP-AS-...-M0 can be found in the hardware documentation,
GDCP-CMMP-M0-HW-... è Tab. 2 Documentation for the motor controller CMMP-AS-...-M0.
Observe the information regarding safety and the requirements for product use in è 2.2 Requirements
for product use.
Product identification
This documentation refers to the following versions:
• Motor controller CMMP-AS-…-M0, firmware from rev. 04.
• Firmware from 4.0.1501.1.2
You can find the information on the rating plate in the hardware description, GDCP-CMMP-M0-HW-...
Service
Please consult your regional Festo contact if you have any technical problems.
Specified standards/directives
Version
EN 61800-5-1:2007 + A1:2017 EN ISO 12100-1:2010
EN 61800-5-2:2017 EN ISO 13849-1:2015
EN 60204-1:2006 + A1:2009 + AC:2010 IEC 61131-2:2007
EN 62061:2005 + AC:2010 + A1:2013 + A2:2015 IEC 61508-1/.../-7:2010
Tab. 1: Standards/directives specified in the document
Documentation
You will find additional information on the motor controller in the following documentation:
User documentation for the motor controller CMMP-AS-...-M0
Name, type Contents
Hardware manual,
GDCP-CMMP-M0-HW-...
Assembly and installation for all variants/performance classes
(1-phase, 3-phase), pin allocations, error messages, mainte-
nance.
Commissioning manual,
GDCP-CMMP-M0-FW-...
Commissioning with FCT + functional description (firmware),
overview of FHPP, fieldbus, safety engineering.
FHPP manual,
GDCP-CMMP-M0/-M0-C-HP-...
Control and parameterisation of the motor controller via the
Festo FHPP profile.

6
Festo — CMMP-AS-...-M0 — 2022-07c
About this document
User documentation for the motor controller CMMP-AS-...-M0
Name, type Contents
CiA 402 (DS 402) manual,
GDCP-CMMP-M3/-M0-C-CO-...
Control and parameterisation of the motor controller via the
device profile CiA 402 (DS 402)
CAM Editor manual,
P.BE-CMMP-CAM-SW-...
Cam disc function (CAM) of the motor controller.
STO safety function manual,
GDCP-CMMP-AS-M0-S1-...
Functional safety engineering for the motor controller with the
STO safety function.
Help for the FCT CMMP-AS plug-in User interface and functions of the CMMP-AS plug-in for the
Festo Configuration Tool è www.festo.com/sp.
Tab. 2: Documentation for the motor controller CMMP-AS-...-M0

Festo — CMMP-AS-...-M0 — 2022-07c
Safety and requirements for product use
7
2 Safety and requirements for product use
2.1 Safety
2.1.1 General safety instructions
–Also always observe the general safety regulations for the motor controller CMMP-AS-...-M0.
The general safety regulations for the CMMP-AS-...-M0 can be found in the hardware documentation
GDCP-CMMP-M0-HW-.... è Tab. 2 Documentation for the motor controller CMMP-AS-...-M0.
NOTICE
Loss of the safety function!
The safety functions might fail if you do not comply with the parameters required for the surroundings
and connections.
• Observe the specified environmental and connection conditions, in particular the input voltage
tolerances è 8.1 Technical data.
NOTICE
Damage to the motor controller due to incorrect handling.
Incorrect handling may cause damage.
• Switch off the power supply before mounting and installation work. Do not switch on the supply
voltages until mounting and installation work is completely finished.
•Observe the handling specifications for electrostatically sensitive devices.
2.1.2 Intended use
The motor controller CMMP-AS-...-M0 supports the following safety function:
–Safe Torque Off (STO) with SIL 3 in accordance with EN 61800-5-2/EN 62061/IEC 61508 and/or
category 4/PL e in accordance with EN ISO 13849-1.
The motor controller CMMP-AS-...-M0 is intended for installation in machines or automation systems
and to be used as follows:
–in excellent technical condition,
–in its original condition, without unauthorised modifications,
–within the limits of the product defined by the technical data è 8.1 Technical data
–in an industrial environment.
NOTICE
In the event of damage caused by unauthorised manipulation or use other than the intended use, the
guarantee will be invalidated and the manufacturer will not be liable for damages.
2.1.3 Achievable safety level, safety function in accordance with EN ISO 13849-1/EN 61800-5-2
The motor controller CMMP-AS-...-M0 with integrated STO safety function fulfils the requirements for
–Category 4/PL e in accordance with EN ISO 13849-1,
–SIL CL 3 in accordance with EN 62061,
and can be used in applications up to cat. 4/PL e in accordance with EN ISO 13849-1 and SIL 3 in
accordance with EN 61800-5-2/EN 62061/IEC 61508.
The achievable safety level depends on the other components used to implement a safety function.

8
Festo — CMMP-AS-...-M0 — 2022-07c
Safety and requirements for product use
2.2 Requirements for product use
–Make this documentation available to the design engineer, installer and personnel responsible for
commissioning the machine or system in which this product is used.
–Make sure that the specifications in the documentation are observed at all times. When so doing,
also take into account the documentation for the other components and modules (e.g. motor
controller, cables etc.).
–Take into account the legal regulations applicable for the location as well as:
–instructions and standards,
–regulations of testing organisations and insurers,
–national specifications.
–If the safety function is required, protection against automatic restart in accordance with the
required category must be installed. For example, an external safety relay unit can be used.
2.2.1 Technical prerequisites
General information on correct and safe use of the product, which must be observed at all times:
–Observe the connection and ambient conditions of the motor controller (è 8.1 Technical data) and
all connected components as specified in the technical data.
Only compliance with the limit values and/or load limits will enable operation of the product in
accordance with the relevant safety directives.
–Observe the notes and warnings in this documentation.
2.2.2 Qualification of the specialist technicians (requirements for staff)
The device may only be set into operation by a qualified electrical technician who is familiar with:
–the installation and operation of electrical control systems,
–the applicable instructions for operating safety engineering systems,
–the applicable instructions for accident prevention and occupational safety and
–the documentation for the product.
2.2.3 Diagnostic coverage (DC)
Diagnostic coverage depends on the integration of the motor controller into the control loop system as
well as the implemented diagnostics measures è 6.4 Diagnostics and fault clearance.
If a potentially dangerous malfunction is recognised during diagnostics, appropriate measures must
be taken to maintain the safety level.
NOTICE
Check whether detection of shorts across contacts of the input circuit and the connection wiring is
required in your application.
If necessary, use a safety relay unit with detection of shorts across contacts to control the safety
function.
2.2.4 Range of application and approvals
The motor controller with integrated safety function is a safety-related part of controllers. For details
of the safety-oriented standards and test values that the product complies with and fulfils, see è 8.1
Technical data.
The product-relevant directives are listed in the declaration of conformity è www.festo.com/sp.

Festo — CMMP-AS-...-M0 — 2022-07c
Safety and requirements for product use
9
Product conformity
in accordance with EU EMC Directive
in accordance with EU Machinery Directive
in accordance with EU RoHS Directive
to UK EMC Regulations
to UK Supply of Machinery Regulations
to UK RoHS Regulations
Tab. 3: Product conformity

10
Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
3 Description of the safety function STO
3.1 Product overview
3.1.1 Purpose
As processes become increasingly automated, protecting people from potentially hazardous move-
ments is becoming ever more relevant. Functional safety refers to measures required of electrical or
electronic equipment to reduce or eliminate dangers due to malfunctions. In normal operation, protec-
tive devices prevent human access to hazard zones. In certain operating modes, e.g. during set-up,
people need to have access to danger zones. In such situations, the operator must be protected by
measures incorporated into the drive and control system.
The functional safety engineering integrated in the motor controller meets the requirements of the
controller and drive for optimised implementation of protective functions. Planning and installation
complexity is reduced. The use of integrated functional safety engineering increases machine function-
ality and availability over the levels achieved by conventional safety engineering.
3.1.2 Interface
The motor controller CMMP-AS-...-M0 has a digital I/O interface [X40] for control of the STO safety
function.
1
2
3
Fig. 1: Motor controller CMMP-AS-...-M0
1
Motor controller CMMP-AS-…-M0
2
Digital I/O interface [X40] for controlling the
STO function
3
Pin 1 of the interface [X40]
3.2 Function and application
The motor controller CMMP-AS-...-M0 has the following safety-related performance feature.
–Achieving the “Safe Torque Off” (STO) function,
–Potential-free feedback contact for the operating status,
The “Safe Stop 1” (SS1) function can be implemented with a suitable external safety relay unit and
appropriate circuitry for the motor controller CMMS-AS-...-M0.

Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
11
3.2.1 Description of the STO safety function
Use the “Safe Torque Off” function (STO) whenever you need to disconnect the energy supply to the
motor reliably in your application.
The “Safe Torque Off” function switches off the driver power supply for the power semiconductor, thus
preventing the power output stage from supplying the power required by the motor; see the diagram
below.
1
2 3
4
4 5
6
Fig. 2: “Safe torque off” - functional principle for the CMMP-AS-…-M0
1
Safety command device (e.g. switch, relay,
safety relay unit)
2
STO integrated safety function
3
Power output stage in the CMMP-AS-…-M0
(only one phase shown)
4
Driver power supply
5
Motor connection
6
Feedback contact
The power supply to the drive is safely disconnected when the STO “Safe Torque Off” safety function
is active. The drive cannot generate torque or force and so cannot perform any dangerous movements.
With suspended loads or other external forces, additional measures must be taken to ensure that the
load does not drop (e.g. mechanical holding brakes). The standstill position is not monitored in the
STO “Safe Torque Off” state.
The machine must be brought to a standstill in a safe manner and secured, e.g. with a safety relay
unit.

12
Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
NOTICE
There is a danger that the drive will advance if there are multiple errors in the CMMP-AS-…-M0.
If the power stage of the motor controller fails during the STO state (simultaneous short circuit of 2
power semiconductors in different phases), this can result in a limited detent movement of the rotor.
The rotation angle/travel corresponds to one pole pitch. Examples:
• rotary axis, synchronous machine, 8-pole è movement < 45° at the motor shaft.
• linear motor, pole pitch 20 mm è movement < 20 mm at the moving part.
3.2.2 Overview of interface [X40]
The front of the motor controller has an 8-pin connection [X40] for control inputs, feedback contact
and a 24 V auxiliary supply for external sensors è 4.2 Electrical installation.
The STO safety function is requested exclusively via the two digital control inputs STO-A and STO-B.
Safety circuitry for additional interfaces on the CMMD-AS-...-M0 motor controller is neither required
nor intended.
Cross-circuit detection in the input circuit is not carried out by the motor controller.
The status of the motor controller is sent to an external safety relay unit via a potential-free feedback
contact (N/O contact). This means that a downward compatible interface can be implemented in a
mixed configuration consisting of CMMP-AS (previous series with the “safe stop” function via the [X3]
connection) and the CMMP-AS-…-M0 è 7.3 Replacement of the previous CMMP-AS series with the
CMMP-AS-…-M0.
The interface [X40] allows direct connection of active and passive sensors, because a 24 V supply
voltage (auxiliary supply) with associated reference potential is connected.
Ports Description
STO-A
0V-A
(Pin 1)
(Pin 2)
Control input A for the STO function with the associated reference potential
–"Safe Torque Off" (STO) request at low (logic 0), together with STO_B.
Control input 24 V, high active, based on EN 61131-2, signal level deviating from
è Tab. 19 Technical data: electrical data of the STO-A and STO-B inputs.
STO-B
0V-B
(Pin 3)
(Pin 4)
Control input B for the STO function with the associated reference potential.
–"Safe Torque Off" (STO) request at low (logic 0), together with STO_A.
Control input 24 V, high active, based on EN 61131-2, signal level deviating from
è Tab. 19 Technical data: electrical data of the STO-A and STO-B inputs.
C1
C2
(Pin 5)
(Pin 6)
Feedback contact for the "Safe Torque Off" status (STO), e.g. to an external con-
troller.
–Feedback contact open: "Safe Torque Off" (STO) not active
–Feedback contact closed: "Safe Torque Off" (STO) active
24V
0V
(Pin 7)
(Pin 8)
Auxiliary power supply, e.g. for safety-oriented peripherals (24 V DC logic power
supply of the motor controller).
Tab. 4: Function of the connections [X40]

Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
13
The connections are galvanically isolated from one another in groups and from the 24 V power supply
of the motor controller è Tab. 22 Technical data: electrical data of the auxiliary supply output.
3.2.3 Control inputs STO-A, 0V-A/STO-B, 0V-B [X40]
The STO (Safe Torque Off) safety function is requested via two channels with the two control inputs
STO-A and STO-B. They allow the direct connection of safe semiconductor outputs (electronic safety
relay units, active safety sensors, e.g. light curtains with OSSD signals) and switching contacts
(safety relay units with relay outputs, passive safety sensors, e. g. positively driven position switches)
è 4.3.1 Safe Torque Off (STO).
In order to request the STO (Safe Torque Off) safety function, the 24 V control voltage is switched off
at both control inputs STO-A and STO-B (0 V).
If the two control ports are switched off simultaneously or within a defined discrepancy time, the STO
safety function is active. If both channels are not actuated simultaneously, the STO is still active on
the first request. If a channel is not switched off, this is interpreted as an error and results in an error
message.
Undervoltage monitoring is integrated for the STO-A and STO-B control inputs in order to rule out
invalid voltage ranges for the downstream electronics, as well as overvoltage monitoring to protect
against overvoltage.
Technical data of the control inputs è Tab. 19 Technical data: electrical data of the STO-A and STO-B
inputs.
Tolerance ranges are defined for the input voltage range of the STO-A and STO-B control inputs.
The amount of energy stored in the components of the motor controller (e.g. capacitors) depends
on the level of the input voltage. This amount of energy must be charged or discharged during
switching operations. The input voltage-dependent values are thus derived for the switch-off time for
the transition to the safe state (STO) and the tolerance time for OSSD signals (buffer time).
The requirements for the time response are derived from the technical data è 8.1.3 Electrical data
[X40]. The time response itself is described here è 3.4 Time response.
Discrepancy time
The transition between a safe and an unsafe state is initiated by level changes at the control inputs
STO-A and STO-B of the motor controller. According to the specification of the safety function, both
levels must be identical, otherwise an error message is generated. The state machine in the motor
controller internally monitors the driver supply voltages as a result of the control of the control
inputs. The level changes do not usually take place exactly simultaneously, for example, because of
component tolerances or bouncing outputs of safety controls. The firmware tolerates this so long as
the second input follows within a defined time, the so-called discrepancy time. If the time is exceeded,
the motor controller generates an error message.
A discrepancy time of 100 ms is the default.
Recommendation: always switch STO-A and STO-B simultaneously.
Test pulses
Test pulses from safety controllers are tolerated in a specific range and thus do not lead to the request
of the STO function.

14
Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
The tolerance to test pulses from sensors with OSSD signals depends on the operating range
è Tab. 20 Typical switch-off time and minimum tolerance time for test pulses (OSSD signals). The
permissible test pulse length depends on the control voltage level at the STO-A and STO-B inputs.
Example: input voltage for STO-A and STO-B = 24 V è OSSD signals with a test pulse length of 3.5 ms
are tolerated.
3.2.4 Feedback contact C1, C2 [X40]
If the STO function is not active, the feedback contact is opened. This is the case if the control voltage
is present at STO-A and STO-B, if only one of the two control voltages STO-A or STO-B is present, if the
24 V logic supply voltage is switched off or if the supply voltage fails.
When the STO function is active, the relay contact is closed.
The feedback contact has a single channel and may only be used for monitoring.
Electrical data of the feedback contact è Tab. 21 Technical data: electrical data of the feedback
contact C1/C2. Time response of the feedback contact è Tab. 20 Typical switch-off time and minimum
tolerance time for test pulses (OSSD signals).
When the 24 V supply of the basic unit is switched on and off, the switching status of the relay may
deviate briefly (approx. 100 ms) from the status of the STO-A and STO-B control inputs due to the
difference in speed at which the internal supply voltage starts up.
In order to ensure the DC and SFF values specified in the technical data, the status of the feedback
contact C1/C2 must be registered whenever the safety function is requested.
After the safety function has been requested, there must be a signal change at the feedback contact
within an application-specific time. In the event of a violation, a safety-oriented reaction must take
place.
3.2.5 24 V, 0 V auxiliary power supply [X40]
The motor controller CMMP-AS-...-M0 supplies a 24 V auxiliary power supply at [X40]. This can be
employed when using the C1/C2 feedback contact or for power to external active sensors.
Electrical data of the auxiliary power supply è 8.1.3 Electrical data [X40], è Tab. 22 Technical data:
electrical data of the auxiliary supply output.
3.3 Functions in the motor controller CMMP-AS-...-M0
The following functions in the motor controller CMMP-AS-...-M0 are not certified according to
EN 61800-5-2. They are functional supplements and offer additional diagnostic options.
Error messages generated by the integrated safety circuit, e. g. exceeding the discrepancy time,
are recorded and evaluated by the non-safety-related state machine of the motor controller. If the
conditions for an error status are detected, an error message is generated. In this case, it cannot be
guaranteed under all circumstances that the power output stage has been safely switched off.
The integrated safety circuit exclusively controls the provision of the driver supply for the motor con-
troller CMMP-AS-...-M0. The levels of the input voltage are monitored area by area, but the integrated
safety circuit does not have its own error evaluation mechanisms or the option of an error display.

Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
15
NOTICE
When error messages are acknowledged, all acknowledgeable errors regarding functional safety are
also acknowledged è 6.4.2 Error messages.
The motor controller CMMP-AS-M0 monitors the status of the STO-A and STO-B control inputs. As a
result, the request for the STO (Safe Torque Off) safety function is detected by the firmware of the
motor controller and various non-safety-related functions are then executed:
–detection of the shutdown of the driver supply for the power semiconductors by the integrated
safety circuit,
–switching off the drive control and the control of the power semiconductors (PWM),
–the holding brake control is switched off (if configured),
–state machine on the motor controller side with evaluation of the control (discrepancy time),
–detection of application-related error states,
–hardware diagnostics,
–status and error indication via display, digital outputs, fieldbuses etc.
NOTICE
If one of the control inputs STO-A or STO-B is deactivated while the output stage is active, this leads to
the drive coasting down without braking.
If uncontrolled coasting could result in a hazard or damage, additional measures are required.
NOTICE
A clamping unit is actuated by the non-safety-relevant firmware of the motor controller
CMMP-AS-...-M0.
The holding brakes on Festo motors are not suitable for active deceleration - only for holding a
position!
A safe state with active control of the power semiconductors (PWM) can be requested. The status
of both driver supply voltages is recorded and evaluated in a 10 ms cycle. If they are unequal over
a longer period of time, an error message is triggered è 6.4.2 Error messages. The safety function
assumes that both signals have the same status. Unequal signals are only tolerated during a transition
period, the so-called "discrepancy time" è 3.2.3 Control inputs STO-A, 0V-A/STO-B, 0V-B [X40].
This status machine in the motor controller CMMP-AS-...-M0 has its own status parallel to the inte-
grated safety circuit. Due to the assessment of the discrepancy time, this state machine may only
reach the "safe state" with a significant delay. Accordingly, this state can only be signaled with a
significant delay via digital outputs or a fieldbus. The power output stage itself is then already "safely
switched off". This status machine is processed in a 10 ms cycle.
This results in a staggered reaction speed according to the following table:

16
Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
Function Reaction time Reaction
Switching time from
high to low
T_STO-A/B_OFF è 8.1.3 Electrical data [X40], è Tab. 19 Tech-
nical data: electrical data of the STO-A and STO-B
inputs
Switching time from
low to high
T_STO-A/B_ON
Detection of failure
Driver power supply
tReaction £ 125 μs Control of the power semiconductors (PWM) is
switched off
Activate holding brake tReaction £ 10 ms Actuation of the holding brake after detecting the
failure of the driver power supply
Signal evaluation and
status indicator
tReaction £ 10 ms Status transitions in the internal status machine,
triggering of an error message if necessary and
showing the status on the display
Tab. 5: Driver supply voltage acquisition and reaction times
3.4 Time response
The STO-A and STO-B inputs are functionally absolutely equivalent, therefore the switching sequence
of STO-A/STO-B is interchangeable in all diagrams.
3.4.1 STO basic time response
The figure below shows the basic time response of the integrated safety circuit. The times can be
found in the table below.
Fig. 3: Basic time response when activating and deactivating the STO safety function

Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
17
Time Description Value
T_STO-A/B_OFF STO-A/B – switching time from high to low è 8.1.3 Electrical data
[X40], è Tab. 19 Technical
data: electrical data of the
STO-A and STO-B inputs
T_STO-A/B_ON STO-A/B – switching time from low to high
T_C1/C2_ON C1/2 – switching time for closing è 8.1.3 Electrical data
[X40], è Tab. 21 Technical
data: electrical data of the
feedback contact C1/C2
T_C1/C2_OFF C1/2 – switching time for opening
T_DRIVE_V Delay of the CMMP-AS-M0 0 … 10 ms
Tab. 6: Time specifications for the basic time response
3.4.2 Time response of activation of STO in operation with restart
The figure below shows the time response from switching off the control voltage at STO-A/B and the
process required to restart the device. The times can be found in the table below. Notes:
–The holding brake is controlled via the motor controller, not safety-related.
–The coasting of the motor is shown, independent of activation/deactivation of the brake.
–The setpoint value is only enabled when the holding brake delay T_BRAKE_V has expired.
Fig. 4: Time response when activating the STO safety function with restart

18
Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
Time Description Value
T_STO-A/B_OFF STO-A/B – switching time from high to low è 8.1.3 Electrical data
[X40], è Tab. 19 Technical
data: electrical data of the
STO-A and STO-B inputs
T_STO-A/B_ON STO-A/B – switching time from low to high
T_DIN5_LOW Time that DIN5 must be low before STO-A/B is
switched on again
0 ms
T_DIN5_SU Time that DIN5 must still be low after switching
on STO-A/B again and changing the status of the
STO module
> 20 ms
T_DRIVE_V Delay of the CMMP-AS-M0 0 … 10 ms
T_BRAKE_V_ON Switch-off delay of the holding brake Depending on the brake 1)
T_BRAKE_V_OFF Switch-on delay of the holding brake Depending on the brake 2)
1) Physical delay time until the brake is activated.
2) Minimum time: physical delay time until the brake is released. This time can be parameterised with a higher value in the controller.
Tab. 7: Times for the time response when activating the STO safety function with restart
3.4.3 Time response of activation of SS1 in operation with restart
The time response in the figure below is based on the sample circuit for SS1 in, based on the control
signal S1 for K1 è 4.3.2 Deceleration and Safe Torque Off (SS1, "Safe Stop 1"). The times can be
found in the table below.

Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
19
Fig. 5: Time response when activating the SS1 safety function (external circuitry) with restart
Time Description Value
T_K1 Delay time between switching S1 and closing
instantaneous contact K1
è Data sheet of the safety
relay unit
T_K1_V Delay time between S1 and opening of the off-
delayed contacts K1
Adjustable on the safety
relay unit
T_STO-A/B_OFF STO-A/B – switching time from high to low è 8.1.3 Electrical data
[X40], è Tab. 19 Technical
data: electrical data of the
STO-A and STO-B inputs
T_STO-A/B_ON STO-A/B – switching time from low to high
T_DRIVE_V Delay of the CMMP-AS-M0 0 … 10 ms
T_DIN5_SU Time that DIN5 must still be low after switching
on STO-A/B again and changing the status of the
STO module
>20 ms

20
Festo — CMMP-AS-...-M0 — 2022-07c
Description of the safety function STO
Time Description Value
T_BRAKE_V_ON Switch-off delay of the holding brake Depending on the brake 1)
T_BRAKE_V_OFF Switch-on delay of the holding brake Depending on the brake 2)
1) Physical delay time until the brake is activated.
2) Minimum time: physical delay time until the brake is released. This time can be parameterised with a higher value in the controller.
Tab. 8: Times for the time response when activating the SS1 safety function