EPOS4, STO, ISO 13849: Safety Zertifizierung von Systemen?

Dieser Beitrag steht aktuell nur in Englisch zur Verfügung!

Topic:

• Do maxon controllers comply to the ISO 13849 standard?
• Is EPOS4's STO (= Safe torque off) certified?
• Is EPOS4's STO sufficient for ISO 13849 performance level Cat.3?

Solution & technical background:

EPOS4's STO feature is not certified and will not be certified for the EPOS4 catalog products. It is possible to think about a certified STO implementation in case of a customized EPOS4 power stage design but this will demand for some add-on development effort and costs plus external certification costs. Finally such a solution can be just focused on the base of some high-volume series demand (> 1000 pcs.). Finally such a development and especially the certification will typically last 1 - 2 years in practice. 

The functionality of maxon's STO technical specification, base design, and features are described by the following two chapters of EPOS4's manuals:

• Chapter "3.3.9 STO (X9)" of the "EPOS4 50-5 Hardware Reference.pdf"
• Chapter "9 Safe Torque Off (STO) ..." of the "EPOs4 Application Notes Collection"

The request about a certified STO is typically discussed based on systems (e.g. robots, AGVs) demanding for ISO 13849. Please find some more insights about these topics below.

1.) ISO 13849 in general

The ISO 13849 is a standard for functional safety of devices (-> https://en.wikipedia.org/wiki/ISO_13849). Especially the ISO 13849-2 deals with the validation of a system (and not just a single motor controller). maxon controllers do not comply with this standard. There has to be a risk assessment processed for the complete final system (e.g. AGV) to fulfill the ISO 13849. ISO 13849 part 1 describes the different so-called "Performance Levels" based on the expected risk to harm humans.

You can find a nice description and chart about ISO13849 validation by the following 3rd party Internet links:
-> https://h-on.it/performance-level-validation/ 
-> https://h-on.it/admin/wp-content/uploads/schema-iso-13849.jpg 
-> https://machinerysafety101.com/2017/01/30/iso-13849-analysis-part-3/ 

2.) Fulfilled standards by maxon products

It is not sufficient to rate the complete system as ISO 13849 compliant if just a single components (like a motor controller) would have a certificate. Therefore maxon components have not been certified for ISO 13849. Please find some more information about standards fulfilled by maxon products by the following linked public maxon Support Center documents:
-> EN und ISO Qualität-Standards und Zertifikate
-> Erfüllte Standards & Normen
-> UL File Number 
-> Zuverlässigkeitsanalyse, Fehlerrate, MTBF 

3.) EPOS4 and safety features: STO -> Not certified!

The EPOS4 has a so-called STO ("Safe Torque Off") feature. Just be aware that this is not(!) certified and will not(!) be sufficient if there is some risk to injure humans by a final system.
 ​​

Additional notes:

• Please check this (German) Support Center document too:
  -> "Was ist die Bedeutung von STO?"
  
• Find more details about EPOS4's STO by chapter "9 Safe Torque Off (STO) ..." of the "EPOS4 Application Notes Collection".

4.) Safe system design?

Robots or systems like AGVs will typically need a safe feature to stop the motor in case of an emergency situation or the risk to injure a human. Typically the detection of critical system states is identified by lots of different sensors (radar, laser, ...) and processed by a specialized add-on certified safety controller. The safety controller finally switches off the power line (EPOX4 -> X1) of the motor controller by a certified safety relay. This is a safe state then resp. the power stage and motors are not powered on anymore if the safety relay cuts the power. In case of a system (e.g. AGV moving downwards or a crane's load) which might still move even if no power is applied anymore there might be one or even two independent electromechanical brakes required in addition to actually stop the motion and ensure a safe state finally. 

Add-on (German) Support Center documents about STO:

• Was ist die Bedeutung von STO?
• EPOS4: Ursachen des "STO error" (0x8A88)