Twenty Safety Functions Certified in a Servo Drive

Elmo Motion Control's Titanium servo drive line has completed functional safety certification to SIL 3 under EN 61508 and to Performance Level e, Category 4 under EN ISO 13849, with FSoE safety-over-EtherCAT per IEC 61784-3 and twenty supported safety functions. The certified range covers industrial-environment models — Titanium Castanet and Solo Castanet at 1.2 kW per axis, two axes at 15 A continuous and 30 A peak to 100 V, and Titanium Harmonica at 2.5 kW per axis, 25 A continuous and 50 A peak with 100 V or 200 V options — plus harsh-environment models Titanium Lizard and Solo Lizard at the lower rating and Titanium Falcon at the higher. Chief executive Ronen Boneh is quoted saying safety has become a core element of servo-drive architecture. The certifying body is not named in the release.

The number worth understanding is twenty, because the count of safety functions determines what a machine builder can do without external hardware. The familiar one is Safe Torque Off, which removes drive power and is by now standard. The rest of the set defined in IEC 61800-5-2 is where the value sits: Safe Stop 1 and 2 for controlled deceleration before power removal, Safely Limited Speed for jogging with the guard open, Safe Direction, Safe Operating Stop to hold position with torque available, Safely Limited Position and Safe Speed Monitoring. Each of those, implemented in the drive, replaces a safety relay, a speed monitor, an encoder splitter and the wiring between them.

That substitution is the commercial argument. A machine that needs limited-speed jogging for setup traditionally requires a safety controller, a certified speed-monitoring module and a second encoder channel, all of which have to be wired, documented and validated. A drive that provides the function internally and reports its safety state over the same EtherCAT cable that carries motion commands removes a cabinet's worth of components and, more significantly, removes the safety wiring — which is where the installation errors and the validation effort concentrate.

The PL e Category 4 rating is the part to read carefully rather than skim. Category 4 requires that a single fault does not lead to loss of the safety function and that faults are detected at or before the next demand, which implies redundancy and continuous diagnostics inside the drive. That is a substantially harder requirement than SIL 3 alone, and it is what allows the drive to be the sole element in a safety function on a machine under the Machinery Directive rather than one component behind a separate monitor. For anyone specifying, two practical questions remain: the safety functions are certified, but the achieved PL of the complete function still depends on the encoder and its mounting, and the certifying body's report is the document to ask for — a press release stating a level is not the same artefact as the certificate a machine's technical file needs.